2008 - Debian 4 - A mail server for an ISP

|=-------------------------------=[ Postfix ]=-----------------------------=|
+---------------------------------------------------------------------------+
|                                                                           |
|                           A mail server for an ISP                        |
|                                Debian 4.0 Etch                            |
|                                                                           |
+---------------------------------------------------------------------------+
|=-------------------------------=[ BH 2008 ]=-----------------------------=|

MailerDeploy = the directory holding the configuration files needed
               for the mail server and all of its components.

        MTA - postfix
        MDA - maildrop
        Antivir + Antispam - MailScanner
        Antispam - postgrey
        Antispam - RBL (vybrane)
        Antispam - DSPAM ( ??? uvidiime ??? )
        POP3s + IMAPs - Dovecot
        Webmail - OpenWebmail
        SeLinux - bolo by VERY FASA ;-)

        # nano /etc/apt/sources.list
        ----------------------------
        # STABLE
        deb http://ftp.sk.debian.org/debian/ etch main
        deb-src http://ftp.sk.debian.org/debian/ etch main

        # SECURITY
        deb http://security.debian.org/ etch/updates main contrib
        deb-src http://security.debian.org/ etch/updates main contrib

        # DEBIAN VOLATILE (clamav a spol)
        deb http://volatile.debian.org/debian-volatile etch/volatile main contrib non-free
        -------------------------------

-----------------
 Install postfix
-----------------

        Install postfix with the basic parameters for an Internet mail server.
        Konfigurak postfixu (main.cf) aj tak prepiseme vlastnou variantou (MailerDeploy/postfix/main.cf).

        # apt-get install postfix
        -------------------------
        General type of configuration? [Internet Site]
        Mail name? [mailhost.provider.example]

-------------------------
 Install SASL komponenty
-------------------------

        Install SASL support so that users can be authenticated
        -------------------------------------------------------
        # apt-get install libsasl2 sasl2-bin libsasl2-modules libdb3-util

----------------
 Config postfix
----------------

        Nakopirujeme konfigurak z MailerDeploy
        --------------------------------------
        # cp /root/MailerDeploy/postfix/main.cf /etc/postfix/

------------------------
 Config SASL overovanie
------------------------

        Nakopirujeme konfigurak z MailerDeploy
        --------------------------------------
        # cp /root/MailerDeploy/postfix/sasl/smtpd.conf /etc/postfix/sasl/

        Since postfix runs chrooted in /var/spool/postfix, SASL has to go into the jail as well
        ---------------------------------------------------------------------------------------
        # mkdir -p /var/spool/postfix/var/run/saslauthd

        # nano /etc/default/saslauthd
        -----------------------------
        START = yes
        OPTIONS="-m /var/spool/postfix/var/run/saslauthd -r -c"
        -----------------------------END /etc/default/saslauthd

        Restart saslauthd demona
        ------------------------
        # /etc/init.d/saslauthd restart

-----------------------------------------------
 TLS (vytvorenie samopodpisanych certifikatov)
-----------------------------------------------

        # cd /tmp
        # mkdir config
        # cd config
        # mkdir certs crl newcerts private
        # echo "01" > serial
        # cp /dev/null index.txt
        # cat /etc/ssl/openssl.cnf | sed -e 's/\.\/demoCA/\./' > openssl.cnf

        Vytvorenie novej CA
        -------------------
        # openssl req -new -x509 -keyout private/cakey.pem -out cacert.pem -days 365 -config openssl.cnf
        -------------------
        Enter PEM pass phrase: hsl4ca.CERt.78
        Country Name (2 letter code) [AU]:SK
        State or Province Name (full name) [Some-State]:Slovakia
        Locality Name (eg, city) []:Mesto
        Organization Name (eg, company) [Internet Widgits Pty Ltd]:Cassovianet s.r.o.
        Organizational Unit Name (eg, section) []:IT
        Common Name (eg, YOUR name) []:CA
        Email Address []:help@provider.example
        -------------------

        Vytvorenie certifikacnej poziadavky (cert request)
        --------------------------------------------------
        # openssl req -nodes -new -x509 -keyout newreq.pem -out newreq.pem -days 365 -config openssl.cnf
        -------------------
        Country Name (2 letter code) [AU]:SK
        State or Province Name (full name) [Some-State]:Slovakia
        Locality Name (eg, city) []:Mesto
        Organization Name (eg, company) [Internet Widgits Pty Ltd]:Cassovianet s.r.o.
        Organizational Unit Name (eg, section) []:IT
        Common Name (eg, YOUR name) []:mailhost.provider.example
        Email Address []:help@provider.example
        -------------------

        # openssl x509 -x509toreq -in newreq.pem -signkey newreq.pem -out tmp.pem

        Podpisanie certifikatu
        ----------------------
        # openssl ca -config openssl.cnf -policy policy_anything -out newcert.pem -infiles tmp.pem

??? tu nieco nehraje ??? -> chujove cesty !!!

Umiestnenie certifikatov
------------------------
# cp cacert.pem /usr/share/ssl/certs
# grep -B 100 "END RSA PRIVATE KEY" newreq.pem > /usr/share/ssl/certs/key.pem
# chmod 400 /usr/share/ssl/certs/key.pem
# cp newcert.pem /usr/share/ssl/certs/cert.pem

        Howto: ISP-style Email Server with Debian-Etch and Postfix 2.3
        --------------------------------------------------------------
        http://workaround.org/articles/ispmail-etch/

        Handling mail for multiple virtual domains with postfix
        -------------------------------------------------------
        http://www.debian-administration.org/articles/243