diff options
Diffstat (limited to '_posts/mail.md')
| -rw-r--r-- | _posts/mail.md | 191 |
1 files changed, 191 insertions, 0 deletions
diff --git a/_posts/mail.md b/_posts/mail.md new file mode 100644 index 0000000..b908d81 --- /dev/null +++ b/_posts/mail.md @@ -0,0 +1,191 @@ +apt install postfix dovecot-imapd opendkim postfix-policyd-spf-python maildrop roundcube prayer nginx postfix-mta-sts-resolver hash-slinger + +vim /etc/dovecot/conf.d/10-mail.conf + mail_location = maildir:~/Maildir + +vim /etc/dovecot/conf.d/10-ssl.conf + ssl_cert = </etc/ssl/certifikati/fullchain.pem + ssl_key = </etc/ssl/certifikati/privkey.pem + +vim /etc/postfix/header\_checks + /^X-Originating-IP:/ IGNORE + /^Received:.*ESMTPSA/ IGNORE + +vim /etc/postfix/command\_filter + /^(.*)šijanec(.*)$/ $1 xn--ijanec-9jb $2 + +vim /etc/postfix/destinations + if !/seznami/ + /ijanec/ ALLOW + /241/ ALLOW + /146/ ALLOW + /235/ ALLOW + /gimb.tk/ ALLOW + /xn--jha/ ALLOW + endif + +usermod -aG opendkim postfix +mkdir /var/spool/postfix/opendkim +chown opendkim:opendkim /var/spool/postfix/opendkim + +opendkim-genkey -D /etc/dkimkeys -s mail + +dodaj vsebino /etc/dkimkeys/mail.txt v DNS zone za domeno + +vim /etc/opendkim.conf + LogWhy yes + UserID opendkim:opendkim + Domain sijanec.eu,sijanec.org,sijanec.net,xn--ijanec-9jb.eu in tako dalje + Selector mail + KeyFile /etc/dkimkeys/mail.private + Socket local:/var/spool/postfix/opendkim/opendkim.sock + +vim /etc/postfix-policyd-spf-python/policyd-spf.conf + HELO_reject = False + Mail_From_reject = False + +vim /etc/postfix/main.cf + smtp_header_checks = regexp:/etc/postfix/header_checks + smtpd_tls_cert_file = /etc/ssl/certifikati/fullchain.pem + smtpd_tls_key_file = /etc/ssl/certifikati/privkey.pem + smtpd_tls_received_header = yes + smtpd_command_filter = pcre:/etc/postfix/command_filter + mydomain = sijanec.eu + mydestination = pcre:/etc/postfix/destinations + smtp_address_preference = ipv4 + mailbox_command = /usr/bin/maildrop -d $(USER) + smtp_bind_address = 89.212.146.168 + smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination, check_policy_service unix:private/policyd-spf + policyd-spf_time_limit = 3600 + message_size_limit = 1222333444 + milter_protocol = 2 + milter_default_action = accept + smtpd_milters = unix:/opendkim/opendkim.sock + non_smtpd_milters = unix:/opendkim/opendkim.sock + smtp_tls_policy_maps = socketmap:inet:127.0.0.1:8451:postfix + smtpd_sasl_type = dovecot + smtpd_sasl_path = private/auth + smtpd_sasl_auth_enable = yes + +vim /etc/postfix/master.cf + odkomentiraj: smtp, submission, smtps (ostali potrebni so že odkomentirani) + dodaj na konec: + policyd-spf unix - n n - 0 spawn + user=policyd-spf argv=/usr/bin/policy-spf + +vim /etc/dovecot/conf.d/10-master.conf + # ta block že obstaja v privzeti konfiguraciji + # https://www.postfix.org/SASL_README.html + service auth { + unix_listener /var/spool/postfix/private/auth { + user = postfix + group = postfix + mode = 0660 + } + } + +vim /etc/dovecot/conf.d/15-mailboxes.conf + # ti blocki že obstajajo v privzeti konfiguraciji, treba jih je samo dopolniti + namespace inbox { + mailbox Drafts { + special_use = \Drafts + auto = subscribe + } + mailbox Junk { + special_use = \Junk + auto = subscribe + } + mailbox Trash { + special_use = \Trash + auto = subscribe + } + mailbox Sent { + special_use = \Sent + auto = subscribe + } + } + +vim ~/.mailfilter + if (/.*librehosting@radiostudent\.si.*/ || /.*kiberpipa\.org.*/ || /.*lugos\.si.*/) + { + to $HOME/Maildir/.liste.lugos + } + if (/.*oss-security.*/ || /.*debian-security-announce.*/) + { + to $HOME/Maildir/.liste.oss-security + } + in tako dalje + +iz IMAP klienta je treba **PRED DODAJANJEM MAPE** v ~/.mailfilter izdelati mapo, v nasprotnem primeru bo maildrop naredil mbox datoteko, česar nočemo. + +chown $USER:$USER ~/.mailfilter +chmod 0600 ~/.mailfilter + +vim /etc/maildroprc +DEFAULT="$HOME/Maildir" + +tlsa --create sijanec.eu +dodaj output v DNS domensko zono (nginx mora teči s pravilnim certifikatom!) - spremeni zapis v DNS zoni, ko spremeniš cert + +rndc freeze +vim /var/lib/bind/db.sijanec.eu + _mta-sts IN TXT "v=STSv1; id=2" + mta-sts IN CNAME mail + @ IN MX 10 mail + mail IN A 89.212.146.168 + _dmarc IN TXT "v=DMARC1; p=none; rua=mailto:dmarc-aggregate@sijanec.eu; ruf=mailto:dmarc-forensic@sijanec.eu; fo=1" + @ IN TXT "v=spf1 mx a ip4:89.212.146.168/32 a:mail.sijanec.eu ~all" + *.sijanec.eu._report._dmarc IN TXT "v=DMARC1" + sijanec.eu._report._dmarc IN TXT "v=DMARC1" + *.sijanec.org._report._dmarc IN TXT "v=DMARC1" + sijanec.org._report._dmarc IN TXT "v=DMARC1" ; in isto za ostale domene + _smtp._tls IN TXT "v=TLSRPTv1; rua=mailto:tls@sijanec.eu" + @ IN CAA 128 issue "letsencrypt.org" + @ IN CAA 128 issuewild "letsencrypt.org" + @ IN CAA 128 iodef "mailto:caa-violation@sijanec.eu" + * IN CAA 128 issue "letsencrypt.org" + * IN CAA 128 issuewild "letsencrypt.org" + * IN CAA 128 iodef "mailto:caa-violation@sijanec.eu" +rndc thaw + +vim /etc/aliases + mailer-daemon: postmaster + postmaster: root + nobody: root + hostmaster: root + webmaster: root + listmaster: root + www: root + ftp: root + abuse: root + noc: root + security: root + root: a + anton: a + whois: hostmaster + dns: whois + devnull: null + null: |/dev/null + luka: anton + dmarc-aggregate: postmaster + dmrac-forensic: postmaster + caa-violation: hostmaster + tls: postmaster + +newaliases + +vim /var/www/html/.well-known/mta-sts.txt + version: STSv1 + mode: testing + mx: mail.sijanec.eu + mx: mail.sijanec.org + mx: mail.sijanec.net + mx: mail.xn--ijanec-9jb.eu + mx: mail.xn--ijanec-9jb.org + mx: mail.xn--ijanec-9jb.net + mx: mail.xn--ijanec-9jb.si + mx: mail.xn--ijanec-9jb.com + max_age: 31557600 + comment: karkoli + +systemctl restart postfix dovecot opendkim prayer nginx postfix-mta-sts-resolver bind9 |