· 9 years ago · Oct 27, 2016, 01:02 AM
1sudo apt-get install mysql-server
2sudo mysql_secure_installation
3
4
5CREATE DATABASE mail;
6GRANT SELECT ON mail.* TO 'mail'@'localhost' IDENTIFIED BY 'mailpassword';
7FLUSH PRIVILEGES;
8USE mail;
9
10
11Tables:
12CREATE TABLE IF NOT EXISTS `virtual_domains` (
13 `id` int(11) NOT NULL AUTO_INCREMENT,
14 `name` varchar(50) NOT NULL,
15 PRIMARY KEY (`id`)
16) ENGINE=InnoDB DEFAULT CHARSET=utf8;
17
18CREATE TABLE IF NOT EXISTS `virtual_aliases` (
19 `id` int(11) NOT NULL AUTO_INCREMENT,
20 `domain_id` int(11) NOT NULL,
21 `source` varchar(254) NOT NULL,
22 `destination` varchar(254) NOT NULL,
23 PRIMARY KEY (`id`),
24 KEY `domain_id` (`domain_id`),
25 CONSTRAINT `virtual_aliases_ibfk_1` FOREIGN KEY (`domain_id`) REFERENCES `virtual_domains` (`id`) ON DELETE CASCADE
26) ENGINE=InnoDB DEFAULT CHARSET=utf8;
27
28CREATE TABLE IF NOT EXISTS `virtual_users` (
29 `id` int(11) NOT NULL AUTO_INCREMENT,
30 `domain_id` int(11) NOT NULL,
31 `password` varchar(106) NOT NULL,
32 `email` varchar(254) NOT NULL,
33 PRIMARY KEY (`id`),
34 UNIQUE KEY `email` (`email`),
35 KEY `domain_id` (`domain_id`),
36 CONSTRAINT `virtual_users_ibfk_1` FOREIGN KEY (`domain_id`) REFERENCES `virtual_domains` (`id`) ON DELETE CASCADE
37) ENGINE=InnoDB DEFAULT CHARSET=utf8;
38
39
40Virtual domains:
41INSERT INTO `virtual_domains`
42(`id`, `name`)
43VALUES
44('1', 'mydomain.com'),
45('2', 'my2nddomain.com');
46
47
48Virtual mailboxes:
49INSERT INTO `virtual_users`
50(`id`, `domain_id`, `password` , `email`)
51VALUES
52('1', '1', ENCRYPT('firstpassword', CONCAT('$6$', SUBSTRING(SHA(RAND()), -16))), 'mail@mydomain.com'),
53('2', '2', ENCRYPT('secondpassword', CONCAT('$6$', SUBSTRING(SHA(RAND()), -16))), 'mail@my2nddomain.com');
54
55
56
57Virtual aliases:
58INSERT INTO `virtual_aliases`
59(`id`, `domain_id`, `source`, `destination`)
60VALUES
61('1', '1', 'alias@mydomain.com', 'mail@mydomain.com');
62
63
64sudo apt-get install -y dovecot-core dovecot-imapd dovecot-lmtpd dovecot-mysql
65
66
67Now we'll enable the protocols we need:
68sudo vim /etc/dovecot/dovecot.conf
69
70!include_try /usr/share/dovecot/protocols.d/*.protocol
71protocols = imap lmtp
72
73we have to make sure the following line is uncommented:
74!include conf.d/*.conf
75
76
77Mail configuration:
78sudo groupadd -g 5000 mail
79sudo useradd -g mail -u 5000 mail -d /var/mail
80sudo mkdir -p /var/mail/vhosts/{mydomain.com,my2nddomain.com}
81sudo chown -R mail:mail /var/mail
82sudo chown -R dovecot:mail /etc/dovecot
83sudo chmod -R o-rwx /etc/dovecot
84
85sudo vim /etc/dovecot/conf.d/10-mail.conf
86Find the mail_location line, uncomment it and change it to the following:
87mail_location = maildir:/var/mail/vhosts/%d/%n
88Find the mail_privileged_group line, uncomment it and change it to the following:
89mail_privileged_group = mail
90Finally, find the first_valid_uid line, uncomment it and change it to the following:
91first_valid_uid = 1
92
93
94
95
96Auth configuration:
97Now we need to tell dovecot that we're using MySQL to authenticate our users.
98sudo vim /etc/dovecot/conf.d/10-auth.conf
99
100Uncomment the following line:
101disable_plaintext_auth = yes
102
103Find the line containing auth_mechanisms = plain and change it to the following:
104auth_mechanisms = plain login
105
106Comment out this line:
107#!include auth-system.conf.ext
108
109Uncomment this line in order to enable MySQL authentication:
110!include auth-sql.conf.ext
111
112
113
114
115MySQL configuration:
116To allow dovecot to connect to our MySQL database, we need to give it our MySQL credentials using a driver.
117sudo vim /etc/dovecot/conf.d/auth-sql.conf.ext
118Enter the following in the file before saving it:
119passdb {
120 driver = sql
121 args = /etc/dovecot/dovecot-sql.conf.ext
122}
123userdb {
124 driver = static
125 args = uid=mail gid=mail home=/var/mail/vhosts/%d/%n
126}
127
128
129
130sudo vim /etc/dovecot/dovecot-sql.conf.ext
131Find the #driver = line, uncomment it and change it to the following:
132driver = mysql
133Find the #connect = line, uncomment it and change it to the following, replacing the highlighted parts with your own MySQL credentials we created here.
134connect = host=127.0.0.1 dbname=mail user=mail password=mailpassword
135Find the #default_pass_scheme = line, uncomment it and change it to the following:
136default_pass_scheme = SHA512-CRYPT
137Finally, find the #password_query = \ line, uncomment it and change it to the following:
138password_query = SELECT email as user, password FROM virtual_users WHERE email='%u';
139
140
141
142Master configuration:
143Now we're going to define the services that dovecot will provide.
144sudo vim /etc/dovecot/conf.d/10-master.conf
145 Find service imap-login and change it to the following:
146service imap-login {
147 inet_listener imap {
148 port = 143
149 }
150 inet_listener imaps {
151 port = 993
152 ssl = yes
153 }
154}
155Find service lmtp and change it to the following:
156service lmtp {
157 unix_listener /var/spool/postfix/private/dovecot-lmtp {
158 mode = 0600
159 user = postfix
160 group = postfix
161 }
162}
163
164Find service auth and change it to the following:
165service auth {
166 unix_listener /var/spool/postfix/private/auth {
167 mode = 0666
168 user = postfix
169 group = postfix
170 }
171
172 unix_listener auth-userdb {
173 mode = 0600
174 user = mail
175 }
176
177 user = dovecot
178}
179
180Finally, find service auth-worker and change it to the following:
181service auth-worker {
182 user = mail
183}
184
185
186
187
188
189
190sudo vim /etc/dovecot/conf.d/10-ssl.conf
191
192Change the ssl parameter to required:
193ssl = required
194Modify the path for ssl_cert to your full certificate chain minus your CA's certificate and ssl_key to the path to your certificate's private key.
195ssl_cert = </etc/letsencrypt/live/mail.mydomain.com/fullchain.pem
196ssl_key = </etc/letsencrypt/live/mail.mydomain.com/privkey
197This will take a very long time to complete, and dovecot will not be functional until it is completed. Alternatively you can use "2048" although that is not as future-proof.
198Use stronger ssl_dh_parameters_length
199ssl_dh_parameters_length = 4096
200Disable insecure ssl_protocols
201ssl_protocols = !SSLv2 !SSLv3 !TLSv1
202Use a stronger ssl_cipher_list
203ssl_cipher_list = ALL:HIGH:!SSLv2:!MEDIUM:!LOW:!EXP:!RC4:!MD5:!aNULL:@STRENGTH
204Prefer server ciphers
205ssl_prefer_server_ciphers = yes