postfix

sudo apt update
sudo DEBIAN_PRIORITY=low apt install postfix

sudo dpkg-reconfigure postfix

sudo postconf -e 'home_mailbox= Maildir/'
sudo postconf -e 'masquerade_domains=homdy.ru'

sudo postconf -e 'virtual_alias_maps= hash:/etc/postfix/virtual'

sudo nano /etc/postfix/virtual

contact@example.com root
admin@example.com root

contact@homdy.ru root
admin@homdy.ru root
support@homdy.ru root

sudo postmap /etc/postfix/virtual

sudo systemctl restart postfix

sudo ufw allow Postfix

echo "This is test email" | mail -s "test subject" support@homdy.ru

echo 'export MAIL=~/Maildir' | sudo tee -a /etc/bash.bashrc | sudo tee -a /etc/profile.d/mail.sh

cat ~/test_message | s-nail -s 'Test email subject line' -r contact@example.com user@email.com

$ s-nail
? file +sent

nano /etc/aliases

# See man 5 aliases for format
postmaster:    root
root:          your_email_address

sudo newaliases

apt install certbot
ufw allow 80
certbot certonly --nginx --rsa-key-size 4096 --agree-tos --preferred-challenges http -d your_domain
tree /etc/letsencrypt/

sudo certbot --nginx --agree-tos --redirect --hsts --staple-ocsp --email you@example.com -d postfixadmin.example.com

sudo certbot --nginx --agree-tos --redirect --hsts --staple-ocsp --email support@homdy.ru -d e.mail.homdy.ru
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator nginx, Installer nginx
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for pa.mail.homdy.ru
Waiting for verification...
Cleaning up challenges
Deploying Certificate to VirtualHost /etc/nginx/sites-enabled/mail-pa
Redirecting all traffic on port 80 to ssl in /etc/nginx/sites-enabled/mail-pa

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Congratulations! You have successfully enabled https://pa.mail.homdy.ru

You should test your configuration at:
https://www.ssllabs.com/ssltest/analyze.html?d=pa.mail.homdy.ru
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/pa.mail.homdy.ru/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/pa.mail.homdy.ru/privkey.pem
   Your cert will expire on 2025-04-19. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot again
   with the "certonly" option. To non-interactively renew *all* of
   your certificates, run "certbot renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

sudo certbot --nginx --agree-tos --redirect --hsts --staple-ocsp --email support@homdy.ru -d pa.mail.homdy.ru
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator nginx, Installer nginx
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for e.mail.homdy.ru
Waiting for verification...
Cleaning up challenges
Deploying Certificate to VirtualHost /etc/nginx/sites-enabled/mail-pa
Redirecting all traffic on port 80 to ssl in /etc/nginx/sites-enabled/mail-pa

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Congratulations! You have successfully enabled https://e.mail.homdy.ru

You should test your configuration at:
https://www.ssllabs.com/ssltest/analyze.html?d=e.mail.homdy.ru
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/e.mail.homdy.ru/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/e.mail.homdy.ru/privkey.pem
   Your cert will expire on 2025-04-19. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot again
   with the "certonly" option. To non-interactively renew *all* of
   your certificates, run "certbot renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

# TLS parameters
smtpd_tls_cert_file=/etc/letsencrypt/live/your_domain/fullchain.pem
smtpd_tls_key_file=/etc/letsencrypt/live/your_domain/privkey.pem

systemctl restart postfix

telnet gmail-smtp-in.l.google.com 25
Trying 74.125.200.27...
Connected to gmail-smtp-in.l.google.com.
Escape character is '^]'.
220 mx.google.com ESMTP k12si849250plk.430 - gsmtp

apt-get install mailutils
echo "I'm sending this email using the amazing postman" | mail -s "Testing My Mail Server" home_work_mail@mail.ru

# ctrl+D for send
mail home_work_mail@mail.ru
Cc: 
Subject: Testing My Mail Server
I'm sending this email using the amazing postman

mail username@gmail.com
Cc: 
Subject: Testing My Postfix Mail Server
I'm sending this email using the postfix mail server from Ubuntu machine

root@95-163-235-44:~# hostnamectl
   Static hostname: homdy.ru
Transient hostname: 95-163-235-44.cloudvps.regruhosting.ru
         Icon name: computer-vm
           Chassis: vm
        Machine ID: 54132cf7fac4423eaf755f37854a7c4e
           Boot ID: 35dc0f28dcbf4b7cbbc18f7a4dc0accd
    Virtualization: kvm
  Operating System: Ubuntu 20.04.5 LTS
            Kernel: Linux 5.4.0-132-generic
      Architecture: x86-64

sudo hostnamectl set-hostname host.example.com
sudo hostnamectl set-hostname "Your Pretty HostName" --pretty
sudo hostnamectl set-hostname host.example.com --static
sudo hostnamectl set-hostname host.example.com --transient
sudo hostnamectl set-hostname homdy.ru --transient

sudo apt install certbot
sudo ufw allow 80
sudo certbot certonly --standalone --rsa-key-size 4096 --agree-tos --preferred-challenges http -d your_domain
sudo certbot certonly --standalone --rsa-key-size 4096 --agree-tos --preferred-challenges http -d homdy.ru
sudo certbot certonly --standalone --rsa-key-size 4096 --agree-tos --preferred-challenges http -d your_domain


certbot certonly --nginx --rsa-key-size 4096 --agree-tos --preferred-challenges http -d homdy.ru

# update an SSL certificate on digital ocean with the command 
certbot renew
--apache          Use the Apache plugin for authentication & installation
--standalone      Run a standalone webserver for authentication
--nginx           Use the Nginx plugin for authentication & installation
--webroot         Place files in a server's webroot folder for authentication
--manual          Obtain certificates interactively, or using shell script hooks

# +short компактный вывод
dig +short homdy.ru mx

ctrl-g      help

alt-a       start select
ctrl-6      end select
alt-6       copy selected
ctrl-k      cut selected
ctrl-u      paste copied

ctrl-o      save
ctrl-x      exit

nano /etc/postfix/main.cf

mydestination = localhost.$mydomain, localhost, localhost.localdomain
...
inet_protocols = ipv4
...
smtpd_tls_cert_file = /etc/ssl/mail/public.pem
smtpd_tls_key_file = /etc/ssl/mail/private.key

myhostname = mx01.dmosk.ru

virtual_mailbox_base = /var/mail
virtual_alias_maps = proxy:mysql:/etc/postfix/mysql_virtual_alias_maps.cf
virtual_mailbox_domains = proxy:mysql:/etc/postfix/mysql_virtual_domains_maps.cf
virtual_mailbox_maps = proxy:mysql:/etc/postfix/mysql_virtual_mailbox_maps.cf
virtual_minimum_uid = 1024
virtual_uid_maps = static:1024
virtual_gid_maps = static:1024
virtual_transport = dovecot
dovecot_destination_recipient_limit = 1

smtpd_sasl_auth_enable = yes
smtpd_sasl_exceptions_networks = $mynetworks
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth

smtp_use_tls = yes
smtpd_use_tls = yes
smtpd_tls_auth_only = yes
smtpd_helo_required = yes

mysql -u root -p

CREATE DATABASE postfix DEFAULT CHARACTER SET utf8 DEFAULT COLLATE utf8_general_ci;
CREATE USER 'postfix'@'localhost' IDENTIFIED BY 'postfix123';
GRANT ALL ON postfix.* TO 'postfix'@'localhost';
quit

apt-get install postfix dovecot-core dovecot-imapd postgresql postfix-pgsql dovecot-lmtpd dovecot-pgsql

sudo ufw allow 80
sudo ufw allow 25

iptables -I INPUT -p tcp --match multiport --dports 25,465,587 -j ACCEPT
iptables -I INPUT -p tcp --match multiport --dports 143,993 -j ACCEPT
iptables -I INPUT -p tcp --match multiport --dports 80,443 -j ACCEPT

iptables -I INPUT -p tcp --match multiport --dports 110,995 -j ACCEPT

netstat -nltp | grep dovecot
netstat -nltp
ps aux | grep dovecot
ss -tulw
netstat -tulpn

25 — стандартный SMTP;
143 — стандартный IMAP (назащищенный или через STARTTLS);
465 — защищенный SMTP через SSL/TLS;
587 — защищенный SMTP через STARTTLS;
993 — защищенный IMAP через SSL/TLS;
80 — HTTP для порталов Postfixadmin и Roundcube;
443 — защищенный HTTPS для порталов Postfixadmin и Roundcube;

110 — стандартный POP3 (назащищенный или через STARTTLS);
995 — защищенный POP3 через SSL/TLS.

# pop
995
starttls
nickname
hosting

# smtp
25
ssl/tls
nickname
hosting

# postmap /etc/postfix/transport
postmap /etc/postfix/virtual
systemctl restart postfix

apt-get install postfix-pgsql

nano /etc/postfix/main.cf

virtual_mailbox_domains = proxy:pgsql:/etc/postfix/pgsql/virtual_domains_maps.cf
virtual_mailbox_maps = proxy:pgsql:/etc/postfix/pgsql/virtual_mailbox_maps.cf
virtual_alias_maps = proxy:pgsql:/etc/postfix/pgsql/virtual_alias_maps.cf
relay_domains = $mydestination, proxy:pgsql:/etc/postfix/pgsql/relay_domains.cf

# Where:
# virtual_mailbox_domains points to a file that will tell Postfix how to look up domain information from the database.
# virtual_mailbox_maps points to files that will tell Postfix how to look up email addresses from the database.
# virtual_alias_maps points to files that will tell Postfix how to look up aliases from the database.

virtual_transport = lmtp:unix:private/dovecot-lmtp


mkdir -p /etc/postfix/pgsql/

nano /etc/postfix/pgsql/virtual_domains_maps.cf
user = postfixadmin
password = postfixadmin_password
hosts = localhost
dbname = postfixadmin
#query = SELECT domain FROM domain WHERE domain='%s' AND active = true
#optional query to use when relaying for backup MX
query = SELECT domain FROM domain WHERE domain='%s' and backupmx = false and active = true


nano /etc/postfix/pgsql/virtual_mailbox_maps.cf
user = postfixadmin
password = postfixadmin_password
hosts = localhost
dbname = postfixadmin
query = SELECT maildir FROM mailbox WHERE username='%s' AND active = true


nano /etc/postfix/pgsql/virtual_alias_maps.cf
user = postfixadmin
password = postfixadmin_password
hosts = localhost
dbname = postfixadmin
query = SELECT goto FROM alias WHERE address='%s' AND active = true


nano /etc/postfix/pgsql/relay_domains.cf
user = postfixadmin
password = postfixadmin_password
hosts = localhost
dbname = postfixadmin
query = SELECT domain FROM domain WHERE domain='%s' and backupmx = true

==============================

nano /etc/postfix/pgsql/virtual_domains_maps.cf
user = postfix
password = 'tgr5%&&5rfUIO)(imu98%T$66tvcfE*()%^HK)(JGH)'
hosts = localhost
dbname = postfix
#query = SELECT domain FROM domain WHERE domain='%s' AND active = true
#optional query to use when relaying for backup MX
query = SELECT domain FROM domain WHERE domain='%s' and backupmx = false and active = true


nano /etc/postfix/pgsql/virtual_mailbox_maps.cf
user = postfix
password = 'tgr5%&&5rfUIO)(imu98%T$66tvcfE*()%^HK)(JGH)'
hosts = localhost
dbname = postfix
query = SELECT maildir FROM mailbox WHERE username='%s' AND active = true


nano /etc/postfix/pgsql/virtual_alias_maps.cf
user = postfix
password = 'tgr5%&&5rfUIO)(imu98%T$66tvcfE*()%^HK)(JGH)'
hosts = localhost
dbname = postfix
query = SELECT goto FROM alias WHERE address='%s' AND active = true


nano /etc/postfix/pgsql/relay_domains.cf
user = postfix
password = 'tgr5%&&5rfUIO)(imu98%T$66tvcfE*()%^HK)(JGH)'
hosts = localhost
dbname = postfix
query = SELECT domain FROM domain WHERE domain='%s' and backupmx = true


==============================
==============================


sudo chmod 0640 /etc/postfix/pgsql/*
sudo setfacl -R -m u:postfix:rx /etc/postfix/pgsql/

sudo postconf mydestination
# mydestination = $myhostname, linuxbabe.com, localhost.$mydomain, localhost

postconf -e "mydestination = \$myhostname, localhost.\$mydomain, localhost"

nano /etc/postfix/main.cf
virtual_mailbox_base = /var/vmail
virtual_minimum_uid = 2000
virtual_uid_maps = static:2000
virtual_gid_maps = static:2000

systemctl restart postfix

adduser vmail --system --group --uid 2000 --disabled-login --no-create-home
mkdir -p /var/vmail/
chown vmail:vmail /var/vmail/ -R

apt-get install dovecot-pgsql

nano /etc/dovecot/conf.d/10-mail.conf
# mail_location = maildir:~/Maildir
mail_home = /var/vmail/%d/%n/


nano /etc/dovecot/conf.d/10-auth.conf
# auth_username_format = %n
auth_username_format = %u

auth_default_realm = example.com
!include auth-sql.conf.ext
#!include auth-system.conf.ext

auth_debug = yes
auth_debug_passwords = yes
## /var/log/mail.log


nano /etc/dovecot/dovecot-sql.conf.ext
driver = pgsql
connect = host=localhost dbname=postfixadmin user=postfixadmin password=postfixadmin_assword
default_pass_scheme = ARGON2I
password_query = SELECT username AS user,password FROM mailbox WHERE username = '%u' AND active = true
user_query = SELECT maildir, 2000 AS uid, 2000 AS gid FROM mailbox WHERE username = '%u' AND active = true
iterate_query = SELECT username AS user FROM mailbox

systemctl restart dovecot

==============================

nano /etc/dovecot/dovecot-sql.conf.ext
driver = pgsql
connect = host=localhost dbname=postfix user=postfix password='tgr5%&&5rfUIO)(imu98%T$66tvcfE*()%^HK)(JGH)'
default_pass_scheme = ARGON2I
password_query = SELECT username AS user,password FROM mailbox WHERE username = '%u' AND active = true
user_query = SELECT maildir, 2000 AS uid, 2000 AS gid FROM mailbox WHERE username = '%u' AND active = true
iterate_query = SELECT username AS user FROM mailbox

systemctl restart dovecot

nano /etc/postfix/main.cf

ss -lnpt

sudo apt install dovecot-lmtpd
sudo nano /etc/dovecot/dovecot.conf
protocols = imap lmtp
sudo nano /etc/dovecot/conf.d/10-master.conf
service lmtp {
 unix_listener /var/spool/postfix/private/dovecot-lmtp {
   mode = 0600
   user = postfix
   group = postfix
  }
}