From f960c6b8365ad292ec224241e10bcdc46b8cc8e0 Mon Sep 17 00:00:00 2001
From: Xiao Pan <gky44px1999@gmail.com>
Date: Fri, 5 Apr 2024 03:30:54 +0000
Subject: default

---
 etc/dovecot/conf.d/10-ssl.conf | 82 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 82 insertions(+)
 create mode 100644 etc/dovecot/conf.d/10-ssl.conf

(limited to 'etc/dovecot/conf.d/10-ssl.conf')

diff --git a/etc/dovecot/conf.d/10-ssl.conf b/etc/dovecot/conf.d/10-ssl.conf
new file mode 100644
index 00000000..ad847664
--- /dev/null
+++ b/etc/dovecot/conf.d/10-ssl.conf
@@ -0,0 +1,82 @@
+##
+## SSL settings
+##
+
+# SSL/TLS support: yes, no, required. <doc/wiki/SSL.txt>
+#ssl = yes
+
+# PEM encoded X.509 SSL/TLS certificate and private key. They're opened before
+# dropping root privileges, so keep the key file unreadable by anyone but
+# root. Included doc/mkcert.sh can be used to easily generate self-signed
+# certificate, just make sure to update the domains in dovecot-openssl.cnf
+ssl_cert = </etc/ssl/certs/dovecot.pem
+ssl_key = </etc/ssl/private/dovecot.pem
+
+# If key file is password protected, give the password here. Alternatively
+# give it when starting dovecot with -p parameter. Since this file is often
+# world-readable, you may want to place this setting instead to a different
+# root owned 0600 file by using ssl_key_password = <path.
+#ssl_key_password =
+
+# PEM encoded trusted certificate authority. Set this only if you intend to use
+# ssl_verify_client_cert=yes. The file should contain the CA certificate(s)
+# followed by the matching CRL(s). (e.g. ssl_ca = </etc/ssl/certs/ca.pem)
+#ssl_ca = 
+
+# Require that CRL check succeeds for client certificates.
+#ssl_require_crl = yes
+
+# Directory and/or file for trusted SSL CA certificates. These are used only
+# when Dovecot needs to act as an SSL client (e.g. imapc backend or
+# submission service). The directory is usually /etc/ssl/certs in
+# Debian-based systems and the file is /etc/pki/tls/cert.pem in
+# RedHat-based systems. Note that ssl_client_ca_file isn't recommended with
+# large CA bundles, because it leads to excessive memory usage.
+#ssl_client_ca_dir =
+#ssl_client_ca_file =
+
+# Require valid cert when connecting to a remote server
+#ssl_client_require_valid_cert = yes
+
+# Request client to send a certificate. If you also want to require it, set
+# auth_ssl_require_client_cert=yes in auth section.
+#ssl_verify_client_cert = no
+
+# Which field from certificate to use for username. commonName and
+# x500UniqueIdentifier are the usual choices. You'll also need to set
+# auth_ssl_username_from_cert=yes.
+#ssl_cert_username_field = commonName
+
+# SSL DH parameters
+# Generate new params with `openssl dhparam -out /etc/dovecot/dh.pem 4096`
+# Or migrate from old ssl-parameters.dat file with the command dovecot
+# gives on startup when ssl_dh is unset.
+#ssl_dh = </etc/dovecot/dh.pem
+
+# Minimum SSL protocol version to use. Potentially recognized values are SSLv3,
+# TLSv1, TLSv1.1, TLSv1.2 and TLSv1.3, depending on the OpenSSL version used.
+#
+# Dovecot also recognizes values ANY and LATEST. ANY matches with any protocol
+# version, and LATEST matches with the latest version supported by library.
+#ssl_min_protocol = TLSv1.2
+
+# SSL ciphers to use, the default is:
+#ssl_cipher_list = ALL:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH
+# To disable non-EC DH, use:
+#ssl_cipher_list = ALL:!DH:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH
+
+# Colon separated list of elliptic curves to use. Empty value (the default)
+# means use the defaults from the SSL library. P-521:P-384:P-256 would be an
+# example of a valid value.
+#ssl_curve_list =
+
+# Prefer the server's order of ciphers over client's.
+#ssl_prefer_server_ciphers = no
+
+# SSL crypto device to use, for valid values run "openssl engine"
+#ssl_crypto_device =
+
+# SSL extra options. Currently supported options are:
+#   compression - Enable compression.
+#   no_ticket - Disable SSL session tickets.
+#ssl_options =
-- 
cgit v1.2.3-70-g09d2


From 416a0ca8403db1d0b841b958ad4bc5e93990af5e Mon Sep 17 00:00:00 2001
From: Xiao Pan <gky44px1999@gmail.com>
Date: Fri, 5 Apr 2024 12:02:22 +0000
Subject: Add email server configs

References:
https://github.com/LukeSmithxyz/emailwiz
https://landchad.net/
https://wiki.archlinux.org/title/Postfix
https://wiki.archlinux.org/title/Dovecot
https://wiki.archlinux.org/title/OpenDKIM
https://wiki.archlinux.org/title/OpenDMARC

Maybe useful:
https://doc.dovecot.org/settings/core/#dovecot-core-settings
https://workaround.org
https://kyun.host/docs/guides/email
`man postconf.5`

More necessary commands notes see arch_install.md
---
 etc/dovecot/conf.d/10-mail.conf   |  2 +-
 etc/dovecot/conf.d/10-master.conf | 12 ++++----
 etc/dovecot/conf.d/10-ssl.conf    |  8 +++---
 etc/nftables.conf                 | 16 +++++++----
 etc/opendkim/opendkim.conf        | 14 +++++-----
 etc/opendmarc/opendmarc.conf      |  3 +-
 etc/postfix/main.cf               | 59 +++++++++++++++++++++++++++++++++++++++
 etc/postfix/master.cf             | 37 +++++++++++++-----------
 8 files changed, 110 insertions(+), 41 deletions(-)

(limited to 'etc/dovecot/conf.d/10-ssl.conf')

diff --git a/etc/dovecot/conf.d/10-mail.conf b/etc/dovecot/conf.d/10-mail.conf
index de48f92d..49e70cb9 100644
--- a/etc/dovecot/conf.d/10-mail.conf
+++ b/etc/dovecot/conf.d/10-mail.conf
@@ -27,7 +27,7 @@
 #
 # <doc/wiki/MailLocation.txt>
 #
-#mail_location = 
+mail_location = maildir:~/Mail:INBOX=~/Mail/Inbox:LAYOUT=fs
 
 # If you need to set multiple mailbox locations or want to change default
 # namespace settings, you can do it by defining namespace sections.
diff --git a/etc/dovecot/conf.d/10-master.conf b/etc/dovecot/conf.d/10-master.conf
index 64fa0f2c..fb03c64c 100644
--- a/etc/dovecot/conf.d/10-master.conf
+++ b/etc/dovecot/conf.d/10-master.conf
@@ -100,16 +100,18 @@ service auth {
   # To give the caller full permissions to lookup all users, set the mode to
   # something else than 0666 and Dovecot lets the kernel enforce the
   # permissions (e.g. 0777 allows everyone full permissions).
-  unix_listener auth-userdb {
+  #unix_listener auth-userdb {
     #mode = 0666
     #user = 
     #group = 
-  }
+  #}
 
   # Postfix smtp-auth
-  #unix_listener /var/spool/postfix/private/auth {
-  #  mode = 0666
-  #}
+  unix_listener /var/spool/postfix/private/auth {
+    mode = 0666
+    user = postfix
+    group = postfix
+  }
 
   # Auth process is run as this user.
   #user = $default_internal_user
diff --git a/etc/dovecot/conf.d/10-ssl.conf b/etc/dovecot/conf.d/10-ssl.conf
index ad847664..b9c2263e 100644
--- a/etc/dovecot/conf.d/10-ssl.conf
+++ b/etc/dovecot/conf.d/10-ssl.conf
@@ -3,14 +3,14 @@
 ##
 
 # SSL/TLS support: yes, no, required. <doc/wiki/SSL.txt>
-#ssl = yes
+ssl = required
 
 # PEM encoded X.509 SSL/TLS certificate and private key. They're opened before
 # dropping root privileges, so keep the key file unreadable by anyone but
 # root. Included doc/mkcert.sh can be used to easily generate self-signed
 # certificate, just make sure to update the domains in dovecot-openssl.cnf
-ssl_cert = </etc/ssl/certs/dovecot.pem
-ssl_key = </etc/ssl/private/dovecot.pem
+ssl_cert = </etc/postfix/flylightning.pem
+ssl_key = </etc/postfix/flylightning.key
 
 # If key file is password protected, give the password here. Alternatively
 # give it when starting dovecot with -p parameter. Since this file is often
@@ -51,7 +51,7 @@ ssl_key = </etc/ssl/private/dovecot.pem
 # Generate new params with `openssl dhparam -out /etc/dovecot/dh.pem 4096`
 # Or migrate from old ssl-parameters.dat file with the command dovecot
 # gives on startup when ssl_dh is unset.
-#ssl_dh = </etc/dovecot/dh.pem
+ssl_dh = </etc/dovecot/dh.pem
 
 # Minimum SSL protocol version to use. Potentially recognized values are SSLv3,
 # TLSv1, TLSv1.1, TLSv1.2 and TLSv1.3, depending on the OpenSSL version used.
diff --git a/etc/nftables.conf b/etc/nftables.conf
index bd943c12..c4ca7f45 100644
--- a/etc/nftables.conf
+++ b/etc/nftables.conf
@@ -33,12 +33,16 @@ table inet my_table {
 		#udp dport qbt accept
 		#tcp dport iperf3 accept
 		udp dport wireguard accept
-		# email ports
-		#tcp dport smtp accept
-		#udp dport smtp accept
-		# other email ports? seems blocked by crunchbits
-		#tcp dport 465 accept
-		#tcp dport 587 accept
+		# for acme.sh standalone mode builtin webserver to renew ssl cert
+		tcp dport http accept
+		# email related ports
+		tcp dport smtp accept
+		tcp dport pop3 accept
+		tcp dport imap accept
+		tcp dport submissions accept
+		tcp dport submission accept
+		tcp dport imaps accept
+		tcp dport pop3s accept
 
 		pkttype host limit rate 5/second counter reject with icmpx type admin-prohibited
 		counter comment "count any other traffic"
diff --git a/etc/opendkim/opendkim.conf b/etc/opendkim/opendkim.conf
index fa3559a3..373c7213 100644
--- a/etc/opendkim/opendkim.conf
+++ b/etc/opendkim/opendkim.conf
@@ -127,7 +127,7 @@
 ##  omitted, "simple" is used.  Valid values for each are "simple" and
 ##  "relaxed".
 
-# Canonicalization	simple/simple
+Canonicalization	relaxed/simple
 
 ##  ClockDrift n
 ##  	default 300
@@ -160,7 +160,7 @@
 ##  Specify for which domain(s) signing should be done.  No default; must
 ##  be specified for signing.
 
-Domain			example.com
+Domain flylightning.xyz
 
 ##  DomainKeysCompat { yes | no }
 ##  	default "no"
@@ -245,7 +245,7 @@ Domain			example.com
 ##  SigningTable and KeyTable are used.  No default; must be specified for 
 ##  signing if SigningTable/KeyTable are not in use.
 
-KeyFile			/var/db/dkim/example.private
+KeyFile /etc/opendkim/mail.private
 
 ##  KeyTable dataset
 ##  	default (none)
@@ -570,7 +570,7 @@ KeyFile			/var/db/dkim/example.private
 ##  The name of the selector to use when signing.  No default; must be
 ##  specified for signing.
 
-Selector		my-selector-name
+Selector mail
 
 ##  SenderHeaders 	dataset
 ##  	default (none)
@@ -658,7 +658,7 @@ Selector		my-selector-name
 ##  inet:port			to listen on all interfaces
 ##  local:/path/to/socket	to listen on a UNIX domain socket
 
-Socket			inet:port@localhost
+Socket local:/run/opendkim/opendkim.sock
 
 ##  SoftwareHeader { yes | no }
 ##  	default "no"
@@ -758,7 +758,7 @@ Syslog			Yes
 ##  The system has its own default which will be used (usually 022).
 ##  See the umask(2) man page for more information.
 
-# UMask			022
+UMask 002
 
 ##  Userid userid
 ##  	default (none)
@@ -766,4 +766,4 @@ Syslog			Yes
 ##  Change to user "userid" before starting normal operation?  May include
 ##  a group ID as well, separated from the userid by a colon.
 
-# UserID		userid
+UserID opendkim
diff --git a/etc/opendmarc/opendmarc.conf b/etc/opendmarc/opendmarc.conf
index 84ea1a83..f8d8120c 100644
--- a/etc/opendmarc/opendmarc.conf
+++ b/etc/opendmarc/opendmarc.conf
@@ -286,7 +286,8 @@ IgnoreAuthenticatedClients true
 ##  address is used, it must be enclosed in square brackets.
 #
 # Socket inet:8893@localhost
-Socket unix:/var/spool/opendmarc/opendmarc.sock
+#Socket unix:/var/spool/opendmarc/opendmarc.sock
+Socket unix:/run/opendmarc/opendmarc.sock
 
 ##  SoftwareHeader { true | false }
 ##  	default "false"
diff --git a/etc/postfix/main.cf b/etc/postfix/main.cf
index 1d93a701..0c36d421 100644
--- a/etc/postfix/main.cf
+++ b/etc/postfix/main.cf
@@ -1,3 +1,62 @@
+# edit configs from:
+# https://wiki.archlinux.org/title/Postfix
+# GPL-3.0-only https://github.com/LukeSmithxyz/emailwiz
+# https://wiki.archlinux.org/title/OpenDMARC
+# https://wiki.archlinux.org/title/OpenDKIM
+# maybe useful things:
+# `man postconf.5`
+# print config: `postconf`
+# default config: `postconf -d`
+myhostname = mail.flylightning.xyz
+
+# fix "relay access denied" error when receiving emails
+# I choose to follow `man postconf.5` instruction to only add $mydomain
+# emailwiz way add a lot more to mydestination, see:
+# https://github.com/LukeSmithxyz/emailwiz/pull/275
+# https://github.com/LukeSmithxyz/emailwiz/issues/265
+mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
+
+smtp_tls_security_level = may
+smtpd_tls_security_level = may
+smtpd_use_tls = yes
+smtpd_tls_cert_file = /etc/postfix/flylightning.pem
+smtpd_tls_key_file = /etc/postfix/flylightning.key
+
+# Here we tell Postfix to look to Dovecot for authenticating users/passwords.
+# Dovecot will be putting an authentication socket in /var/spool/postfix/private/auth
+smtpd_sasl_auth_enable = yes
+smtpd_sasl_type = dovecot
+smtpd_sasl_path = private/auth
+
+# NOTE: the trailing slash here, or for any directory name in the home_mailbox
+# command, is necessary as it distinguishes a maildir (which is the actual
+# directory that we want) from a spoolfile (which is what old unix boomers want
+# and no one else).
+home_mailbox = Mail/Inbox/
+
+# https://wiki.archlinux.org/title/OpenDKIM
+non_smtpd_milters = unix:/run/opendkim/opendkim.sock, unix:/run/opendmarc/opendmarc.sock
+smtpd_milters = unix:/run/opendkim/opendkim.sock, unix:/run/opendmarc/opendmarc.sock
+
+# more emailwiz configs, maybe useful:
+
+# TLS required for authentication.
+#smtpd_tls_auth_only = yes
+
+# Exclude insecure and obsolete encryption protocols.
+#smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
+#smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
+#smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
+#smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
+
+# helo, sender, relay and recipient restrictions
+#smtpd_sender_login_maps = pcre:/etc/postfix/login_maps.pcre
+#smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_sender_login_mismatch, reject_unknown_reverse_client_hostname, reject_unknown_sender_domain
+#smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination, reject_unknown_recipient_domain
+#smtpd_relay_restrictions = permit_sasl_authenticated, reject_unauth_destination
+#smtpd_helo_required = yes
+#smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, reject_unknown_helo_hostname
+
 # Global Postfix configuration file. This file lists only a subset
 # of all parameters. For the syntax, and for a complete parameter
 # list, see the postconf(5) manual page (command: "man 5 postconf").
diff --git a/etc/postfix/master.cf b/etc/postfix/master.cf
index fd282dd2..7ce6e816 100644
--- a/etc/postfix/master.cf
+++ b/etc/postfix/master.cf
@@ -1,3 +1,6 @@
+# I follow these guides:
+# https://wiki.archlinux.org/title/Postfix#Secure_SMTP_(receiving)
+
 #
 # Postfix master process configuration file.  For details on the format
 # of the file, see the master(5) manual page (command: "man 5 master" or
@@ -16,13 +19,13 @@ smtp      inet  n       -       n       -       -       smtpd
 #tlsproxy  unix  -       -       n       -       0       tlsproxy
 # Choose one: enable submission for loopback clients only, or for any client.
 #127.0.0.1:submission inet n -   n       -       -       smtpd
-#submission inet n       -       n       -       -       smtpd
-#  -o syslog_name=postfix/submission
-#  -o smtpd_tls_security_level=encrypt
-#  -o smtpd_sasl_auth_enable=yes
-#  -o smtpd_tls_auth_only=yes
+submission inet n       -       n       -       -       smtpd
+  -o syslog_name=postfix/submission
+  -o smtpd_tls_security_level=encrypt
+  -o smtpd_sasl_auth_enable=yes
+  -o smtpd_tls_auth_only=yes
 #  -o local_header_rewrite_clients=static:all
-#  -o smtpd_reject_unlisted_recipient=no
+  -o smtpd_reject_unlisted_recipient=no
 #     Instead of specifying complex smtpd_<xxx>_restrictions here,
 #     specify "smtpd_<xxx>_restrictions=$mua_<xxx>_restrictions"
 #     here, and specify mua_<xxx>_restrictions in main.cf (where
@@ -30,17 +33,17 @@ smtp      inet  n       -       n       -       -       smtpd
 #  -o smtpd_client_restrictions=
 #  -o smtpd_helo_restrictions=
 #  -o smtpd_sender_restrictions=
-#  -o smtpd_relay_restrictions=
-#  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
-#  -o milter_macro_daemon_name=ORIGINATING
+  -o smtpd_relay_restrictions=
+  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
+  -o milter_macro_daemon_name=ORIGINATING
 # Choose one: enable submissions for loopback clients only, or for any client.
 #127.0.0.1:submissions inet n  -       n       -       -       smtpd
-#submissions     inet  n       -       n       -       -       smtpd
-#  -o syslog_name=postfix/submissions
-#  -o smtpd_tls_wrappermode=yes
-#  -o smtpd_sasl_auth_enable=yes
+submissions     inet  n       -       n       -       -       smtpd
+  -o syslog_name=postfix/submissions
+  -o smtpd_tls_wrappermode=yes
+  -o smtpd_sasl_auth_enable=yes
 #  -o local_header_rewrite_clients=static:all
-#  -o smtpd_reject_unlisted_recipient=no
+  -o smtpd_reject_unlisted_recipient=no
 #     Instead of specifying complex smtpd_<xxx>_restrictions here,
 #     specify "smtpd_<xxx>_restrictions=$mua_<xxx>_restrictions"
 #     here, and specify mua_<xxx>_restrictions in main.cf (where
@@ -48,9 +51,9 @@ smtp      inet  n       -       n       -       -       smtpd
 #  -o smtpd_client_restrictions=
 #  -o smtpd_helo_restrictions=
 #  -o smtpd_sender_restrictions=
-#  -o smtpd_relay_restrictions=
-#  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
-#  -o milter_macro_daemon_name=ORIGINATING
+  -o smtpd_relay_restrictions=
+  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
+  -o milter_macro_daemon_name=ORIGINATING
 #628       inet  n       -       n       -       -       qmqpd
 pickup    unix  n       -       n       60      1       pickup
 cleanup   unix  n       -       n       -       0       cleanup
-- 
cgit v1.2.3-70-g09d2