Centos7メールサーバ構築(postfix+Dovecot+PostfixAdmin+Let'sEncrypt)


# 概要
centos7でメールサーバー構築のメモです。

## サーバー既存情報
■OS

```
# cat /etc/redhat-release
CentOS Linux release 7.6.1810 (Core)
```
■MySQLがすでにインストールしている

```
# mysql --version
mysql  Ver 8.0.16 for Linux on x86_64 (MySQL Community Server - GPL)
```
■Apacheとmod_sslもインストール済

```
# httpd -v
Server version: Apache/2.4.6 (CentOS)
Server built:   Apr  2 2020 13:13:23
```


## 事前準備
■ドメイン：vmail.domain.jp
■管理者メール:admin@vmail.domain.jp

## 今回インストールするもの
■postfix

```
# postconf | grep mail_version
mail_version = 2.10.1
```

■Dovecot

```
# dovecot --version
2.2.36 (1f10bfa63)
```
■PostfixAdmin

```
postfixadmin-3.2.4
```
■PHP

```
# php -v
PHP 7.3.6 (cli) (built: May 28 2019 09:32:59) ( NTS )
Copyright (c) 1997-2018 The PHP Group
Zend Engine v3.3.6, Copyright (c) 1998-2018 Zend Technologies
```

## 作業手順
### Let's EncryptのスクリプトをGitでCloneします。

```
# git clone https://github.com/certbot/certbot /usr/local/certbot
```

### Dovecotをインストール

```
# yum -y install dovecot dovecot-mysql
```

### Postfix/PostfixAdminをインストール

```
# yum -y install postfix postfix-mysql
```


#### Remiのリポジトリ設定

```
# rpm -Uvh https://rpms.remirepo.net/enterprise/remi-release-7.rpm
```

#### phpをインストール

```
# yum clean all
# yum -y install php73-php
# yum -y install php73-php-{mbstring,imap,mysql}
```

#### Firewall設定

```
# firewall-cmd --permanent --add-port={80,443}/tcp
# firewall-cmd --permanent --add-port={25,110,143,465,587,993,995}/tcp
# firewall-cmd --reload
```

#### Let's Encryptで証明書を発行
>Certbot(Let's Encrypt)入門
https://certbot.open-code.club/

httpdが起動する場合、先にStopしておきましょう。

```
# systemctl stop httpd
```
証明書を発行

```
>/usr/local/certbot/certbot-auto certonly -n --standalone --agree-tos -d vmail.domain.jp -m admin@vmail.domain.jp --server https://acme-v02.api.letsencrypt.org/directory
```

成功した場合、/etc/letsencrypt/live/vmail.domain.jp/に証明書が作成されます。

```
# ll /etc/letsencrypt/live/vmail.domain.jp/
total 4
-rw-r--r-- 1 root root 692 May  4 21:04 README
lrwxrwxrwx 1 root root  48 May  4 21:04 cert.pem -> ../../archive/vmail.domain.jp/cert1.pem
lrwxrwxrwx 1 root root  49 May  4 21:04 chain.pem -> ../../archive/vmail.domain.jp/chain1.pem
lrwxrwxrwx 1 root root  53 May  4 21:04 fullchain.pem -> ../../archive/vmail.domain.jp/fullchain1.pem
lrwxrwxrwx 1 root root  51 May  4 21:04 privkey.pem -> ../../archive/vmail.domain.jp/privkey1.pem
```

Cronで毎日〜週に1回程度の頻度で自動更新するようにバッチ登録

```
echo "5 5 * * 1 root /usr/local/certbot/certbot-auto renew --pre-hook 'systemctl stop httpd' --post-hook 'systemctl reload postfix dovecot; systemctl start httpd'" > /etc/cron.d/certbot-auto
```

### PostfixAdminをインストール

```
# cd /srv/
# git clone https://github.com/postfixadmin/postfixadmin.git
# cd postfixadmin
```
postfixadmin-3.2.4をチェックアウトする

```
# git checkout postfixadmin-3.2.4
```

#### postfixのDBを準備

```
# mysql -u root -p
> CREATE DATABASE IF NOT EXISTS postfix;
> CREATE USER 'postfix'@'localhost' IDENTIFIED BY 'ここDBのパスワード';
> GRANT ALL PRIVILEGES ON postfix.* TO 'postfix'@'localhost';
> FLUSH PRIVILEGES;
```

#### postfixadmin DB設定ファイルを作成

```
# vi /srv/postfixadmin/config.local.php
```
以下の内容を追加

```
<?php
$CONF['configured'] = true;
$CONF['default_language'] = 'ja';
$CONF['database_type'] = 'mysqli';
$CONF['database_user'] = 'postfix';
$CONF['database_password'] = 'ここDBのパスワード';
$CONF['database_name'] = 'postfix';
$CONF['domain_path'] = 'YES';
$CONF['domain_in_mailbox'] = 'NO';
$CONF['dovecotpw'] = "doveadm pw -s SHA512-CRYPT";
$CONF['encrypt'] = 'dovecot:SHA512-CRYPT';
$CONF['footer_link'] = 'https://vmail.domain.jp/postfixadmin/';
$CONF['footer_text'] = 'Return to vmail.domain.jp/postfixadmin/';
?>
```

#### テンプレートフォルダ作成

```
# mkdir -p /srv/postfixadmin/templates_c
# chown -R apache /srv/postfixadmin/templates_c
```

#### Apacheにpostfixadminの設定を追加

```
vi /etc/httpd/conf.d/postfixadmin.conf
```  
以下の内容を追加

```
<VirtualHost *:443>

    ServerName vmail.domain.jp
    ServerAlias vmail.domain.jp
    DocumentRoot /var/www/html/

    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/vmail.domain.jp/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/vmail.domain.jp/privkey.pem
    SSLCertificateChainFile /etc/letsencrypt/live/vmail.domain.jp/chain.pem

    <Directory "/var/www/html">
      Options -Indexes
      Order Deny,Allow
      Deny from None
      Allow from All
    </Directory>

    Alias /postfixadmin "/srv/postfixadmin/public"
    <Directory "/srv/postfixadmin/public">
        DirectoryIndex index.html index.php
        AllowOverride All
        Options FollowSymlinks
        Require all granted
    </Directory>

</VirtualHost>
<VirtualHost *:80>
    ServerName vmail.domain.jp
    ServerAlias vmail.domain.jp

    Redirect / https://vmail.domain.jp/
</VirtualHost>
```
セットアップ実⾏

```
# curl -s -o /dev/null -L -k　https://vmail.domain.jp/postfixadmin/setup.php
```

PostfixADminの初期ユーザ登録

```
# /srv/postfixadmin/scripts/postfixadmin-cli admin add admin@vmail.domain.jp --superadmin 1 --active 1 --password 'パスワード' --password2'パスワード'
# /srv/postfixadmin/scripts/postfixadmin-cli domain add vmail.domain.jp
# /srv/postfixadmin/scripts/postfixadmin-cli domain update vmail.domain.jp --mailboxes 0
# /srv/postfixadmin/scripts/postfixadmin-cli mailbox add admin@vmail.domain.jp --password 'パスワード' --password2 'パスワード'

転送設定
# /srv/postfixadmin/scripts/postfixadmin-cli alias add root@vmail.domain.jp --goto admin@vmail.domain.jp
# /srv/postfixadmin/scripts/postfixadmin-cli alias update abuse@vmail.domain.jp --goto admin@vmail.domain.jp
# /srv/postfixadmin/scripts/postfixadmin-cli alias update hostmaster@vmail.domain.jp --goto admin@vmail.domain.jp
# /srv/postfixadmin/scripts/postfixadmin-cli alias update postmaster@vmail.domain.jp --goto admin@vmail.domain.jp
# /srv/postfixadmin/scripts/postfixadmin-cli alias update webmaster@vmail.domain.jp --goto admin@vmail.domain.jp
```

### Postfix設定

```
postconf -e smtpd_banner='$myhostname ESMTP'
postconf -e smtp_header_checks='regexp:/etc/postfix/smtp_header_checks'
postconf -e mime_header_checks='regexp:/etc/postfix/mime_header_checks'
postconf -e disable_vrfy_command=yes
postconf -e smtpd_helo_required=yes
postconf -e inet_interfaces=all
postconf -e myhostname=vmail.domain.jp
postconf -e mydestination='localhost.$mydomain, localhost'
postconf -e relay_domains='$mydestination'
postconf -e virtual_alias_maps='proxy:mysql:/etc/postfix/virtual_alias_maps.cf'
postconf -e virtual_mailbox_domains=proxy:mysql:/etc/postfix/virtual_mailbox_domains.cf
postconf -e virtual_mailbox_maps='proxy:mysql:/etc/postfix/virtual_mailbox_maps.cf'
postconf -e virtual_mailbox_base='/home/vmail'
postconf -e virtual_mailbox_limit=512000000
postconf -e message_size_limit=20480000
postconf -e virtual_minimum_uid=10000
postconf -e virtual_transport=virtual
postconf -e virtual_uid_maps='static:10000'
postconf -e virtual_gid_maps='static:10000'
postconf -e local_transport=virtual
postconf -e local_recipient_maps='$virtual_mailbox_maps'
postconf -e transport_maps='hash:/etc/postfix/transport'
postconf -e smtpd_sasl_auth_enable=yes
postconf -e smtpd_sasl_type=dovecot
postconf -e smtpd_sasl_path='/var/run/dovecot/auth-client'
postconf -e smtpd_recipient_restrictions='permit_auth_destination, permit_mynetworks, permit_sasl_authenticated,reject_unauth_destination'
postconf -e smtpd_client_restrictions='permit_mynetworks, reject_unknown_client, permit'
postconf -e smtpd_sender_restrictions='reject_unknown_sender_domain, reject_non_fqdn_sender'
postconf -e smtpd_relay_restrictions='permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination'
postconf -e smtpd_sasl_security_options=noanonymous
postconf -e smtpd_sasl_tls_security_options='$smtpd_sasl_security_options'
postconf -e smtpd_tls_security_level=may
postconf -e smtpd_tls_auth_only=yes
postconf -e smtpd_tls_received_header=yes
postconf -e smtpd_tls_cert_file=/etc/letsencrypt/live/vmail.domain.jp/fullchain.pem
postconf -e smtpd_tls_key_file=/etc/letsencrypt/live/vmail.domain.jp/privkey.pem
postconf -e smtpd_tls_CAfile='/etc/pki/tls/certs/ca-bundle.crt'
postconf -e smtpd_tls_mandatory_protocols='!SSLv2,!SSLv3,!TLSv1,!TLSv1.1'
postconf -e smtpd_tls_protocols='!SSLv2,!SSLv3,!TLSv1,!TLSv1.1'
postconf -e smtpd_tls_ask_ccert=yes
postconf -e smtpd_tls_mandatory_ciphers=high
postconf -e smtpd_use_tls=yes
postconf -e smtpd_sasl_local_domain='$mydomain'
postconf -e broken_sasl_auth_clients=yes
postconf -e smtpd_tls_loglevel=1
postconf -e smtp_tls_security_level=may
postconf -e smtp_tls_loglevel=1
postconf -e smtp_tls_mandatory_protocols='!SSLv2,!SSLv3,!TLSv1,!TLSv1.1'
postconf -e smtp_tls_protocols='!SSLv2,!SSLv3,!TLSv1,!TLSv1.1'
```

#### /etc/postfix/master.cf変更

```
vi /etc/postfix/master.cf

submission inet n       -       n       -       -       smtpd
↑#を削除
smtps     inet  n       -       n       -       -       smtpd
↑#を削除
↑の下に以下を追加
 -o smtpd_tls_wrappermode=yes
 -o smtpd_sasl_auth_enable=yes
```

送信者の IP とユーザーエージェントを Received ヘッダに載せない

```
# vi /etc/postfix/smtp_header_checks
```
以下を追加

```
/^Received: .*/ IGNORE
/^User-Agent: .*/ IGNORE
```

ヘッダの取り扱いを追加

```
vi /etc/postfix/mime_header_checks
```
以下を追加

```
/^Mime-Version:/ IGNORE
```

#### DBの接続設定追加

virtual_alias_maps.cf

```
# vi /etc/postfix/virtual_alias_maps.cf
user = postfix
password = ここDBのパスワード
hosts = localhost
dbname = postfix
table = alias
select_field = goto
where_field = address
```
virtual_mailbox_domains.cf

```
# vi /etc/postfix/virtual_mailbox_domains.cf
user = postfix
password = ここDBのパスワード
hosts = localhost
dbname = postfix
table = domain
select_field = domain
where_field = domain
```
virtual_mailbox_maps.cf

```
# vi /etc/postfix/virtual_mailbox_maps.cf
user = postfix
password = ${DATABASE_PASSWORD}
hosts = localhost
dbname = postfix
table = mailbox
select_field = maildir
where_field = username
```

#### postfixをリロードする

```
#　postmap /etc/postfix/transport
#　systemctl restart postfix.service
#　systemctl enable postfix.service
```

### Dovecot設定

```
# groupadd -g 10000 vmail
# useradd -u 10000 -g vmail -s /usr/bin/nologin -d /home/vmail -m vmail
# mkdir -p /home/vmail/vmail.domain.jp/admin/{cur,new,tmp}
# chown -R vmail. /home/vmail/
```

dovecot.conf

```
# vi /etc/dovecot/dovecot.conf
#!include conf.d/*.conf
↑#を追加
↓を最後に追加
protocols = imap pop3
auth_mechanisms = plain
passdb {
driver = sql
args = /etc/dovecot/dovecot-sql.conf
}
userdb {
driver = sql
args = /etc/dovecot/dovecot-sql.conf
}
service auth {
unix_listener auth-client {
group = postfix
mode = 0660
user = postfix
}
user = root
}
mail_home = /home/vmail/%d/%n
mail_location = maildir:~
ssl = yes
ssl_cert = </etc/letsencrypt/live/vmail.domain.jp/fullchain.pem
ssl_key = </etc/letsencrypt/live/vmail.domain.jp/privkey.pem
ssl_protocols = !SSLv3 !TLSv1 !TLSv1.1
```

dovecot-sql.conf

```
# vi /etc/dovecot/dovecot-sql.conf
driver = mysql
connect = host=localhost dbname=postfix user=postfix password=ここDBのパスワード
default_pass_scheme = SHA512-CRYPT
user_query = SELECT '/home/vmail/%d/%n' as home, 'maildir:/home/vmail/%d/%n' as mail, 10000 AS uid, 10000 AS gid, concat('dirsize:storage=', quota) AS quota FROM mailbox WHERE username = '%u' AND active = '1'
password_query = SELECT username as user, password, '/home/vmail/%d/%n' as userdb_home,'maildir:/home/vmail/%d/%n' as userdb_mail, 10000 as userdb_uid, 10000 as userd
b_gid FROM mailbox WHERE username = '%u' AND active = '1'
```

#### dovecotを再起動

```
# systemctl start dovecot.service
# systemctl enable dovecot.service
```

ここまで作業完了