Servers 101: Emailify Your Server Part 4: Finishing up Dovecot with SSL & Webmail!

dimitrisp (68)in #tutorial • 9 years ago (edited)

In the previous part, we configured Dovecot -except for the SSL. In this part, we will add our email hostname to our Apache configuration, generate a certificate via Let's Encrypt, configure Dovecot to use this certificate, and install roundcube for webmail!

Other stuff in the Server 101 series:

Intro and getting into your server - Single Article
Basic Server Security - 3 Parts
Setting up a Web Server - 4 Parts
Managing Your Server - 4 Parts
caddy - Lightweight Web Server - 1 Part

Before starting, get root access, if you don't have it already! sudo su

Apache vhost

I will provide a really quick guide for Apache vhost. I have already covered this in the past in Servers 101: Setting Up a Web Server Part 4. This will be the file we want to create:

nano /etc/apache2/sites-enabled/999-mail-example-com.conf

And these are the contents of the file.

<VirtualHost *:80>
        ServerName mail.example.com
        ServerAdmin [email protected]
        DocumentRoot /var/www/example.com
        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

Obviously change "mail.example.com" and "example.com" to suit your needs! For more detailed info, read the post I've linked above!

Save and exit!

Let's Encrypt

If you don't understand something, read Servers 101: Setting Up a Web Server Part 3 - SSL

We run the certbot:

certbot --apache

We will see something like this:

But with extra hostnames, including the one we've set above (mail.example.com). Press the number in front of the mail domain, and enter. Add your email, and press enter. Then Agree to the terms, select the Secure option and we are ready!

Now, go to folder /etc/apache2/sites-enabled. You should see a file named 999-mail-example-com-le-ssl.conf (the real file name will have your own hostname instead of mail-example-com). Open it up with nano, and go to the bottom. You will see 2 lines resembling these 2:

SSLCertificateFile /etc/letsencrypt/live/mail.example.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/mail.example.com/privkey.pem

Copy and paste the 2 paths somewhere you can easily find them. The first one (fullchain) is our certificate, and the second one (privekey) is our private key. We will need them for the next step to finish up the dovecot configuration.

Setting up SSL in Dovecot

Open up /etc/dovecot/conf.d/10-ssl.conf

nano /etc/dovecot/conf.d/10-ssl.conf

In the beginning, you will see a line reading:

ssl = no

Change it to this:

ssl = required

Now we need the 2 file paths we copy pasted earlier. Make them look like this:

ssl_cert = </etc/letsencrypt/live/mail.example.com/fullchain.pem
ssl_key = </etc/letsencrypt/live/mail.example.com/privkey.pem

and put those 2 lines just below ssl = required. Notice the "<" I've put in there. Do not skip this. It is needed.

Restart dovecot for a final time:

service dovecot restart

And we are done! You can now set up of the emails you created in the database in your email software (Thunderbird, Outlook, whatever), and verify it works by sending and reply from an external email for example a gmail account). A quick note though about ports:

IMAP: SSL on 993
POP3: SSL on 995
SMTP: SSL on 587

Setting up Roundcube

We first have to install Roundcube:

apt-get -y install roundcube roundcube-core roundcube-mysql roundcube-plugins roundcube-plugins-extra javascript-common libjs-jquery-mousewheel php-net-sieve tinymce

You will be asked for this:

Configure database for roundcube with dbconfig-common? Choose Yes
MySQL application password for roundcube: Press enter

You will then be asked for the root MySQL password. Enter it, at roundcube will be configured.

Then we have to edit the default apache roundcube config file. It was installed right now, with roundcube:

nano /etc/apache2/conf-enabled/roundcube.conf

Locate the lines:

<Directory /var/lib/roundcube>
#AddType application/x-httpd-php .php

And remove the hashtag (#) infront of the AddType line.

Also, locate the line reading:

# Alias /roundcube /var/lib/roundcube

and change it to:

Alias /roundcube /var/lib/roundcube

We now have to restart apache for this to take effect!

service apache2 restart

The final step is to edit the default roundcube config. We only want to be able to connect to the local mailserver! Locate the line saying $config['default_host'], and change it to look like this:

$config['default_host'] = 'localhost';

This will prevent roundcube from showing the "server hostname" field, and we will only be able to connect to our mailserver. Otherwise, it may get abused!

Conclusion!

That's it! We have fully configured our mailserver! In the next part, we will add spam and virus filtering, as well as learn how to add new emails!

The next part is available here

Thank you for reading!

Main image source: Junauza/Santang

If you need a place to host your servers consider Vultr, Digital Ocean and BuyVM.

These are affiliate links. If you sign up through them, you support me and I will have more free time to write more content like this.

Also If you signup for Digital Ocean through my affiliate link, you will get $10 to try them out. Note: to battle abusers of this offer, you'll have to make a $5 deposit via Paypal or add your credit/debit card, so they can confirm that you are a new user. I did a deposit via Paypal to test them out, and then I added my credit card so I won't have to deposit money manually every now and then.