Setup Your Own Mail Server on Centos 8 With Postfix

Setup Your Own Dedicated Mail Server on CentOS 8 With Postfix, Dovecot and MySQL

Pre-requisites you need to have the following

    Fully Qualifed Domain Name (FQDN)

    A and MX Records for your Domain in a Public Domain Name Server. These records must point to the Public IP of your server.

A- Update your System and Set your hostname 

 [wecan@mail ~]#sudo dnf update

 [wecan@mail ~]#sudo hostnamectl set-hostname mail.example.com (in my case, i have it already set to mail.wecan.ae)

B-  Install postfix, Apache and PHP packages (postfix is MTA mail Transfer Agent which does that quite well. To install postfix, run the command below once your server is back up.)

[wecan@mail ~]#sudo dnf install postfix postfix-mysql httpd vim policycoreutils-python-utils epel-release -y

C- Install PHP 7.4 on CentOS 8 / RHEL 8,  After PHP is installed, add extra PHP packages like so:

 [wecan@mail ~]#sudo  dnf install -y php-common php-json php-xml php-mbstring php-mysqlnd

D- Install and configure MySQL, will be using MariaDB, installtion as per following this guide:

 [wecan@mail ~]#sudo  dnf install MariaDB-server MariaDB-client 

 [wecan@mail ~]#sudo  systemctl enable –now mariadb

 [wecan@mail ~]#sudo  mysql_secure_installation

 “NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB

      SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY!

In order to log into MariaDB to secure it, we’ll need the current

password for the root user.  If you’ve just installed MariaDB, and

you haven’t set the root password yet, the password will be blank,

so you should just press enter here.

Enter current password for root (enter for none): 

OK, successfully used password, moving on…

Setting the root password ensures that nobody can log into the MariaDB

root user without the proper authorisation.

Set root password? [Y/n] y

New password: 

Re-enter new password: 

Password updated successfully!

Reloading privilege tables..

 … Success!

By default, a MariaDB installation has an anonymous user, allowing anyone

to log into MariaDB without having to have a user account created for

them.  This is intended only for testing, and to make the installation

go a bit smoother.  You should remove them before moving into a

production environment.

Remove anonymous users? [Y/n] y

 … Success!

Normally, root should only be allowed to connect from ‘localhost’.  This

ensures that someone cannot guess at the root password from the network.

Disallow root login remotely? [Y/n] y

 … Success!

By default, MariaDB comes with a database named ‘test’ that anyone can

access.  This is also intended only for testing, and should be removed

before moving into a production environment.

Remove test database and access to it? [Y/n] y

 – Dropping test database…

 … Success!

 – Removing privileges on test database…

 … Success!

Reloading the privilege tables will ensure that all changes made so far

will take effect immediately.

Reload privilege tables now? [Y/n] y

 … Success!

Cleaning up…

All done!  If you’ve completed all of the above steps, your MariaDB

installation should now be secure.

Thanks for using MariaDB!

 [wecan@mail ~]#sudo mysql -u root -p

 Enter password: 

Welcome to the MariaDB monitor.  Commands end with ; or g.

Your MariaDB connection id is 19

Server version: 10.4.11-MariaDB MariaDB Server

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type ‘help;’ or ‘h’ for help. Type ‘c’ to clear the current input statement.

MariaDB [(none)]> SELECT version();

+—————–+

| version()       |

+—————–+

| 10.4.11-MariaDB |

+—————–+

1 row in set (0.000 sec)

MariaDB [(none)]> QUIT

Bye

— creating Postfix DB

mysql -u root -p   (add the password)

create database postfix_domain_email;

grant all on postfix_domain_email.* to postfix_admin@localhost identified by ‘StrongPassword’;

flush privileges;

CREATE TABLE `postfix_accounts`.`domains_table` ( `DomainId` INT NOT NULL AUTO_INCREMENT , `DomainName` VARCHAR(50) NOT NULL , PRIMARY KEY (`DomainId`)) ENGINE = InnoDB;

Emails 

CREATE TABLE `postfix_accounts`.`accounts_table` ( 

    `AccountId` INT NOT NULL AUTO_INCREMENT,  

    `DomainId` INT NOT NULL,  

    `password` VARCHAR(300) NOT NULL,  

    `Email` VARCHAR(100) NOT NULL,  

    PRIMARY KEY (`AccountId`),  

    UNIQUE KEY `Email` (`Email`),  

    FOREIGN KEY (DomainId) REFERENCES domains_table(DomainId) ON DELETE CASCADE 

) ENGINE = InnoDB;

Alias

CREATE TABLE `postfix_accounts`.`alias_table` (

    `AliasId` INT NOT NULL AUTO_INCREMENT, 

    `DomainId` INT NOT NULL, 

    `Source` varchar(100) NOT NULL, 

    `Destination` varchar(100) NOT NULL, 

    PRIMARY KEY (`AliasId`), 

    FOREIGN KEY (DomainId) REFERENCES domains_table(DomainId) ON DELETE CASCADE

) ENGINE = InnoDB;

INSERT INTO `postfix_accounts`.`domains_table` (DomainName) VALUES (‘wecan.ae’);  

INSERT INTO `postfix_accounts`.`accounts_table` (DomainId, password, Email) VALUES (1, ENCRYPT(‘Password’, CONCAT(‘$6

 [wecan@mail ~]#sudo mysql -u root -p

 Enter password: 

Welcome to the MariaDB monitor.  Commands end with ; or g.

Your MariaDB connection id is 19

Server version: 10.4.11-MariaDB MariaDB Server

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type ‘help;’ or ‘h’ for help. Type ‘c’ to clear the current input statement.

MariaDB [(none)]> SELECT version();

+—————–+

| version()       |

+—————–+

| 10.4.11-MariaDB |

+—————–+

1 row in set (0.000 sec)

MariaDB [(none)]> QUIT

Bye

— creating Postfix DB

mysql -u root -p   (add the password)

create database postfix_domain_email;

grant all on postfix_domain_email.* to postfix_admin@localhost identified by ‘StrongPassword’;

flush privileges;

CREATE TABLE `postfix_accounts`.`domains_table` ( `DomainId` INT NOT NULL AUTO_INCREMENT , `DomainName` VARCHAR(50) NOT NULL , PRIMARY KEY (`DomainId`)) ENGINE = InnoDB;

Emails 

CREATE TABLE `postfix_accounts`.`accounts_table` ( 

    `AccountId` INT NOT NULL AUTO_INCREMENT,  

    `DomainId` INT NOT NULL,  

    `password` VARCHAR(300) NOT NULL,  

    `Email` VARCHAR(100) NOT NULL,  

    PRIMARY KEY (`AccountId`),  

    UNIQUE KEY `Email` (`Email`),  

    FOREIGN KEY (DomainId) REFERENCES domains_table(DomainId) ON DELETE CASCADE 

) ENGINE = InnoDB;

Alias

CREATE TABLE `postfix_accounts`.`alias_table` (

    `AliasId` INT NOT NULL AUTO_INCREMENT, 

    `DomainId` INT NOT NULL, 

    `Source` varchar(100) NOT NULL, 

    `Destination` varchar(100) NOT NULL, 

    PRIMARY KEY (`AliasId`), 

    FOREIGN KEY (DomainId) REFERENCES domains_table(DomainId) ON DELETE CASCADE

) ENGINE = InnoDB;

INSERT INTO `postfix_accounts`.`domains_table` (DomainName) VALUES (‘wecan.ae’);  

INSERT INTO `postfix_accounts`.`accounts_table` (DomainId, password, Email) VALUES (1, ENCRYPT(‘Password’, CONCAT(‘$6$’, SUBSTRING(SHA(RAND()), -16))), ‘[email protected]’);  

INSERT INTO `postfix_accounts`.`accounts_table` (DomainId, password, Email) VALUES (1, ENCRYPT(‘Password’, CONCAT(‘$6$’, SUBSTRING(SHA(RAND()), -16))), ‘[email protected]’);  

INSERT INTO `postfix_accounts`.`alias_table` (DomainId, Source, Destination) VALUES (1, ‘[email protected]’, ‘[email protected]’);

flush privileges;

quit;

E- Quick Configurtion of Postfix and Dovecot. 

 [wecan@mail ~]#sudo vi /etc/postfix/main.cf

# line 709, 715: comment out

#

smtpd_tls_cert_file = /etc/pki/tls/certs/postfix.pem

#

smtpd_tls_key_file = /etc/pki/tls/private/postfix.key

# add to the end (replace certificate to your own one)

smtpd_use_tls = yes

smtp_tls_mandatory_protocols = !SSLv2, !SSLv3

smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3

smtpd_tls_cert_file = /etc/letsencrypt/live/mail.wecan.ae/fullchain.pem

smtpd_tls_key_file = /etc/letsencrypt/live/mail.wecan.ae/privkey.pem

smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache

myhostname = mail.wecan.ae

mydomain = wecan.ae  ## Input your unique domain here

 [wecan@mail ~]#sudo vi /etc/postfix/master.cf

# line 17,18,20: uncomment

submission inet n       –       n       –       –       smtpd

  -o syslog_name=postfix/submission

#  -o smtpd_tls_security_level=encrypt

  -o smtpd_sasl_auth_enable=yes

# line 29-32: uncomment

smtps     inet  n       –       n       –       –       smtpd

  -o syslog_name=postfix/smtps

  -o smtpd_tls_wrappermode=yes

  -o smtpd_sasl_auth_enable=yes

 [wecan@mail ~]#sudovi /etc/dovecot/conf.d/10-ssl.conf

# line 8: change (if set SSL required, specify [required])

ssl = yes

# line 14,15: specify certificates

ssl_cert = </etc/letsencrypt/live/mail.wecan.ae/fullchain.pem

ssl_key = </etc/letsencrypt/live/mail.wecan.ae/privkey.pem

 [wecan@mail ~]#sudo systemctl restart postfix dovecot 

 B- If you have SELinux enabled, restote context for certificates. 

 [wecan@mail ~]#sudo restorecon -v /etc/letsencrypt/live/mail.wecan.aefullchain.pem

 [wecan@mail ~]#sudo restorecon -v /etc/letsencrypt/live/mail.wecan.ae/privkey.pem 

  C-If Firewalld is running, allow SMTP-Submission/SMTPS/POP3S/IMAPS services.

   [wecan@mail ~]#sudo firewall-cmd –add-service={smtp-submission,smtps,pop3s,imaps} –permanent    

   [wecan@mail ~]#sudo firewall-cmd  –reload