101 lines
2.9 KiB
Markdown
101 lines
2.9 KiB
Markdown
# mailserver - Mail Server mail.nbit.ch
|
|
|
|
Als Grundlage soll https://thomas-leister.de/mailserver-debian-buster/ dienen,
|
|
jedoch verwenden wir CentOS 8.
|
|
|
|
Code zum Erstellen des Servers
|
|
|
|
Spezifikaktion:
|
|
- CentOS 8
|
|
- Hetzner Cloud Server
|
|
- mailcow (Docker-basiert)
|
|
|
|
## Erstellen des Servers
|
|
|
|
Mit dem Binary hcloud von:
|
|
https://github.com/hetznercloud/cli
|
|
|
|
Temporaer einen API Key erstellen (nachher wieder loeschen)
|
|
|
|
$ hcloud context create nbit.ch
|
|
$ hcloud image list # zeigt moegliche Images
|
|
$ hcloud server-type list # zeigt moegliche Typen
|
|
|
|
$ hcloud server create --name mail --image centos-8 --type cx21 --ssh-key joerg@cinnamon.nbit.ch
|
|
$ hcloud server set-rdns mail --hostname mail.nbit.ch
|
|
$ IPV6="$(hcloud server ip mail -6)"
|
|
$ hcloud server set-rdns mail --ip $IPV6 --hostname mail.nbit.ch
|
|
|
|
DNS Eintraege erstellen:
|
|
$ hcloud server ip mail
|
|
$ hcloud server ip mail -6
|
|
|
|
Root-Passwort setzen (das machen wir von Hand)
|
|
|
|
## Ansible Playbook laufen lassen
|
|
|
|
$ cd ansible
|
|
$ ansible-playbook -i production mailserver.yml
|
|
|
|
|
|
## Zertifikate erzeugen
|
|
|
|
# systemctl stop nginx
|
|
# certbot certonly --noninteractive --standalone --agree-tos -m postmaster@nbit.ch -d mail2.nbit.ch -d smtp.nbit.ch -d imap.nbit.ch
|
|
# systemctl start nginx
|
|
|
|
|
|
## DB erstellen
|
|
|
|
# mysql
|
|
MariaDB [(none)]> create database vmail CHARACTER SET 'utf8';
|
|
MariaDB [(none)]> grant select on vmail.* to 'vmail'@'localhost' identified by 'vmaildbpass';
|
|
# anderes Passwort waehlen!
|
|
MariaDB [(none)]> use vmail;
|
|
|
|
Folgende Statements durchfuehren:
|
|
|
|
CREATE TABLE `domains` (
|
|
`id` int unsigned NOT NULL AUTO_INCREMENT,
|
|
`domain` varchar(255) NOT NULL,
|
|
PRIMARY KEY (`id`),
|
|
UNIQUE KEY (`domain`)
|
|
);
|
|
|
|
CREATE TABLE `accounts` (
|
|
`id` int unsigned NOT NULL AUTO_INCREMENT,
|
|
`username` varchar(64) NOT NULL,
|
|
`domain` varchar(255) NOT NULL,
|
|
`password` varchar(255) NOT NULL,
|
|
`quota` int unsigned DEFAULT '0',
|
|
`enabled` boolean DEFAULT '0',
|
|
`sendonly` boolean DEFAULT '0',
|
|
PRIMARY KEY (id),
|
|
UNIQUE KEY (`username`, `domain`),
|
|
FOREIGN KEY (`domain`) REFERENCES `domains` (`domain`)
|
|
);
|
|
|
|
CREATE TABLE `aliases` (
|
|
`id` int unsigned NOT NULL AUTO_INCREMENT,
|
|
`source_username` varchar(64),
|
|
`source_domain` varchar(255) NOT NULL,
|
|
`destination_username` varchar(64) NOT NULL,
|
|
`destination_domain` varchar(255) NOT NULL,
|
|
`enabled` boolean DEFAULT '0',
|
|
PRIMARY KEY (`id`),
|
|
UNIQUE KEY (`source_username`, `source_domain`, `destination_username`, `destination_domain`),
|
|
FOREIGN KEY (`source_domain`) REFERENCES `domains` (`domain`)
|
|
);
|
|
|
|
CREATE TABLE `tlspolicies` (
|
|
`id` int unsigned NOT NULL AUTO_INCREMENT,
|
|
`domain` varchar(255) NOT NULL,
|
|
`policy` enum('none', 'may', 'encrypt', 'dane', 'dane-only', 'fingerprint', 'verify', 'secure') NOT NULL,
|
|
`params` varchar(255),
|
|
PRIMARY KEY (`id`),
|
|
UNIQUE KEY (`domain`)
|
|
);
|
|
|
|
|
|
## DKIM Signing (manuell einrichten)
|