IRedMail Mail Server. Almalinux 8. Installation and configuration
Add resource records to dns server, which serving your domains (in mikrotik, for example, but it can be any dns-record manager of the registrar, which provides you your new domain)
-----
Domain for administration (Web admin panel (iRedAdmin)) (it's not your domain for mail, just for management)
/ip dns static
add address=45.67.59.224 name=domain123.ru ttl=1m
add address=45.67.59.224 name=mail.domain123.ru ttl=1m
add mx-exchange=mail.domain123.ru mx-preference=10 name=domain123.ru ttl=1m type=MX
###add mx-exchange=mail.domain123.ru mx-preference=10 name=mail.domain123.ru ttl=1m type=MX
Mail domain (which will be your first mail domain)
/ip dns static
add address=45.67.59.224 name=don661.ru ttl=1m
add address=45.67.59.224 name=mail.don661.ru ttl=1m
add mx-exchange=mail.don661.ru mx-preference=10 name=don661.ru ttl=1m type=MX
###add mx-exchange=mail.don661.ru mx-preference=10 name=mail.don661.ru ttl=1m type=MX
MAIL SERVER
-----
dnf install -y epel-release wget tmux bind-utils tar bzip2
yum config-manager --set-enabled powertools
dnf -y update
reboot
Step 2: Set SELinux in Permissive mode
iRedMail development team doesn’t provide SELinux policies for the service to work when SELinux is enforcing. You need to disable SELinux or configure it to run in Permissive mode.
setenforce 0
sed -i 's/^SELINUX=.*/SELINUX=permissive/g' /etc/selinux/config
Confirm current SELinux status after making the change.
sestatus
export HOSTNAME="mail.domain123.ru"
sudo hostnamectl set-hostname $HOSTNAME --static
sudo hostnamectl set-hostname $HOSTNAME --transient
nano /etc/hosts
...
45.67.59.224 mail.domain123.ru
---
host mail.domain123.ru
dig A mail.domain123.ru
mkdir ~/distr/
cd ./distr/
wget https://github.com/iredmail/iRedMail/archive/refs/tags/1.6.2.tar.gz
tar xvf 1.6.2.tar.gz
cd iRedMail-*/
chmod +x iRedMail.sh
tmux
./iRedMail.sh
mail dir: /var/vmail
web server: nginx
backend to store mail accounts: MariaDB
mysql admin password: PassWord
first mail account (it should be NOT admin domain "mail.domain123.ru"): don661.ru
postmaster@don661.ru admin password: PassWord
optinal components: <select ALL components>
Continue? [y|N]: y
********************************************************************
* URLs of installed web applications:
*
* - Roundcube webmail: https://mail.domain123.ru/mail/
* - SOGo groupware: https://mail.domain123.ru/SOGo/
* - netdata (monitor): https://mail.domain123.ru/netdata/
*
* - Web admin panel (iRedAdmin): https://mail.domain123.ru/iredadmin/
*
* You can login to above links with below credential:
*
* - Username: postmaster@don661.ru
* - Password: dispersia85D
*
*
********************************************************************
* Congratulations, mail server setup completed successfully. Please
* read below file for more information:
*
* - /root/distr/iRedMail-1.6.2/iRedMail.tips
*
* And it's sent to your mail account postmaster@don661.ru.
*
********************* WARNING **************************************
*
* Please reboot your system to enable all mail services.
*
********************************************************************
ERROR AFTER CLEAN INSTALL:
"Internal Server Error" at https://mail.domain123.ru/iredadmin/
DESCRIPTION:
cat /var/log/messages
...
Jul 10 13:45:11 iredmail iredadmin[4313]: Traceback (most recent call last):
Jul 10 13:45:11 iredmail iredadmin[4313]: File "/opt/www/iRedAdmin-1.3/iredadmin.py", line 8, in <module>
Jul 10 13:45:11 iredmail iredadmin[4313]: from libs import iredbase
Jul 10 13:45:11 iredmail iredadmin[4313]: File "/opt/www/iRedAdmin-1.3/libs/iredbase.py", line 5, in <module>
Jul 10 13:45:11 iredmail iredadmin[4313]: import web
Jul 10 13:45:11 iredmail iredadmin[4313]: ModuleNotFoundError: No module named 'web'
...
SOLUTION:
// https://github.com/iredmail/iRedMail/issues/63
pip3 install web.py==0.62
reboot
LETSENCRYPT CERTS
-----
Certbot install
---
dnf install -y certbot
Cert create
---
You don't have to create cert for each domain. You can create one cert with a few certs in it.
Also you have to create certs for root domains of the mail domains (don661.ru, etc.). Otherwise mail clients (like Thunderbird will warning about untrusted cert of root domains).
In our example: domain123.ru,mail.domain123.ru,don661.ru,mail.don661.ru
certbot certonly --webroot --agree-tos -d domain123.ru,mail.domain123.ru,don661.ru,mail.don661.ru --cert-name ALL-MAIL-DOMAINS --email cless@don661.ru -w /var/www/html
Check certs
certbot certificates
...
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Found the following certs:
Certificate Name: ALL-MAIL-DOMAINS
Serial Number: 3f2f142e6ae07d2a6c251bdc15acf7d2774
Key Type: RSA
Domains: domain123.ru mail.domain123.ru don661.ru mail.don661.ru
Expiry Date: 2023-04-28 09:24:29+00:00 (VALID: 89 days)
Certificate Path: /etc/letsencrypt/live/ALL-MAIL-DOMAINS/fullchain.pem
Private Key Path: /etc/letsencrypt/live/ALL-MAIL-DOMAINS/privkey.pem
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
...
Renew certs
certbot renew --force-renewal --cert-name ALL-MAIL-DOMAINS
systemctl restart nginx
systemctl restart postfix
systemctl restart dovecot
Autorenew certs
crontab -e
...
# letsencrypt weekly renew
0 8 * * 7 certbot renew --force-renewal --cert-name ALL-MAIL-DOMAINS
---
Nginx certs add
---
Comment native self-signed certs and add letsencrypt certs.
nano /etc/nginx/templates/ssl.tmpl
...
#ssl_certificate /etc/pki/tls/certs/iRedMail.crt;
#ssl_certificate_key /etc/pki/tls/private/iRedMail.key;
ssl_certificate /etc/letsencrypt/live/ALL-MAIL-DOMAINS/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/ALL-MAIL-DOMAINS/privkey.pem;
---
systemctl restart nginx
Now you able to open any of your domains in browser for Roundcube, iRadMail (web panel), etc, because all of your certs for your domains are in the same cert files.
Postfix certs add
---
nano /etc/postfix/main.cf
...
#smtpd_tls_key_file = /etc/pki/tls/private/iRedMail.key
#smtpd_tls_cert_file = /etc/pki/tls/certs/iRedMail.crt
#smtpd_tls_CAfile = /etc/pki/tls/certs/iRedMail.crt
#smtpd_tls_CApath = /etc/pki/tls/certs
smtpd_tls_key_file = /etc/letsencrypt/live/ALL-MAIL-DOMAINS/privkey.pem
smtpd_tls_cert_file = /etc/letsencrypt/live/ALL-MAIL-DOMAINS/cert.pem
smtpd_tls_CAfile = /etc/letsencrypt/live/ALL-MAIL-DOMAINS/chain.pem
smtpd_tls_CApath = /etc/letsencrypt/live/ALL-MAIL-DOMAINS
...
systemctl restart postfix
Dovecot certs add
---
nano /etc/dovecot/dovecot.conf
...
#ssl_cert = </etc/pki/tls/certs/iRedMail.crt
#ssl_key = </etc/pki/tls/private/iRedMail.key
ssl_dh = </etc/pki/tls/dh2048_param.pem
ssl_cert = </etc/letsencrypt/live/ALL-MAIL-DOMAINS/fullchain.pem
ssl_key = </etc/letsencrypt/live/ALL-MAIL-DOMAINS/privkey.pem
...
systemctl restart dovecot
Now you able to add your mail account to Desktop mail client without having a warning about untrusted certs.
IMPROVING EMAIL DELIVERABILITY (VERY IMPORTANT!)
-----
// https://www.linuxbabe.com/mail-server/centos-7-iredmail-email-server
To prevent your emails from being flagged as spam, you should set PTR, SPF, DKIM and DMARC records.
PTR записи на DNS сервере
---
// ЗАПИСЬ PTR ПРАВИТСЯ _НЕ_ В РЕСУРСНЫХ ЗАПИСЯХ ДНС-СЕРВЕРА, К КОТОРОМУ ПРИВЯЗАН ВАШ ПОЧТОВЫЙ ДОМЕН, ЭТО ДЕЛАЕТ ИМЕННО РЕГИСТРАТОР IP-АДРЕСА (ПРОВАЙДЕР ИЛИ ХОСТЕР, ПРЕДОСТАВЛЯЮЩИЙ ВНЕШНИЙ IP-АДРЕС)!
// ЕСЛИ ПРОВАЙДЕР РОСТЕЛЕКОМ, ПИШЕМ НА ЭЛЕКТРОНКУ support@tmb.ru С ПРОСЬБОЙ ЗАРЕГИСТРИРОВАТЬ PTR-ЗАПИСЬ, ШТАТНАЯ ТЕХПОДДЕРЖКА ОТКАЗЫВАЕТСЯ ПРЕДОСТАВЛЯТЬ ТАКУЮ УСЛУГУ
Если у вас есть свой почтовый сервер, то необходимо, чтобы ваш провайдер (а точнее тот, кто выдал вам статические ip-адреса. если ваш внешний IP предоставил вам хостер, на котором у вас крутится VPS/VDS, то обращаемся в техподдержку хостера) зарегистрировал на своем DNS-сервере PTR записи для вашего почтового сервера (MX-записи). Иначе, подавляющая часть почтовых серверов интернета откажется принимать почту от вашего почтового сервера.
Так же, многие почтовые сервера отвергают письма, если при проверке адреса отправителя в строке им выдается "dynamicip" или "dsl" или подобные слова означающие, что ваш адрес не статический или не совпадает с именем вашего домена.
Если в ответе сервера на ваше отправленное письмо вы видите что-то типа:
mxs.mail.ru: 550 Sorry, we do not accept mail from hosts with dynamic IP or generic DNS PTR-records. Please get a custom reverse DNS name from your ISP for your host 215.54.54.54 or contact abuse@corp.mail.ru in case of error
это значит, что вам необходимо корректно зарегистрировать PTR запись на DNS-сервере для вашего доменного имени.
Для этого необходимо послать запрос тому, кто выдал вам статические ip-адреса (обычно, это ваш провайдер) с просьбой зарегистрировать PTR запись для вашего домена.
PTR запись должна быть одна для одного IP (не нужно создавать две записи для основного домена (mydomain.ru) и почтового домена (mail.mydomain.ru) если оба они привязаны А-записью к одному IP)
PTR запись должна быть создана именно для MX записи. То есть, если адреса домена и почтового обменника не совпадают, то PTR создаем именно для MX записи.
Например, если домен mydomain.ru находится по адресу 22.11.33.44, а почтовый обменник (MX запись) создана для хоста mail.mydomain.ru, расположенного по адресу 11.22.33.44, то и PTR запись нужно создавать для mail.mydomain.ru:
44.33.22.11.in-addr.arpa mail.mydomain.ru
Естественно, можно "до кучи" создать обратную запись и для самого домена mydomain.ru. Она так же не помешает:
44.33.11.22.in-addr.arpa mydomain.ru
РЕЗЮМИРУЯ
1. НАДО ПРОПИСАТЬ РЕСУРСНУЮ ЗАПИСЬ MX (MX 10 mail.don661.ru.) ДЛЯ ОСНОВНОГО ДОМЕНА "don661.ru", указав что почтовым доменом MX-сервера является "mail.don661.ru"
// это делаем мы
// например, IP нашего don661.ru - 1.2.3.4
A don661.ru 1.2.3.4
MX 10 mail.don661.ru.
2. Создать PTR-запись на DNS сервере регистратора
IP домена "mail.don661.ru" необязательно должен совпадать с IP "don661.ru", но PTR-запись должна быть создана регистратором IP-адреса (5.6.7.8) домена "mail.don661.ru"
!!! Я ТОЧНО НЕ УВЕРЕН, НО:
!!! ЕСЛИ У НАС НЕСКОЛЬКО ПОЧТОВЫХ ДОМЕНОВ НА ОДНОМ ПОЧТОВОМ СЕРВЕРЕ И ВСЕ ОНИ ВЫХОДЯТ ЧЕРЕЗ ЕДИНСТВЕННЫЙ ВНЕШНИЙ IP,
!!! ТО PTR СООТВЕТСТВИЕ НЕОБХОДИМО ПРОПИСАТЬ ДЛЯ ДОМЕНА, КОТОРЫМ ИМЕНУЕТСЯ (HOSTNAME) САМ ФИЗИЧЕСКИЙ ПОЧТОВЫЙ СЕРВЕР.
!!! НАПРИМЕР, САМА ФИЗИЧЕСКАЯ МАШИНА ИМЕНУЕТСЯ mail.domain123.ru
!!! (
!!! Также для этого необходимо прописать "mail.domain123.ru" в следующих местах:
!!! - hostnamectl set-hostname mail.domain123.ru
!!! - соответствие внешнего IP, для которого создаем PTR-запись, и домена mail.domain123.ru прописываем в /etc/hosts)
!!! - в /etc/postfix/main.cf:
!!! ...
!!! myhostname = mail.domain123.ru
!!! myorigin = mail.domain123.ru
!!! mydomain = mail.domain123.ru
!!! ...
!!! )
!!! mail.domain123.ru НЕ ОБЯЗАН ВООБЩЕ БЫТЬ ПОЧТОВЫМ ДОМЕНОМ, НО ОН БУДЕТ В ПОЛЕ "HELO: mail.domain123.ru" ПРИ ОТПРАВКЕ ПИСЬМА С ЛЮБОГО ДРУГОГО ПОЧТОВОГО ДОМЕНА, РАБОТАЮЩЕГО НА НАШЕМ ПОЧТОВОМ СЕРВЕРЕ.
!!! ПОЭТОМУ СОЗДАЕМ PTR-ЗАПИСЬ ИМЕННО ДЛЯ mail.domain123.ru - "8.7.6.5.in-addr.arpa mail.domain123.ru"
!!! ПРОВЕРИТЬ !!!
// это делает регистратор внешнего IP
// например, IP нашего mail.don661.ru 5.6.7.8
8.7.6.5.in-addr.arpa mail.don661.ru
ПРОВЕРКИ
1.
host 5.6.7.8
...
8.7.6.5.in-addr.arpa domain name pointer mail.don661.ru.
...
Готово!
2.
Например, для домена mydomain.ru с адресом 215.54.54.54, необходимо зарегистрировать следующую запись:
54.54.54.215.in-addr.arpa name=mydomain.ru
А если почтовый сервер сидит на отдельном адресе, например, mail.mydomain.ru имеет адрес 215.54.54.55, то необходимо зарегистрировать еще одну PTR запись:
55.54.54.215.in-addr.arpa name=mail.mydomain.ru
Проверить наличие PTR записи на сервере DNS можно с помощью интерфейса команды NSLOOKUP:
nslookup
теперь подключаемся к DNS-серверу провайдера:
server 215.54.54.1
устанавливаем тип ресурсной записи:
set type=PTR
делаем запрос на интересующий нас адрес:
215.54.54.54
в ответ мы должны получить имя своего домена mydomain.ru
SPF
---
SPF (Sender Policy Framework) record specifies which hosts or IP addresses are allowed to send emails on behalf of a domain. You should allow only your own email server or your ISP’s server to send emails for your domain. In your DNS management interface, create a new TXT record like below.
Add TXT-record to your main domain (for example "don661.ru", _NOT_ subdomain "mail.don661.ru"!)
A don661.ru 45.67.59.224
MX 10 mail.don661.ru.
TXT v=spf1 mx ~all
^^^ THIS RECORD
Wait 5-10 minutes!
Test:
dig don661.ru txt
...
;; ANSWER SECTION:
don661.ru. 10 IN TXT "v=spf1 mx ~all"
...
DKIM
---
DKIM (DomainKeys Identified Mail) uses a private key to digitally sign emails sent from your domain. Receiving SMTP servers verify the signature by using the public key, which is published in the DNS DKIM record.
The iRedMail script automatically configured DKIM for your server. The only thing left to do is creating DKIM record in DNS manager. Run the following command to show the DKIM public key.
Generate record in iredmail server CLI:
amavisd -c /etc/amavisd/amavisd.conf showkeys
...
dkim._domainkey.don661.ru. 3600 TXT (
"v=DKIM1; p="
"MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu6L+HQnFMEzYH+aETHbz"
"3WYbOBXLoF/4+NHiSgXXyErE7IYkvwu4Nu02WPHczNAUCue0qRWMB5cr5b2NNoUg"
"jOsjv/bHFxvrZK4/mW7Yy/8MDpbkUN/dVdeJmw8W6962woxe+YXZd5HVuBg3Xn0J"
"xfqpsLBzzEGU0f+EZ/VA7yAKsuikKKWbT5Y46mj3JB548Hg2qjzzr9J2GjSQ6I9O"
"YO3RcteaRTrtJpwckKv1dLT2GUK2jGlKDkSVlAuiPmVgfarZvSqvhP0qWTXSE61N"
"rJHRa0Spo54U2qJBIflQ1oymY3dzHzJ7A08Vx3NJByzLbmRLQM1yuQqfrUbfPEVh"
"kwIDAQAB")
...
Copy it from ""v=DKIM1..." to "...kwIDAQAB"
Remove all "" and line breaks
You have to get something like this:
v=DKIM1; p= MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu6L+HQnFMEzYH+aETHbz3WYbOBXLoF/4+NHiSgXXyErE7IYkvwu4Nu02WPHczNAUCue0qRWMB5cr5b2NNoUgjOsjv/bHFxvrZK4/mW7Yy/8MDpbkUN/dVdeJmw8W6962woxe+YXZd5HVuBg3Xn0JxfqpsLBzzEGU0f+EZ/VA7yAKsuikKKWbT5Y46mj3JB548Hg2qjzzr9J2GjSQ6I9OYO3RcteaRTrtJpwckKv1dLT2GUK2jGlKDkSVlAuiPmVgfarZvSqvhP0qWTXSE61NrJHRa0Spo54U2qJBIflQ1oymY3dzHzJ7A08Vx3NJByzLbmRLQM1yuQqfrUbfPEVhkwIDAQAB
Create subdomain "dkim._domainkey" for your main domain "don661.ru"
Create TXT-record in "dkim._domainkey" subdomain (_NOT_ for main domain "don661.ru" or subdomain "mail.don661.ru":
TXT v=DKIM1; p= MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu6L+HQnFMEzYH+aETHbz3WYbOBXLoF/4+NHiSgXXyErE7IYkvwu4Nu02WPHczNAUCue0qRWMB5cr5b2NNoUgjOsjv/bHFxvrZK4/mW7Yy/8MDpbkUN/dVdeJmw8W6962woxe+YXZd5HVuBg3Xn0JxfqpsLBzzEGU0f+EZ/VA7yAKsuikKKWbT5Y46mj3JB548Hg2qjzzr9J2GjSQ6I9OYO3RcteaRTrtJpwckKv1dLT2GUK2jGlKDkSVlAuiPmVgfarZvSqvhP0qWTXSE61NrJHRa0Spo54U2qJBIflQ1oymY3dzHzJ7A08Vx3NJByzLbmRLQM1yuQqfrUbfPEVhkwIDAQAB
Wait 5-10 minutes!
Test on iredmail server:
amavisd -c /etc/amavisd/amavisd.conf testkeys
...
TESTING#1 don661.ru: dkim._domainkey.don661.ru => pass
...
Test on arbitrary server in internet:
dig dkim._domainkey.don661.ru txt
...
;; ANSWER SECTION:
dkim._domainkey.don661.ru. 10 IN TXT "v=DKIM1; p= MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu6L+HQnFMEzYH+aETHbz3WYbOBXLoF/4+NHiSgXXyErE7IYkvwu4Nu02WPHczNAUCue0qRWMB5cr5b2NNoUgjOsjv/bHFxvrZK4/mW7Yy/8MDpbkUN/dVdeJmw8W6962woxe+YXZd5HVuBg3Xn0JxfqpsLBzzEGU0f+EZ/VA7yAKsuikKKWbT5Y46mj3JB548Hg2qjz" "zr9J2GjSQ6I9OYO3RcteaRTrtJpwckKv1dLT2GUK2jGlKDkSVlAuiPmVgfarZvSqvhP0qWTXSE61NrJHRa0Spo54U2qJBIflQ1oymY3dzHzJ7A08Vx3NJByzLbmRLQM1yuQqfrUbfPEVhkwIDAQAB"
...
ADD SECOND ADDITIONAL DOMAIN KEY
---
// https://forum.iredmail.org/topic415-dkim-signing-for-additional-domains.html
1. Generate the new key.
cd /var/lib/dkim/
amavisd genrsa domain123.ru.pem
chmod 0644 domain123.ru.pem
2. Add it to your amavisd.conf file:
Search for "# Add dkim_key here.", and add it alongside the others, preferably in alphabetic order so you can find it faster.
dkim_key("domain123.ru", "dkim", "/var/lib/dkim/domain123.ru.pem");
3. Add your new domain to @local_domains_maps in amavisd.conf. The line should now read something like this:
# was:
@local_domains_maps = 1;
# now edit
@local_domains_maps = ( [".$mydomain", "don661.ru", "domain123.ru"] ); # list of all local domains
4. Restart amavisd
systemctl restart amavisd
5. Test that the key was installed properly
amavisd -c /etc/amavisd/amavisd.conf showkeys
...
; key#2 1024 bits, s=dkim, d=domain123.ru, /var/lib/dkim/domain123.ru.pem
dkim._domainkey.domain123.ru. 3600 TXT (
"v=DKIM1; p="
"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDaXxDmeelXeWKDYY7viovRIvMA"
"ez/7Kfk9naYsDlrpKuHUVVUQ+fENPs85YVTJQthCP2sqOAxEj0//sHjuC0Gh2UFA"
"8s7TW7/lC/UEXYFiyU+hAge+Tviallqk6m5z44dZAcDA5AONz619CbQKpBDt+4xA"
"MWCMXChfwm6ndHEdXwIDAQAB")
...
Now add this key to DNS as the first domain!
DMARC
---
DMARC stands for Domain-based Message Authentication, Reporting and Conformance. DMARC can help receiving email servers to identify legitimate emails and prevent your domain name from being used by email spoofing.
To create a DMARC record, go to your DNS manager and add a TXT record. In the name field, enter _dmarc. In the value field, enter the following. (You should create the dmarc@your-domain.com email address.)
Create subdomain "_dmarc" for your main domain "don661.ru"
Create TXT-record in "_dmarc" (_dmarc.don661.ru) subdomain (_NOT_ for main domain "don661.ru" or subdomain "mail.don661.ru":
A 45.67.59.224
TXT v=DMARC1; p=none; pct=100; rua=mailto:dmarc@don661.ru
^^^ THIS RECORD
Wait 5-10 minutes!
Test:
dig _dmarc.don661.ru txt
...
;; ANSWER SECTION:
_dmarc.don661.ru. 10 IN TXT "v=DMARC1; p=none; pct=100; rua=mailto:dmarc@don661.ru"
...
GENERAL DELIVERABILITY TEST
---
Go to:
https://www.mail-tester.com/
Send email from your mail account of your new mail server to randomly generated service's mail address (test-avlwah6p3@srv1.mail-tester.com, for example)
Then click "Затем проверьте оценку"
Wait for tests passed
If your grade more than 8, congratulations!
SPAMASSASIN
---
Configuration
---
It's already configured!
Test
---
- send email to yourself from user@don661.ru to user@don661.ru with following string in its body:
XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X
- this email will be dropped to the SPAM folder in your mailbox
CLAMAV
---
Mirrors of the DB update
--
Set one of the links in param "DatabaseMirror" in /etc/freshclam.conf
pivotal-clamav-mirror.s3.amazonaws.com
https://clamav.jinr.ru
https://packages.microsoft.com/clamav/
Then remove the freshclam.dat file and restart the service:
rm -f /var/lib/clamav/freshclam.dat
systemctl restart clamav-freshclam
Test
---
- download file https://secure.eicar.org/eicar.com.txt
- send email with this file attached to yourself from user@don661.ru to user@don661.ru
- see /var/log/maillog, you'l see something like "Blocked INFECTED", and you'll not get this email
CONCLUSION
---
After the above setting, my sended mail from cless@don661.ru was graded as 9.5/10 scores at www.mail-tester.com and took on google and yandex without drop in spam.
HINTS
-----
----------
Message size limit (message size itself + attached file size).
You have to set limits in the each following entity.
// In this example we make limit ast 30MB for attachment
// https://docs.iredmail.org/change.mail.attachment.size.html
---
Postfix limit:
/etc/postfix/main.cf
...
message_size_limit = 36700160 # 35MB
...
systemctl restart postfix
Roundcube limit:
Note: Roundcube preserves some percentage of the max message size (search 1.33 on this page, so if you set the max to 100M, it tells you only 75MB is allowed (100 / 1.33). This is better because email messsage will be encoded before sending to MTA and the encoded attachment is larger than the original file.
nano /opt/www/roundcubemail-1.5.3/config/config.inc.php
...
$config['max_message_size'] = '40M'; # max summ message size (not file)
...
Nginx limit:
nano /etc/nginx/sites-available/00-default-ssl.conf
...
server {
...
client_max_body_size 30M; # max size of a message
client_body_timeout 300s; # timeout while upload attachment, otherwise upload may be canceled by timeout in case of a low upload speed, for example
}
systemctl restart nginx
PHP limit:
nano /etc/php.ini
...
post_max_size = 35M;
upload_max_filesize = 35M;
...
reboot
----------
ERROR
Inbound messages don't come
Log:
cat /var/log/maillog:
"Recipient address rejected: Intentional policy rejection, please try again"
DESCRIPTION
This is OK. Greylisting service drop the first attempt of the remote mail service (e.g. @gmail.com) to send message, if remote service tries one more time - it will be received. It's a protection from spammers. Spammers doubtfully will send the message for the second time.
SOLUTION
1. // https://docs.iredmail.org/manage.iredapd.html#how-to-disable-whiteblacklists-completely
To disable white/blacklists completely, please remove plugin name amavisd_wblist in iRedAPD config file /opt/iredapd/settings.py, parameter plugins =:
# remove 'greylisting', 'amavisd_wblist' from here:
nano /opt/iRedAPD-5.1/settings.py
...
plugins = [..., 'greylisting', ..., 'amavisd_wblist', ...]
...
2. (I'm not sure that it worked) Put remote mail domain to the whitelist
/opt/iRedAPD-5.1/tools/greylisting_admin.py --whitelist-domain --from '@google.com'
...
* Whitelisting sender domain: gmail.com
...
----------
Increase default mailbox size for new user (when you create one in the web-interface iRedMailAdmin):
mysql -uroot -p
// Password for mariadb, that you type during iRedMail installation
MariaDB [(none)]> USE vmail;
// 4096 - 4GB
// don661.ru - user's domain
UPDATE domain SET settings = 'default_user_quota:4096;' WHERE domain = 'don661.ru';
----------
ROUNDCUBE
-----
Create new messages with HTML-EDITOR on:
---
nano /opt/www/roundcubemail-1.5.3/config/defaults.inc.php
...
$config['htmleditor'] = 1;
...
Renew Roundcube page
DESKTOP MAIL CLIENT
-----
Thunderbird
---
Username: user@don661.ru
IMAP:
mail.don661.ru
143
STARTTLS
SMTP:
mail.don661.ru
587
STARTTLS