====== CentOS7 安裝 iRedMail Mail Server ======
* 安裝環境 : ++CentOS Linux release 7.5.1804 (Core) |cat /etc/redhat-release
++
* iRedMail 0.9.8
* IP : 172.21.20.253
* DN : iredmail.ichiayi.com
* hostname : iredmail
===== 環境準備 =====
* 關閉 selinux
vi /etc/selinux/config
:
SELINUX=disabled
* 設定 /etc/sysconfig/network
HOSTNAME=iredmail.ichiayi.com
* 設定 /etc/hosts
127.0.0.1 iredmail.ichiayi.com iredmail localhost localhost.localdomain
* 設定 /etc/hostname
iredmail.ichiayi.com
* 重新開機
sync;sync;sync;reboot
===== 下載安裝 iRedMail =====
su - root
yum install wget bzip2
cd /root/
wget https://bitbucket.org/zhb/iredmail/downloads/iRedMail-0.9.9.tar.bz2
tar xjf iRedMail-0.9.9.tar.bz2
cd /root/iRedMail-0.9.9/
bash iRedMail.sh
* 安裝完成最後更新完成掃毒病毒碼 daily.cld 之後, 要重新開機所有服務才能正常啟動
sync;sync;sync;reboot
* 如果執行安裝時一直出現 /etc/hosts 的設定錯誤, 請先用 hostname -f
是否能夠正確出現標準 FQDN 格式 Exp. iredmai.ichiayi.com
* 如果是安裝在中國機房, 因為 iredmail.org 被 GFW 封鎖, 所以要改用以下語法
IREDMAIL_EPEL_MIRROR='http://mirrors.aliyun.com/epel'
IREDMAIL_MIRROR='https://dl.iredmail.org' bash iRedMail.sh
* 安裝完成後重要資訊會產生在 /root/iRedMail-0.9.8/iRedMail.tips 檔案內
===== 相關設定與驗證測試 =====
* DNS : MX / DKIM / [[http://blog.xuite.net/tolarku/blog/233356505-DNS+%E8%A8%AD%E5%AE%9A+spf+%E8%A8%98%E9%8C%84+-+Sender+Policy+Framework|SPF 設定]] / [[https://support.google.com/a/answer/2466563?hl=zh-Hant|DMARC]]
* 重新產生 DKIM key
* 參考 - https://docs.iredmail.org/sign.dkim.signature.for.new.domain.html ++ 操作語法|
amavisd -c /etc/amavisd/amavisd.conf genrsa /var/lib/dkim/mail3.ichiayi.com.pem
chown amavis:amavis /var/lib/dkim/mail3.ichiayi.com.pem
chmod 0400 /var/lib/dkim/mail.ichiayi.com.pem
vi /etc/amavisd/amavisd.conf
:
# Add dkim_key here.
dkim_key('mail3.ichiayi.com', 'dkim', '/var/lib/dkim/mail3.ichiayi.com.pem');
:
@dkim_signature_options_bysender_maps = ({
:
# catch-all (one dkim key for all domains)
'.' => {d => 'mail3.ichiayi.com',
:
systemctl restart amavisd
至 DNS 設定 DKIM Public Key
amavisd -c /etc/amavisd/amavisd.conf showkeys
Exp. dkim._domainkey.mail3.ichiayi.com
dkim._domainkey.mail3.ichiayi.com. 3600 TXT (
"v=DKIM1; p="
"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCrXC0tedP//DPy+CcC72g8lNw"
"8H9igOIphFtrvNKknJPKlKaxLP8cy41rWI91WHFS0jxPyJh39kzP7ueukUMDUE0d"
"veNPGOfYh32sdn5xNSYKg3l1HTj7wLIKsedN0E4aWbsBVwqAkgU3JJky7JzCc98R"
"G4wj6UPgbQVBKxtgNwIDAQAB")
++
* IP 反查設定 -> 找 ISP 協助
* 設定 aliases domain 的方式 - https://docs.iredmail.org/sql.add.alias.domain.html ++SQL 語法|
INSERT INTO alias_domain (alias_domain, target_domain) VALUES ('alias-1.com', 'example.com');
++
* 設定 aliases - mail list (虛擬信箱轉寄實際信箱) 的方式 - https://docs.iredmail.org/user.alias.address.html ++SQL 語法|
INSERT INTO forwardings (address, forwarding, domain, dest_domain, is_alias, active)
VALUES ('infotech@ichaiyi.com', 'tech1@ichiayi.com', 'ichiayi.com', 'ichiayi.com', 1, 1);
++
* 設定 aliases - mail forwarding (收信轉寄給其他信箱) 的方式 - https://docs.iredmail.org/sql.user.mail.forwarding.html ++SQL 語法|
INSERT INTO forwardings (address, forwarding, domain, dest_domain, is_forwarding, active)
VALUES ('jonathan@ichaiyi.com', 'jonathan-forward1@ichiayi.com', 'ichiayi.com', 'ichiayi.com', 1, 1);
++
* 設定多個 domain 的 DKIM - https://docs.iredmail.org/sign.dkim.signature.for.new.domain.html
* 設定預設 domain 的處理方式 - ++主要是修改 dovecot.conf 內的 auth_default_realm |
:
auth_default_realm = mail.ichiayi.com
:
++
* 解決 outlook 寄信無法使用 STARTTLS(port:587) 需要設定提供 SMTPS(port:465) - https://docs.iredmail.org/enable.smtps.html
* 調整限制附件大小設定
* 參考 - https://docs.iredmail.org/change.mail.attachment.size.html
* Exp. 20M => 20*1024*1024=20971520 因為 MIME 的編碼特性, 所以要再 * 1.5 會比較接近 => 20971520 * 1.5= 31457280
postconf -e message_size_limit=31457280
systemctl restart postfix
* 自動刪除 Trash 的信件方式
* 參考 - https://forum.iredmail.org/topic10062-iredmail-support-auto-delete-emails-in-users-trash.html
* ++建立清除信件命令|
#!/bin/bash
#
DOVEADM="/usr/bin/doveadm";
$DOVEADM expunge -A mailbox Trash savedbefore 3d
$DOVEADM expunge -A mailbox Junk savedbefore 30d
++
* ++執行命令|
chmod a+x /root/dovecot_expunge.sh
++
* ++設定 crontab 設定|
:
# delete iRedMail emails in Trash older than 3 days and in Junk older than 30 days.
30 3 * * * root /root/dovecot_expunge.sh > /tmp/dovecot_expunge.log
++
* ++重新啟動 crond |
service crond restart
++
* 特定 SMTP 認證帳號寄信可以不需要檢查 From 與 SMTP 認證帳號相同設定方式
* 出現的錯誤訊息類似:
SMTPRecipientsRefused: {'xxx@xxx': (554, '5.7.1 : Recipient address rejected: Sender is not same as SMTP authenticate username')}
* 參考 - https://docs.iredmail.org/errors.html#recipient-address-rejected-sender-is-not-same-as-smtp-authenticate-username
* 修改 /opt/iredapd/settings.py 最後加入以下設定 ++Exp. 增加 SMTP 的 sysop@ichiayi.com 認證就不需要檢查 From 是否一致 |
:
# https://docs.iredmail.org/errors.html#recipient-address-rejected-sender-is-not-same-as-smtp-authenticate-username
ALLOWED_LOGIN_MISMATCH_SENDERS = ['sysop@ichiayi.com']
++
* 重新啟動 iredapd 服務 systemctl restart iredapd
* 關閉 ClamAV 防毒軟體的作法 (2019/5/27 寄信附件含 PDF 會出現 Win.Exploit.CVE_2019_0903-6966169-0 誤判問題)
* 參考 - https://forum.iredmail.org/topic3149-iredmail-support-disable-clamav-and-turn-off.html
* 修改 /etc/amavisd/amavisd.conf ++ @bypass_virus_checks_maps 由 0 改成 1 關閉掃毒功能|
:
# controls running of anti-virus/spam code: 0 -> enabled, 1 -> disabled.
@bypass_virus_checks_maps = (1);
:
重新啟動 amavisd 服務
systemctl restart amavisd
++
==== 修改主機名稱的處理方式 ====
* 除修改 /etc/hosts 之外還有其他服務設定檔都要一起修改
* 參考 - https://docs.iredmail.org/change.server.hostname.html
* /etc/hosts
* /etc/sysconfig/network
* /var/spool/postfix/etc/hosts
* /etc/postfix/main.cf
* /etc/amavisd/amavisd.conf
==== SSL 憑證設定 ====
* 設定 SSL 憑證 : https://docs.iredmail.org/use.a.bought.ssl.certificate.html
* 取得免費的 LetsEncrypt ssl 憑證 參考 - [[tech/ssl_letsencrypt]]
* Exp. 取得的憑證存放在 /etc/letsencrypt/live/mail.ichiayi.com/
* 設定 Postfix (SMTP server) ++執行命令|
postconf -e smtpd_tls_cert_file='/etc/letsencrypt/live/mail.ichiayi.com/cert.pem'
postconf -e smtpd_tls_key_file='/etc/letsencrypt/live/mail.ichiayi.com/privkey.pem'
postconf -e smtpd_tls_CAfile='/etc/letsencrypt/live/mail.ichiayi.com/fullchain.pem'
systemctl restart postfix
++
* 設定 Dovecot (POP3/IMAP server) ++參考設定內容|
ssl = required
ssl_cert = ++ ++執行命令|
systemctl restart dovecot
++
* 設定 WebMail(nginx) ++參考執行命令|
cd /etc/pki/tls/
mv cert.pem cert.pem.old
ln -s /etc/letsencrypt/live/mail.ichiayi.com/fullchain.pem cert.pem
cd certs/
mv iRedMail.crt iRedMail.crt.old
ln -s /etc/letsencrypt/live/mail.ichiayi.com/cert.pem iRedMail.crt
cd ../private/
mv iRedMail.key iRedMail.key.old
ln -s /etc/letsencrypt/live/mail.ichiayi.com/privkey.pem iRedMail.key
service nginx restart
++
* 確認設定的 SSL 憑證有正式運作
* IMAP ++執行命令|
openssl s_client -showcerts -connect mail.ichiayi.com:993
++
* POP3 ++執行命令|
openssl s_client -showcerts -connect mail.ichiayi.com:995
++
* SMTP ++執行命令|
openssl s_client -showcerts -connect mail.ichiayi.com:587 -starttls smtp
++
* Web ++執行命令|
openssl s_client -showcerts -connect mail.ichiayi.com:443
++
* 如果 SSL 憑證與 Mail Server 在不同主機上, 每次憑證更新後可透過 rsync 方式來進行跨主機同步
* Exp. SSL 憑證存在 192.168.11.234 主機上, 可在 Mail Server ++執行以下的同步語法:|
rm -rf /etc/letsencrypt/archive/mail.ichiayi.com.old
mv /etc/letsencrypt/archive/mail.ichiayi.com /etc/letsencrypt/archive/mail.ichiayi.com.old
rsync -zavl root@192.168.11.234:/etc/letsencrypt/archive/mail.ichiayi.com/ /etc/letsencrypt/archive/mail.ichiayi.com/
rm -rf /etc/letsencrypt/live/mail.ichiayi.com.old
mv /etc/letsencrypt/live/mail.ichiayi.com /etc/letsencrypt/live/mail.ichiayi.com.old
rsync -zavl root@192.168.11.234:/etc/letsencrypt/live/mail.ichiayi.com/ /etc/letsencrypt/live/mail.ichiayi.com/
systemctl restart postfix
systemctl restart dovecot
++
==== 白名單與黑名單設定 ====
* 設定 greylisting 白名單的方式 - https://docs.iredmail.org/manage.iredapd.html#greylisting
- iredapd.greylisting_whitelist 資料表先增加白名單網域 Exp. ik2.com ++SQL 語法|
insert into iredapd.greylisting_whitelist_domains (domain) values ('ik2.com');
++
- 執行spf_to_greylist_whitelists.py 讓白名單生效 ++執行命令|
/opt/iredapd/tools/spf_to_greylist_whitelists.py
++
* 設定 spam 白名單與黑名單
* 參考網址 - https://docs.iredmail.org/amavisd.wblist.html
- 新增白名單: Exp. 來自 service@ichiayi.com 加入白名單 ++執行命令|
python /opt/iredapd/tools/wblist_admin.py --add --whitelist service@ichiayi.com
++
- 新增黑名單: Exp. 來自 ad@ichiayi.com 加入黑名單 ++執行命令|
python /opt/iredapd/tools/wblist_admin.py --add --blacklist ad@ichiayi.com
++
- 顯示目前設定的白名單與黑名單 ++執行命令|
python /opt/iredapd/tools/wblist_admin.py --list --whitelist
python /opt/iredapd/tools/wblist_admin.py --list --blacklist
++
* fail2ban 的白名單設定
* 參考 - https://www.ichiayi.com/wiki/tech/fail2ban_unban
* 參考 - https://forum.iredmail.org/topic10045-iredmail-support-solved-fail2ban-problems.html
* 將要列入的 IP 寫在 /etc/fail2ban/jail.local 內的 ignoreip = 後面 ++看範例.|
:
maxretry = 5
ignoreip = 127.0.0.1 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 60.248.245.172/32
++
* 重新載入設定 ++執行命令|service fail2ban reload
++
===== 郵件移轉 (imapsync) =====
* 是透過新舊 Mail Server 的 imap 協定來將舊 Mail Server 內的信件移轉至新 Mail Server 內
* 安裝 imapsync
yum install imapsync
* 假設要移轉 jonathan 的信件, 要知道新舊主機 jonathan 的密碼, 將密碼寫入 /root/sync_info/jonathan 檔案內, 然後執行以下的語法
imapsync --host1 mail.ichiayi.com --user1 jonathan --passfile1 /root/sync_info/jonathan --host2 192.168.11.236 --user2 jonathan --passfile2 /root/sync_info/jonathan
* 執行後, 會在執行目錄底下產生 LOG_imapsync 目錄, 裡面會有執行過程的紀錄檔案 Exp. 2018_09_07_11_35_30_testalbert.txt
* 記錄檔內出現 Err 的項目表示同步時出現異常的信件匣, 需要另外處理 Exp.
Err 1/2: Could not create folder [from Albert/&ZbBbomI2--Data/INDIA/ABC.] from [from Albert/&ZbBbomI2--Data/INDIA/ABC.]: 38252 NO [CANNOT] Character not allowed in mailbox name: '.' (0.001 + 0.000 secs).
:
===== 更新版本程序 =====
* 參考 - https://docs.iredmail.org/iredmail.releases.html
* Exp. 目前版本是 0.9.8 預計更新到最新版 0.9.9 -> 參考 https://docs.iredmail.org/upgrade.iredmail.0.9.8-0.9.9.html
- Upgrade iRedAPD -> 5.0.2 - https://docs.iredmail.org/upgrade.iredapd.html
su - root
mkdir -p 0.9.9
cd 0.9.9
wget -O iRedAPD-5.0.2.tar.gz https://github.com/iredmail/iRedAPD/archive/5.0.2.tar.gz
tar zxf iRedAPD-5.0.2.tar.gz
cd iRedAPD-5.0.2/tools/
bash upgrade_iredapd.sh
查看更新紀錄tail -500 /var/log/iredapd/iredapd.log
- Upgrade iRedAdmin -> 1.3 - https://docs.iredmail.org/migrate.or.upgrade.iredadmin.html
cd /root/0.9.9
wget https://dl.iredmail.org/yum/misc/iRedAdmin-1.3.tar.gz
tar zxvf iRedAdmin-1.3.tar.gz
cd iRedAdmin-1.3/tools/
bash upgrade_iredadmin.sh
- Upgrade mlmmjadmin -> 3.1.2 - https://docs.iredmail.org/upgrade.mlmmjadmin.html
cd /root/0.9.9
wget https://github.com/iredmail/mlmmjadmin/archive/3.1.2.tar.gz
tar zxf 3.1.2.tar.gz
cd mlmmjadmin-3.1.2/tools/
bash upgrade_mlmmjadmin.sh
- Upgrade Roundcube webmail -> 1.4.11 - https://github.com/roundcube/roundcubemail/wiki/Upgrade
cd /root/0.9.9
wget https://github.com/roundcube/roundcubemail/releases/download/1.4.11/roundcubemail-1.4.11-complete.tar.gz
tar xf roundcubemail-*.tar.gz
cd roundcubemail-*
bin/installto.sh /var/www/roundcubemail
如果無法執行 /bin/installto.sh 可能要檢查 /etc/php.ini 內是否關閉 system 的命令使用
- Upgrade netdata -> 1.12.0 - https://docs.iredmail.org/upgrade.netdata.html
wget https://github.com/netdata/netdata/releases/download/v1.12.0/netdata-v1.12.0.gz.run
chmod +x netdata-*.gz.run
./netdata-*.gz.run --accept
- Fix improper Nginx config files for Roundcube
vi /etc/nginx/templates/roundcube.tmpl
:
location ~ ^/mail/(bin|config|installer|logs|SQL|temp|vendor)($|/.*) { deny all; }
:
location ~ ^/mail/(CHANGELOG|composer.json|INSTALL|jsdeps.json|LICENSE|README|UPGRADING)($|.*) { deny all; }
:
location ~ ^/mail/plugins/.*/config.inc.php.* { deny all; }
:
location ~ ^/mail/plugins/enigma/home($|/.*) { deny all; }
:
vi /etc/nginx/templates/roundcube-subdomain.tmpl
:
location ~ ^/(bin|config|installer|logs|SQL|temp|vendor)/.* { deny all; }
:
location ~ ^/(CHANGELOG|composer.json|INSTALL|jsdeps.json|LICENSE|README|UPGRADING)$ { deny all; }
:
location ~ ^/plugins/.*/config.inc.php.* { deny all; }
:
location ~ ^/plugins/enigma/home($|/.*) { deny all; }
:
- Improve mlmmj script used for appending footer text
cd /usr/bin/
wget -O mlmmj-amime-receive https://raw.githubusercontent.com/iredmail/iRedMail/master/samples/mlmmj/mlmmj-amime-receive
chown mlmmj:mlmmj mlmmj-amime-receive
chmod 0550 mlmmj-amime-receive
- Fix address mapping issue for mlmmj mailing list
vi /etc/amavisd/amavisd.conf
:
$policy_bank{'MLMMJ'} = {
...
forward_method => 'smtp:[127.0.0.1]:10028',
};
:
vi /etc/postfix/master.cf
:
127.0.0.1:10028 inet n - n - - smtpd
-o syslog_name=postfix/10028
-o content_filter=
-o mynetworks_style=host
-o mynetworks=127.0.0.1
-o local_recipient_maps=
-o relay_recipient_maps=
-o strict_rfc821_envelopes=yes
-o smtp_tls_security_level=none
-o smtpd_tls_security_level=none
-o smtpd_restriction_classes=
-o smtpd_delay_reject=no
-o smtpd_client_restrictions=permit_mynetworks,reject
-o smtpd_helo_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,reject
-o smtpd_end_of_data_restrictions=
-o smtpd_error_sleep_time=0
-o smtpd_soft_error_limit=1001
-o smtpd_hard_error_limit=1000
-o smtpd_client_connection_count_limit=0
-o smtpd_client_connection_rate_limit=0
-o receive_override_options=no_header_body_checks,no_unknown_recipient_checks
systemctl restart postfix
systemctl restart amavisd
- Fixed: SOGo backup script ((如果安裝時有更改目錄 Exp. /maildata/backup, 就依照更改的目錄執行))
cd /var/vmail/backup/
wget -O backup_sogo.sh https://raw.githubusercontent.com/iredmail/iRedMail/master/tools/backup_sogo.sh
chown root backup_sogo.sh
chmod 0400 backup_sogo.sh
- MySQL/MariaDB special
- SQL structure changes in vmail database
cd /root/0.9.9
wget -O iredmail.mysql https://raw.githubusercontent.com/iredmail/iRedMail/master/update/0.9.9/iredmail.mysql
mysql vmail < iredmail.mysql
- Dovecot: read mailbox format from SQL
vi /etc/dovecot/dovecot-mysql.conf
:
user_query = SELECT \
...
LOWER(CONCAT(mailbox.storagebasedirectory, '/', mailbox.storagenode, '/', mailbox.maildir)) AS home, \
CONCAT(mailbox.mailboxformat, ':~/', mailbox.mailboxfolder, '/') AS mail, \
...
:
systemctl restart dovecot
- 更新 /etc/iredmail-release 內容為 0.9.9
vi /etc/iredmail-release
0.9.9
#0.9.8 MARIADB edition.
:
===== 其他議題 =====
==== 關閉 netdata ====
* 如要移除請參考 - https://forum.iredmail.org/topic15606-how-to-removeuninstall-netdata.html
* 關閉的語法
systemctl stop netdata
systemctl disable netdata
==== 關閉 SPF 的方式 ====
* 參考 - https://forum.iredmail.org/topic2699-iredmail-support-how-to-remove-or-disable-spf-andor-dkim.html
* 關閉的語法
vi /etc/mail/spamassassin/init.pre
:
#loadplugin Mail::SpamAssassin::Plugin::SPF
:
systemctl restart amavisd
==== 出現 postfix/amavis/smtp[6831]: connect to 127.0.0.1[127.0.0.1]:10024: Connection refused 問題 ====
* 2020/08 之後開始出現這問題, 快速解決方式是將 amavisd 服務啟動
systemctl start amavisd
systemctl enable amavisd
==== 忘記 iRedAdmin 登入的管理者密碼處理方式 ====
* 可以直接透過資料庫加上一位現有的信箱用戶當管理者 Exp. jonathan@ichiayi.com
* 登入 iRedMail 的資料庫
mysql -u root -p
USE vmail;
select isadmin,isglobaladmin from mailbox where username = 'jonathan@ichiayi.com';
UPDATE mailbox SET isadmin=1, isglobaladmin=1 WHERE username = 'jonathan@ichiayi.com';
INSERT INTO domain_admins (username, domain) VALUES ('jonathan@ichiayi.com', 'ALL');
* 看詳細過程
mysql -u root -p
MariaDB [(none)]> USE vmail;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Database changed
MariaDB [vmail]> select isadmin,isglobaladmin from mailbox where username = 'jonathan@ichiayi.com';
+---------+---------------+
| isadmin | isglobaladmin |
+---------+---------------+
| 0 | 0 |
+---------+---------------+
1 row in set (0.00 sec)
MariaDB [vmail]> UPDATE mailbox SET isadmin=1, isglobaladmin=1 WHERE username = 'jonathan@ichiayi.com';
Query OK, 1 row affected (0.00 sec)
Rows matched: 1 Changed: 1 Warnings: 0
MariaDB [vmail]> INSERT INTO domain_admins (username, domain) VALUES ('jonathan@ichiayi.com', 'ALL');
Query OK, 1 row affected (0.00 sec)
MariaDB [vmail]> exit
Bye
* 使用這位帳號密碼登入 iRedAdmin 就可以進行 Web 的管理
===== 備份與還原 =====
===== 參考網址 =====
* https://docs.iredmail.org/install.iredmail.on.rhel.html
* https://www.iredmail.org/download.html
* https://www.digitalocean.com/community/questions/setting-up-iredmail-with-digital-ocean
* https://serverfault.com/questions/853102/nginx-could-not-build-map-hash-you-should-increase-map-hash-bucket-size-64
* https://www.howtoforge.com/community/threads/postfix-554-relay-access-denied.55720/
* https://www.howtoforge.com/postfix-do-not-list-domain-example.com-in-both-mydestination-and-virtual_mailbox_domains#error-postfix-do-not-list-domain-examplecom-in-both-mydestination-and-virtualmailboxdomains
* http://blog.xuite.net/tolarku/blog/233356505-DNS+%E8%A8%AD%E5%AE%9A+spf+%E8%A8%98%E9%8C%84+-+Sender+Policy+Framework
* https://forum.iredmail.org/topic4097-iredmail-support-change-default-login-domain.html
* https://support.plesk.com/hc/en-us/articles/213961665-How-to-verify-that-SSL-for-IMAP-POP3-SMTP-works-and-the-proper-certificate-is-installed-using-Linux
* https://forum.iredmail.org/topic11159-iredmail-support-how-to-reset-the-postmaster-password-for-iredadmin.html
{{tag>mail}}