Просмотр исходного текста страницы Почтовый сервер Postfix, Dovecot

При установке будем ориентироваться на этот мануал: http://dummyluck.com/page/pochtovyi_server_nastroika_opisanie<br/>
Настройку будем производить для сервера с одним доменом. Система Debian Stretch


'''1. Подготовка'''<br/>
Прописываем хостнейм <code>/etc/hostname</code><br/>
<code>mail.megapuper.ru</code>


Делаем изменения в хостах <code>/etc/hosts</code>
 127.0.0.1         localhost
 109.172.52.114	  megapuper.ru
 109.172.52.114    mail.megapuper.ru


Создаём пользователя и группу для виртуальных почтовых ящиков
 # useradd -u 20003 -d /dev/null -s /bin/false vmail
 # usermod -aG vmail vmail


'''2. Установка Nginx, MySQL, PHP. Этот web-сервер будет использоваться с PostfixAdmin '''

Здесь коротко, ибо уже тыщу раз ставилось)<br/>


Nginx cтавим из пакетов
 # apt install nginx


Основной конфиг примерно такой<code>/etc/nginx/nginx.conf</code><br/>
 user www-data;
 worker_processes 2;
 
 error_log  /var/log/nginx/error.log;
 pid        /var/run/nginx.pid;
 events {
  worker_connections  4096;
  multi_accept on;
  use epoll;
 }
 http {
  include       /etc/nginx/mime.types;
  default_type  application/octet-stream;
  sendfile on;
  tcp_nopush on;
  tcp_nodelay on;
  keepalive_requests 100;
  keepalive_timeout  5;
  variables_hash_max_size 1024;
  variables_hash_bucket_size 64;
  server_names_hash_bucket_size 64;
  types_hash_max_size 2048;
  types_hash_bucket_size 64;
  client_body_buffer_size 608M;
  client_max_body_size 608M;
  include /etc/nginx/conf.d/*.conf;
  include /etc/nginx/sites-enabled/*;
 }


Конфиг виртуального хоста <code>/etc/nginx/conf/postfix.conf</code>
 server {
        listen 80;
        server_name postfix.megapuper.ru;
 
        root /srv/www/postfix;
        index index.php;
 
        access_log /var/log/nginx/postfix.access.log;
        error_log  /var/log/nginx/postfix.error.log;
 
        location / {
            try_files $uri $uri/ /index.php?$uri&$args;
        }
 
        location ~ \.php$ {
            fastcgi_pass   127.0.0.1:20003;
            fastcgi_index  index.php;
            fastcgi_param  SCRIPT_FILENAME  $document_root/$fastcgi_script_name;
            fastcgi_intercept_errors on;
            include fastcgi_params;
        }
 }


Ставим PHP<br/>
 # apt install php7.1-fpm php7.1-gd php7.1-imap php7.1-intl php7.1-mbstring php7.1-mcrypt php7.1-mysql


Конфиг для виртуального хоста <code>/etc/php/7.1/fpm/pool.d/postfix.conf</code>
 [postfix]
 listen = 127.0.0.1:20003
 listen.allowed_clients = 127.0.0.1
 listen.owner = www-data
 listen.group = www-data
 listen.mode = 0660
 user = www-data
 group = www-data
 pm = dynamic
 pm.max_children = 50
 pm.start_servers = 5
 pm.min_spare_servers = 4
 pm.max_spare_servers = 10
 pm.max_requests = 100
 request_terminate_timeout = 30000s
 request_slowlog_timeout = 100m
 slowlog = /var/log/php/$pool.slow.log
 catch_workers_output = yes
 env[TMP] = /tmp
 env[TMPDIR] = /tmp
 env[TEMP] = /tmp
 php_admin_flag[display_errors] = off
 php_admin_value[error_log] = /var/log/php/$pool.error.log
 php_admin_flag[log_errors] = on


Ставим MySQL
 # wget https://repo.percona.com/apt/percona-release_0.1-6.$(lsb_release -sc)_all.deb
 # dpkg -i percona-release_0.1-6.$(lsb_release -sc)_all.deb
 # apt update
 # apt install percona-server-server-5.7


В конфиг <code>/etc/mysql/percona-server.conf.d/mysqld.cnf добавляем</code><br/>
 [mysqld]
 bind-address=127.0.0.1

<font color=red>'''В конфигах, где используется подключение к базе указываем хост 127.0.0.1'''</font>

После этого имеем готовый web-сервер можно переходить к установке PostfixAdmin


'''3. Установка PostfixAdmin'''

Скачиваем последнюю версию отсюда http://sourceforge.net/projects/postfixadmin/ и заливаем на web-сервер

Создаём базу и даём права пользователю
 > create database postfix character set utf8 collate utf8_general_ci;
 > grant all on postfix.* to postfix@127.0.0.1 identified by '<font color=blue>ПАРОЛЬ</font>';

Правим основной конфиг PostfixAdmin <code>config.inc.php</code><br/>
<spoiler>
<?php

$CONF['configured'] = true;


// In order to setup Postfixadmin, you MUST specify a hashed password here.<br/>
// To create the hash, visit setup.php in a browser and type a password into the field,<br/>
// on submission it will be echoed out to you as a hashed value.<br/>
$CONF['setup_password'] = 'пароль_установки';


// Language config<br/>
// Language files are located in './languages', change as required..<br/>
$CONF['default_language'] = 'ru';


// Hook to override or add translations in $PALANG<br/>
// Set to the function name you want to use as hook function (see language_hook example function below)<br/>
$CONF['language_hook'] = '';


// Database Config<br/>
// mysql = MySQL 3.23 and 4.0, 4.1 or 5<br/>
// mysqli = MySQL 4.1+<br/>
// pgsql = PostgreSQL<br/>
$CONF['database_type'] = 'mysqli';<br/>
$CONF['database_host'] = '127.0.0.1';<br/>
$CONF['database_user'] = 'postfix';<br/>
$CONF['database_password'] = 'ПАРОЛЬ';<br/>
$CONF['database_name'] = 'postfix';<br/>


// Here, if you need, you can customize table names.<br/>
$CONF['database_prefix'] = '';<br/>
$CONF['database_tables'] = array (<br/>
'admin' => 'admin'<br/>
'alias' => 'alias',<br/>
'alias_domain' => 'alias_domain',<br/>
'config' => 'config',<br/>
'domain' => 'domain',<br/>
'domain_admins' => 'domain_admins',<br/>
'fetchmail' => 'fetchmail',<br/>
'log' => 'log',<br/>
'mailbox' => 'mailbox',<br/>
'vacation' => 'vacation',<br/>
'vacation_notification' => 'vacation_notification',<br/>
'quota' => 'quota',<br/>
'quota2' => 'quota2',<br/>
);


// Site Admin<br/>
$CONF['admin_email'] = 'postmaster@megapuper.ru';


// Mail Server<br/>
$CONF['smtp_server'] = '127.0.0.1';<br/>
$CONF['smtp_port'] = '25';


// Encrypt<br/>
$CONF['encrypt'] = 'cleartext';


// Password validation<br/>
// New/changed passwords will be validated using all regular expressions in the array.<br/>
// If a password doesn't match one of the regular expressions, the corresponding<br/>
// error message from $PALANG (see languages/) will be displayed.<br/>
// If you need custom error messages, you can add them using $CONF['language_hook'].<br/>
// If a $PALANG text contains a %s, you can add its value after the $PALANG key<br/>
// (separated with a space).<br/>
$CONF['password_validation'] = array(<br/>
'/.{5}/'                => 'password_too_short 5',      # minimum length 5 characters<br/>
'/([a-zA-Z].*){3}/'     => 'password_no_characters 3',  # must contain at least 3 characters<br/>
'/([0-9].*){2}/'        => 'password_no_digits 2',      # must contain at least 2 digits<br/>
);


// Generate Password<br/><br/>
$CONF['generate_password'] = 'NO';


// Show Password<br/><br/>
$CONF['show_password'] = 'NO';


// Page Size<br/>
// Set the number of entries that you would like to see in one page.<br/>
$CONF['page_size'] = '50';


// Default Aliases<br/>
//$CONF['default_aliases'] = array (<br/>
'abuse' => 'postmaster',<br/>
//    'hostmaster' => 'hostmaster@change-this-to-your.domain.tld',<br/>
//    'postmaster' => 'postmaster@change-this-to-your.domain.tld',<br/>
//    'webmaster' => 'webmaster@change-this-to-your.domain.tld'<br/>
);


// Mailboxes<br/>
//   YES: /usr/local/virtual/domain.tld/username@domain.tld<br/>
//   NO:  /usr/local/virtual/username@domain.tld<br/>
$CONF['domain_path'] = 'YES';<br/>
// If you don't want to have the domain in your mailbox set this to 'NO'.<br/>
//   YES: /usr/local/virtual/domain.tld/username@domain.tld<br/>
//   NO:  /usr/local/virtual/domain.tld/username<br/>
// Note: If $CONF['domain_path'] is set to NO, this setting will be forced to YES.<br/>
$CONF['domain_in_mailbox'] = 'NO';<br/>
// If you want to define your own function to generate a maildir path set this to the name of the function.<br/>
//   - this configuration directive will override both domain_path and domain_in_mailbox<br/>
//   - the maildir_name_hook() function example is present below, commented out<br/>
//   - if the function does not exist the program will default to the above domain_path and domain_in_mailbox settings<br/>
$CONF['maildir_name_hook'] = 'NO';

$CONF['admin_struct_hook']          = '';<br/>
$CONF['domain_struct_hook']         = '';<br/>
$CONF['alias_struct_hook']          = '';<br/>
$CONF['mailbox_struct_hook']        = '';<br/>
$CONF['alias_domain_struct_hook']   = '';<br/>


// Default Domain Values<br/>
// Specify your default values below. Quota in MB.<br/>
$CONF['aliases'] = '0';<br/>
$CONF['mailboxes'] = '0';<br/>
$CONF['maxquota'] = '0';<br/>
$CONF['domain_quota_default'] = '0';


// Quota<br/>
// When you want to enforce quota for your mailbox users set this to 'YES'.<br/>
$CONF['quota'] = 'YES';<br/>
// If you want to enforce domain-level quotas set this to 'YES'.<br/>
$CONF['domain_quota'] = 'YES';<br/>
// You can either use '1024000' or '1048576'<br/>
$CONF['quota_multiplier'] = '1048576';<br/>


// Transport<br/>
// If you want to define additional transport options for a domain set this to 'YES'.<br/>
$CONF['transport'] = 'YES';<br/>
// Transport options<br/>
// If you want to define additional transport options put them in array below.<br/>
$CONF['transport_options'] = array (<br/>
'virtual',  // for virtual accounts<br/>
'local',    // for system accounts<br/>
'relay'     // for backup mx<br/>
);<br/>
// Transport default<br/>
// You should define default transport. It must be in array above.<br/>
$CONF['transport_default'] = 'virtual';


// Virtual Vacation Stuff<br/>
// If you want to use virtual vacation for you mailbox users set this to 'YES'.<br/>
// NOTE: Make sure that you install the vacation module. (See VIRTUAL-VACATION/)<br/>
$CONF['vacation'] = 'NO';


// This is the autoreply domain that you will need to set in your Postfix<br/>
// transport maps to handle virtual vacations. It does not need to be a<br/>
// real domain (i.e. you don't need to setup DNS for it).<br/>
// This domain must exclusively be used for vacation. Do NOT use it for "normal" mail addresses.<br/>
$CONF['vacation_domain'] = '';


// Vacation Control<br/>
// If you want users to take control of vacation set this to 'YES'.<br/>
$CONF['vacation_control'] ='NO';


// Vacation Control for admins<br/>
// Set to 'YES' if your domain admins should be able to edit user vacation.<br/>
$CONF['vacation_control_admin'] = 'YES';


// ReplyType options<br/>
// If you want to define additional reply options put them in array below.<br/>
// The array has the format   seconds between replies => $PALANG text<br/>
// Special values for seconds are:<br/>
// 0 => only reply to the first mail while on vacation<br/>
// 1 => reply on every mail<br/>
$CONF['vacation_choice_of_reply'] = array (<br/>
0 => 'reply_once',        // Sends only Once the message during Out of Office<br/>
60*60 *24*7 => 'reply_once_per_week'        // Reply if last autoreply was at least a week ago<br/>
);<br/>
// End Vacation Stuff.


// Users Control for Domain Admin<br/>
// Set to "Yes" if your domain admins schould be able to  edit  field userscontrole in  table domain<br/>
// Userscontrol is edited in admin_create-domain.tpl and admin_edit-domain.tpl<br/>
// Userscontrol is default set  to  on when creating a domain<br/>
$CONF['users_domain_controle'] = 'YES';


// Alias Control<br/>
// Alias control for superadmins<br/>
$CONF['alias_control'] = 'YES';


// Alias Control for domain admins<br/>
$CONF['alias_control_admin'] = 'YES';


// Special Alias Control<br/>
// Set to 'NO' if your domain admins shouldn't be able to edit the default aliases<br/>
// as defined in $CONF['default_aliases']<br/>
$CONF['special_alias_control'] = 'NO';


// Alias Goto Field Limit<br/>
// Set the max number of entries that you would like to see<br/>
// in one 'goto' field in overview, the rest will be hidden and "[and X more...]" will be added.<br/>
// '0' means no limits.<br/>
$CONF['alias_goto_limit'] = '0';


// Alias Domains<br/>
// Alias domains allow to "mirror" aliases and mailboxes to another domain. This makes<br/>
// configuration easier if you need the same set of aliases on multiple domains, but<br/>
// also requires postfix to do more database queries.<br/>
// Note: If you update from 2.2.x or earlier, you will have to update your postfix configuration.<br/>
// Set to 'NO' to disable alias domains.<br/>
$CONF['alias_domain'] = 'YES';


// Backup<br/>
// If you don't want backup tab set this to 'NO';<br/>
//$CONF['backup'] = 'YES';


// Send Mail<br/>
// If you don't want sendmail tab set this to 'NO';<br/>
//$CONF['sendmail'] = 'YES';


// Logging<br/>
// If you don't want logging set this to 'NO';<br/>
$CONF['logging'] = 'YES';


// Fetchmail<br/>
// If you don't want fetchmail tab set this to 'NO';<br/>
//$CONF['fetchmail'] = 'YES';


// fetchmail_extra_options allows users to specify any fetchmail options and any MDA<br/>
// (it will even accept 'rm -rf /' as MDA!)<br/>
// This should be set to NO, except if you *really* trust *all* your users.<br/>
$CONF['fetchmail_extra_options'] = 'YES';


// Header<br/>
$CONF['show_header_text'] = 'YES';<br/>
$CONF['header_text'] = ':: Postfix Admin ::';


// Footer<br/>
$CONF['show_footer_text'] = 'YES';<br/>
$CONF['footer_text'] = 'Return to postfix.megapuper.ru';<br/>
$CONF['footer_link'] = 'http://postfix.megapuper.ru/';


// MOTD ("Motto of the day")<br/>
// You can display a MOTD below the menu on all pages.<br/>
// This can be configured seperately for users, domain admins and superadmins<br/>
$CONF['motd_user'] = '';<br/>
$CONF['motd_admin'] = '';<br/>
$CONF['motd_superadmin'] = '';


// Welcome Message<br/>
// This message is send to every newly created mailbox.<br/>
// Change the text between EOM.<br/>
$CONF['welcome_text'] = <<<EOM<br/>
Hi,

Welcome to your new account.<br/>
EOM;


// When creating mailboxes or aliases, check that the domain-part of the<br/>
// address is legal by performing a name server look-up.<br/>
$CONF['emailcheck_resolve_domain']='NO';


// Optional:<br/>
//set to YES to enable this feature<br/>
$CONF['show_status']='YES';<br/>
//display a guide to what these colors mean<br/>
$CONF['show_status_key']='YES';<br/>
// 'show_status_text' will be displayed with the background colors<br/>
// associated with each status, you can customize it here<br/>
$CONF['show_status_text']='&nbsp;&nbsp;';<br/>
// show_undeliverable is useful if most accounts are delivered to this<br/>
// postfix system.  If many aliases and mailboxes are forwarded<br/>
// elsewhere, you will probably want to disable this.<br/>
$CONF['show_undeliverable']='YES';<br/>
$CONF['show_undeliverable_color']='tomato';<br/>
// mails to these domains will never be flagged as undeliverable<br/>
$CONF['show_undeliverable_exceptions']=array("unixmail.domain.ext","exchangeserver.domain.ext");<br/>
$CONF['show_popimap']='YES';<br/>
$CONF['show_popimap_color']='darkgrey';<br/>
// you can assign special colors to some domains. To do this,<br/>
// - add the domain to show_custom_domains<br/>
// - add the corresponding color to show_custom_colors<br/>
$CONF['show_custom_domains']=array("megapuper.ru","localhost");<br/>
$CONF['show_custom_colors']=array("lightgreen","lightblue");<br/>
// If you use a recipient_delimiter in your postfix config, you can also honor it when aliases are checked.<br/>
// Example: $CONF['recipient_delimiter'] = "+";<br/>
// Set to "" to disable this check.<br/>
$CONF['recipient_delimiter'] = "+";


// Optional:<br/>
// Script to run after creation of mailboxes.<br/>
$CONF['mailbox_postcreation_script'] = '/srv/www/postfix/scripts/addmail.sh';


// Optional:<br/>
// Script to run after alteration of mailboxes.<br/>
$CONF['mailbox_postedit_script'] = '/srv/www/postfix/scripts/editmail.sh';


// Optional:<br/>
// Script to run after deletion of mailboxes.<br/>
$CONF['mailbox_postdeletion_script'] = '/srv/www/postfix/scripts/delmail.sh';


// Optional:<br/>
// Script to run after creation of domains.<br/>
$CONF['domain_postcreation_script'] = '/srv/www/postfix/scripts/domainadd.sh';


// Optional:<br/>
// Script to run after deletion of domains.<br/>
$CONF['domain_postdeletion_script'] = '/srv/www/postfix/scripts/domaindel.sh';


// Optional:<br/>
// Sub-folders which should automatically be created for new users.<br/>
// The sub-folders will also be subscribed to automatically.<br/>
$CONF['create_mailbox_subdirs'] = array('Archive', 'Drafts', 'Sent', 'Trash');<br/>
$CONF['create_mailbox_subdirs_host']='127.0.0.1';
//
// Specify '' for Dovecot and 'INBOX.' for Courier.<br/>
$CONF['create_mailbox_subdirs_prefix']='';


// Optional:<br/>
// Show used quotas from Dovecot dictionary backend in virtual<br/>
// mailbox listing.<br/>
$CONF['used_quotas'] = 'YES';


// if you use dovecot >= 1.2, set this to yes.<br/>
// Note about dovecot config: table "quota" is for 1.0 & 1.1, table "quota2" is for dovecot 1.2 and newer<br/>
$CONF['new_quota_table'] = 'YES';


// Normally, the TCP port number does not have to be specified.<br/>
$CONF['create_mailbox_subdirs_hostport']=143;<br/>
// If you have trouble connecting to the IMAP-server, then specify<br/>
// a value for $CONF['create_mailbox_subdirs_hostoptions']. These<br/>
// are some examples to experiment with:<br/>
$CONF['create_mailbox_subdirs_hostoptions'] = array('novalidate-cert','norsh');


// Theme Config<br/>
// Specify your own logo and CSS file<br/>
$CONF['theme_logo'] = 'images/logo-default.png';<br/>
$CONF['theme_css'] = 'css/default.css';<br/>
// If you want to customize some styles without editing the $CONF['theme_css'] file,<br/>
// you can add a custom CSS file. It will be included after $CONF['theme_css'].<br/>
$CONF['theme_custom_css'] = '';


// XMLRPC Interface.<br/>
// This should be only of use if you wish to use e.g the<br/>
// Postfixadmin-Squirrelmail package<br/>
//  change to boolean true to enable xmlrpc<br/>
$CONF['xmlrpc_enabled'] = false;


// If you want to keep most settings at default values and/or want to ensure<br/>
// that future updates work without problems, you can use a separate config<br/>
// file (config.local.php) instead of editing this file and override some<br/>
// settings there.<br/>
if (file_exists(dirname(__FILE__) . '/config.local.php')) {<br/>
include(dirname(__FILE__) . '/config.local.php');<br/>
}<br/>

// END OF CONFIG FILE
</spoiler>


Выставляем права
 # chown -R www-data:www-data /srv/www/postfix


Теперь заходим на http://postfixadmin/setup.php и видим, что запустилась установка<br/>
Если все условия установки выполнены, то в базе создадутся необходимые таблицы и будет предложено создать суперадмина.

В поле ''Setup password'' вводим пароль из config.inc.php: $CONF['setup_password'] = 'пароль_установки';<br/>
Заполняем остальные поля, и после нажатия кнопки ''Создать'' сгенерится хэш.

Этот хеш надо вставить в config.inc.php вместо пароля установки: $CONF['setup_password'] = 'хеш';<br/>
Повторяем процедуру заведения суперадмина используя пароль_установки

После создания суперадмина временно оставляем PostfixAdmin(так как без postfix и dovecot ящики создаваться не будут)


'''4. Установка Postfix'''

 # apt install postfix postfix-mysql


Правим основные конфиги postfix<br/>
первый <code>/etс/postfix/main.cf</code><br/>
<spoiler>
biff=no<br/>
smtpd_banner = $myhostname ESMTP<br/>
queue_directory = /var/spool/postfix<br/>
command_directory = /usr/sbin<br/>
daemon_directory = /usr/lib/postfix/sbin<br/>
data_directory = /var/db/postfix<br/>

mail_owner = postfix<br/>
append_dot_mydomain = no<br/>
recipient_delimiter = +<br/>
default_destination_recipient_limit = 1<br/>
mailbox_size_limit = 0<br/>
message_size_limit = 20480000<br/>

inet_protocols = ipv4<br/>
inet_interfaces = all

myhostname = mail.megapuper.ru<br/>
mydomain = megapuper.ru<br/>
myorigin = $mydomain<br/>
mydestination = localhost.$mydomain, localhost<br/>
mynetworks = 127.0.0.0/8, 192.168.0.0/24

alias_maps = hash:/etc/aliases<br/>
alias_database = hash:/etc/aliases<br/>
smtp_generic_maps = hash:/etc/postfix/aliases_smtp_output<br/>
lmtp_generic_maps = hash:/etc/postfix/aliases_lmtp<br/>
sender_bcc_maps = mysql:/etc/postfix/maps/mysql_bcc_mailbox_maps.cf, mysql:/etc/postfix/maps/mysql_bcc_domain_maps.cf<br/>
virtual_mailbox_domains = mysql:/etc/postfix/maps/mysql_virtual_domains.cf<br/>
virtual_mailbox_maps = mysql:/etc/postfix/maps/mysql_virtual_maps.cf<br/>
virtual_alias_maps = mysql:/etc/postfix/maps/mysql_virtual_alias_domain_maps.cf, mysql:/etc/postfix/maps/mysql_virtual_alias_maps.cf
virtual_transport = lmtp:unix:private/dovecot-lmtp

strict_rfc821_envelopes = yes

mail_spool_directory = /var/spool/mail

smtpd_helo_required = yes

delay_notice_recipient = postmaster@megapuper.ru<br/>
bounce_notice_recipient = postmaster@megapuper.ru<br/>
2bounce_notice_recipient = postmaster@megapuper.ru<br/>
error_notice_recipient = postmaster@megapuper.ru

debug_peer_level = 2<br/>
debugger_command =<br/>
PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5<br/>

sendmail_path = /usr/sbin/sendmail<br/>
newaliases_path = /usr/bin/newaliases<br/>
mailq_path = /usr/bin/mailq<br/>
sample_directory = /etc/postfix
</spoiler>


второй конфиг<code>/etс/postfix/master.cf</code><br/>
<spoiler>
 # ==========================================================================
 # service type  private unpriv  chroot  wakeup  maxproc command + args
 #               (yes)   (yes)   (yes)   (never) (100)
 # ==========================================================================
 smtp      inet  n       -       n       -       -       smtpd
 #smtp      inet  n       -       n       -       1       postscreen
 #smtpd     pass  -       -       n       -       -       smtpd
 #dnsblog   unix  -       -       n       -       0       dnsblog
 #tlsproxy  unix  -       -       n       -       0       tlsproxy
 #submission inet n       -       n       -       -       smtpd
 #  -o syslog_name=postfix/submission
 #  -o smtpd_tls_security_level=encrypt
 #  -o smtpd_sasl_auth_enable=yes
 #  -o smtpd_reject_unlisted_recipient=no
 #  -o smtpd_client_restrictions=$mua_client_restrictions
 #  -o smtpd_helo_restrictions=$mua_helo_restrictions
 #  -o smtpd_sender_restrictions=$mua_sender_restrictions
 #  -o smtpd_recipient_restrictions=
 #  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
 #  -o milter_macro_daemon_name=ORIGINATING
 #smtps     inet  n       -       n       -       -       smtpd
 #  -o syslog_name=postfix/smtps
 #  -o smtpd_tls_wrappermode=yes
 #  -o smtpd_sasl_auth_enable=yes
 #  -o smtpd_reject_unlisted_recipient=no
 #  -o smtpd_client_restrictions=$mua_client_restrictions
 #  -o smtpd_helo_restrictions=$mua_helo_restrictions
 #  -o smtpd_sender_restrictions=$mua_sender_restrictions
 #  -o smtpd_recipient_restrictions=
 #   -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
 #  -o milter_macro_daemon_name=ORIGINATING
 #628       inet  n       -       n       -       -       qmqpd
 pickup    unix  n       -       n       60      1       pickup
 cleanup   unix  n       -       n       -       0       cleanup
 qmgr      unix  n       -       n       300     1       qmgr
 tlsmgr    unix  -       -       n       1000?   1       tlsmgr
 rewrite   unix  -       -       n       -       -       trivial-rewrite
 bounce    unix  -       -       n       -       0       bounce
 defer     unix  -       -       n       -       0       bounce
 trace     unix  -       -       n       -       0       bounce
 verify    unix  -       -       n       -       1       verify
 flush     unix  n       -       n       1000?   0       flush
 proxymap  unix  -       -       n       -       -       proxymap
 proxywrite unix -       -       n       -       1       proxymap
 smtp      unix  -       -       n       -       -       smtp
 relay     unix  -       -       n       -       -       smtp
 #       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
 showq     unix  n       -       n       -       -       showq
 error     unix  -       -       n       -       -       error
 retry     unix  -       -       n       -       -       error
 discard   unix  -       -       n       -       -       discard
 local     unix  -       n       n       -       -       local
 virtual   unix  -       n       n       -       -       virtual
 lmtp      unix  -       -       n       -       -       lmtp
 anvil     unix  -       -       n       -       1       anvil
 scache    unix  -       -       n       -       1       scache
 # ====================================================================
 # Interfaces to non-Postfix software.
 # ====================================================================
 #maildrop  unix  -       n       n       -       -       pipe
 #  flags=DRhu user=vmail argv=/usr/local/bin/maildrop -d ${recipient}
 # ============================ =======================================
 # Recent Cyrus versions can use the existing "lmtp" master.cf entry.
 #
 # Specify in cyrus.conf:
 #   lmtp    cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
 #
 # Specify in main.cf one or more of the following:
 #  mailbox_transport = lmtp:inet:localhost
 #  virtual_transport = lmtp:inet:localhost
 #
 # ====================================================================
 #
 # Cyrus 2.1.5 (Amos Gouaux)
 # Also specify in main.cf: cyrus_destination_recipient_limit=1
 #
 # cyrus     unix  -       n       n       -       -       pipe
 #  user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
 #
 # ====================================================================
 #
 #  Old example of delivery via Cyrus.
 #
 #old-cyrus unix  -       n       n       -       -       pipe
 #  flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
 #
 # ====================================================================
 #
 # See the Postfix UUCP_README file for configuration details.
 #
 #uucp      unix  -       n       n       -       -       pipe
 #  flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
 # 
 # ====================================================================
 #
 # Other external delivery methods.
 # 
 #ifmail    unix  -       n       n       -       -       pipe
 #  flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
 #
 #bsmtp     unix  -       n       n       -       -       pipe
 #  flags=Fq. user=bsmtp argv=/usr/local/sbin/bsmtp -f $sender $nexthop $recipient
 #
 # scalemail-backend unix -       n       n       -       2       pipe
 #  flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store
 #  ${nexthop} ${user} ${extension}
 #
 #mailman   unix  -       n       n       -       -       pipe
 #  flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
 #  ${nexthop} ${user}
</spoiler>

Создаём таблицы данных формата "hash" и базы с помощью команды '''postmap'''<br/>
<font color=red>'''Необходимо создать файлы и базы со списками, которые были подключены в конфиге выше, даже если они будут пустыми'''</font>
 # touch aliases_lmtp
 # touch aliases_smtp_output
 # postmap aliases_lmtp
 # postmap aliases_smtp_output


Создаём файлы, хранящие SQL-запросы, проверяя имена таблиц и полей (<font color=red>в очередной версии PostfixAdmin они могут измениться</font>)
 [/etc/postfix/maps/mysql_virtual_maps.cf]
 
 user = postfix
 password = ПАРОЛЬ
 hosts = 127.0.0.1
 dbname = postfix
 query = SELECT username FROM mailbox WHERE username='%s' AND active = '1'

 [/etc/postfix/maps/mysql_virtual_domains.cf]
 
 user = postfix
 password = ПАРОЛЬ
 hosts = 127.0.0.1
 dbname = postfix
 query = SELECT domain FROM domain WHERE domain = '%s' AND backupmx = '0' AND active = '1'

 [/etc/postfix/maps/mysql_virtual_alias_maps.cf]
 
 user = postfix
 password = ПАРОЛЬ
 hosts = 127.0.0.1
 dbname = postfix
 query = SELECT goto FROM alias WHERE address='%s' AND active = '1'

 [/etc/postfix/maps/mysql_virtual_alias_domain_maps.cf]
 
 user = postfix
 password = ПАРОЛЬ
 hosts = 127.0.0.1
 dbname = postfix
 query = SELECT CONCAT('%u', '@', target_domain) FROM alias_domain WHERE alias_domain = '%d' AND active = 1


Следующие два необязательны, если не будем делать сохранение копий всех писем
 [/etc/postfix/maps/mysql_bcc_domain_maps.cf]
 
 user = postfix
 password = ПАРОЛЬ
 hosts = 127.0.0.1
 dbname = postfix
 query = SELECT 'bccsnd+bccflag@megapuper.ru' FROM domain WHERE domain='%d' AND active = '1'

 [/etc/postfix/maps/mysql_bcc_mailbox_maps.cf]
 
 user = postfix
 password = ПАРОЛЬ
 hosts = 127.0.0.1
 dbname = postfix
 query = SELECT CONCAT('%u', '+bccflag', '@', '%d') FROM mailbox WHERE username='%s' AND active = '1'


Выставляем права на конфиги
 # chgrp postfix /etc/postfix/*.cf
 # chgrp postfix /etc/postfix/maps/*.cf
 # chmod u=rw,g=r,o=r /etc/postfix/*.cf
 # chmod u=rw,g=r,o=r /etc/postfix/maps/*.cf


Рестартим postfix
 # service postfix restart


'''5. Установка Dovecot'''<br/><br/>

Dovecot и плагины
 # apt install dovecot-core dovecot-mysql dovecot-imapd dovecot-lmtpd dovecot-sieve dovecot-managesieved


Создаём сопутствуюшие папки
 # mkdir /var/log/dovecot
 # mkdir -p /var/lib/dovecot/sieve/global/
 # mkdir -p /var/lib/dovecot/sieve/private/


Выставляем права
 # chown -R vmail /var/lib/dovecot/sieve/private/
 # chmod -R 700 /var/lib/dovecot/sieve/private/


Правим конфиги dovecot
 [/etc/dovecot/dovecot.conf]
 
 # Enable installed protocols
 protocols = imap lmtp sieve
 dict {
 #quota = mysql:/etc/dovecot/dovecot-dict-auth.conf.ext
 #expire = sqlite:/etc/dovecot/dovecot-dict-sql.conf.ext
 }
 !include conf.d/*.conf


 [/etc/dovecot/dovecot-sql.conf.ext]
 
 driver = mysql
 connect = host=127.0.0.1 dbname=postfix user=postfix password=ПАРОЛЬ
 default_pass_scheme = PLAIN
 #default_pass_scheme = PLAIN-MD5
 #   %u = entire user@domain
 #   %n = user part of user@domain
 #   %d = domain part of user@domain
 
 #одной строкой без переносов
 password_query = SELECT username as user, password, '%u' AS userdb_master_user, CONCAT('/var/spool/mail/', maildir) AS userdb_home, 20003 AS userdb_uid, 20003 AS userdb_gid, CONCAT('*:storage=', quota, 'B')
 as userdb_quota_rule FROM mailbox WHERE username = '%u' AND active = '1'
 
 #одной строкой без переносов
 user_query = SELECT CONCAT('/var/spool/mail/', maildir) AS home, 20003 AS uid, 20003 AS gid, CONCAT('*:storage=', quota, 'B') as quota_rule FROM mailbox WHERE username = '%u' AND active ='1'


 [/etc/dovecot/dovecot-sql-master.conf.ext]
 
 driver = mysql
 #default_pass_scheme = PLAIN-MD5
 default_pass_scheme = PLAIN
 connect = host=127.0.0.1 dbname=postfix user=postfix password=ПАРОЛЬ
 password_query = SELECT username AS user, password FROM admin WHERE username = '%u' AND active = '1'


 [/etc/dovecot/conf.d/10-auth.conf]
 
 # Connect only after start SSL/TLS
 # If not local network only !
 disable_plaintext_auth = no
 auth_cache_size = 1M
 auth_cache_negative_ttl = 0
 auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@
 auth_master_user_separator = *
 auth_mechanisms = plain
 
 !include auth-sql.conf.ext


 [/etc/dovecot/conf.d/10-director.conf]
 
 service director {
   unix_listener login/director {
     #mode = 0666
   }
   fifo_listener login/proxy-notify {
     #mode = 0666
   }
   unix_listener director-userdb {
     #mode = 0600
   }
   inet_listener {
     #port =
   }
 }
 # Enable director for the wanted login services by telling them to
 # connect to director socket instead of the default login socket:
 service imap-login {
   #executable = imap-login director
 }
 
 #service pop3-login {
   #executable = pop3-login director
 #}
 
 # Enable director for LMTP proxying:
 protocol lmtp {
   #auth_socket_path = director-userdb
 }


 [/etc/dovecot/conf.d/10-logging.conf]
 
 # Log file to use for error messages. "syslog" logs to syslog,
 # /dev/stderr logs to stderr.
 log_path = /var/log/dovecot/dovecot.log
 info_log_path = /var/log/dovecot/dovecot-info.log
 debug_log_path = /var/log/dovecot/dovecot-debug.log
 auth_verbose = yes
 auth_verbose_passwords = yes
 auth_debug = no
 auth_debug_passwords = no
 mail_debug = yes
 verbose_ssl = no
 
 #plugin {
 #}
 #log_timestamp = "%b %d %H:%M:%S "
 #login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c
 #login_log_format = %$: %s
 #mail_log_prefix = "%s(%u): "
 #  Format to use for logging mail deliveries. You can use variables:
 #  %$ - Delivery status message (e.g. "saved to INBOX")
 #  %m - Message-ID
 #  %s - Subject
 #  %f - From address
 #  %p - Physical size
 #  %w - Virtual size
 #deliver_log_format = msgid=%m: %$


 [/etc/dovecot/conf.d/10-mail.conf]
 
 mail_location = maildir:/var/spool/mail/%d/%n:INBOX=/var/spool/mail/%d/%n
 
 namespace inbox {
   type = private
   separator = /
   prefix =
   inbox = yes
   hidden = no
   list = yes
   subscriptions = yes
 }
 
 mail_uid = 20003
 mail_gid = 20003


 [/etc/dovecot/conf.d/10-master.conf]
 
 service imap-login {
  inet_listener imap {
   address = *
   port = 143
   #ssl = yes
  }
  inet_listener imaps {
   #port = 993
   #ssl = yes
  }
 
 }
 
 service lmtp {
   unix_listener lmtp {
   path = /var/spool/postfix/private/dovecot-lmtp
   group = postfix
   user = postfix
   mode = 0666
  }
  executable = lmtp -L
 }
 
 service auth {
   unix_listener auth {
   path = /var/spool/postfix/private/auth
   user = postfix
   group = postfix
   mode = 0660
  }
  user = $default_internal_user
 }
 
 service auth-worker {
   user = $default_internal_user
 }


 [/etc/dovecot/conf.d/15-lda.conf]
 
 postmaster_address = postmaster@megapuper.ru
 hostname = mail.megapuper.ru
 #rejection_subject = Rejected: %s
 #  %n = CRLF, %r = reason, %s = original subject, %t = recipient
 rejection_reason = Your message to <%t> was automatically rejected:%n%r
 
 protocol lda {
   mail_plugins = sieve
   log_path = /var/log/dovecot/mail-dovecot-lda-errors.log
   info_log_path = /var/log/dovecot/mail-dovecot-lda.log
 }


 [/etc/dovecot/conf.d/20-imap.conf]
 
 protocol imap {
  mail_plugins = $mail_plugins imap_quota mail_log notify quota
  info_log_path = /var/log/dovecot/dovecot-imap.log
  mail_max_userip_connections = 100
  #ssl_cert = </etc/dovecot/ssl.cert.pem
  #ssl_key = </etc/dovecot/ssl.key.pem
 
 }



 [/etc/dovecot/conf.d/20-lmtp.conf]
 
 protocol lmtp {
  mail_plugins = $mail_plugins quota sieve
  postmaster_address = postmaster@megapuper.ru
  info_log_path = /var/log/dovecot/dovecot-lmtp.log
 }


 [/etc/dovecot/conf.d/20-managesieve.conf]
 
 service managesieve-login {
   inet_listener sieve {
   address = 127.0.0.1
   port = 4190
 }
  service_count = 1
  vsz_limit = 64M
 }
 #mail_plugins = virtual
 #protocol sieve {
  #managesieve_max_line_length = 65536
  #mail_max_userip_connections = 10
  #mail_plugins = virtual
  # MANAGESIEVE logout format string:
  #  %i - total number of bytes read from client
  #  %o - total number of bytes sent to client
  #managesieve_logout_format = bytes=%i/%o
  #managesieve_implementation_string = Dovecot Pigeonhole
  #managesieve_sieve_capability =
  #managesieve_notify_capability =
  #managesieve_max_compile_errors = 5
 #}


 [/etc/dovecot/conf.d/90-quota.conf]
 
 plugin {
   quota = dict:user::file:/var/spool/mail/%d/%n/dovecot-quota
   quota_rule = *:storage=1GB
   quota_rule2 = Trash:storage=+10%%
 }
 
 # Note that % needs to be escaped as %%, otherwise "% " expands to empty.
 plugin {
   #quota_warning = storage=95%% quota-warning 95 %u
   #quota_warning2 = storage=80%% quota-warning 80 %u
 }
 
 plugin {
   #quota = dirsize:User quota
   #quota = maildir:User quota
   #quota = dict:User quota::proxy::quota
   #quota = fs:User quota
 }
 
 plugin {
   #quota = dict:user::proxy::quota
   #quota2 = dict:domain:%d:proxy::quota_domain
   #quota_rule = *:storage=102400
   #quota2_rule = *:storage=1048576
 }


 [/etc/dovecot/conf.d/90-sieve.conf]
 
 plugin {
  sieve_user_log = /var/lib/dovecot/sieve/private/%d/%n/.main.peronal.log
  sieve = /var/lib/dovecot/sieve/private/%d/%n/.main.personal.sieve
  #sieve_default = /var/lib/dovecot/sieve/default.sieve
  sieve_dir = /var/lib/dovecot/sieve/private/%d/%n/
  sieve_global_dir = /var/lib/dovecot/sieve/global/
  #sieve_before2 =
  sieve_before = /var/lib/dovecot/sieve/global/incoming_deduplicate.sieve
  #sieve_after =
  #sieve_after2 =
  sieve_extensions = +editheader
  sieve_global_extensions = +vnd.dovecot.duplicate
  sieve_duplicate_period = 1d
  #sieve_plugins =
  recipient_delimiter = +
  #sieve_max_script_size = 1M
  #sieve_max_actions = 32
  #sieve_max_redirects = 4
  #sieve_quota_max_scripts = 0
  #sieve_quota_max_storage = 0
 }


 [/etc/dovecot/conf.d/auth-sql.conf.ext]
 
 auth_master_user_separator = *
 #auth_debug = yes
 passdb {
   driver = sql
   args = /etc/dovecot/dovecot-sql-master.conf.ext
   master = yes
   pass = yes
 }
 passdb {
   driver = sql
   args = /etc/dovecot/dovecot-sql.conf.ext
   #default_fields = userdb_gid=20003 userdb_uid=20003
 }
 userdb {
   driver = prefetch
 }
 userdb {
   driver = sql
   args = /etc/dovecot/dovecot-sql.conf.ext
   #default_fields = uid=20003 gid=20003
 }


Меняем права и владельца конфигов:
 # chgrp vmail /etc/dovecot/*.conf
 # chmod g+r /etc/dovecot/*.conf
 # chgrp vmail /etc/dovecot/*.ext
 # chmod g+r /etc/dovecot/*.ext
 # chgrp vmail /etc/dovecot/conf.d/*.conf
 # chmod g+r /etc/dovecot/conf.d/*.conf
 # chgrp vmail /etc/dovecot/conf.d/*.ext
 # chmod g+r /etc/dovecot/conf.d/*.ext


Теперь можно вернуться к PostfixAdmin и приступить к созданию доменов и ящиков

Папка для логов
 # mkdir /var/log/postfixadmin
 # chown www-data:www-data /var/log/postfixadmin


Копируем скрипты в /srv/www/postfix/scripts/

 [addmail.sh]
 
 #!/bin/sh
 daten=`date -R`
 printf "$daten \n CREATE mailbox: $1\n Domain: $2\n MailDir: $3\n Quota: $4 B\n\n" >> /var/log/postfixadmin/addmailbox.log

 [delmail.sh]
 
 #!/bin/sh
 daten=`date -R`
 printf "$daten \n DELETE mailbox: $1\n Domain: $2\n\n" >> /var/log/postfixadmin/delmailbox.log

 [domainadd.sh]
 
 #!/bin/sh
 daten=`date -R`
 printf "$daten \n CREATE Domain: $1\n\n" >> /var/log/postfixadmin/domainadd.log

 [domaindel.sh]
 
 #!/bin/sh
 daten=`date -R`
 printf "$daten \n DELETE Domain: $1\n\n" >> /var/log/postfixadmin/domaindel.log

 [editmail.sh]
 
 #!/bin/sh
 daten=`date -R`
 #del RoundCube user:
 host="127.0.0.1"
 user="_ROUNDCUBE_SQL_USER_ "
 pass="_ROUNDCUBE_SQL_PASSWORD_"
 db="_ROUNDCUBE_SQL_BASE_"
 
 sql="SELECT user_id FROM users WHERE username = '$1'"
 RES=`mysql --host=$host --port=3306 --user=$user --password=$pass --database=$db --execute="$sql"`
 
 printf "$daten \n DELETE mailbox: $1\n Domain: $2\n MailDir: $3\n Quota: $4 B\n" >> /var/log/postfixadmin/delmailbox.log
 printf " >>> RoundCube SQL-query START \n" >> /var/log/postfixadmin/delmailbox.log
 
 for i in $RES; do
 if [ "$i" != "user_id" ]; then
 printf " ! FOUND RECORD: USER_ID = $i ! ( $1 )\n" >> /var/log/postfixadmin/delmailbox.log
 
 # Find user_id:
 printf " SQL: $sql \n" >> /var/log/postfixadmin/delmailbox.log
 
 # Delete user from Cache:
 sql="DELETE FROM cache WHERE user_id = $i"
 RESD=`mysql --host=$host --port=3306 --user=$user --password=$pass --database=$db --execute="$sql"`
 printf " SQL: $sql\n" >> /var/log/postfixadmin/delmailbox.log
 
 # Delete user from ContactGroupMembers:
 sql="DELETE FROM contactgroupmembers WHERE contactgroup_id IN (SELECT contactgroup_id FROM contactgroups WHERE user_id = $i)"
 RESD=`mysql --host=$host --port=3306 --user=$user --password=$pass --database=$db --execute="$sql"`
 printf " SQL: $sql\n" >> /var/log/postfixadmin/delmailbox.log
 
 # Delete user from ContactGroups:
 sql="DELETE FROM contactgroups WHERE user_id = $i"
 RESD=`mysql --host=$host --port=3306 --user=$user --password=$pass --database=$db --execute="$sql"`
 printf " SQL: $sql\n" >> /var/log/postfixadmin/delmailbox.log
 
 # Delete user from Contacts:
 sql="DELETE FROM contacts WHERE user_id = $i"
 RESD=`mysql --host=$host --port=3306 --user=$user --password=$pass --database=$db --execute="$sql"`
 printf " SQL: $sql\n" >> /var/log/postfixadmin/delmailbox.log
 
 # Delete user from Identities:
 sql="DELETE FROM identities WHERE user_id = $i"
 RESD=`mysql --host=$host --port=3306 --user=$user --password=$pass --database=$db --execute="$sql"`
 printf " SQL: $sql\n" >> /var/log/postfixadmin/delmailbox.log
 
 # Delete user from Cache Messages
 sql="DELETE FROM cache_messages WHERE user_id = $i"
 RESD=`mysql --host=$host --port=3306 --user=$user --password=$pass --database=$db --execute="$sql"`
 printf " SQL: $sql\n" >> /var/log/postfixadmin/delmailbox.log
 
 # Delete user from Cache Thread
 sql="DELETE FROM cache_thread WHERE user_id = $i"
 RESD=`mysql --host=$host --port=3306 --user=$user --password=$pass --database=$db --execute="$sql"`
 printf " SQL: $sql\n" >> /var/log/postfixadmin/delmailbox.log
 
 # Delete user from Users:
 sql="DELETE FROM users WHERE user_id = $i"
 RESD=`mysql --host=$host --port=3306 --user=$user --password=$pass --database=$db --execute="$sql"`
 printf " SQL: $sql\n" >> /var/log/postfixadmin/delmailbox.log
 fi
 done
 printf " >>> RoundCube SQL-query END \n\n" >> /var/log/postfixadmin/delmailbox.log


Даём права
 # chown -R www-data:www-data /srv/www/postfix/scripts/
 # chmod 744 addmail.sh delmail.sh domainadd.sh domaindel.sh editmail.sh


Создаём папку для почты
 # mkdir /var/spool/mail
 # chown -R vmail:vmail /var/spool/mail


Рестартим postfix и dovecot

Создаём в postfixadmin домен и ящики, проверяем хождение почты.


'''6. Roundcube'''<br/>

[https://roundcube.net/download/ Качаем отсюда нужную версию] и распаковываем её в папку на веб-сервере


Примерный конфиг nginx
  server {
         listen 80;
         server_name webmail.megapuper.ru;
 
 root /srv/www/roundcube;
         index index.php index.html index.htm;
 
         access_log /var/log/nginx/roundcube.access.log;
         error_log  /var/log/nginx/roundcube.error.log;
 
 location / {
         try_files $uri $uri/ /index.php?$uri&$args;
         }
 
 location ~ \.php$ {
     fastcgi_pass   127.0.0.1:20003;
     fastcgi_index  index.php;
     fastcgi_param  SCRIPT_FILENAME  $document_root/$fastcgi_script_name;
     fastcgi_intercept_errors on;
     include fastcgi_params;
         }
     }


Конфиг php
 [roundcube]
 listen = 127.0.0.1:20003
 listen.allowed_clients = 127.0.0.1
 listen.owner = www-data
 listen.group = www-data
 listen.mode = 0660
 user = $pool
 group = $pool
 pm = dynamic
 pm.max_children = 4
 pm.start_servers = 2
 pm.min_spare_servers = 1
 pm.max_spare_servers = 3
 pm.max_requests = 100
 ;pm.status_path = /status/php-fpm/$pool
 request_terminate_timeout = 0
 request_slowlog_timeout = 1m
 slowlog = /var/log/php/$pool.slow.log
 catch_workers_output = yes


Создаём базу и заводим пользователя
 > create database roundcube character set utf8 collate utf8_general_ci;
 > grant all privileges on roundcube.* to roundcube@127.0.0.1 identified by '<font color=blue>ПАРОЛЬ</font>';


Заходим http://webmail.megapuper.ru/installer/ и далее по тексту


'''7. SPF'''<br/>

SPF - это фактически список серверов которым будет разрешено отправлять почту от имени нашего домена


Прописывает в DNS путём добавления TXT-записи
 megapuper.ru. 1440 TXT "v=spf1 a mx ip4:109.172.52.114 ~all"


Опции:
 "v=spf1" - используемая версия SPF.
 "+" - принимать корреспонденцию (Pass). Этот параметр установлен по умолчанию. То есть, если никаких параметров не установлено, то это "Pass";
 "-" - Отклонить (Fail);
 "~" - "мягкое" отклонение (SoftFail). Письмо будет принято, но будет помечено как СПАМ;
 "?" - нейтральное отношение;
 "mx" - включает в себя все адреса серверов, указанные в MX-записях домена;
 "ip4" - опция позволяет указать конкретный IP-адрес или сеть адресов;
 "a" - указываем поведение в случае получения письма от конкретного домена;
 "include" - включает в себя хосты, разрешенные SPF-записью указанного домена;
 "all" - все остальные сервера, не перечисленные в SPF-записи.


Отправляем письмо на какую-нибудь гуглопочту и проверяем<br/>
При просмотре оригинала письма с заголовками у получателя, увидим такие строчки
 Received-SPF: pass (google.com: domain of finston@megapuper.ru designates 109.172.52.114 as permitted sender) client-ip=109.172.52.114;
 Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of finston@megapuper.ru 


Или здесь http://dkimvalidator.com/


'''8. DKIM'''<br/>

DKIM - цифровая подпись, которая добавляется к заголовкам письма сервером отправителя, по которой сервер получателя может удостовериться, что отправитель письма соответствует полю From в заголовках письма.

Ставим opendkim и тулзы
 # apt install opendkim opendkim-tools


Добавляем пользователя в группу
 # usermod -aG opendkim vmail


Создаём папку для ключей
 # mkdir /etc/opendkim/


Подготавливаем конфиг <code>/etc/opendkim.conf</code>
 Socket                  inet:8891@localhost
 PidFile                 /var/run/opendkim/opendkim.pid
 UserID                  opendkim:opendkim
 UMask                   002
 Syslog                  yes
 SyslogSuccess           yes
 # на время отладки включим расширенное логирование
 LogWhy                  yes
 SoftwareHeader          yes
 Canonicalization        relaxed/relaxed
 # подпись и проверка подписей
 #Mode                   sv
 # если только подписываем
 Mode                    s
 
 # список ключей
 KeyTable file:/etc/opendkim/keytable
 # соответствие адресов/доменов и ключей
 SigningTable file:/etc/opendkim/signingtable
 # если подписываем и на других серверах
 #ExternalIgnoreList file:/etc/opendkim/trusted
 # список внутренних хостов, почта которых требует подписи
 InternalHosts file:/etc/opendkim/internal


Генерируем ключ
 # opendkim-genkey -D /etc/opendkim/ -d megapuper.ru -s megapuper


Прописываем ключ в <code>/etc/opendkim/keytable</code>
 megapuper._domainkey.megapuper.ru megapuper.ru:megapuper:/etc/opendkim/megapuper.private


Соответствие адреса и ключа <code>/etc/opendkim/signingtable</code>
 megapuper.ru megapuper._domainkey.megapuper.ru


Список хостов, почта которых требует подписи <code>/etc/opendkim/internal</code>
 108.195.52.173
 32.210.209.35
 192.168.0.7
 192.168.100.120


Выставляем права
 # chown -R opendkim:vmail /etc/opendkim/


Подключаем в postfix <code>/etc/postfix/main.cf</code>
 milter_default_action = accept
 smtpd_milters = inet:localhost:8891
 non_smtpd_milters = inet:localhost:8891


Прописываем в DNS TXT-запись из сгенерённого megapuper.txt
 megapuper._domainkey IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDGECRuiaVV2Z8BMwCXp0yoai4IqWQJw/gAa+Qp5BC"


Проверяем всё ли правильно
 # opendkim-testkey -vvv -d megapuper.ru -s megapuper -k /etc/opendkim/megapuper.private


Проверка DNS-записи
 # dig @8.8.8.8 megapuper._domainkey.megapuper.ru TXT +short
 или
 # host -t TXT megapuper._domainkey.megapuper.ru 8.8.8.8


Далее стартуем/рестартуем сервисы
 # service opendkim restart
 # service postfix restart


Снова отправляем письмо на гуглопочту и проверяем<br/>
В логах увидим, что opendkim отработал 
 Oct 19 17:36:51 mail postfix/cleanup[1472]: 4124D4E732: message-id=<op.x6rb05dw73xu59@ws0037>
 Oct 19 17:36:51 mail opendkim[1451]: 4124D4E732: DKIM-Signature field added (s=megapuper, d=megapuper.ru)
 Oct 19 17:36:51 mail postfix/qmgr[1352]: 4124D4E732: from=<finston@megapuper.ru>, size=702, nrcpt=1 (queue active)


При просмотре оригинала письма с заголовками у получателя, увидим такие строчки
 Authentication-Results: mx.google.com;
       dkim=pass header.i=@megapuper.ru
 DKIM-Filter: OpenDKIM Filter v2.10.3 mail.megapuper.ru 4124D4E732
 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=megapuper.ru;
	s=megapuper; t=1445265411;
	bh=rTOBSfI4+dnRHaqML+b7IT3SM2GI+FE6G0AOa/+zdEc=;
	h=To:Subject:Date:From;
	b=Ofgjyx6SPMtwF2o7EAIJTXG67RLcJHfNlUeyEDBAB9kesrz9t0gYz22NB54T+v1Wo
	 tQ+P7b60eoI4rgEZtZPwA3iXZgOWwtdUhiGob6MFgkRm0kB2T8L0O+AtNhusQD3LSf
	 0xGaJDLd2r/BbS/xwe3fMFUVQOJ5nLQctqmCm5HE=


Или здесь http://dkimvalidator.com/


'''Пересылка входящей почты на другой ящик'''<br/>

Требуется пересылать входящую почту с ящика test@megapuper.ru на test@mail.ru


Добавляем в <code>/etc/postfix/main.cf</code>
 recipient_bcc_maps = hash:/etc/postfix/recipient_bcc 


В этот файл <code>/etc/postfix/recipient_bcc</code> прописываем с какого ящика на какой пересылать
 test@megapuper.ru test@mail.ru


Выполняем
 postmap /etc/postfix/recipient_bcc
 postfix reload


Проверяем


Вуаля. Пока всё.