Red Hat Enterprise Linux 9 にメールサーバーを構築（前編）

[postfix]
enabled = true
mode = aggressive

[postfix-sasl]
enabled = true

[dovecot]
enabled = true

# Change this to where you keep your virtual mail users' maildirs.
#basedir=/var/spool/maildirs
basedir=/home/vmail

# Change this to where you would like deleted maildirs to reside.
#trashbase=/var/spool/deleted-maildirs
trashbase=/home/vmail/.deleted-maildirs

if [ ! -e "$maildir" ]; then
    echo "maildir '$maildir' does not exist; nothing to do."
    #exit 1
    exit 0
fi

# Change this to where you keep your virtual mail users' maildirs.
#basedir=/var/spool/maildirs
basedir=/home/vmail

# Change this to where you would like deleted maildirs to reside.
#trashbase=/var/spool/deleted-maildirs
trashbase=/home/vmail/.deleted-maildirs

## Same thing without a password
# %wheel        ALL=(ALL)       NOPASSWD: ALL
nobody ALL=(vmail) NOPASSWD: /home/vmail/bin/postfixadmin-mailbox-postdeletion.sh
nobody ALL=(vmail) NOPASSWD: /home/vmail/bin/postfixadmin-domain-postdeletion.sh

<?php
$CONF['configured']        = true;
$CONF['setup_password']    = '';
$CONF['default_language']  = 'ja';
$CONF['database_type']     = 'mysqli';
$CONF['database_host']     = 'localhost';
$CONF['database_user']     = 'postfix';
$CONF['database_password'] = 'XXXXXXXXXXXX';
$CONF['database_name']     = 'postfix';
$CONF['database_prefix']   = '';
$CONF['footer_text']       = 'ドメイン名';
$CONF['footer_link']       = 'https://ドメイン名';
# パスワードのバリデーションを無効にする場合
#$CONF['password_validation'] = array();

$CONF['mailbox_postdeletion_script'] = 'sudo -u vmail /home/vmail/bin/postfixadmin-mailbox-postdeletion.sh';
$CONF['domain_postdeletion_script']  = 'sudo -u vmail /home/vmail/bin/postfixadmin-domain-postdeletion.sh';
?>

#myhostname = virtual.domain.tld
myhostname = mail.ドメイン名

#mydomain = domain.tld
mydomain = ドメイン名

#myorigin = $mydomain
myorigin = $mydomain

#inet_interfaces = localhost
inet_interfaces = all

#home_mailbox = Maildir/
home_mailbox = Maildir/

#smtpd_banner = $myhostname ESMTP $mail_name ($mail_version)
smtpd_banner = $myhostname ESMTP unknown

# SASL
smtpd_sasl_type             = dovecot
smtpd_sasl_path             = private/auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain     = $myhostname

# ここに記述すると 25 番ポートで認証してしまうので
# master.cf の smtps（465）や submission（587）に記述する
#smtpd_sasl_auth_enable    = yes
#
# Outlook Express 4 や Microsoft Exchange 5 向けなので不要
#broken_sasl_auth_clients  = yes

user = postfix
password = XXXXXXXXXXXX
hosts = localhost
dbname = postfix
table = mailbox
select_field = maildir
where_field = username
additional_conditions = and active = '1'

user = postfix
password = XXXXXXXXXXXX
hosts = localhost
dbname = postfix
table = domain
select_field = domain
where_field = domain
additional_conditions = and active = '1'

user = postfix
password = XXXXXXXXXXXX
hosts = localhost
dbname = postfix
table = alias
select_field = goto
where_field = address
additional_conditions = and active = '1'

# Virtual Mail Box
local_transport         = local
virtual_transport       = dovecot
virtual_uid_maps        = static:10000
virtual_gid_maps        = static:10000
virtual_minimum_uid     = 10000
virtual_mailbox_base    = /home/vmail
virtual_mailbox_maps    = mysql:/etc/postfix/mysql_virtual_mailbox_maps.cf
virtual_mailbox_domains = mysql:/etc/postfix/mysql_virtual_domains_maps.cf
virtual_alias_maps      = mysql:/etc/postfix/mysql_virtual_alias_maps.cf
virtual_alias_domains   = $virtual_alias_maps
dovecot_destination_recipient_limit = 1

# Dovecot LDA
dovecot     unix  -      n       n       -       -       pipe
  flags=DRhu user=vmail:vmail argv=/usr/libexec/dovecot/dovecot-lda -f ${sender} -d ${recipient}

# 内部ユーザの隠蔽
disable_vrfy_command = yes

# HELO/EHLO コマンドの要求
smtpd_helo_required = yes

# HELO/EHLO コマンド時の制限設定
smtpd_helo_restrictions =
        # $mynetworks 内からの接続は許可
        permit_mynetworks
        # EHLO ホスト名の文法が不正な場合に要求を拒否
        reject_invalid_hostname
        # EHLO ホスト名の文法が RFC で要求されているような完全修飾ドメイン形式ではない場合に要求を拒否
        reject_non_fqdn_hostname

# MAIL FROM コマンド時の制限設定
smtpd_sender_restrictions =
        # 送信者ドメインが存在しない（DNSに「A」や「MX」レコードが無い）場合に要求を拒否
        reject_unknown_sender_domain
        # 送信者ドメインが RFC で要求されているような完全修飾ドメイン形式ではない場合に要求を拒否
        reject_non_fqdn_sender

# RCPT TO コマンド時の制限設定
smtpd_recipient_restrictions =
        # アクセスしてきているクライアントのIPアドレスが$mynetworksにマッチする場合許可
        permit_mynetworks
        # SASL 認証に成功した場合のメール送信を許可
        permit_sasl_authenticated
        # このサーバで配送終了とならないドメイン宛メール送信要求を拒否（不正中継対応）
        reject_unauth_destination
        # このサーバで配送終了となるドメイン宛メール送信を許可
        permit_auth_destination

# メールリレーの設定
smtpd_relay_restrictions =
        # $mynetworks に記載されたクライアントからのメールリレーを許可
        permit_mynetworks
        # SASL 認証されたメールのリレーを許可
        permit_sasl_authenticated
        # 不明な宛先からのメールリレーを一時的なエラーコード(4xx)で拒否
        defer_unauth_destination

# デバッグ関係
#auth_verbose = yes
#auth_debug = yes
#mail_debug = yes
#auth_debug_passwords = yes

listen = *
log_path = syslog
maildir_stat_dirs = yes
disable_plaintext_auth = no
auth_mechanisms = cram-md5 plain login

# @以降なし
mail_location = maildir:/home/vmail/%d/%n
# @以降あり
#mail_location = maildir:/home/vmail/%d/%u

first_valid_uid = 10000

protocols = imap lmtp sieve
protocol imap {
  mail_plugins = $mail_plugins
}
protocol lmtp {
  mail_plugins = $mail_plugins
}
protocol lda {
  mail_plugins = $mail_plugins
}

passdb {
  driver = sql
  args = /etc/dovecot/dovecot-sql.conf.ext
}
userdb {
  driver = sql
  args = /etc/dovecot/dovecot-sql.conf.ext
}

service auth {
  unix_listener /var/spool/postfix/private/auth {
    mode = 0666
    user = vmail
  }
}

service stats {
  unix_listener stats-reader {
    user = vmail
    group = vmail
    mode = 0660
  }
  unix_listener stats-writer {
    user = vmail
    group = vmail
    mode = 0660
  }
}

# 初回ログイン時にディレクトリを自動作成
namespace inbox {
  inbox = yes
  location = maildir:~/maildir
  mailbox Drafts {
    auto = subscribe
  }
  mailbox Junk {
    auto = subscribe
  }
  mailbox Trash {
    auto = subscribe
  }
  mailbox Sent {
    auto = subscribe
  }
}
# Archive フォルダのみ sdbox 形式
namespace archive {
  location = sdbox:~/
  separator = .
  prefix = Dbox.
  mailbox Archive {
    auto = subscribe
  }
}

auth_mechanisms = plain
↓（コメントアウトする）
#auth_mechanisms = plain

!include auth-system.conf.ext
↓（コメントアウトする）
#!include auth-system.conf.ext

driver = mysql
connect = host=/var/lib/mysql/mysql.sock dbname=postfix user=postfix password=XXXXXXXXXXXX
default_pass_scheme = MD5-CRYPT
password_query = SELECT username AS user, password FROM mailbox WHERE username = '%u' AND active = '1'
user_query = SELECT concat('/home/vmail/', maildir) AS home, 10000 AS uid, 10000 AS gid FROM mailbox WHERE username = '%u' AND active = '1'
iterate_query = SELECT username as user FROM mailbox WHERE active = '1'

# TLS CONFIGURATION
#
# Basic Postfix TLS configuration by default with self-signed certificate
# for inbound SMTP and also opportunistic TLS for outbound SMTP.

tls_high_cipherlist = ECDHE+AESGCM:ECDHE+CHACHA20:ECDHE+AES

# The full pathname of a file with the Postfix SMTP server RSA certificate
# in PEM format. Intermediate certificates should be included in general,
# the server certificate first, then the issuing CA(s) (bottom-up order).
#
#smtpd_tls_cert_file = /etc/pki/tls/certs/postfix.pem
smtpd_tls_cert_file = /etc/letsencrypt/live/ドメイン名/fullchain.pem

# The full pathname of a file with the Postfix SMTP server RSA private key
# in PEM format. The private key must be accessible without a pass-phrase,
# i.e. it must not be encrypted.
#
#smtpd_tls_key_file = /etc/pki/tls/private/postfix.key
smtpd_tls_key_file = /etc/letsencrypt/live/ドメイン名/privkey.pem

# Announce STARTTLS support to remote SMTP clients, but do not require that
# clients use TLS encryption (opportunistic TLS inbound).
#
smtpd_tls_security_level = may

# 受信時の暗号設定
smtpd_use_tls                 = yes
smtpd_tls_ciphers             = high
smtpd_tls_protocols           = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtpd_tls_eecdh_grade         = strong
smtpd_tls_mandatory_ciphers   = high
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1

smtpd_tls_session_cache_database = btree:/var/lib/postfix/smtpd_scache

# Directory with PEM format Certification Authority certificates that the
# Postfix SMTP client uses to verify a remote SMTP server certificate.
#
smtp_tls_CApath = /etc/pki/tls/certs

# The full pathname of a file containing CA certificates of root CAs
# trusted to sign either remote SMTP server certificates or intermediate CA
# certificates.
#
smtp_tls_CAfile = /etc/pki/tls/certs/ca-bundle.crt

# Use TLS if this is supported by the remote SMTP server, otherwise use
# plaintext (opportunistic TLS outbound).
#
smtp_tls_security_level = may

# 送信時の暗号設定
smtp_tls_ciphers             = high
smtp_tls_protocols           = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtp_tls_loglevel            = 1

smtps     inet  n       -       n       -       -       smtpd
#  -o syslog_name=postfix/smtps
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes
#  -o smtpd_reject_unlisted_recipient=no
#  -o smtpd_client_restrictions=$mua_client_restrictions
#  -o smtpd_helo_restrictions=$mua_helo_restrictions
#  -o smtpd_sender_restrictions=$mua_sender_restrictions
#  -o smtpd_recipient_restrictions=
#  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
#  -o milter_macro_daemon_name=ORIGINATING

#ssl_cert = </etc/pki/dovecot/certs/dovecot.pem
ssl_cert = </etc/letsencrypt/live/ドメイン名/fullchain.pem

#ssl_key = </etc/pki/dovecot/private/dovecot.pem
ssl_key = </etc/letsencrypt/live/ドメイン名/privkey.pem

mail_plugins = $mail_plugins quota

protocol imap {
  mail_plugins = $mail_plugins imap_quota
}

# Quota の設定
service quota-status {
  executable = quota-status -p postfix
  inet_listener {
    port = 12340
  }
  client_limit = 1
}
plugin {
  quota_status_success = DUNNO
  quota_status_nouser = DUNNO
  quota_status_overquota = "552 5.2.2 Mailbox is full"
  # 容量超過猶予
  quota_grace = 10%%
}
plugin {
  quota = count:User quota
  quota_max_mail_size = 100M
  quota_vsizes = yes
}

#user_query = SELECT CONCAT('/home/vmail/', maildir) AS home, 10000 AS uid, 10000 AS gid FROM mailbox WHERE username = '%u' AND active = '1'
user_query = SELECT CONCAT('/home/vmail/', maildir) AS home, 10000 AS uid, 10000 AS gid, CONCAT('*:bytes=', quota) AS quota_rule FROM mailbox WHERE username = '%u' AND active = '1'

# RCPT TO コマンド時の制限設定
smtpd_recipient_restrictions =
        # アクセスしてきているクライアントのIPアドレスが$mynetworksにマッチする場合許可
        permit_mynetworks
        # SASL 認証に成功した場合のメール送信を許可
        permit_sasl_authenticated
        # このサーバで配送終了とならないドメイン宛メール送信要求を拒否（不正中継対応）
        reject_unauth_destination
        # Dovecot に容量制限を確認する
        check_policy_service inet:127.0.0.1:12340
        # このサーバで配送終了となるドメイン宛メール送信を許可
        permit_auth_destination

$CONF['quota'] = 'YES';

protocol lmtp {
  mail_plugins = $mail_plugins sieve
}
protocol lda {
  mail_plugins = $mail_plugins sieve
}

virtual_transport = virtual
transport_maps = hash:/etc/postfix/transport
procmail_destination_recipient_limit = 1

john@example.com      procmail:
smith@example.net     procmail:
     ・
     ・
     ・
example.com           dovecot:
example.net           dovecot:
     ・
     ・
     ・

# Procmail
procmail    unix  -      n       n       -       -       pipe
 flags=R user=vmail argv=/usr/bin/procmail -t -m USER=${user} DOMAIN=${nexthop} /etc/procmailrc

SHELL=/bin/bash
PATH=/usr/bin
DEFAULT=/home/vmail/$DOMAIN/$USER
LOCKFILE=/home/vmail/$DOMAIN/$USER/procmail.lock

# User .procmailrc
:0
* ? test -e "$DEFAULT/.procmailrc"
| /usr/bin/procmail -t -m USER=$USER DOMAIN=$DOMAIN $DEFAULT/.procmailrc

SHELL=/bin/bash
PATH=/usr/bin
MAILDIR=/home/vmail/$DOMAIN/$USER
DEFAULT=$MAILDIR/
LOCKFILE=$MAILDIR/procmail.lock
LOGFILE=$MAILDIR/procmail.log
    ・
    ・
    ・