Postfix als Mailserver mit Dovecot und PostfixAdmin¶

nano /home/beispiel.conf

content = Dokumentationen

domain  = example.com
owner   = root

[...]
domain  = example.com
[...]

nano /home/beispiel.map

[email protected]
[email protected]

sudo -i

apt update && apt upgrade

hostnamectl set-hostname mailserver
cat /etc/hostname > /etc/mailname

nano /etc/hosts

127.0.1.1       mailserver.example.com mailserver
[...]

apt install apt-transport-https
LC_ALL=C.UTF-8 add-apt-repository ppa:ondrej/php
apt update

curl -LsS https://r.mariadb.com/downloads/mariadb_repo_setup | sudo bash -s -- --mariadb-server-version="mariadb-11.4"
apt update

apt install apt install postfix postfix-mysql postfix-pcre dovecot-core dovecot-imapd dovecot-mysql dovecot-managesieved dovecot-sieve mariadb-server apache2 libapache2-mod-php8.4 php8.4 php8.4-mysql php8.4-mbstring php8.4-imap fail2ban whois

groupadd -g 5000 vmailer
useradd -s /usr/sbin/nologin -u 5000 -g 5000 vmailer

mkdir /var/spool/mail/virtual
mkdir /var/spool/mail/virtual/deleted-maildirs
chown -R vmailer:vmailer /var/spool/mail/virtual

mysql_secure_installation
    [...]
    Enter current password for root (enter for none): "Enter"
    [...]
    Switch to unix_socket authentication [Y/n] n
    [...]
    Change the root password? [Y/n] :y
    New password: SicheresRootPasswortVerwenden!
    Re-enter new password: SicheresRootPasswortVerwenden!
    [...]
    Remove anonymous users? [Y/n] :y
    [...]
    Disallow root login remotely? [Y/n] :y
    [...]
    Remove test database and access to it? [Y/n] :y
    [...]
    Reload privilege tables now? [Y/n] :y
    [...]
    Thanks for using MariaDB!

apt update
apt install snapd
snap install core
snap refresh core
snap install --classic certbot
ln -s /snap/bin/certbot /usr/bin/certbot

sudo certbot certonly --apache -d mailserver.example.com

nano /etc/letsencrypt/renewal-hooks/deploy/reload-services.sh

#!/bin/bash
services=(
    apache2
    postfix
    dovecot
)

for service in "${services[@]}"; do
    if systemctl is-active --quiet "$service"; then
        echo "[Certbot-Hook] Reloading $service"
        systemctl reload "$service"
    else
        echo "[Certbot-Hook] $service is not active"
    fi
done

chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-services.sh

cd /etc/ssl/private
openssl dhparam -out dh4096.tmp 4096 && mv dh4096.tmp dh4096.pem
chmod 600 dh4096.pem

a2dissite 000-default.conf

rm -R /var/www/html

nano /etc/apache2/sites-available/new-default.conf

<VirtualHost *:80>
    ServerName example.com
    ServerAdmin [email protected]

    DocumentRoot /var/www

    #Weiterleitung von HTTP zu HTTPS
    RewriteEngine On
    RewriteCond %{HTTPS} !=on
    RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]

    LogLevel warn
    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

[...]
ServerName example.com
ServerAdmin [email protected]
[...]

nano /etc/apache2/sites-available/new-default-ssl.conf

<IfModule mod_ssl.c>
    <VirtualHost _default_:443>
        ServerName example.com
        ServerAdmin [email protected]

        DocumentRoot /var/www

        # Aktivieren Sie diese Option, wenn Sie ein offiziell siginiertes SSL-Zertifikat verwenden und Zugriffe ausschliesslich über SSL stattfinden.
        #Header always set Strict-Transport-Security "max-age=31556926; includeSubDomains"

        SSLEngine on
        SSLCompression Off
        SSLHonorCipherOrder on
        SSLProtocol -ALL +TLSv1.2 +TLSv1.3
        SSLCipherSuite EECDH+AESGCM:EECDH+CHACHA20:HIGH:!aNULL:!MD5:!3DES:!RC4:!SHA1:!CAMELLIA:!SEED:!EDH:!DSS
        SSLOpenSSLConfCmd Curves X25519:secp521r1:secp384r1:prime256v1

        SSLCertificateFile /etc/letsencrypt/live/mailserver.example.com/fullchain.pem
        SSLCertificateKeyFile /etc/letsencrypt/live/mailserver.example.com/privkey.pem

        LogLevel warn
        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined
    </VirtualHost>
</IfModule>

[...]
        ServerName example.com
        ServerAdmin [email protected]
[...]
        # Nur anpassen, wenn Sie ein anderes Zertifikat verwenden!
        SSLCertificateFile /etc/letsencrypt/live/mailserver.example.com/fullchain.pem
        SSLCertificateKeyFile /etc/letsencrypt/live/mailserver.example.com/privkey.pem
[...]

nano /etc/apache2/conf-available/security.conf

[...]
ServerTokens Prod
[...]
ServerSignature Off
[...]

a2enmod ssl rewrite
a2ensite new-default.conf new-default-ssl.conf
service apache2 restart

wget https://github.com/postfixadmin/postfixadmin/archive/refs/tags/postfixadmin-3.3.15.tar.gz
tar -xzf postfixadmin-3.3.15.tar.gz -C /usr/share/

 mv /usr/share/postfixadmin-postfixadmin-3.3.15/ /usr/share/postfixadmin

mkdir /usr/share/postfixadmin/templates_c
chown -R www-data:www-data /usr/share/postfixadmin/templates_c

ln -s /usr/share/postfixadmin/public /var/www/postfixadmin

mysql -u root -p

CREATE DATABASE postfix;
CREATE USER 'postfix'@'localhost' IDENTIFIED BY 'SicheresPasswortVerwenden!';
GRANT ALL PRIVILEGES ON `postfix` . * TO 'postfix'@'localhost';
FLUSH PRIVILEGES;
QUIT;

cp /usr/share/postfixadmin/ADDITIONS/postfixadmin-mailbox-postdeletion.sh /usr/local/bin/
cp /usr/share/postfixadmin/ADDITIONS/postfixadmin-domain-postdeletion.sh /usr/local/bin/

nano /usr/local/bin/postfixadmin-mailbox-postdeletion.sh

[...]
basedir=/var/spool/mail/virtual
[...]
trashbase=/var/spool/mail/virtual/deleted-maildirs
[...]

nano /usr/local/bin/postfixadmin-domain-postdeletion.sh

[...]
basedir=/var/spool/mail/virtual
[...]
trashbase=/var/spool/mail/virtual/deleted-maildirs
[...]

chmod +x /usr/local/bin/postfixadmin-*

nano /etc/sudoers.d/postfixadmin

www-data ALL=(vmailer) NOPASSWD: /usr/local/bin/postfixadmin-domain-postdeletion.sh
#end (Zeile unbedingt mitkopieren! Sonst funktioniert die Datei nicht.)

chmod 440 /etc/sudoers.d/postfixadmin

nano /etc/cron.daily/postfixadmin-cleanup-deleted-maildirs

#!/bin/sh
#
#            ___________       .__.__  .__       .__     __
#            \__    ___/_  _  _|__|  | |__| ____ |  |___/  |_
#              |    |  \ \/ \/ /  |  | |  |/ ___\|  |  \   __\
#              |    |   \     /|  |  |_|  / /_/  >   Y  \  |
#              |____|    \/\_/ |__|____/__\___  /|___|  /__|
#                                        /_____/      \/
#
#  Twilight-Networks ∙ est. 2k1 ∙ fxp ∙ h4x ∙ nfo ∙ scene ∙ legacy lives
#  Keep it lean, keep it silent. Code like it's 2002.
#
#########################################################################
# Script Name   : postfixadmin-cleanup-deleted-maildirs
# Description   : Removes deleted-maildirs from Filesystem after X days
#                 Runs automatically by a Cron-Job
#
# Version       : 1.01
# Last Update   : 05.04.2025
# Author        : Twilight
# Contact       : [email protected]
# Web:          : https://www.twilight-networks.com
#
# Tested with   : Ubuntu 24.04 LTS
#
#########################################################################


# Config

# Deleted-Maildirs-Folder
dir='/var/spool/mail/virtual/deleted-maildirs'
# Days until deletion
days='30'


# Below this line: scene code. You break it, you bought it.
#########################################################################

find $dir -type d -name "*[0-9][0-9][0-9][0-9]-[0-1][0-9]-[0-3][0-9]*" -exec sh -c 'days='$days' fdate=$(basename ${1%\_*\_*});\
 [ "$fdate" "<" "$(date +%F -d "$days days ago")" ] && rm -R "$1"' find-sh {} > /dev/null 2>&1 \;

exit 0
#end

chmod +x /etc/cron.daily/postfixadmin-cleanup-deleted-maildirs

nano /usr/share/postfixadmin/config.local.php

<?php
# Datenbank-Verbindung
$CONF['database_type'] = 'mysqli';
$CONF['database_host'] = 'localhost';
$CONF['database_user'] = 'postfix';
$CONF['database_password'] = 'SicheresPasswortVerwenden!';
$CONF['database_name'] = 'postfix';

# Pflicht-Aliase nach RFC 2142 und RFC 2821
$CONF['default_aliases'] = array (
'abuse' => '[email protected]',
'hostmaster' => '[email protected]',
'postmaster' => '[email protected]',
'webmaster' => '[email protected]'
);

# Quota in Mbyte
$CONF['quota'] = 'YES';
$CONF['used_quotas'] = 'YES';
$CONF['aliases'] = '10';
$CONF['mailboxes'] = '10';
$CONF['maxquota'] = '10';
$CONF['domain_quota_default'] = '2048';

# Sonstiges
$CONF['configured'] = true;
$CONF['show_footer_text'] = 'NO';

$CONF['mailbox_postdeletion_script']='sudo -u vmailer /usr/local/bin/postfixadmin-mailbox-postdeletion.sh';
$CONF['domain_postdeletion_script'] = 'sudo -u vmailer /usr/local/bin/postfixadmin-domain-postdeletion.sh';
?>

[...]
$CONF['database_password'] = 'SicheresPasswortVerwenden!';
[...]
# Geben Sie hier den Empfänger der Pflicht-Aliase an.
$CONF['default_aliases'] = array (
    'abuse' => '[email protected]',
    'hostmaster' => '[email protected]',
    'postmaster' => '[email protected]',
    'webmaster' => '[email protected]'
[...]
# Default-Werte pro Domain. Quota in Mbyte.
$CONF['aliases'] = '10';
$CONF['mailboxes'] = '10';
$CONF['maxquota'] = '10';
$CONF['domain_quota_default'] = '2048';
[...]

service apache2 restart

sh /usr/share/postfixadmin/DOCUMENTS/POSTFIX_CONF.txt
    /tmp/postfixadmin-I5MG0h
    Database host? (often localhost)
    localhost
    Database name?
    postfix
    Database user?
    postfix
    Database password?
    SicheresPasswortVerwenden!
    Config files have been written to /tmp/postfixadmin-I5MG0h. Please check their content and move them to /etc/postfix/sql/.
    Do not forget to edit /etc/postfix/main.cf as described in /usr/share/postfixadmin/DOCUMENTS/POSTFIX_CONF.txt.

mkdir /etc/postfix/sql
mv /tmp/postfixadmin-I5MG0h/mysql_virtual_* /etc/postfix/sql/

nano /etc/postfix/sql/mysql_sender_login_maps.cf

user = postfix
password = SicheresPasswortVerwenden!
hosts = localhost
dbname = postfix
query = SELECT username AS allowedUser FROM mailbox WHERE username="%s" AND active = 1 UNION SELECT goto FROM alias WHERE address="%s" AND active = 1

[...]
password = SicheresPasswortVerwenden!
[...]

chown root:postfix /etc/postfix/sql/*.cf
chmod 640 /etc/postfix/sql/*.cf

mv /etc/postfix/master.cf /etc/postfix/master.cf.bak

nano /etc/postfix/master.cf

# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (yes)   (never) (100)
# ==========================================================================
smtp      inet  n       -       n       -       -       smtpd

submission inet  n       -       n       -       -       smtpd
        -o smtpd_tls_security_level=encrypt
        -o smtpd_sasl_auth_enable=yes
        -o smtpd_client_restrictions=permit_sasl_authenticated,reject
        -o smtpd_helo_restrictions=permit_sasl_authenticated,reject
        -o smtpd_sender_restrictions=reject_sender_login_mismatch,permit_sasl_authenticated,reject
        -o smtpd_relay_restrictions=permit_sasl_authenticated,reject_unauth_destination
        -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
        -o cleanup_service_name=submission-header_checks

dovecot   unix  -       n       n       -       -       pipe
    flags=DRhu user=vmailer:vmailer argv=/usr/lib/dovecot/dovecot-lda -f ${sender} -d ${recipient}

submission-header_checks unix n - n    -       0       cleanup
        -o header_checks=pcre:${config_directory}/header_checks


pickup    unix  n       -       n       60      1       pickup
cleanup   unix  n       -       n       -       0       cleanup
qmgr      unix  n       -       n       300     1       qmgr
tlsmgr    unix  -       -       n       1000?   1       tlsmgr
rewrite   unix  -       -       n       -       -       trivial-rewrite
bounce    unix  -       -       n       -       0       bounce
defer     unix  -       -       n       -       0       bounce
trace     unix  -       -       n       -       0       bounce
verify    unix  -       -       n       -       1       verify
flush     unix  n       -       n       1000?   0       flush
proxymap  unix  -       -       n       -       -       proxymap
proxywrite unix -       -       n       -       1       proxymap
smtp      unix  -       -       n       -       -       smtp
relay     unix  -       -       n       -       -       smtp
showq     unix  n       -       n       -       -       showq
error     unix  -       -       n       -       -       error
retry     unix  -       -       n       -       -       error
discard   unix  -       -       n       -       -       discard
local     unix  -       n       n       -       -       local
virtual   unix  -       n       n       -       -       virtual
lmtp      unix  -       -       n       -       -       lmtp
anvil     unix  -       -       n       -       1       anvil
scache    unix  -       -       n       -       1       scache

#
# ====================================================================

rm /etc/postfix/main.cf

nano /etc/postfix/main.cf

# HOST CONFIGURATION
#########################################################################

myhostname                              = mailserver.example.com
mydomain                                = example.com
myorigin                                = $mydomain
mynetworks_style                        = host
inet_interfaces                         = all
inet_protocols                          = ipv4
mail_owner                              = postfix
setgid_group                            = postdrop
delay_warning_time                      = 4h
alias_maps                              = hash:/etc/aliases
alias_database                          = $alias_maps
local_transport                         = dovecot
local_recipient_maps                    = $virtual_mailbox_maps
config_directory                        = /etc/postfix
compatibility_level                     = 3.6

# maximale Mailboxgrösse in Byte (Wird durch PostfixAdmin-Quota geregelt, 0 = unbegrenzt)
mailbox_size_limit                      = 0
# maximale Nachrichtengrösse in Byte (50 MByte)
message_size_limit                      = 52428800


# VIRTUAL CONFIGURATION
#########################################################################

virtual_transport                       = dovecot

virtual_mailbox_domains                 = proxy:mysql:${config_directory}/sql/mysql_virtual_domains_maps.cf
virtual_alias_maps =
   proxy:mysql:${config_directory}/sql/mysql_virtual_alias_maps.cf,
   proxy:mysql:${config_directory}/sql/mysql_virtual_alias_domain_maps.cf,
   proxy:mysql:${config_directory}/sql/mysql_virtual_alias_domain_catchall_maps.cf
virtual_mailbox_maps =
   proxy:mysql:${config_directory}/sql/mysql_virtual_mailbox_maps.cf,
   proxy:mysql:${config_directory}/sql/mysql_virtual_alias_domain_mailbox_maps.cf


# SMTPD CONFIGURATION
#########################################################################

smtpd_banner                            = $myhostname ESMTP Service Ready
smtpd_helo_required                     = yes
smtpd_delay_reject                      = yes
smtpd_error_sleep_time                  = 1s
smtpd_soft_error_limit                  = 10
smtpd_hard_error_limit                  = 20
smtpd_recipient_limit                   = 16
smtpd_client_message_rate_limit         = 30
smtpd_client_connection_count_limit     = 100
smtpd_client_connection_rate_limit      = 100

smtp_helo_timeout                       = 60s

soft_bounce                             = no
disable_vrfy_command                    = yes
mime_header_checks                      = regexp:${config_directory}/mime_header_checks.regexp

smtpd_sender_login_maps                 = mysql:${config_directory}/sql/mysql_sender_login_maps.cf


#SMTPD Restrictions
#########################################################################

# Client
smtpd_client_restrictions =
    permit_mynetworks
    reject_unknown_client_hostname
    reject_unknown_reverse_client_hostname
    reject_unauth_pipelining

# HELO
smtpd_helo_restrictions =
    permit_mynetworks
    check_recipient_access hash:${config_directory}/roleaccount_exceptions
    reject_invalid_helo_hostname
    reject_unknown_helo_hostname
    reject_non_fqdn_helo_hostname
    check_helo_access pcre:/etc/postfix/helo_checks
    reject_unauth_pipelining

# MAIL FROM:<...>
smtpd_sender_restrictions =
    permit_mynetworks
    reject_non_fqdn_sender
    reject_unknown_sender_domain
    reject_unauth_pipelining

# RCPT TO:<...>
smtpd_relay_restrictions =
    check_sender_access regexp:${config_directory}/add_x_envelope_from
    permit_mynetworks
    reject_unauth_destination
    reject_unauth_pipelining

smtpd_recipient_restrictions =
    reject_unlisted_recipient
    check_policy_service unix:private/quota-status
    permit_mynetworks
    reject_unauth_pipelining

# DATA
smtpd_data_restrictions =
    reject_multi_recipient_bounce
    reject_unauth_pipelining


#TLS
#########################################################################

tls_eecdh_strong_curve                  = prime256v1
tls_eecdh_ultra_curve                   = secp384r1
tls_random_source                       = dev:/dev/urandom
tls_preempt_cipherlist                  = yes
tls_high_cipherlist                     = EECDH+AESGCM:EDH+AESGCM:EECDH+AES:EDH+AES
tls_medium_cipherlist                   = EECDH+AESGCM:EDH+AESGCM:EECDH+AES:EDH+AES
tls_low_cipherlist                      = EECDH+AESGCM:EDH+AESGCM:EECDH+AES:EDH+AES

smtp_tls_mandatory_protocols            = >=TLSv1.2
smtp_tls_protocols                      = >=TLSv1.2
smtp_tls_note_starttls_offer            = yes
smtp_tls_security_level                 = may

smtp_tls_session_cache_timeout          = 3600
smtp_tls_session_cache_database         = btree:/var/lib/postfix/smtp_scache

smtpd_tls_mandatory_protocols           = >=TLSv1.2
smtpd_tls_protocols                     = >=TLSv1.2
smtpd_tls_security_level                = may
smtpd_tls_auth_only                     = yes
smtpd_tls_received_header               = yes
smtpd_tls_mandatory_ciphers             = high
smtpd_tls_ciphers                       = high
smtpd_tls_eecdh_grade                   = strong
smtpd_tls_dh1024_param_file             = /etc/ssl/private/dh4096.pem

smtpd_client_new_tls_session_rate_limit = 60
smtpd_tls_session_cache_timeout         = 3600s
smtpd_tls_session_cache_database        = btree:/var/lib/postfix/smtpd_scache

smtpd_tls_key_file                      = /etc/letsencrypt/live/mailserver.example.com/privkey.pem
smtpd_tls_cert_file                     = /etc/letsencrypt/live/mailserver.example.com/fullchain.pem


#SASL Authentication
#########################################################################

smtpd_sasl_type                         = dovecot
smtpd_sasl_path                         = private/auth
smtpd_sasl_security_options             = noanonymous
smtpd_sasl_authenticated_header         = yes
broken_sasl_auth_clients                = yes


# Queue
#########################################################################

queue_run_delay                         = 300s
maximal_queue_lifetime                  = 7d
bounce_queue_lifetime                   = 5d
minimal_backoff_time                    = 300s
maximal_backoff_time                    = 4000s
qmgr_message_active_limit               = 10000
qmgr_message_recipient_limit            = 10000


# DEBUG CONFIGURATION
#########################################################################

smtp_tls_loglevel                       = 1
smtpd_tls_loglevel                      = 1
debug_peer_level                        = 2

myhostname      = mailserver.example.com
mydomain        = example.com
[...]
# Nur anpassen, wenn Sie ein anderes Zertifikat verwenden!
smtpd_tls_key_file      = /etc/letsencrypt/live/mailserver.example.com/privkey.pem
smtpd_tls_cert_file     = /etc/letsencrypt/live/mailserver.example.com/fullchain.pem
[...]

nano /etc/postfix/main.cf

[...]
mynetworks          = 127.0.0.0/8, [::1/128]
[...]
inet_protocols      = ipv4, ipv6
[...]

nano /etc/postfix/helo_checks

/^mailserver\.example\.com$/        550 That's not your hostname
/^example\.com$/                    550 That's not your domain
/^192\.0\.2\.42$/                   550 That's not your IP-Address

nano /etc/postfix/roleaccount_exceptions

postmaster@     OK
abuse@          OK
hostmaster@     OK
webmaster@      OK

postmap hash:/etc/postfix/roleaccount_exceptions

nano /etc/postfix/header_checks

# SPAM-Agent
/^X-Spam-Checker-Version:/      IGNORE
/^X-Sanitizer:/                 IGNORE

# Mail-Client
/^Received:/                    IGNORE
/^User-Agent:/                  IGNORE
/^X-Forward:/                   IGNORE
/^X-Mailer:/                    IGNORE
/^X-MimeOLE:/                   IGNORE
/^X-Originating-IP:/            IGNORE
/^X-MSMail-Priority:/           IGNORE

nano /etc/postfix/mime_header_checks.regexp

/^\s*Content-(Disposition|Type).*name\s*=\s*"?(.+\.(lnk|asd|hlp|ocx|reg|bat|dat|c[ho]m|cmd|exe|dll|vxd|pif|scr|hta|jse?|sh[mbs]|vb[esx]|ws[fh]|mov|wmf|xl))"?\s*$/
   REJECT Attachment type not allowed. File "$2" has the unacceptable extension "$3"

nano /etc/postfix/add_x_envelope_from

/^<>$/ PREPEND X-Envelope-From: <>
/^(.*)$/  PREPEND X-Envelope-From: <$1>

[...]
RELAY-HOST CONFIGURATION
#########################################################################

Relayhost ohne Authentifizierung
relayhost              = mailserver.example.com:587
[...]

[...]
relayhost   = mailserver.example.com:587
[...]

service postfix restart

nano /etc/postfix/sasl_relayhost_passwd
mailserver.example.com [email protected]:SicheresPasswortVerwenden!

postmap hash:/etc/postfix/sasl_relayhost_passwd

chmod 600 /etc/postfix/sasl_relayhost*

nano /etc/postfix/main.cf

[...]
RELAY-HOST CONFIGURATION
#########################################################################

Relayhost mit Authentifizierung
relayhost                   = [mailserver.example.com]:587
smtp_use_tls                = yes
smtp_sasl_auth_enable       = yes
smtp_sasl_password_maps     = hash:${config_directory}/sasl_relayhost_passwd
smtp_sasl_security_options  = noanonymous
[...]

[...]
relayhost   = [mailserver.example.com]:587
[...]

service postfix restart

nano /etc/dovecot/dovecot-sql.conf

driver = mysql
connect = host=localhost dbname=postfix user=postfix password=SicheresPasswortVerwenden!
default_pass_scheme = MD5

user_query = SELECT CONCAT('/var/spool/mail/virtual/',maildir) as home, \
             CONCAT('*:bytes=', \
             IF(mailbox.quota = 0, domain.maxquota*1024000, mailbox.quota)) \
             as quota_rule \
             FROM mailbox, domain \
             WHERE username = '%u' AND mailbox.active = '1' AND \
             domain.domain = '%d' AND domain.active = '1'

password_query = SELECT username as user, password, \
                 CONCAT('/var/spool/mail/virtual/',maildir) AS userdb_home \
                 FROM mailbox WHERE username = '%u' AND active = '1'

iterate_query = SELECT local_part AS username, domain FROM mailbox

[...]
connect = [...] password=SicheresPasswortVerwenden!
[...]

nano /etc/dovecot/dovecot-dict-sql-user.conf

connect = host=localhost dbname=postfix user=postfix password=SicheresPasswortVerwenden!

map {
    pattern = priv/quota/storage
    table = quota2
    username_field = username
    value_field = bytes
}

map {
    pattern = priv/quota/messages
    table = quota2
    username_field = username
    value_field = messages
}

connect = [...] password=SicheresPasswortVerwenden!
[...]

nano /etc/dovecot/dovecot-dict-sql-domain.conf

connect = host=localhost dbname=postfix user=postfix password=SicheresPasswortVerwenden!

map {
    pattern = priv/quota/storage
    table = domain
    username_field = domain
    value_field = quota
}

map {
    pattern = priv/quota/messages
    table = quota2
    username_field = username
    value_field = messages
}

connect = [...] password=SicheresPasswortVerwenden!
[...]

mv /etc/dovecot/dovecot.conf /etc/dovecot/dovecot.conf.bak

nano /etc/dovecot/dovecot.conf

# Host Configuration
#########################################################################

listen                          = *
protocols                       = imap sieve
postmaster_address              = [email protected]

mail_location                   = maildir:~/maildir:LAYOUT=fs:UTF-8
mail_plugins                    = quota acl
mail_uid                        = 5000
mail_gid                        = 5000
last_valid_uid                  = 5000
first_valid_uid                 = 5000
mail_debug                      = no


# TLS
#########################################################################

auth_mechanisms                 = plain login
disable_plaintext_auth          = yes
auth_verbose                    = yes

ssl                             = required
ssl_min_protocol                = TLSv1.2
ssl_cipher_list                 = EECDH+AESGCM:EECDH+AES
ssl_prefer_server_ciphers       = yes
ssl_cert                        = </etc/letsencrypt/live/mailserver.example.com/fullchain.pem
ssl_key                         = </etc/letsencrypt/live/mailserver.example.com/privkey.pem

# User Mapping
#########################################################################

userdb {
  args                          = /etc/dovecot/dovecot-sql.conf
  driver                        = sql
}

passdb {
  args                          = /etc/dovecot/dovecot-sql.conf
  driver                        = sql
}


# Quota
#########################################################################

dict {
  sqldomainquota                = mysql:/etc/dovecot/dovecot-dict-sql-domain.conf
  sqluserquota                  = mysql:/etc/dovecot/dovecot-dict-sql-user.conf
}

plugin {
  quota                         = dict:User Quota::proxy::sqluserquota
  quota_grace                   = 10%%
  quota_rule2                   = Trash:storage=+10%%
  quota_status_nouser           = DUNNO
  quota_status_overquota        = 552 5.2.2 Mailbox is over quota
  quota_status_success          = DUNNO
  quota_warning                 = storage=80%% quota-warning 80 %u
  quota_warning2                = storage=95%% quota-warning 95 %u
  quota_warning3                = storage=100%% quota-warning 100 %u
}

service quota-status {
  client_limit                  = 1
  executable                    = quota-status -p postfix

  unix_listener /var/spool/postfix/private/quota-status {
    user                        = postfix
    group                       = postfix
    mode                        = 0660
  }
}

service quota-warning {
  user                          = vmailer
  executable                    = script /usr/local/bin/quota-warning.sh

  unix_listener quota-warning {
    group                       = vmailer
    mode                        = 0660
    user                        = vmailer
  }
}

protocol lda {
  quota_full_tempfail           = yes
}


# Sieve
#########################################################################

service managesieve-login {
  inet_listener sieve {
    address                     = *
    port                        = 4190
  }
}

plugin {
  sieve                         = ~/.dovecot.sieve
  sieve_dir                     = ~/sieve
  sieve_before                  = /etc/dovecot/sieve/global.sieve
}

protocol lda {
  mail_plugins                  = $mail_plugins sieve
}


# Default-Folders
#########################################################################

namespace inbox {
  type                          = private
  prefix                        =
  location                      =
  inbox                         = yes

  mailbox "Gesendete Elemente" {
    auto                        = subscribe
    special_use                 = \Sent
  }

  mailbox Entwürfe {
    auto                        = subscribe
    special_use                 = \Drafts
  }

  mailbox Junk-E-Mail {
    auto                        = subscribe
    special_use                 = \Junk
  }

  mailbox "Gelöschte Elemente" {
    auto                        = subscribe
    special_use                 = \Trash
  }

  mailbox Archiv {
    auto                        = no
    special_use                 = \Archive
  }
}


# Folder-Sharing
#########################################################################

namespace {
  type                          = shared
  separator                     = /
  prefix                        = shared/%%u/
  location                      = maildir:%%h/maildir:INDEX=~/shared/%%u:INDEXPVT=~/shared/%%u
  subscriptions                 = yes
  list                          = children
  inbox                         = no
  hidden                        = no
  ignore_on_failure             = no
}

plugin {
  acl                           = vfile
  acl_shared_dict               = file:/var/spool/mail/virtual/shared-mailboxes.db
}


# IMAP
#########################################################################

imap_idle_notify_interval       = 29 mins

service imap-login {
  inet_listener imap {
    address                     = *
    port                        = 143
  }
}

protocol imap {
  mail_max_userip_connections   = 20
  mail_plugins                  = $mail_plugins imap_quota imap_acl
}


# Master
#########################################################################

service auth {
  unix_listener /var/spool/postfix/private/auth {
    user                        = postfix
    group                       = postfix
    mode                        = 0660
  }

  unix_listener auth-userdb {
    user                        = vmailer
    group                       = vmailer
    mode                        = 0777
  }
}

service dict {
  unix_listener dict {
    user                        = vmailer
    mode                        = 0600
  }
}


# Stats
#########################################################################

service stats {
  unix_listener stats-reader {
    user = vmailer
    group = vmailer
    mode = 0600
  }
  unix_listener stats-writer {
    user = vmailer
    group = vmailer
    mode = 0660
  }
}

# Host Configuration
#########################################################################
[...]
postmaster_address = [email protected]
[...]
# TLS
#########################################################################
[...]
# Nur anpassen, wenn Sie ein anderes Zertifikat verwenden!
ssl_cert = </etc/letsencrypt/live/mailserver.example.com/fullchain.pem
ssl_key = </etc/letsencrypt/live/mailserver.example.com/privkey.pem
[...]

nano /etc/dovecot/dovecot.conf

[...]
listen      = * ::
[...]

nano /usr/local/bin/quota-warning.sh

#!/bin/sh
#
#            ___________       .__.__  .__       .__     __
#            \__    ___/_  _  _|__|  | |__| ____ |  |___/  |_
#              |    |  \ \/ \/ /  |  | |  |/ ___\|  |  \   __\
#              |    |   \     /|  |  |_|  / /_/  >   Y  \  |
#              |____|    \/\_/ |__|____/__\___  /|___|  /__|
#                                        /_____/      \/
#
#  Twilight-Networks ∙ est. 2k1 ∙ fxp ∙ h4x ∙ nfo ∙ scene ∙ legacy lives
#  Keep it lean, keep it silent. Code like it's 2002.
#
#########################################################################
# Script Name   : quota-warning.sh
# Description   : Generates Quota-Warning-Messages for Dovecot
#
# Version       : 1.01
# Last Update   : 02.04.2025
# Author        : Twilight
# Contact       : [email protected]
# Web:          : https://www.twilight-networks.com
#
# Tested with   : Ubuntu 24.04 LTS
#                 Dovecot 2.3.21
#########################################################################


# Config
FROM='[email protected]'


# Below this line: scene code. You break it, you bought it.
#########################################################################

PERCENT=$1
USER=$2

if [ "$PERCENT" -eq 100 ] ; then
  (
  echo "X-Priority: 1"
  echo "Content-Type: text/plain; charset=UTF-8"
  echo "To: $USER"
  echo "MIME-Version: 1.0"
  echo "Subject: Mail-Quota Warnung! Ihr Postfach ist voll!"
  echo "From: $FROM"
  echo
  echo "Hallo $USER,"
  echo
  echo "der Speicherplatz Ihres Postfachs ist derzeit zu $PERCENT% ausgelastet."
  echo "Bitte löschen Sie einige E-Mails."
  echo
  echo "Derzeit ist KEIN weiterer E-Mail-Empfang möglich!"
  echo
  ) | /usr/lib/dovecot/dovecot-lda -d "$USER"
  exit 0

else

  (
  echo "X-Priority: 1"
  echo "Content-Type: text/plain; charset=UTF-8"
  echo "To: $USER"
  echo "MIME-Version: 1.0"
  echo "Subject: Mail-Quota Warnung!"
  echo "From: $FROM"
  echo
  echo "Hallo $USER,"
  echo
  echo "der Speicherplatz Ihres Postfachs ist derzeit zu $PERCENT% ausgelastet."
  echo "Bitte löschen Sie einige E-Mails."
  echo
  ) | /usr/lib/dovecot/dovecot-lda -d "$USER"
  exit 0

fi
#end

[...]
FROM='[email protected]'
[...]

chmod +x /usr/local/bin/quota-warning.sh

mkdir /etc/dovecot/sieve

nano /etc/dovecot/sieve/global.sieve

require "fileinto";

if header :contains "X-Spam-Flag" ["YES"] {
        fileinto "Junk";
        stop;
}

chown -R vmailer:vmailer /etc/dovecot/sieve

nano /etc/fail2ban/jail.local

[DEFAULT]
destemail   = [email protected]
sender      = [email protected]

ignorself   = true
ignoreip    = 127.0.0.1/8 192.0.2.42

bantime     = 24h
maxretry    = 5

[postfix]
enabled     = true
mode        = aggressive
logpath     = /var/log/mail.log
action      = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
              %(mta)s-whois[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s"]

[dovecot]
enabled     = true
action      = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
              %(mta)s-whois[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s"]

[sshd]
enabled     = true
port        = 22
mode        = aggressive
logpath     = /var/log/auth.log
action      = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
              %(mta)s-whois[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s"]

[...]
destemail   = [email protected]
sender      = [email protected]

ignoreip    = 192.0.2.42
[...]

service fail2ban restart

service postfix restart
service postfix status
[...]
Jan 29 15:17:21 ubuntu-1604-server-amd64-template systemd[1]: Starting LSB: Postfix Mail Transport Agent...
Jan 29 15:17:21 ubuntu-1604-server-amd64-template postfix[13975]:  * Starting Postfix Mail Transport Agent postfix
Jan 29 15:17:21 ubuntu-1604-server-amd64-template postfix[13975]:    ...done.
Jan 29 15:17:21 ubuntu-1604-server-amd64-template systemd[1]: Started LSB: Postfix Mail Transport Agent.
Jan 29 15:17:21 ubuntu-1604-server-amd64-template postfix/master[14041]: daemon started -- version 3.1.0, configuration /etc/postfix

telnet mailserver.example.com 25
Trying 192.0.2.42...
Connected to mailserver.example.com.
Escape character is '^]'.
220 mailserver.example.com ESMTP Postfix
EHLO example.net
250-mailserver.example.com
250-PIPELINING
250-SIZE 26214400
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
MAIL FROM:<[email protected]>
250 2.1.0 Ok
RCPT TO:<[email protected]>
554 5.7.1 <[email protected]>: Relay access denied

telnet mailserver.example.com 25
Trying mailserver.example.com...
Connected to mailserver.example.com.
Escape character is '^]'.
220 mailserver.example.com ESMTP Postfix
EHLO example.net
250-mailserver.example.com
250-PIPELINING
250-SIZE 26214400
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
MAIL FROM:<[email protected]>
250 2.1.0 Ok
RCPT TO:<GÜLTIGE-E-MAIL-ADRESSE>
250 2.1.5 Ok
DATA
354 End data with <CR><LF>.<CR><LF>
Subject: Testmail
Test E-Mail-Empfang.
.
250 2.0.0 Ok: queued as 1191727019
QUIT
221 2.0.0 Bye
Connection closed by foreign host.

openssl s_client -starttls smtp -connect mailserver.example.com:25
[...]
Start Time: 1551023261
Timeout   : 300 (sec)
Verify return code: 18 (self signed certificate)
---
250 DSN
ehlo example.net
250-mailserver.example.com
250-PIPELINING
250-SIZE 26214400
250-ETRN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
mail from: [email protected]
250 2.1.0 Ok
rcpt to: GÜLTIGE-E-MAIL-ADRESSE
250 2.1.5 Ok
data
354 End data with <CR><LF>.<CR><LF>
Subject: Testmail
Test E-Mail-Empfang mit STARTTLS.
.
250 2.0.0 Ok: queued as EC70C26FD8
quit
221 2.0.0 Bye
closed

echo -n '[email protected]' | openssl base64
dGVzdEBleGFtcGxlLmNvbQ==

echo -n 'SicheresPasswort' | openssl base64
U2ljaGVyZXNQYXNzd29ydA==

openssl s_client -starttls smtp -connect mailserver.example.com:587
[...]
Start Time: 1551012088
Timeout   : 300 (sec)
Verify return code: 18 (self signed certificate)
---
250 DSN
ehlo example.net
250-mailserver.example.com
250-PIPELINING
250-SIZE 26214400
250-ETRN
250-AUTH PLAIN LOGIN
250-AUTH=PLAIN LOGIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
auth login
334 VXNlcm5hbWU6
dGVzdEBleGFtcGxlLmNvbQ== (base64-Benutzername)
334 UGFzc3dvcmQ6
U2ljaGVyZXNQYXNzd29ydA== (base64-Passwort)
235 2.7.0 Authentication successful
mail from: [email protected]
250 2.1.0 Ok
rcpt to: GÜLTIGE-E-MAIL-ADRESSE
250 2.1.5 Ok
data
354 End data with <CR><LF>.<CR><LF>
Subject: Test
Test E-Mail-Versand.
.
250 2.0.0 Ok: queued as A4D7326FD8
quit
221 2.0.0 Bye
closed

postqueue -p

postfix flush

postsuper -d ALL

doveadm user *.*

doveadm quota recalc -A

doveadm quota get -u *@example.com

doveadm mailbox list -u *@example.com