Virtual user mail system with Postfix, Dovecot and Roundcube

From ArchWiki
Revision as of 21:42, 4 January 2011 by Boyska (talk | contribs) (expansion required on db)
Jump to navigation Jump to search

This template has only maintenance purposes. For linking to local translations please use interlanguage links, see Help:i18n#Interlanguage links.

Local languages: Català – Dansk – English – Español – Esperanto – Hrvatski – Indonesia – Italiano – Lietuviškai – Magyar – Nederlands – Norsk Bokmål – Polski – Português – Slovenský – Česky – Ελληνικά – Български – Русский – Српски – Українська – עברית – العربية – ไทย – 日本語 – 正體中文 – 简体中文 – 한국어

External languages (all articles in these languages should be moved to the external wiki): Deutsch – Français – Română – Suomi – Svenska – Tiếng Việt – Türkçe – فارسی

This article describes how to set up a complete virtual user mail system on an Arch Linux system in the simplest manner possible. However, since a mail system consists of many complex components, quite a bit of configuration will still be necessary. Roughly, the components used in this article are Postfix, Cyrus, Courier, PAM, PostfixAdmin and Roundcube.

In the end, the provided solution will allow you to use the best currently available security mechanisms, you will be able to send mails using SMTP and SMTPS and receive mails using POP3, POP3S, IMAP and IMAPS. Additionally, configuration will be easy thanks to PostfixAdmin and users will be able to login using Roundcube. What a deal!

This article assumes that you have a working LAMP setup as we will need a working Apache2 as well as MYSQL database. Of course, with a few changes to these instructions you could easily use another httpd and database. For the purposes of this tutorial, however, the choice made above will be used. Additionally, the article assumes all-default settings for every package installed below. No changes except for those mentioned will be required.

Should any unforeseen problems occur, feel free to use the discussion page to voice your problems and I will try to answer.


# pacman -S postfix courier-imap cyrus-sasl cyrus-sasl-plugins pam_mysql



For security reasons, a new user should be created to store the mails:

groupadd -g 5000 vmail
useradd -u 5000 -g vmail -s /sbin/nologin -d /home/vmail -m vmail

A gid and uid of 5000 is used in both cases so that we do not run into conflicts with regular users. All your mail will then be stored in /home/vmail. You could change the home dir to something like /var/mail/vmail but careful to change this in any configuration below as well.


Tango-view-fullscreen.pngThis article or section needs expansion.Tango-view-fullscreen.png

Reason: please use the first argument of the template to provide a brief explanation. (Discuss in Talk:Virtual user mail system with Postfix, Dovecot and Roundcube#)

You will need to create an empty database and corresponding user. We will be using PostfixAdmin's tables to fill the database later on. In this article, postfix_user will have read/write access to postfix_db using hunter2 for a password. You are expected to create your database and user yourself. Make sure to assign proper permissions.


To Template:Filename append:

relay_domains = *
virtual_alias_maps = proxy:mysql:/etc/postfix/
virtual_mailbox_domains = proxy:mysql:/etc/postfix/
virtual_mailbox_maps = proxy:mysql:/etc/postfix/
virtual_mailbox_base = /home/vmail
virtual_mailbox_limit = 512000000
virtual_minimum_uid = 5000
virtual_transport = virtual
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000
local_transport = virtual
local_recipient_maps = $virtual_mailbox_maps
transport_maps = hash:/etc/postfix/transport

smtpd_sasl_auth_enable = yes
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_sasl_security_options = noanonymous
smtpd_sasl_tls_security_options = $smtpd_sasl_security_options
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /etc/ssl/certs/server.crt
smtpd_tls_key_file = /etc/ssl/private/server.key
smtpd_sasl_local_domain = $mydomain
broken_sasl_auth_clients = yes
smtpd_tls_loglevel = 1

This references a lot of files that don't even exist yet. Let's create them.

Edit Template:Filename as new and add:

user = postfix_user
password = hunter2
hosts = localhost
dbname = postfix_db
query = SELECT goto FROM alias WHERE address='%s' AND active = true

Edit Template:Filename as new and add:

user = postfix_user
password = hunter2
hosts = localhost
dbname = postfix_db
query = SELECT domain FROM domain WHERE domain='%s' and backupmx = false and active = true

Edit Template:Filename as new and add:

user = postfix_user
password = hunter2
hosts = localhost
dbname = postfix_db
query = SELECT quota FROM mailbox WHERE username='%s'

Edit Template:Filename as new and add:

user = postfix_user
password = hunter2
hosts = localhost
dbname = postfix_db
query = SELECT maildir FROM mailbox WHERE username='%s' AND active = true

Run postmap on transport to generate its db:

postmap /etc/postfix/transport

We still need the SSL cert and private key:

cd /etc/ssl/certs
openssl req -new -x509 -newkey rsa:1024 -days 365 -keyout server.key -out server.crt
openssl rsa -in server.key -out server.key
chown nobody:nobody server.key
chmod 600 server.key
mv server.key /etc/ssl/private/


In Template:Filename make sure that authmodulelist only contains authmysql:


Next, we need to configure the field names used by PostfixAdmin in Template:Filename. Search and replace values provided here. Uncomment commented entries if necessary:

MYSQL_HOST          localhost
MYSQL_PORT          3306
MYSQL_USERNAME      postfix_user
MYSQL_PASSWORD      hunter2
MYSQL_DATABASE      postfix_db
MYSQL_HOME_FIELD    "/home/vmail"

Edit the [ reg_dn } part in Template:Filename and Template:Filename to correctly state your mail server's location. E.g.:

[ req_dn ]
O=Courier Mail Server
OU=Automatically-generated IMAP SSL key

Next, generate the certificates and move them into position:

mv /usr/share/imapd.pem /etc/courier-imap/
mv /usr/share/pop3.pem /etc/courier-imap/


Firstly, edit Template:Filename and add

smtps          465/tcp   # Secure Simple Mail Transfer
smtps          465/udp   # Secure Simple Mail Transfer

to it.

Contents of Template:Filename should be:

auth required /lib/security/ user=postfix_user passwd=hunter2 host=localhost db=postfix_db table=mailbox usercolumn=username passwdcolumn=password crypt=1
account sufficient /lib/security/ user=postfix_user passwd=hunter2 host=localhost db=postfix_db table=mailbox usercolumn=username passwdcolumn=password crypt=1

Modify Template:Filename to say:

SASLAUTHD_OPTS="-m /var/run/saslauthd -r -a pam"

Finally, Template:Filename should have:

pwcheck_method: saslauthd
mech_list: plain login
saslauthd_path: /var/run/saslauthd/mux
log_level: 7


To install PostfixAdmin, we need to manually get its upstream package and extract it to our web root (or other desired directory). You should use the most recent version available at the time. This article will use the most recent version at the time of writing.

cd /srv/http/
tar xzf postfixadmin-2.3.2.tar.gz
cd postfixadmin-2.3.2

Next, PostfixAdmin needs to be configured. Assuming localhost is the hostname of the machine you are installing this on, navigate to http://localhost/postfixadmin-2.3.2/setup.php. The setup will guide you through the remaining steps to set up PostfixAdmin.


As with PostfixAdmin, this article will use the most recent version as of the time of writing. You should always use the most recent version available.

cd /srv/http/
tar xzf roundcubemail-0.4.tar.gz
cd roundcubemail-0.4

Make some directories writable by the webserver:

chown -R http:http temp logs

Assuming that localhost is your current host, navigate a browser to http://localhost/roundcubemail-0.4/installer/ and follow the instructions. You could use the same database for Roundcube that you already used for PostfixAdmin though you shouldn't. For a proper setup, create a second database "roundcube_db" and a "roundcube_user" for use with Roundcube.

While running the installer, make sure to address the IMAP host with tls://localhost/ instead of just localhost. Use port 993. Likewise with SMTP, make sure to provide ssl://localhost/ on port 465.


The services should be restarted in the correct order on system restart. Make sure your DAEMONS array in Template:Filename contains:

DAEMONS=( ... fam saslauthd postfix authdaemond courier-imap ... )

Make sure to keep this order.

Fire it up

Since now hopefully everything is set up correctly, all necessary daemon should be started for a test run:

for daemon in fam saslauthd postfix authdaemond courier-imap; do /etc/rc.d/$daemon start; done

The order in which the daemons are started up is actually important here.

As a final bit of configuration, Postfix needs to be able to write to saslauth. Thus:

chown postfix:postfix /var/run/saslauthd

Now for testing purposes, create a domain and mail account in PostfixAdmin. Try to login to this account using Roundcube. Now send yourself a mail.

See also