With this configuration if the user attempts to send spam or a
virus, the message will be quarantined and the user will be
notified of the issue.
MR !9
Service amavis even though part of group vmail who has mark 770
on '/var/spool/spamassassin', can't write lockfile to do a bayes
check.
Set '/var/spool/spamassassin' mask to be `777` with owner
`debian-spamd:vmail` recursive. so that amavis bayes check works.
MR !9
Sieve extensions set to:
-vacation
Remove vaction extension as this has the potential to leak to
external users. this could be re-enabled if it could be blocked
from leaving the server and only being available within the
same domain
-enotify
Remove enotify extension as this has the potential to leak to
external users. this could be re-enabled if it could be blocked
from leaving the server and only being available within the
same domain
-editheader
editheader disabled, as the user should not be able to edit
message headers as this could remove message validity.
imap4flags
Enable imap4flags so that the user can flag messages as they
desire.
MR !9
used https://ssl-config.mozilla.org/ to generate recommended
ciphers config for dovecot and postfix.
postfix set to use medium ciphers due to possibility of smtp
servers not being updated to latest.
MR !9
Mail quota was not visible in Thunderbird. bug was havinf two
`quota =` rules. adjusted to `quota2=` for shared quota to diplay,
however, had no effect in display shared quota.
Disabled shared in the meantime.
MR !7
Check the users quota before accepting the mail for delivery.
If the user belongs to the server, the user wont send the message,
nor save it for it only to be rejected at a later stage.
Current rules and order as follows:
1. reject_non_fqdn_recipient
Require recipient to be in FQDN format so the message can
be routed.
2. reject_unknown_recipient_domain
Prevent mail from being sent to a random location that can't
be found.
3. check_policy_service,unix:private/quota
If the mail is for a local user and their mailbox is full, reject
the mail.
This allows the sender not to recieve a bounce message for
a message that wasn't actually sent.
4. permit_sasl_authenticated
A user of the mail server can send E-Mail to anyone as long as
it passes the filters above.
5. reject
Reject any further mail, as they clearly are not a user of the
mail server.
MR !7
Mail server should only relay mail for domains and users it hosts. default is to reject.
Rules and order as follows:
1. reject_non_fqdn_recipient
Require the recipient to be in FQDN format for relaying
and routing reasons including locating user.
2. permit_auth_destination
Only accept mail to be routed if authorized.
3. reject
Don't accept any further mail for relaying.
MR !7
Filter mail based on recipient restrictions. default is to filter then
reject the remaining.
This is a default rule and submission requires it's own rule specified.
rules and order as follows:
1. permit_mynetworks
Allow local mail host to send to whomever.
2. reject_non_fqdn_recipient
must use a FQDN so that the recipient can be identified.
3. reject_unknown_recipient_domain
Only accept mail for the domains we host.
4. reject_unauth_destination
reject mail for domains we don't host and before any policy
checks are done. This prevents additional processes from
spawning that would otherwise be unused.
5. check_policy_service,unix:private/policyd-spf
bounce the mail that fails spf check. likely to be a non-smtp
server.
6. check_policy_service unix:private/quota
Check the recipients quota before delivery. if fails, bounce
the mail.
7. permit_auth_destination
Only accept mail for domains we host. This rule placed after
the bounces, so that filtering can be done first.
8. reject
Hard reject as the recipient doesn't belong to this host.
MR !7
Default is to accept all mail from sender after filtering.
smtpd_sender_restrictions rules and order are as follows:
1. permit_mynetworks
permit my network (localhost). Placed first as sometimes the
sender will not be a FQDN sender. (i.e. cron)
2. reject_non_fqdn_sender
bounce mail where sender not in format of FQDN.
3. reject
Reject all remaining senders
MR !7
Default is permit.
Rule order as follows:
1. permit_mynetworks
My network (localhost) is exempt from restriction
2. reject_invalid_helo_hostname
Don't allow a connection from an invalid host.
3. permit
Allow the remaining hosts not booted.
MR !7
Default is reject.
order of rules as follows:
1. reject_unauth_destination
if postfix doesn't own the destination, bounce
2. reject_unauth_pipelining
not punch through commands.
3. permit_mynetworks,
set as rule 3 after the above rejects, so that if a rouge
process on the server attempts to send, it is blocked.
4. permit_auth_destination,
Only accept a connection if the mailserver is the destination.
5. reject
Reject all remaining mail as it's clearly not for this host.
MR !7
There is no requirement to open an additional port so that postfix can
can check the dovecot quota.
The socket is created in postfix's service directory with dovecot as the
owner and vmail as the group. setting it this way enables ls command to
display who the owner is for debugging purposes.
Postfix is a member of group vmail.
MR !7
fix the merge request dockerhub build.
var CI_COMMIT_BRANCH is not available in a merge request pipleine.
adjusted the pipline to run if development branch with a commit message
starting with Merge branch.
this enables usage of variable CI_COMMIT_BRANCH.
MR !4
When a git tag occurs, the image will also be tagged 'latest' and be
pushed to docker hub.
When a merge request occurs on the development branch, the image
will also be tagged 'dev' and be pushed to dockerhub.
MR !2
Default config is for domain example.org, which
is the testing domain.
User will be required to customise '90-dkim' with thier
own domain configuration, including generating dkim signing certificates.
MR !2
- **automagic**: [b1b5fc20](https://gitlab.com/nofusscomputing/projects/docker-mail/-/commit/b1b5fc20606dc0d87d860ae5ee64559307c6f3ea) - use template automagic for jobs [ [!12](https://gitlab.com/nofusscomputing/projects/docker-mail/-/merge_requests/12) [#5](https://gitlab.com/nofusscomputing/projects/docker-mail/-/issues/5) ]
## 0.1.0rc3 (2023-05-24)
### Bug Fixes
- **docs**: [e872534a](https://gitlab.com/nofusscomputing/projects/docker-mail/-/commit/e872534aec12c0905a7713532f36f6fde63b4730) - use docs path instead of pages [ [!10](https://gitlab.com/nofusscomputing/projects/docker-mail/-/merge_requests/10) [!26](https://gitlab.com/nofusscomputing/projects/docker-mail/-/merge_requests/26) ]
- **website**: [c2902063](https://gitlab.com/nofusscomputing/projects/docker-mail/-/commit/c290206392836642af5a3b6ca1dad67abe799b42) - correct repo name [ [!10](https://gitlab.com/nofusscomputing/projects/docker-mail/-/merge_requests/10) ]
- **docs**: [bfcb3469](https://gitlab.com/nofusscomputing/projects/docker-mail/-/commit/bfcb346924b12411102fc58bec13aa7e0820a0ce) - add base files for navigation [ [!10](https://gitlab.com/nofusscomputing/projects/docker-mail/-/merge_requests/10) ]
- **ci**: [235aa8d7](https://gitlab.com/nofusscomputing/projects/docker-mail/-/commit/235aa8d7ccd19dcee44f56a27367113f2e4f5354) - must have index.md file for linting to start [ [!10](https://gitlab.com/nofusscomputing/projects/docker-mail/-/merge_requests/10) ]
- **repo**: [d6b2b5b4](https://gitlab.com/nofusscomputing/projects/docker-mail/-/commit/d6b2b5b40ef2643005078807da7ca7dcce82505a) - lock dovecot repo to specified version [ [!3](https://gitlab.com/nofusscomputing/projects/docker-mail/-/merge_requests/3) ]
### Code Refactor
- **image**: [4c106025](https://gitlab.com/nofusscomputing/projects/docker-mail/-/commit/4c106025d545d89cadef0bf019a86cbaf7dca00a) - reduce the number of layers [ [!10](https://gitlab.com/nofusscomputing/projects/docker-mail/-/merge_requests/10) ]
- **dockerfile**: [1c6b3a36](https://gitlab.com/nofusscomputing/projects/docker-mail/-/commit/1c6b3a3617cfcd0a781391c96d0265c2fb7eef3b) - use global var [ [!10](https://gitlab.com/nofusscomputing/projects/docker-mail/-/merge_requests/10) ]
- **dockerfile**: [88bfc649](https://gitlab.com/nofusscomputing/projects/docker-mail/-/commit/88bfc64940e7a2b7073c8ebe644afd06a4e2149c) - use args for apt software versions [ [!10](https://gitlab.com/nofusscomputing/projects/docker-mail/-/merge_requests/10) ]
- **gitlab-ci**: [e2e704c5](https://gitlab.com/nofusscomputing/projects/docker-mail/-/commit/e2e704c54588c6bddccfcd38c18f21a5bc863c78) - use dev branch and type docker container [ [!3](https://gitlab.com/nofusscomputing/projects/docker-mail/-/merge_requests/3) ]
- **backup**: [acccf247](https://gitlab.com/nofusscomputing/projects/docker-mail/-/commit/acccf24774e100f0cda38941549099adc52b7b58) - ssl dir renamed to certs [ [!9](https://gitlab.com/nofusscomputing/projects/docker-mail/-/merge_requests/9) ]
- **backup**: [93378dee](https://gitlab.com/nofusscomputing/projects/docker-mail/-/commit/93378dee86abe5f1ee86e824f2543656e1826e64) - /var/spool/postfix needs to be backed up [ [!9](https://gitlab.com/nofusscomputing/projects/docker-mail/-/merge_requests/9) ]
- **sa-learn**: [43f6a356](https://gitlab.com/nofusscomputing/projects/docker-mail/-/commit/43f6a356bd7f458ee33955151ff5609c2b599a70) - amavis can't do bayes check if not mask 777 [ [!9](https://gitlab.com/nofusscomputing/projects/docker-mail/-/merge_requests/9) ]
- **cron**: [e9718c97](https://gitlab.com/nofusscomputing/projects/docker-mail/-/commit/e9718c97a678223257c2450cede863757e376b90) - sa-learn must run as spamd user [ [!9](https://gitlab.com/nofusscomputing/projects/docker-mail/-/merge_requests/9) ]
- **bayes_learn**: [967fd04f](https://gitlab.com/nofusscomputing/projects/docker-mail/-/commit/967fd04fe7af6c3d5330357e18c1a76583163ede) - ensure journal is synced after scan [ [!9](https://gitlab.com/nofusscomputing/projects/docker-mail/-/merge_requests/9) ]
- **file_permission**: [fbdf6efa](https://gitlab.com/nofusscomputing/projects/docker-mail/-/commit/fbdf6efab73324aceebfc49ab37190adb9bc0af5) - set spamd to own spamassassin folder [ [!9](https://gitlab.com/nofusscomputing/projects/docker-mail/-/merge_requests/9) ]
- **local_group**: [7f7a259a](https://gitlab.com/nofusscomputing/projects/docker-mail/-/commit/7f7a259a820bdbb6025dfee93cfb8df5ad8dba0a) - amavis and opendkim added to vmail [ [!9](https://gitlab.com/nofusscomputing/projects/docker-mail/-/merge_requests/9) ]
- **build**: [db03fc2e](https://gitlab.com/nofusscomputing/projects/docker-mail/-/commit/db03fc2efaa418b28267fe532a0cc9c09d2e09ab) - corrected syntax error in dockerfile
- **postfix**: [5f7095f2](https://gitlab.com/nofusscomputing/projects/docker-mail/-/commit/5f7095f274e6fe3cf61d8b55e14eaa47f1d2ae4d) - only use the servers order of tls ciphers [ [!7](https://gitlab.com/nofusscomputing/projects/docker-mail/-/merge_requests/7) ]
- **docker_container**: [22a987a5](https://gitlab.com/nofusscomputing/projects/docker-mail/-/commit/22a987a5133e8e878f8c79e016e218ea5a8b76d1) - Ensure amavis data is a volume [ [!9](https://gitlab.com/nofusscomputing/projects/docker-mail/-/merge_requests/9) ]
- **amavis**: [9f7ccabf](https://gitlab.com/nofusscomputing/projects/docker-mail/-/commit/9f7ccabfa52dc71f14fa690ef9e7f0e3184f14c9) - don't allow user to send banned email [ [!9](https://gitlab.com/nofusscomputing/projects/docker-mail/-/merge_requests/9) ]
- **amavis**: [c3739c4f](https://gitlab.com/nofusscomputing/projects/docker-mail/-/commit/c3739c4f1964e4e315cd9eaa2a67e787aa121688) - Don't allow user to send spam/virus [ [!9](https://gitlab.com/nofusscomputing/projects/docker-mail/-/merge_requests/9) ]
- **amavis**: [f6b7bae3](https://gitlab.com/nofusscomputing/projects/docker-mail/-/commit/f6b7bae3eba7398ad6de11b9cb2b36594df6f891) - move policy bank to own config file [ [!9](https://gitlab.com/nofusscomputing/projects/docker-mail/-/merge_requests/9) ]
- **amavis**: [7ec97502](https://gitlab.com/nofusscomputing/projects/docker-mail/-/commit/7ec975021659fee5ebaa78332fef0d9533ee769d) - Add received header to message [ [!9](https://gitlab.com/nofusscomputing/projects/docker-mail/-/merge_requests/9) ]
- **postfix**: [f90daea4](https://gitlab.com/nofusscomputing/projects/docker-mail/-/commit/f90daea454fac0ccec781129128bbf40e43378a3) - enforce only reaying mail for auth destination [ [!7](https://gitlab.com/nofusscomputing/projects/docker-mail/-/merge_requests/7) ]
- **quota_status**: [8f938bd3](https://gitlab.com/nofusscomputing/projects/docker-mail/-/commit/8f938bd3ce1a5f432a97a2aae75592f39e82d28e) - use a unix socket for postfix [ [!7](https://gitlab.com/nofusscomputing/projects/docker-mail/-/merge_requests/7) ]
- **ssl**: [09aabeb6](https://gitlab.com/nofusscomputing/projects/docker-mail/-/commit/09aabeb68aae478bd125e48b4bfaecaa7a97b1ae) - Moved /ssl to /certs [ [!2](https://gitlab.com/nofusscomputing/projects/docker-mail/-/merge_requests/2) ]
### Continious Integration
- **docker_hub**: [27ad07ea](https://gitlab.com/nofusscomputing/projects/docker-mail/-/commit/27ad07ead345bbf7b0c929adbfd24947ef977e40) - fix dev push [ [!5](https://gitlab.com/nofusscomputing/projects/docker-mail/-/merge_requests/5) ]
- **docker_hub**: [aafd9acc](https://gitlab.com/nofusscomputing/projects/docker-mail/-/commit/aafd9acca9fe98bad1710a4af2f1b0eabadd6944) - ensure build and DH push works on merge [ [!4](https://gitlab.com/nofusscomputing/projects/docker-mail/-/merge_requests/4) ]
- **docker_hub**: [36808960](https://gitlab.com/nofusscomputing/projects/docker-mail/-/commit/36808960ce9a1369eebcaf0fe878d85bdbd37ced) - push a dev and latest tag to docker hub [ [!2](https://gitlab.com/nofusscomputing/projects/docker-mail/-/merge_requests/2) ]
To utilise DKIM message signing for outbound mail (leaving the server), you will need to configure dkim to use your certificates.
This document assumes that your are familar with amavis and DKIM E-Mail signing. Without this assumed knowledge, there may be uninteded consequences.
## DKIM Key creation
You will be required to generate your DKIM signing certificates for the E-Mail domains that you utilise. The recommended location for DKIM keys is `/certs/amavis/dkim`, this ensures they are included in the backups.
has a key of length 2048 bits _[See RFC6376 - Key Sizes](https://datatracker.ietf.org/doc/html/rfc6376#section-3.3.3)_
saved to location `/certs/amavis/dkim/` with a name of `example.org.dkim.pem`
The filename is crucial and has some requirements:
- `example.org` set to your E-Mail domain name.
- `dkim` is the key selector that will be utilised during the amavis configuration
- `.pem` is the file extension
For example: if you have a E-Mail domain called `myemail.com` and wanted to use a key selector of `q2` for second quarter of teh year, you would use command `amavisd-new genrsa /certs/amavis/dkim/myemail.com.q2.pem 2048` to create your dkim signing key. _not forgetting that `q2` needs to be added to your amavis config, see below_
2. Set the permissions for your dkim signing key to only be accessable to amavis
## Configuring Amavis
To configure amavis, you will be required to create a confiuguration file with your E-Mail domain settings. you can name this file anything you wish, as long as the filename is oredered after `90-dkim`. The configuration file needs to be located in `/etc/amavis/conf.d/` and amavis will need to be restarted `supervisorctl restart amavis` for the configuration to take effect.
!!! tip Note
Ensure you adjust all occurances of `example.org` to match your E-Mail domain
``` conf title="/etc/amavis/conf.d/99-dkim-keys"
dkim_key(
'example.org', # (1)!
'dkim', # (2)!
'/certs/amavis/dkim/example.org.dkim.pem' # (3)!
);
@dkim_signature_options_bysender_maps = (
{
"example.org" => { # (1)!
s => 'dkim', # (2)! # (4)!
d => 'example.org', # (1)!
a => 'rsa-sha256', # (5)!
ttl => 30*24*3600 # (6)!
}
}
);
```
1. Adjust to suit your domain name
2. This is the key selector _located in the filename, `{E-Mail domain}.{key_selector}.pem`_.
3. This is the location of the DKIM Signing key. This must match the name given during key generation.
4. This is the key selector. Only this key will be used to sign the E-Mails if it matches the E-Mail domain name.
5. This is the key signing algorithm
6. This is the signed E-Mail validity duration `30*24*3600` = `30 days * 24 hours * seconds in one hour`. This value is used to set the E-Mails signature validation period.
!!! Tip
you can add as many `dkim_key` sections to your config as required.
!!! note
if you don't place a domain entry in `@dkim_signature_options_bysender_maps` that matches your E-Mail domain, any email sent from that domain will not be dkim signed. You can specify `'.'` for the domain entry to capture all domains.
Once configuration is complete issue command `supervisorctl restart amavis` to load the config changes
## Configuring DNS
Once you have configured Amavis and created your DKIM keys, you will need to configure DNS. For this you will require the DKIM Key information. Since we are using Amavis, issue command `amavisd-new showkeys` to display your keys and the required dns config.
1. Using the example output from the above command, displays the required DNS txt entry.
Create a DNS `TXT` entry named `dkim._domainkey.example.org` The breakdown of this name is as follows `{key selector}._domainkey.{domain name}`
!!! note
if you have configured amavis correctly, the selector and domain name will match your E-Mail domain.
Give it a TTL of at least `3600`. Any value can be set here. However understand that if the duration is too long, if you need to change your key, the ttl period will need to pass before any cached look ups will expire.
enter the value of (obviously, use the output of your command run):
If you have multiple keys, the above command will output all of the keys and selectors that was configured within amavis.
2. once dns is configured, you can test the DNS entries and amavis config with the following command `amavisd testkeys` if the tests pass, you have configured it properly.
## Changing DKIM Keys
To change your DKIM keys, generate new ones, ensuring you utilise a differently named selector and update `99-dkim-keys` with your new key details. You will also be required to update the DNS entries.
!!! alert Danger
If you reconfigure amavis to sign your E-Mails with a new key before the DNS changes take effect (before cache expires), you run the risk of having your E-Mails fail the receiving servers DKIM checks.
It is recommended that you do the following:
1. generate the new key, add it to a new `dkim_key` section in file `99-dkim-keys`
2. run `amavisd-new showkeys` to get your dns config. Reconfigure DNS with the new key
3. wait 24 hours
5. Prevent users from sending emails (or do after hours when the mail server would normally be quite)
3. edit the `s` to match the new key selector and `d` value to match the domain name in the new key file in section `@dkim_signature_options_bysender_maps` in file `99-dkim-keys`
6. restart amavis with `supervisorctl restart amavis`
7. test the config with `amavisd testkeys`. if the tests pass, thumbs up.
Sender Policy Framework (SPF) is defined in [RFC7208, Sender Policy Framework (SPF) for Authorizing Use of Domains in Email](https://datatracker.ietf.org/doc/html/rfc7208).
DNS SPF text record example:
``` text
IN TXT "v=spf1 mx a ip4:192.168.0.100 ip6:2001:ef3:2911::/64"
" a:mail.example.org a:mail2.example.org -all"
```
1. `v=spf1` Version attribute. only v1 available.
2. `mx` `a` DNS record type. This indicated that `mx` and `a` records within the domain are authorized senders.
3. `ip4:192.168.0.100` indicates that an ipv4 address as specified is authorized as a sender.
4. `ip6:2001:ef3:2911::/64` Sepcifies that an ipv6 subnet is authorized as a sender
5. `-all` specifies a fail if the sender doesn't match what is specified in the record. other valid qualifiers are "+" pass, "-" fail, "~" softfail, "?" neutral
!!! tip
To allow only specified MX DNS records to be the only specified senders, create a record as follows:
``` text
IN TXT "v=spf1 mx -all"
```
If your MX servers only receive mail, then this option is not suitable. you'll have to use the hostname of the receiving server.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
