Centos7メールサーバ構築(postfix+Dovecot+PostfixAdmin+Let'sEncrypt)

概要

centos7でメールサーバー構築のメモです。

サーバー既存情報

■OS

# cat /etc/redhat-release
CentOS Linux release 7.6.1810 (Core)

■MySQLがすでにインストールしている

# mysql --version
mysql  Ver 8.0.16 for Linux on x86_64 (MySQL Community Server - GPL)

■Apacheとmod_sslもインストール済

# httpd -v
Server version: Apache/2.4.6 (CentOS)
Server built:   Apr  2 2020 13:13:23

事前準備

■ドメイン：vmail.domain.jp
■管理者メール:[e-mail]

今回インストールするもの

■postfix

# postconf | grep mail_version
mail_version = 2.10.1

■Dovecot

# dovecot --version
2.2.36 (1f10bfa63)

■PostfixAdmin

postfixadmin-3.2.4

■PHP

# php -v
PHP 7.3.6 (cli) (built: May 28 2019 09:32:59) ( NTS )
Copyright (c) 1997-2018 The PHP Group
Zend Engine v3.3.6, Copyright (c) 1998-2018 Zend Technologies

作業手順

Let's EncryptのスクリプトをGitでCloneします。

# git clone https://github.com/certbot/certbot /usr/local/certbot

Dovecotをインストール

# yum -y install dovecot dovecot-mysql

Postfix/PostfixAdminをインストール

# yum -y install postfix postfix-mysql

Remiのリポジトリ設定

# rpm -Uvh https://rpms.remirepo.net/enterprise/remi-release-7.rpm

phpをインストール

# yum clean all
# yum -y install php73-php
# yum -y install php73-php-{mbstring,imap,mysql}

Firewall設定

# firewall-cmd --permanent --add-port={80,443}/tcp
# firewall-cmd --permanent --add-port={25,110,143,465,587,993,995}/tcp
# firewall-cmd --reload

Let's Encryptで証明書を発行

Certbot(Let's Encrypt)入門
https://certbot.open-code.club/

httpdが起動する場合、先にStopしておきましょう。

# systemctl stop httpd

証明書を発行

>/usr/local/certbot/certbot-auto certonly -n --standalone --agree-tos -d vmail.domain.jp -m [e-mail] --server https://acme-v02.api.letsencrypt.org/directory

成功した場合、/etc/letsencrypt/live/vmail.domain.jp/に証明書が作成されます。

# ll /etc/letsencrypt/live/vmail.domain.jp/
total 4
-rw-r--r-- 1 root root 692 May  4 21:04 README
lrwxrwxrwx 1 root root  48 May  4 21:04 cert.pem -> ../../archive/vmail.domain.jp/cert1.pem
lrwxrwxrwx 1 root root  49 May  4 21:04 chain.pem -> ../../archive/vmail.domain.jp/chain1.pem
lrwxrwxrwx 1 root root  53 May  4 21:04 fullchain.pem -> ../../archive/vmail.domain.jp/fullchain1.pem
lrwxrwxrwx 1 root root  51 May  4 21:04 privkey.pem -> ../../archive/vmail.domain.jp/privkey1.pem

Cronで毎日〜週に1回程度の頻度で自動更新するようにバッチ登録

echo "5 5 * * 1 root /usr/local/certbot/certbot-auto renew --pre-hook 'systemctl stop httpd' --post-hook 'systemctl reload postfix dovecot; systemctl start httpd'" > /etc/cron.d/certbot-auto

PostfixAdminをインストール

# cd /srv/
# git clone https://github.com/postfixadmin/postfixadmin.git
# cd postfixadmin

postfixadmin-3.2.4をチェックアウトする

# git checkout postfixadmin-3.2.4

postfixのDBを準備

# mysql -u root -p
> CREATE DATABASE IF NOT EXISTS postfix;
> CREATE USER 'postfix'@'localhost' IDENTIFIED BY 'ここDBのパスワード';
> GRANT ALL PRIVILEGES ON postfix.* TO 'postfix'@'localhost';
> FLUSH PRIVILEGES;

postfixadmin DB設定ファイルを作成

# vi /srv/postfixadmin/config.local.php

以下の内容を追加

<?php
$CONF['configured'] = true;
$CONF['default_language'] = 'ja';
$CONF['database_type'] = 'mysqli';
$CONF['database_user'] = 'postfix';
$CONF['database_password'] = 'ここDBのパスワード';
$CONF['database_name'] = 'postfix';
$CONF['domain_path'] = 'YES';
$CONF['domain_in_mailbox'] = 'NO';
$CONF['dovecotpw'] = "doveadm pw -s SHA512-CRYPT";
$CONF['encrypt'] = 'dovecot:SHA512-CRYPT';
$CONF['footer_link'] = 'https://vmail.domain.jp/postfixadmin/';
$CONF['footer_text'] = 'Return to vmail.domain.jp/postfixadmin/';
?>

テンプレートフォルダ作成

# mkdir -p /srv/postfixadmin/templates_c
# chown -R apache /srv/postfixadmin/templates_c

Apacheにpostfixadminの設定を追加

vi /etc/httpd/conf.d/postfixadmin.conf

以下の内容を追加

<VirtualHost *:443>

    ServerName vmail.domain.jp
    ServerAlias vmail.domain.jp
    DocumentRoot /var/www/html/

    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/vmail.domain.jp/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/vmail.domain.jp/privkey.pem
    SSLCertificateChainFile /etc/letsencrypt/live/vmail.domain.jp/chain.pem

    <Directory "/var/www/html">
      Options -Indexes
      Order Deny,Allow
      Deny from None
      Allow from All
    </Directory>

    Alias /postfixadmin "/srv/postfixadmin/public"
    <Directory "/srv/postfixadmin/public">
        DirectoryIndex index.html index.php
        AllowOverride All
        Options FollowSymlinks
        Require all granted
    </Directory>

</VirtualHost>
<VirtualHost *:80>
    ServerName vmail.domain.jp
    ServerAlias vmail.domain.jp

    Redirect / https://vmail.domain.jp/
</VirtualHost>

セットアップ実⾏

# curl -s -o /dev/null -L -k　https://vmail.domain.jp/postfixadmin/setup.php

PostfixADminの初期ユーザ登録

# /srv/postfixadmin/scripts/postfixadmin-cli admin add [e-mail] --superadmin 1 --active 1 --password 'パスワード' --password2'パスワード'
# /srv/postfixadmin/scripts/postfixadmin-cli domain add vmail.domain.jp
# /srv/postfixadmin/scripts/postfixadmin-cli domain update vmail.domain.jp --mailboxes 0
# /srv/postfixadmin/scripts/postfixadmin-cli mailbox add [e-mail] --password 'パスワード' --password2 'パスワード'

転送設定
# /srv/postfixadmin/scripts/postfixadmin-cli alias add [e-mail] --goto [e-mail]
# /srv/postfixadmin/scripts/postfixadmin-cli alias update [e-mail] --goto [e-mail]
# /srv/postfixadmin/scripts/postfixadmin-cli alias update [e-mail] --goto [e-mail]
# /srv/postfixadmin/scripts/postfixadmin-cli alias update [e-mail] --goto [e-mail]
# /srv/postfixadmin/scripts/postfixadmin-cli alias update [e-mail] --goto [e-mail]

Postfix設定

postconf -e smtpd_banner='$myhostname ESMTP'
postconf -e smtp_header_checks='regexp:/etc/postfix/smtp_header_checks'
postconf -e mime_header_checks='regexp:/etc/postfix/mime_header_checks'
postconf -e disable_vrfy_command=yes
postconf -e smtpd_helo_required=yes
postconf -e inet_interfaces=all
postconf -e myhostname=vmail.domain.jp
postconf -e mydestination='localhost.$mydomain, localhost'
postconf -e relay_domains='$mydestination'
postconf -e virtual_alias_maps='proxy:mysql:/etc/postfix/virtual_alias_maps.cf'
postconf -e virtual_mailbox_domains=proxy:mysql:/etc/postfix/virtual_mailbox_domains.cf
postconf -e virtual_mailbox_maps='proxy:mysql:/etc/postfix/virtual_mailbox_maps.cf'
postconf -e virtual_mailbox_base='/home/vmail'
postconf -e virtual_mailbox_limit=512000000
postconf -e message_size_limit=20480000
postconf -e virtual_minimum_uid=10000
postconf -e virtual_transport=virtual
postconf -e virtual_uid_maps='static:10000'
postconf -e virtual_gid_maps='static:10000'
postconf -e local_transport=virtual
postconf -e local_recipient_maps='$virtual_mailbox_maps'
postconf -e transport_maps='hash:/etc/postfix/transport'
postconf -e smtpd_sasl_auth_enable=yes
postconf -e smtpd_sasl_type=dovecot
postconf -e smtpd_sasl_path='/var/run/dovecot/auth-client'
postconf -e smtpd_recipient_restrictions='permit_auth_destination, permit_mynetworks, permit_sasl_authenticated,reject_unauth_destination'
postconf -e smtpd_client_restrictions='permit_mynetworks, reject_unknown_client, permit'
postconf -e smtpd_sender_restrictions='reject_unknown_sender_domain, reject_non_fqdn_sender'
postconf -e smtpd_relay_restrictions='permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination'
postconf -e smtpd_sasl_security_options=noanonymous
postconf -e smtpd_sasl_tls_security_options='$smtpd_sasl_security_options'
postconf -e smtpd_tls_security_level=may
postconf -e smtpd_tls_auth_only=yes
postconf -e smtpd_tls_received_header=yes
postconf -e smtpd_tls_cert_file=/etc/letsencrypt/live/vmail.domain.jp/fullchain.pem
postconf -e smtpd_tls_key_file=/etc/letsencrypt/live/vmail.domain.jp/privkey.pem
postconf -e smtpd_tls_CAfile='/etc/pki/tls/certs/ca-bundle.crt'
postconf -e smtpd_tls_mandatory_protocols='!SSLv2,!SSLv3,!TLSv1,!TLSv1.1'
postconf -e smtpd_tls_protocols='!SSLv2,!SSLv3,!TLSv1,!TLSv1.1'
postconf -e smtpd_tls_ask_ccert=yes
postconf -e smtpd_tls_mandatory_ciphers=high
postconf -e smtpd_use_tls=yes
postconf -e smtpd_sasl_local_domain='$mydomain'
postconf -e broken_sasl_auth_clients=yes
postconf -e smtpd_tls_loglevel=1
postconf -e smtp_tls_security_level=may
postconf -e smtp_tls_loglevel=1
postconf -e smtp_tls_mandatory_protocols='!SSLv2,!SSLv3,!TLSv1,!TLSv1.1'
postconf -e smtp_tls_protocols='!SSLv2,!SSLv3,!TLSv1,!TLSv1.1'

/etc/postfix/master.cf変更

vi /etc/postfix/master.cf

submission inet n       -       n       -       -       smtpd
↑#を削除
smtps     inet  n       -       n       -       -       smtpd
↑#を削除
↑の下に以下を追加
 -o smtpd_tls_wrappermode=yes
 -o smtpd_sasl_auth_enable=yes

送信者の IP とユーザーエージェントを Received ヘッダに載せない

# vi /etc/postfix/smtp_header_checks

以下を追加

/^Received: .*/ IGNORE
/^User-Agent: .*/ IGNORE

ヘッダの取り扱いを追加

vi /etc/postfix/mime_header_checks

以下を追加

/^Mime-Version:/ IGNORE

DBの接続設定追加

virtual_alias_maps.cf

# vi /etc/postfix/virtual_alias_maps.cf
user = postfix
password = ここDBのパスワード
hosts = localhost
dbname = postfix
table = alias
select_field = goto
where_field = address

virtual_mailbox_domains.cf

# vi /etc/postfix/virtual_mailbox_domains.cf
user = postfix
password = ここDBのパスワード
hosts = localhost
dbname = postfix
table = domain
select_field = domain
where_field = domain

virtual_mailbox_maps.cf

# vi /etc/postfix/virtual_mailbox_maps.cf
user = postfix
password = ${DATABASE_PASSWORD}
hosts = localhost
dbname = postfix
table = mailbox
select_field = maildir
where_field = username

postfixをリロードする

#　postmap /etc/postfix/transport
#　systemctl restart postfix.service
#　systemctl enable postfix.service

Dovecot設定

# groupadd -g 10000 vmail
# useradd -u 10000 -g vmail -s /usr/bin/nologin -d /home/vmail -m vmail
# mkdir -p /home/vmail/vmail.domain.jp/admin/{cur,new,tmp}
# chown -R vmail. /home/vmail/

dovecot.conf

# vi /etc/dovecot/dovecot.conf
#!include conf.d/*.conf
↑#を追加
↓を最後に追加
protocols = imap pop3
auth_mechanisms = plain
passdb {
driver = sql
args = /etc/dovecot/dovecot-sql.conf
}
userdb {
driver = sql
args = /etc/dovecot/dovecot-sql.conf
}
service auth {
unix_listener auth-client {
group = postfix
mode = 0660
user = postfix
}
user = root
}
mail_home = /home/vmail/%d/%n
mail_location = maildir:~
ssl = yes
ssl_cert = </etc/letsencrypt/live/vmail.domain.jp/fullchain.pem
ssl_key = </etc/letsencrypt/live/vmail.domain.jp/privkey.pem
ssl_protocols = !SSLv3 !TLSv1 !TLSv1.1

dovecot-sql.conf

# vi /etc/dovecot/dovecot-sql.conf
driver = mysql
connect = host=localhost dbname=postfix user=postfix password=ここDBのパスワード
default_pass_scheme = SHA512-CRYPT
user_query = SELECT '/home/vmail/%d/%n' as home, 'maildir:/home/vmail/%d/%n' as mail, 10000 AS uid, 10000 AS gid, concat('dirsize:storage=', quota) AS quota FROM mailbox WHERE username = '%u' AND active = '1'
password_query = SELECT username as user, password, '/home/vmail/%d/%n' as userdb_home,'maildir:/home/vmail/%d/%n' as userdb_mail, 10000 as userdb_uid, 10000 as userd
b_gid FROM mailbox WHERE username = '%u' AND active = '1'

dovecotを再起動

# systemctl start dovecot.service
# systemctl enable dovecot.service

ここまで作業完了