Postfix + Dovecot + Postfix Adminでマルチドメインのメールサーバ（PostgreSQL）

mkdir -p /var/spol/vmail
chown vmail:vmail /var/spool/vmail
chmow 700 /var/spool/vmail

pkg install -y postfix-pgsql postgresql16-server

mkdir -p /usr/local/etc/mail
install -m 0644 /usr/local/sharec/postfix/mailer.conf.postfix /usr/local/etc/mail/mailer.conf

cd /etc
vi periodic.conf

daily_clean_hoststat_enable="NO"
daily_status_mail_rejects_enable="NO"
daily_status_include_submit_mailq="NO"
daily_submit_queuerun="NO"

cd /usr/ports/mail/dovecot
make config

BATCH=yes make install clean

pkg lock dovecot

cd /usr/ports/mail/postfixadmin
make config

BATCH=yes make install clean

cd /usr/local/www
chown -R www:www postfixadmin

pkg lock postfixadmin-php83 

pkg prime-list | grep postfixadmin

service php_fpm reload

cd /usr/local/www/apache24/data
ln -s /usr/local/www/postfixadmin/public postfixadmin

<VirtualHost *:80>
    ServerName postfixadmin.example.com
    DocumentRoot "/usr/local/www/postfixadmin/public"
    <Directory "/usr/local/www/postfixadmin/public">
        Options None
        AllowOverride Limit
        Require ip 127.0.0.1 192.168.0.0/24
    </Directory>
    ErrorLog "/var/log/httpd-error-postfixadmin.log"
    CustomLog "/var/log/httpd-access-postfixadmin.log" combined
</VirtualHost>

<VirtualHost *:443>
    ServerName postfixadmin.example.com
    SSLEngine On
    SSLCertificateFile "/usr/local/etc/apache24/server.crt"
    SSLCertificateKeyFile "/usr/local/etc/apache24/server.key"
    DocumentRoot "/usr/local/www/postfixadmin/public"
    <Directory "/usr/local/www/postfixadmin">
        Options None
        AllowOverride Limit
        Require ip 127.0.0.1 192.168.0.0/24
    </Directory>
    ErrorLog "/var/log/httpd-error-postfixadmin.log"
    CustomLog "/var/log/httpd-access-postfixadmin.log" combined
</VirtualHost>

service apache24 reload

service postgresql enable
service postgresql initdb

service postgresql start

psql -U postgres

CREATE ROLE postfix WITH LOGIN PASSWORD 'password';
CREATE DATABASE postfix;
ALTER DATABASE postfix OWNER TO postfix;
\q

cd /usr/local/www/postfixadmin
touch config.local.php
chown www:www config.local.php
chmod 600 config.local.php
vi config.local.php

<?php
$CONF['configured'] = true;
$CONF['setup_password'] = '';

$CONF['default_language'] = 'ja';

$CONF['database_type'] = 'pgsql';
$CONF['database_password'] = 'password';

$CONF['encrypt'] = 'php_crypt:BLOWFISH';

$CONF['default_aliases'] = array();

$CONF['domain_quota_default'] = '0';

$CONF['show_footer_text'] = 'NO';

cd /usr/local/etc/dovecot/example-config
cp -pr * ../

*** example-config/dovecot-sql.conf.ext	Sat Oct 12 17:44:22 2024
--- dovecot-sql.conf.ext	Mon Nov  4 20:04:17 2024
***************
*** 29,35 ****
  # );
  
  # Database driver: mysql, pgsql, sqlite
! #driver = 
  
  # Database connection string. This is driver-specific setting.
  #
--- 29,35 ----
  # );
  
  # Database driver: mysql, pgsql, sqlite
! driver = pgsql
  
  # Database connection string. This is driver-specific setting.
  #
***************
*** 71,84 ****
  #   connect = host=sql.example.com dbname=virtual user=virtual password=blarg
  #   connect = /usr/local/etc/dovecot/authdb.sqlite
  #
! #connect =
  
  # Default password scheme.
  #
  # List of supported schemes is in
  # http://wiki2.dovecot.org/Authentication/PasswordSchemes
  #
! #default_pass_scheme = MD5
  
  # passdb query to retrieve the password. It can return fields:
  #   password - The user's password. This field must be returned.
--- 71,84 ----
  #   connect = host=sql.example.com dbname=virtual user=virtual password=blarg
  #   connect = /usr/local/etc/dovecot/authdb.sqlite
  #
! connect = host=localhost dbname=postfix user=postfix password=password
  
  # Default password scheme.
  #
  # List of supported schemes is in
  # http://wiki2.dovecot.org/Authentication/PasswordSchemes
  #
! default_pass_scheme = BLF-CRYPT
  
  # passdb query to retrieve the password. It can return fields:
  #   password - The user's password. This field must be returned.
***************
*** 107,115 ****
  #   password_query = SELECT userid AS user, pw AS password \
  #     FROM users WHERE userid = '%u' AND active = 'Y'
  #
! #password_query = \
! #  SELECT username, domain, password \
! #  FROM users WHERE username = '%n' AND domain = '%d'
  
  # userdb query to retrieve the user information. It can return fields:
  #   uid - System UID (overrides mail_uid setting)
--- 107,115 ----
  #   password_query = SELECT userid AS user, pw AS password \
  #     FROM users WHERE userid = '%u' AND active = 'Y'
  #
! password_query = \
!   SELECT username AS user, password \
!   FROM mailbox WHERE username = '%u' AND active = true
  
  # userdb query to retrieve the user information. It can return fields:
  #   uid - System UID (overrides mail_uid setting)
***************
*** 127,135 ****
  #   user_query = SELECT dir AS home, user AS uid, group AS gid FROM users where userid = '%u'
  #   user_query = SELECT home, 501 AS uid, 501 AS gid FROM users WHERE userid = '%u'
  #
! #user_query = \
! #  SELECT home, uid, gid \
! #  FROM users WHERE username = '%n' AND domain = '%d'
  
  # If you wish to avoid two SQL lookups (passdb + userdb), you can use
  # userdb prefetch instead of userdb sql in dovecot.conf. In that case you'll
--- 127,136 ----
  #   user_query = SELECT dir AS home, user AS uid, group AS gid FROM users where userid = '%u'
  #   user_query = SELECT home, 501 AS uid, 501 AS gid FROM users WHERE userid = '%u'
  #
! user_query = \
!   SELECT '/var/spool/vmail/' || maildir AS home, \
!   'vmail' AS uid, 'vmail' AS gid \
!   FROM mailbox WHERE username = '%u' AND active = true
  
  # If you wish to avoid two SQL lookups (passdb + userdb), you can use
  # userdb prefetch instead of userdb sql in dovecot.conf. In that case you'll
***************
*** 141,144 ****
  #  FROM users WHERE userid = '%u'
  
  # Query to get a list of all usernames.
! #iterate_query = SELECT username AS user FROM users
--- 142,145 ----
  #  FROM users WHERE userid = '%u'
  
  # Query to get a list of all usernames.
! iterate_query = SELECT username AS user FROM mailbox

cd /usr/local/etc/dovecot
patch dovecot-sql.conf.ext < /path/to/file/dovecot-sql.conf.ext.diff

cd /usr/local/etc/dovecot
chown dovecot:dovecot dovecot-sql.conf.ext
chmod 600 dovecot-sql.conf.ext

*** example-config/dovecot.conf Sat Oct 12 17:44:22 2024
--- dovecot.conf        Wed Oct 23 05:38:43 2024
***************
*** 21,27 ****
  # --sysconfdir=/usr/local/etc --localstatedir=/var
  
  # Protocols we want to be serving.
! #protocols = imap pop3 lmtp submission
  
  # A comma separated list of IPs or hosts where to listen in for connections. 
  # "*" listens in all IPv4 interfaces, "::" listens in all IPv6 interfaces.
--- 21,27 ----
  # --sysconfdir=/usr/local/etc --localstatedir=/var
  
  # Protocols we want to be serving.
! protocols = imap pop3 lmtp
  
  # A comma separated list of IPs or hosts where to listen in for connections. 
  # "*" listens in all IPv4 interfaces, "::" listens in all IPv6 interfaces.
***************
*** 39,45 ****
  #instance_name = dovecot
  
  # Greeting message for clients.
! #login_greeting = Dovecot ready.
  
  # Space separated list of trusted network ranges. Connections from these
  # IPs are allowed to override their IP addresses and ports (for logging and
--- 39,45 ----
  #instance_name = dovecot
  
  # Greeting message for clients.
! login_greeting = IMAP server ready.
  
  # Space separated list of trusted network ranges. Connections from these
  # IPs are allowed to override their IP addresses and ports (for logging and

cd /usr/local/etc/dovecot
patch dovecot.conf < /path/to/file/dovecot.conf.diff

*** ../example-config/conf.d/10-auth.conf	Sat Oct 12 17:44:22 2024
--- 10-auth.conf	Thu Oct 24 16:47:48 2024
***************
*** 7,13 ****
  # matches the local IP (ie. you're connecting from the same computer), the
  # connection is considered secure and plaintext authentication is allowed.
  # See also ssl=required setting.
! #disable_plaintext_auth = yes
  
  # Authentication cache size (e.g. 10M). 0 means it's disabled. Note that
  # bsdauth and PAM require cache_key to be set for caching to be used.
--- 7,13 ----
  # matches the local IP (ie. you're connecting from the same computer), the
  # connection is considered secure and plaintext authentication is allowed.
  # See also ssl=required setting.
! disable_plaintext_auth = no
  
  # Authentication cache size (e.g. 10M). 0 means it's disabled. Note that
  # bsdauth and PAM require cache_key to be set for caching to be used.
***************
*** 119,126 ****
  #!include auth-deny.conf.ext
  #!include auth-master.conf.ext
  
! !include auth-system.conf.ext
! #!include auth-sql.conf.ext
  #!include auth-ldap.conf.ext
  #!include auth-passwdfile.conf.ext
  #!include auth-checkpassword.conf.ext
--- 119,126 ----
  #!include auth-deny.conf.ext
  #!include auth-master.conf.ext
  
! #!include auth-system.conf.ext
! !include auth-sql.conf.ext
  #!include auth-ldap.conf.ext
  #!include auth-passwdfile.conf.ext
  #!include auth-checkpassword.conf.ext

*** ../example-config/conf.d/10-mail.conf	Sat Oct 12 17:44:22 2024
--- 10-mail.conf	Mon Nov  4 19:41:57 2024
***************
*** 27,33 ****
  #
  # <doc/wiki/MailLocation.txt>
  #
! #mail_location = 
  
  # If you need to set multiple mailbox locations or want to change default
  # namespace settings, you can do it by defining namespace sections.
--- 27,33 ----
  #
  # <doc/wiki/MailLocation.txt>
  #
! mail_location = mdbox:/var/spool/vmail/%d/%n
  
  # If you need to set multiple mailbox locations or want to change default
  # namespace settings, you can do it by defining namespace sections.
***************
*** 105,112 ****
  # System user and group used to access mails. If you use multiple, userdb
  # can override these by returning uid or gid fields. You can use either numbers
  # or names. <doc/wiki/UserIds.txt>
! #mail_uid =
! #mail_gid =
  
  # Group to enable temporarily for privileged operations. Currently this is
  # used only with INBOX when either its initial creation or dotlocking fails.
--- 105,112 ----
  # System user and group used to access mails. If you use multiple, userdb
  # can override these by returning uid or gid fields. You can use either numbers
  # or names. <doc/wiki/UserIds.txt>
! mail_uid = vmail
! mail_gid = vmail
  
  # Group to enable temporarily for privileged operations. Currently this is
  # used only with INBOX when either its initial creation or dotlocking fails.

*** ../example-config/conf.d/10-master.conf	Sun Nov  3 13:17:05 2024
--- 10-master.conf	Sun Nov  3 13:18:34 2024
***************
*** 55,62 ****
  }
  
  service lmtp {
!   unix_listener lmtp {
!     #mode = 0666
    }
  
    # Create inet listener only if you can't use the above UNIX socket
--- 55,65 ----
  }
  
  service lmtp {
!   user = vmail
! 
!   unix_listener /var/spool/postfix/private/dovecot-lmtp {
!     mode = 0600
!     user = postfix
    }
  
    # Create inet listener only if you can't use the above UNIX socket
***************
*** 107,115 ****
    }
  
    # Postfix smtp-auth
!   #unix_listener /var/spool/postfix/private/auth {
!   #  mode = 0666
!   #}
  
    # Auth process is run as this user.
    #user = $default_internal_user
--- 110,119 ----
    }
  
    # Postfix smtp-auth
!   unix_listener /var/spool/postfix/private/auth {
!     mode = 0600
!     user = postfix
!   }
  
    # Auth process is run as this user.
    #user = $default_internal_user

*** ../example-config/conf.d/20-imap.conf	Sat Oct 12 17:44:22 2024
--- 20-imap.conf	Fri Nov 29 23:13:46 2024
***************
*** 91,97 ****
  
  protocol imap {
    # Space separated list of plugins to load (default is global mail_plugins).
!   #mail_plugins = $mail_plugins
  
    # Maximum number of IMAP connections allowed for a user from each IP address.
    # NOTE: The username is compared case-sensitively.
--- 91,97 ----
  
  protocol imap {
    # Space separated list of plugins to load (default is global mail_plugins).
!   mail_plugins = $mail_plugins imap_zlib
  
    # Maximum number of IMAP connections allowed for a user from each IP address.
    # NOTE: The username is compared case-sensitively.

*** ../example-config/conf.d/90-plugin.conf	Sat Oct 12 17:44:22 2024
--- 90-plugin.conf	Fri Nov 29 23:15:07 2024
***************
*** 8,11 ****
--- 8,12 ----
  
  plugin {
    #setting_name = value
+   imap_compress_deflate_level = 6
  }

*** ../example-config/conf.d/10-ssl.conf	Sat Oct 12 17:44:22 2024
--- 10-ssl.conf	Wed Oct 23 13:47:43 2024
***************
*** 3,16 ****
  ##
  
  # SSL/TLS support: yes, no, required. <doc/wiki/SSL.txt>
! #ssl = yes
  
  # PEM encoded X.509 SSL/TLS certificate and private key. They're opened before
  # dropping root privileges, so keep the key file unreadable by anyone but
  # root. Included doc/mkcert.sh can be used to easily generate self-signed
  # certificate, just make sure to update the domains in dovecot-openssl.cnf
! ssl_cert = </etc/ssl/certs/dovecot.pem
! ssl_key = </etc/ssl/private/dovecot.pem
  
  # If key file is password protected, give the password here. Alternatively
  # give it when starting dovecot with -p parameter. Since this file is often
--- 3,16 ----
  ##
  
  # SSL/TLS support: yes, no, required. <doc/wiki/SSL.txt>
! ssl = no
  
  # PEM encoded X.509 SSL/TLS certificate and private key. They're opened before
  # dropping root privileges, so keep the key file unreadable by anyone but
  # root. Included doc/mkcert.sh can be used to easily generate self-signed
  # certificate, just make sure to update the domains in dovecot-openssl.cnf
! #ssl_cert = </etc/ssl/certs/dovecot.pem
! #ssl_key = </etc/ssl/private/dovecot.pem
  
  # If key file is password protected, give the password here. Alternatively
  # give it when starting dovecot with -p parameter. Since this file is often

*** /usr/local/etc/postfix/main.cf.sample	Wed Oct  9 05:55:04 2024
--- main.cf	Wed Nov  6 06:54:22 2024
***************
*** 119,125 ****
  # to recipient addresses that have no @domain part.
  #
  #myorigin = $myhostname
! #myorigin = $mydomain
  
  # RECEIVING MAIL
  
--- 119,125 ----
  # to recipient addresses that have no @domain part.
  #
  #myorigin = $myhostname
! myorigin = $mydomain
  
  # RECEIVING MAIL
  
***************
*** 269,276 ****
  # only the local machine.
  # 
  #mynetworks_style = class
! #mynetworks_style = subnet
! mynetworks_style = host
  
  # Alternatively, you can specify the mynetworks list by hand, in
  # which case Postfix ignores the mynetworks_style setting.
--- 269,276 ----
  # only the local machine.
  # 
  #mynetworks_style = class
! mynetworks_style = subnet
! #mynetworks_style = host
  
  # Alternatively, you can specify the mynetworks list by hand, in
  # which case Postfix ignores the mynetworks_style setting.
***************
*** 575,580 ****
--- 575,581 ----
  #
  #smtpd_banner = $myhostname ESMTP $mail_name
  #smtpd_banner = $myhostname ESMTP $mail_name ($mail_version)
+ smtpd_banner = $myhostname ESMTP MTA
  
  # PARALLEL DELIVERY TO THE SAME DESTINATION
  #
***************
*** 687,689 ****
--- 688,737 ----
  smtp_tls_CApath = /etc/ssl/certs
  meta_directory = /usr/local/libexec/postfix
  shlib_directory = /usr/local/lib/postfix
+ 
+ # SASL
+ smtpd_sasl_auth_enable = yes
+ smtpd_sasl_type = dovecot
+ smtpd_sasl_path = private/auth
+ smtpd_sasl_security_options = noanonymous
+ 
+ # Security
+ smtpd_helo_required = yes
+ disable_vrfy_command = yes
+ strict_rfc821_envelopes = yes
+ smtpd_relay_restrictions =
+ 	permit_mynetworks,
+ 	permit_sasl_authenticated,
+ 	reject_unauth_destination
+ smtpd_client_restrictions =
+ 	permit_mynetworks,
+ 	permit_sasl_authenticated,
+ 	reject_invalid_hostname,
+ 	reject_non_fqdn_sender,
+ 	reject_non_fqdn_recipient,
+ 	reject_unknown_sender_domain,
+ 	reject_unauth_destination,
+ 	reject_unknown_client,
+ 	check_client_access hash:/usr/local/etc/postfix/reject_clients,
+ 	permit
+ smtpd_helo_restrictions =
+ 	permit_mynetworks,
+ 	reject_invalid_hostname,
+ 	permit
+ smtpd_sender_restrictions =
+ 	check_sender_access hash:/usr/local/etc/postfix/reject_sender,
+ 	reject_unknown_sender_domain,
+ 	reject_non_fqdn_sender
+ smtpd_etrn_restrictions =
+ 	permit_mynetworks,
+ 	reject_invalid_hostname
+ 
+ # Virtual Domain
+ virtual_transport = lmtp:unix:private/dovecot-lmtp
+ virtual_mailbox_domains =
+ 	pgsql:/usr/local/etc/postfix/pgsql_virtual_domains_maps.cf
+ virtual_mailbox_maps =
+ 	pgsql:/usr/local/etc/postfix/pgsql_virtual_mailbox_maps.cf
+ virtual_alias_maps =
+ 	pgsql:/usr/local/etc/postfix/pgsql_virtual_alias_maps.cf,
+ 	pgsql:/usr/local/etc/postfix/pgsql_virtual_alias_domains_maps.cf

user = postfix
password = password
hosts = localhost
dbname = postfix
table = domain
select_field = domain
where_field = domain
additional_conditions = AND active = true

user = postfix
password = password
hosts = localhost
dbname = postfix
table = mailbox
select_field = maildir
where_field = username
additional_conditions = AND active = true

user = postfix
password = password
hosts = localhost
dbname = postfix
table = alias
select_field = goto
where_field = address
additional_conditions = AND active = true

user = postfix
password = password
hosts = localhost
dbname = postfix
query = SELECT goto FROM alias, alias_domain WHERE alias_domain.alias_domain = '%d' AND alias.address = '%u' || '@' || alias_domain.target_domain AND alias.active = true AND alias_domain.active = true

cd /usr/local/etc/postfix
chown root:postfix pgsql_*
chmod 640 pgsql_*

10.0.3.123 REJECT

spam@spam.com REJECT
spam.org REJECT

cd /usr/local/etc/postfix
postmap reject_clients
postmap reject_sender

*** master.cf.sample	Wed Oct  9 05:55:02 2024
--- master.cf	Wed Oct 23 15:34:08 2024
***************
*** 16,25 ****
  #tlsproxy  unix  -       -       n       -       0       tlsproxy
  # Choose one: enable submission for loopback clients only, or for any client.
  #127.0.0.1:submission inet n -   n       -       -       smtpd
! #submission inet n       -       n       -       -       smtpd
! #  -o syslog_name=postfix/submission
  #  -o smtpd_tls_security_level=encrypt
! #  -o smtpd_sasl_auth_enable=yes
  #  -o smtpd_tls_auth_only=yes
  #  -o local_header_rewrite_clients=static:all
  #  -o smtpd_reject_unlisted_recipient=no
--- 16,25 ----
  #tlsproxy  unix  -       -       n       -       0       tlsproxy
  # Choose one: enable submission for loopback clients only, or for any client.
  #127.0.0.1:submission inet n -   n       -       -       smtpd
! submission inet n       -       n       -       -       smtpd
!   -o syslog_name=postfix/submission
  #  -o smtpd_tls_security_level=encrypt
!   -o smtpd_sasl_auth_enable=yes
  #  -o smtpd_tls_auth_only=yes
  #  -o local_header_rewrite_clients=static:all
  #  -o smtpd_reject_unlisted_recipient=no
***************
*** 31,37 ****
  #  -o smtpd_helo_restrictions=
  #  -o smtpd_sender_restrictions=
  #  -o smtpd_relay_restrictions=
! #  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
  #  -o milter_macro_daemon_name=ORIGINATING
  # Choose one: enable submissions for loopback clients only, or for any client.
  #127.0.0.1:submissions inet n  -       n       -       -       smtpd
--- 31,37 ----
  #  -o smtpd_helo_restrictions=
  #  -o smtpd_sender_restrictions=
  #  -o smtpd_relay_restrictions=
!   -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
  #  -o milter_macro_daemon_name=ORIGINATING
  # Choose one: enable submissions for loopback clients only, or for any client.
  #127.0.0.1:submissions inet n  -       n       -       -       smtpd

newaliases

service dovecot enable
service dovecot start
service postfix enable
service postfix start