Manual tp Develop EAI Mail Server on CentOS 7
Contents
EAI Email Server
This manual is designed to guide how to install an Email Server to send Thai email addresses or Email Address Internationalization (EAI) using Opensource Software. It could be further developed on different set of softwares.
Required Software
- Centos 7.4
- Postfix 3.2.3
- Dovecot 2.2.10
- MariaDB 10.3.11
- Squirrelmail 5.5.56
Remarks:
- This manual have no explanation for installing Centos 7.4
- Postfix Version 3.x.x and above will support EAI
- In real setting, DNS server is also required
- putty and winscp are used for connecting to the server
Installing EAI Email Server
1. Setting hostname
1. Update mail server packages to the latest version
# yum -y update
2. Define a hostname, e.g. mail.eai.in.th with command
# hostnamectl set-hostname mail.eai.in.th
3. Add the defined hostname to "hosts" file
# vi /etc/hosts
sample of hosts file
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 mail.eai.in.th ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 mail.eai.in.th
*Depends on the environment of CenOS installation, you may need to install additional services e.g. you may not be able to use "vi" command
4. Install wget to download additional necessary softwares
# yum -y install wget
5. Install telnet to test email server functionality
# yum -y install telnet
2. Setting firewall
1. Verify "firewalld service" status on the mail server
- It must be active (running)
# systemctl status firewalld
sample
Active: active (running) since Mon 2019-11-18 14:12:03 +07; 1h 13min ago
2. Check the firewall zone and network interface that are opened
# firewall-cmd --get-active-zones
example
public interfaces: ens32
3. Check services of firewall in public zone
# firewall-cmd --zone=public --list-services
sample
cockpit dhcpv6-client ssh
4. Open firewall services at public zone of mail server (open on services that needed)
# firewall-cmd --permanent --zone=public --add-service=http # firewall-cmd --permanent --zone=public --add-service=https # firewall-cmd --permanent --zone=public --add-service=mysql # firewall-cmd --permanent --zone=public --add-service=smtp # firewall-cmd --permanent --zone=public --add-service=smtps # firewall-cmd --permanent --zone=public --add-service=imap # firewall-cmd --permanent --zone=public --add-service=imaps # firewall-cmd --reload
5. Check services list of the firewall at the public zone again, will find the just open services
*ref: configure firewall services for mail server (https://spalinux.com/2015/06/centos-7-basic-configure-firewall-by-firewall-cmd)
# firewall-cmd --zone=public --list-services
sample
cockpit dhcpv6-client http https imap imaps mysql smtp smtps ssh
6. In this example, we open SELinux for convenience in setting up (it is not recommended for production server)
- เปลี่ยน SELinux=enforcing เป็น SELinux=disabled
# vi /etc/selinux/config
sample
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
SELINUX=disabled
# SELINUXTYPE= can take one of these two values:
# targeted - Targeted processes are protected,
# mls - Multi Level Security protection.
SELINUXTYPE=targeted
7. ตรวจสอบสถานะ SELinux อีกครั้ง
- สั่ง restart server และทำการตรวจสอบ
# reboot # sestatus
sample
disabled
3. Create an SSL Cert
- The step is for creating SSL key for using with postfix and dovecot
1. Create a private key
# cd /etc/pki/tls/certs # make eai.key
sample
umask 77 ; \ /usr/bin/openssl genrsa -aes128 2048 > eai.key Generating RSA private key, 2048 bit long modulus ... ... e is 65537 (0x10001) Enter pass phrase: #set passphrase Verifying - Enter pass phrase: #confirm
2. Remove Passphase from the created private key
# openssl rsa -in eai.key -out eai.key
sample
Enter pass phrase for eai.key: #input passphrase writing RSA key
3. Create csr
# make eai.csr
sample
umask 77 ; \ /usr/bin/openssl req -utf8 -new -key eai.key -out eai.csr You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:TH #country State or Province Name (full name) []:Bangkok #state Locality Name (eg, city) [Default City]:Dusit #city Organization Name (eg, company) [Default Company Ltd]:EAI #company Organizational Unit Name (eg, section) []:IT #department Common Name (eg, your name or your server's hostname) []:mail.eai.in.th #server's FQDN Email Address []:xxx@eai.in.th #email address Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: #Enter An optional company name []: #Enter
4. Generate key
# openssl x509 -in eai.csr -out eai.crt -req -signkey eai.key -days 3650
sample
Signature ok subject=/C=JP/ST=Hiroshima/L=Hiroshima/O=GTS/OU=Server World/CN=www.srv.world/emailAddress=xxx@eai.in.th Getting Private key
4. Install mariadb, Postfix and Dovecot
1. Install mariadb , Postfix , Dovecot and necessary packages
# yum --enablerepo=centosplus install postfix # yum install dovecot mariadb-server dovecot-mysql
2. Udate postfix version 2.x.x to version 3.x.x
- On CentOS 7 postfix version 2.x.x is the default installation. We have to removepostfix version 2.x.x and upgrade to version 3.x.x or higher version
# yum -y remove postfix # yum -y remove ssmtp # yum -y remove sendmail
- Create repo file gf.repo to install postfix version 3.x.x or above
# vi /etc/yum.repos.d/gf.repo
sample
[gf] name=Ghettoforge packages that won't overwrite core distro packages. mirrorlist=http://mirrorlist.ghettoforge.org/el/7/gf/$basearch/mirrorlist enabled=1 gpgcheck=1 gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-gf.el7 failovermethod=priority [gf-plus] name=Ghettoforge packages that will overwrite core distro packages. mirrorlist=http://mirrorlist.ghettoforge.org/el/7/plus/$basearch/mirrorlist # Please read http://ghettoforge.org/index.php/Usage *before* enabling this repository! enabled=1 gpgcheck=1 gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-gf.el7 failovermethod=priority
- Load key to use with repo, put into path : /etc/pki/rpm-gpg/
# cd /etc/pki/rpm-gpg/ # wget http://mirror.ghettoforge.org/distributions/gf/RPM-GPG-KEY-gf.el7
- Install postfix version 3.x.x
# yum -y install postfix3 postfix-mysql
- Chaeck postfix version 3.x.x
# postconf -d | grep mail_version
mail_version = 3.5.7
3. Setup mariadb, postfix, dovecot to start automatically
# systemctl start mariadb # systemctl enable mariadb # systemctl start postfix # systemctl enable postfix # systemctl start dovecot # systemctl enable dovecot
4. Check status of mariadb, postfix, dovecot
# systemctl status mariadb # systemctl status postfix # systemctl status dovecot
5. Setup MariaDB
1. Set UTF8 for mysql to accept Unicode by adding the following command to /etc/my.cnf.d/maridb-server.cnf under [mysqld]
# vi /etc/my.cnf
sample
[mysqld] character-set-server = utf8 collation-server = utf8_general_ci skip-character-set-client-handshake bind-address=127.0.0.1 datadir=/var/lib/mysql socket=/var/lib/mysql/mysql.sock # Disabling symbolic-links is recommended to prevent assorted security risks symbolic-links=0 # Settings user and group are ignored when systemd is used. # If you need to run mysqld under a different user or group, # customize your systemd unit file for mariadb according to the # instructions in http://fedoraproject.org/wiki/Systemd [mysqld_safe] log-error=/var/log/mariadb/mariadb.log pid-file=/var/run/mariadb/mariadb.pid # # include all files from the config directory # !includedir /etc/my.cnf.d
2. Restart MariaDB
# systemctl restart mariadb
3. Set security access to mysql by setup password for root user (* define only new password, skip the rest by pressing enter)
# mysql_secure_installation
4. Login to mysql using the new password
# mysql -u root -p
5. Create new DB for keeping records of Email Server usage
# CREATE DATABASE eaimail; # USE eaimail;
Create a user with grants to the eaimail database
# GRANT SELECT, INSERT, UPDATE, DELETE ON eaimail.* TO 'yourdbuser'@'localhost' IDENTIFIED BY 'yourdbpassword'; # GRANT SELECT, INSERT, UPDATE, DELETE ON eaimail.* TO 'yourdbuser'@'localhost.localdomain' IDENTIFIED BY 'yourdbpassword'; # FLUSH PRIVILEGES;
7. Check the created user
# SHOW GRANTS FOR 'yourdbuser'@'localhost';
8. Create tables for domains, forwardings (to forward EAI email to ASCII email address), and users for creating mailboxes
# CREATE TABLE domains (domain varchar(50) NOT NULL, PRIMARY KEY (domain) );
8. Create tables for domains, forwardings (to forward EAI email to ASCII email address), and users for creating mailboxes
# CREATE TABLE forwardings (source varchar(80) NOT NULL, destination TEXT NOT NULL, PRIMARY KEY (source) );
8. Create tables for domains, forwardings (to forward EAI email to ASCII email address), and users for creating mailboxes
# CREATE TABLE users (email varchar(80) NOT NULL, password varchar(20) NOT NULL, PRIMARY KEY (email) ); # quit
11. Restart MariaDB
# systemctl restart mariadb
12. Setup domain and user in eaimail database
- Access mariadb and choose eaimail database , enter ASCII domainand IDN , enter ASCII and EAI Email-Account with password to start
# mysql -u root -p
# USE eaimail; # INSERT INTO domains (domain) VALUES ('eai.in.th'); # INSERT INTO domains (domain) VALUES ('อีเอไอ.ไทย'); # INSERT INTO users (email, password) VALUES ('thai@eai.in.th', ENCRYPT('thaiuserpassword')); # INSERT INTO users (email, password) VALUES ('ไทย@อีเอไอ.ไทย', ENCRYPT('thaiuserpassword'));
- Setup a forwrding rule to forward all emails to EAI email address to ASCII email address, since the server can creat mailboxes in Unicode
# INSERT INTO forwardings (source,destination) VALUES ('ไทย@อีเอไอ.ไทย','thai@eai.in.th'); # quit
6. Setup Postfix
Create connect file between Postfix and MariaDB
1. Create a script file to get domain value from DB
# vi /etc/postfix/mysql-virtual_domains.cf
sample
user = yourdbuser password = yourdbpassword dbname = eaimail query = SELECT domain AS virtual FROM domains WHERE domain='%s' hosts = 127.0.0.1
2. Create a file mysql-virtual_forwardings.cf to retreive the forward email fron database
# vi /etc/postfix/mysql-virtual_forwardings.cf
sample
user = yourdbuser password = yourdbpassword dbname = eaimail query = SELECT destination FROM forwardings WHERE source='%s' hosts = 127.0.0.1
3. Create a script file for creating mailbox and use for login
# vi /etc/postfix/mysql-virtual_mailboxes.cf
sample
user = yourdbuser password = yourdbpassword dbname = eaimail query = SELECT CONCAT(SUBSTRING_INDEX(email,'@',-1),'/',SUBSTRING_INDEX(email,'@',1),'/') FROM users WHERE email='%s' hosts = 127.0.0.1
4. Create a script file for forwarding all email to another SMTP server (in the case that referring to a host as an IP address)
# vi /etc/postfix/mysql-virtual_email2email.cf
sample
user = yourdbuser password = yourdbpassword dbname = eaimail query = SELECT email FROM users WHERE email='%s' hosts = 127.0.0.1
5. Set access control right to the created script
# chmod o= /etc/postfix/mysql-virtual_*.cf # chgrp postfix /etc/postfix/mysql-virtual_*.cf
6. Create user and group for the mailbox
# groupadd -g 5000 vmail # useradd -g vmail -u 5000 vmail -d /home/vmail -m
7. Modify "/etc/postfix/main.cf"
# vi /etc/postfix/main.cf
sample
inet_interfaces = all inet_protocols = ipv4 mydestination = localhost, localhost.localdomain alias_database = hash:/etc/aliases sendmail_path = /usr/sbin/sendmail.postfix newaliases_path = /usr/bin/newaliases.postfix mailq_path = /usr/bin/mailq.postfix meta_directory = /etc/postfix shlib_directory = no myhostname = mail.eai.in.th mydomain = eai.in.th myorigin = $mydomain readme_directory = no mynetworks = 127.0.0.1 message_size_limit = 30720000 smtpd_sasl_auth_enable = yes smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth smtpd_sasl_authenticated_header = yes broken_sasl_auth_clients = yes smtpd_use_tls = yes smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination smtpd_tls_cert_file = /etc/pki/tls/certs/eai.crt smtpd_tls_key_file = /etc/pki/tls/certs/eai.key smtpd_tls_security_level = may smtpd_tls_auth_only = yes smtpd_tls_loglevel = 1 alias_maps = hash:/etc/aliases virtual_mailbox_base = /home/vmail virtual_mailbox_maps = proxy:mysql:/etc/postfix/mysql-virtual_mailboxes.cf virtual_mailbox_domains = proxy:mysql:/etc/postfix/mysql-virtual_domains.cf virtual_uid_maps = static:5000 virtual_gid_maps = static:5000 virtual_alias_domains = อีเอไอ.ไทย virtual_transport = dovecot virtual_alias_maps = proxy:mysql:/etc/postfix/mysql-virtual_forwardings.cf, mysql:/etc/postfix/mysql-virtual_email2email.cf smtputf8_enable = yes proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks
8. Modify /etc/postfix/master.cf add command to the end of the file
# vi /etc/postfix/master.cf
sample
dovecot unix - n n - - pipe flags=DRhu user=vmail:vmail argv=/usr/libexec/dovecot/deliver -f ${sender} -d ${recipient}
9. Modify /etc/postfix/master.cf allow the commands below (others keep # in front)
sample
smtps inet n - - - - smtpd -o syslog_name=postfix/smtps -o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes -o smtpd_client_restrictions=permit_sasl_authenticated,reject -o smtpd_relay_restrictions=permit_sasl_authenticated,reject -o milter_macro_daemon_name=ORIGINATING
10. restart postfix
sample
# systemctl restart postfix
11. Define alias email by modifying the aliases file
- add 2 lines
# vi /etc/aliases
postmaster: root root: postmaster@eai.in.th
12. Update aliases and restart postfix
# newaliases # systemctl restart postfix
7. Setup Dovecot
1. keep exisiting configuration
# mv /etc/dovecot/dovecot.conf /etc/dovecot/dovecot.conf-backup
2. Setup config dovecot
# vi /etc/dovecot/dovecot.conf
sample
protocols = imap pop3 lmtp log_timestamp = "%Y-%m-%d %H:%M:%S " mail_location = maildir:/home/vmail/%d/%n/Maildir ssl_cert = </etc/pki/tls/certs/eai.crt ssl_key = </etc/pki/tls/certs/eai.key ssl_dh_parameters_length = 2048 ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL namespace { type = private separator = . prefix = INBOX. inbox = yes } service auth { unix_listener auth-master { mode = 0600 user = vmail } unix_listener /var/spool/postfix/private/auth { mode = 0666 user = postfix group = postfix } user = root } auth_mechanisms = plain login service auth-worker { user = root } protocol lda { log_path = /home/vmail/dovecot-deliver.log auth_socket_path = /var/run/dovecot/auth-master postmaster_address = postmaster@eai.in.th } protocol pop3 { pop3_uidl_format = %08Xu%08Xv pop3_client_workarounds = outlook-no-nuls oe-ns-eoh } passdb { driver = sql args = /etc/dovecot/dovecot-sql.conf.ext } userdb { driver = static args = uid=5000 gid=5000 home=/home/vmail/%d/%n allow_all_users=yes }
3. Create script to let dovecot work with SQL
# vi /etc/dovecot/dovecot-sql.conf.ext
sample
driver = mysql connect = host=127.0.0.1 dbname=eaimail user=yourdbuser password=yourdbpassword default_pass_scheme = CRYPT password_query = SELECT email as user, password FROM users WHERE email='%u';
4. Allow users in the dovecot group to use
# chgrp dovecot /etc/dovecot/dovecot-sql.conf.ext # chmod o= /etc/dovecot/dovecot-sql.conf.ext
5. restart dovecot
# systemctl restart dovecot
6. Check log of mail server at /var/log/maillog
# tail /var/log/maillog
sample
Mar 18 17:10:26 localhost postfix/postfix-script[3274]: starting the Postfix mail system
Mar 18 17:10:26 localhost postfix/master[3276]: daemon started -- version 2.10.1, configuration /etc/postfix
Mar 18 17:12:28 localhost dovecot: master: Dovecot v2.2.10 starting up for imap, pop3 (core dumps disabled)
8. Test EAI Email Server
1. Test pop3
# telnet localhost pop3
sample
Trying 127.0.0.1... Connected to localhost.localdomain. Escape character is '^]'. +OK Dovecot ready.
2. Test SMTP
# telnet localhost 25 # ehlo localhost
sample
250-mail.eai.in.th 250-PIPELINING 250-SIZE 30720000 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN 250-AUTH=PLAIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 SMTPUTF8
3. Test sending and receiving emails with mailx
- check log /var/log/maillog should get the result
# yum -y install mailx # mailx thai@eai.in.th (input subject then press enter follow by content and use Ctrl+D for sending out)
# tail /var/log/maillog
sample
Nov 13 15:19:07 mail postfix/pickup[31954]: E9AB020199E5: uid=0 from=<root> Nov 13 15:19:07 mail postfix/cleanup[1938]: E9AB020199E5: message-id=<20171113081907.E9AB020199E5@mail.eai.in.th> Nov 13 15:19:07 mail postfix/qmgr[21141]: E9AB020199E5: from=<root@eai.in.th>, size=434, nrcpt=1 (queue active) Nov 13 15:19:08 mail postfix/pipe[1946]: E9AB020199E5: to=<tanagan@eai.in.th>, relay=dovecot, delay=0.09, delays=0.04/0.01/0/0.03, dsn=2.0.0, status=sent (delivered via dovecot service) Nov 13 15:19:08 mail postfix/qmgr[21141]: E9AB020199E5: removed
- If found log error: unsupported dictionary type: MySQL, it is because of using postfix 3.2.4 which still has some bugs. If the problem comes from mysql.cf, check /etc/postfix/dynamicmaps.cf.d/
# cd /etc/postfix/dynamicmaps.cf.d/ # vi mysql.cf
mysql /usr/lib/postfix/postfix-mysql.so dict_mysql_open
4. Check the log to see Dovecot sending result /home/vmail/dovecot-deliver.log, should see the result
# tail /home/vmail/dovecot-deliver.log
2017-11-13 15:19:08 lda(tanagan@eai.in.th): Info: msgid=<20171113081907.E9AB020199E5@mail.eai.in.th>: saved mail to INBOX
5. Check the mailbox. When there are sendings and receiving emails, you will see the results
# cd /home/vmail/eai.in.th/thai/Maildir # find
sample
. ./dovecot-uidlist ./cur ./new ./new/1285609582.P6115Q0M368794.li172-137 ./dovecot.index ./dovecot.index.log ./tmp
6. Check mailbox by using mail client, mutt, to see emaila inside the mailbox
# yum -y install mutt # mutt -f .
7. Test sending an EAI mails
- Use “.” to end and sending the message
- Press Ctrl+] to quit
# telnet localhost 25 # EHLO localhost # MAIL FROM: ไทย@อีเอไอ.ไทย SMTPUTF8 # RCPT TO: ธนากานต์@คน.ไทย # data # Subject: eai test # เทสอีเมลส์ภาษาไทย # .
9. Install SquirrelMail
1. Install squirrelmail
# yum -y install epel-release # yum install squirrelmail
2. If Apache was not install, install the Apche
# yum -y install httpd # systemctl enable httpd # systemctl start httpd # systemctl status httpd
3. Copy/move squirrelmail to /var/www/html/
# cd /var/www/html/
(copy squirrelmail to /var/www/html/ , we use winscp to copy)
4. Create data directory for squirrelmail
# cd /var/lib/squirrelmail/ # mkdir data # chmod ugo+rwx data/
5. Test login to access via web browsers Use the IP of Server follows by /squirrelmail e.g. http://119.59.113.240/squirrelmail/
# Test sending and receiving mail