semhoun / sqmail_all-in-one

All-in-one S/QMail server with: s/qmail, dkim, spam filter, imap/pop3, web admin

SQMail All-In-One

All-in-one S/QMail server with

• s/qmail
• spam filter
• dovecot (imap/pop)
• web admin
• Roundcube
• Fetchmail

Usage

Docker

docker run \
  --name sqmail-aio \
  --publish 80:80 \
  --publish 88:88 \
  --publish 25:25 \
  --publish 465:465 \
  --publish 587:587 \
  --publish 110:110 \
  --publish 995:995 \
  --publish 143:143 \
  --publish 993:993 \
  --volume /opt/mail_data/qcontrol:/var/qmail/control \
  --volume /opt/mail_data/ssl:/ssl \
  --volume /opt/mail_data/domains:/var/vpopmail/domains \
  --volume /opt/mail_data/vpopmail_etc:/var/vpopmail/etc \
  --volume /opt/mail_data/log:/log \
  --volume /opt/mail_data/spamassassin:/var/spamassassin \
  --volume /opt/mail_data/tmp:/var/qmail/tmp \
  --volume /opt/mail_data/qusers:/var/qmail/users \
  --volume /opt/mail_data/queue:/var/qmail/queue \
  --volume /opt/mail_data/qalias:/var/qmail/alias \
  --volume /opt/mail_data/domainkeys:/var/qmail/ssl/domainkeys
  semhoun/sqmail_all-in-one

Docker Compose

version: '3.8'

services:
  sqmail-aio:
    image: semhoun/sqmail_all-in-one
    volumes:
      - ./data/qcontrol:/var/qmail/control
      - ./data/ssl:/ssl
      - ./data/domains:/var/vpopmail/domains
      - ./data/vpopmail_etc:/var/vpopmail/etc
      - ./data/log:/log
      - ./data/spamassassin:/var/spamassassin
      - ./data/tmp:/var/qmail/tmp
      - ./data/qusers:/var/qmail/users
      - ./data/queue:/var/qmail/queue
      - ./data/qalias:/var/qmail/alias
      - ./data/domainkeys:/var/qmail/ssl/domainkeys
    ports:
      - 80:80
      - 88:88
      - 443:443
      - 25:25
      - 465:465
      - 587:587
      - 110:110
      - 995:995
      - 143:143
      - 993:993

Initialization

Docker

docker run \
  --rm -it \
  --env SKIP_INIT_ENV=1 \
  --volume /opt/mail_data/qcontrol:/var/qmail/control \
  --volume /opt/mail_data/ssl:/ssl \
  --volume /opt/mail_data/domains:/var/vpopmail/domains \
  --volume /opt/mail_data/vpopmail_etc:/var/vpopmail/etc \
  --volume /opt/mail_data/spamassassin:/var/spamassassin \
  --volume /opt/mail_data/qusers:/var/qmail/users \
  --volume /opt/mail_data/queue:/var/qmail/queue \
  --volume /opt/mail_data/qalias:/var/qmail/alias \
  --volume /opt/mail_data/domainkeys:/var/qmail/ssl/domainkeys
  semhoun/sqmail_all-in-one /opt/bin/init.sh
  
docker run \
  --rm -it \
  --env SKIP_INIT_ENV=1 \
  --volume ./mail_data/ssl:/ssl \
  --publish 80:80 \
  semhoun/sqmail_all-in-one /opt/bin/init-certs.sh

Docker Compose

docker compose run -e SKIP_INIT_ENV=1 --rm sqmail-aio /opt/bin/init.sh
docker compose run -e SKIP_INIT_ENV=1 --rm sqmail-aio /opt/bin/init-certs.sh

Docker configuration

Environment

• SKIP_INIT_ENV - Skip all initialization of docker_entrypoint (like directory, spamassassin, clamav)
• DEV_MODE - Currently remove some clamav databases

Volumes

• /ssl - SSL Certificates
• /var/qmail/control- QMail config files
• /var/vpopmail/domains - Domains (mail) data
• /var/vpopmail/etc- vpopmail config files
• /log - Log directoy
• /var/spamassassin- SpamAssassin
• /var/qmail/tmp- QMail temporary directory (best if tmpfs)
• /var/qmail/users - QMail user file
• /var/qmail/queue - QMail queue
• /var/qmail/alias - QMail alias (for local users)
• /var/qmail/ssl/domainkeys - Domain DKIM private and public keys

Ports

• 80 - Webmail (roundcube) and SSL Acme certs
• 88 - HTTP admin (https and security not provided)
• 443 - SSL Webmail (roundcube)
• 25 - SMTP
• 465 - SMTPs
• 587 - Submission
• 110 - POP3
• 995 - POP3s
• 143 - IMAP
• 993 - IMAPs

Useful File Locations

• /ssl/acme - Letsencrypt SSL data (remove to renew certs installation)

• /ssl - SSL Certificates

  • /ssl/http.key - Webmail Key
  • /ssl/http.crt - Webmail Certificate
  • /ssl/imap.key - IMAP Key
  • /ssl/imap.crt - IMAP Certificate
  • /ssl/pop.key - POP3 Key
  • /ssl/pop.crt - POP3 Certificate
  • /ssl/smtp.key - SMTP Key
  • /ssl/smtp.crt - SMTP Certificate

• /opt/bin/init.sh - Initialisation script

• /opt/bin/init-certs.sh - Certs initialisation script

• /opt/bin/mkdkimkey.sh - DKIM key creation

  • usage /opt/bin/mkdkimkey.sh [-p] <domain>
  • Print domainkey with -p, without create domain keys
  • You can split the result here: https://www.mailhardener.com/tools/dns-record-splitter

• /var/qmail/control/dkimdomains - DKIM domains

• Sending domains other than the default domain and with they own key must be added in this file

• For more information see https://www.fehcom.de/sqmail/man/qmail-dksign.html

• /opt/bin/tester.sh - Check is IMAP POP SMTP Clamav and SpamAssasin was working

  • usage tester.sh <test mail recipient> -doit

Built With

• qmail-autoresponder 2.0
• clamav 1.2.1
• dovecot 2.3.21
• ezmlm-idx 7.2.2
• fehQlibs 23
• fcron 3.3.1
• qmailadmin
• qmail-autoresponder 2.0
• Roundcube 1.6.4
• SpamAssassin 4.0.0
• s6 2.11.3.2
• SQMail 4.2.28
• VPopMail
• vqadmin
• acme.sh 3.0.7
• fetchmail

Testing

Manual SMTP

You can test the SMTP part with Swaks A simpe test mail could be done with this:

swaks --to <to mail> --from <from email> --server <qmail aio host name>

Auto

You can check IMAP POP SMTP Clamav and SpamAssasin configuration inside the docker with tester.sh script. A valid mail account must used (a temporay is also created for testing). Docker must be running during the tests.

Docker

docker exec -it sqmail-aio /opt/bin/tester.sh <receipient email> -doit

Docker compose

docker compose exec sqmail-aio /opt/bin/tester.sh <receipient email> -doit

Find Me

• GitHub
• DockerHub

Authors

• Nathanaël Semhoun - Docker creation - semhoun

License

This project is licensed under the MIT License - see the LICENSE.md file for details.

Acknowledgments

This docker use sources and patches from

• http://cr.yp.to
• https://www.fehcom.de/sqmail/sqmail.html
• https://notes.sagredo.eu
• https://github.com/brunonymous/vpopmail
• http://skarnet.org/software/s6/index.html
• http://fcron.free.fr
• http://untroubled.org/qmail-autoresponder/

sqmail_all-in-one's Issues

Vpopmail versions including several patches

For your information, we have a version of Vpopmail with several patches. Patches from Roberto, FreeBSD, Gentoo and other patches. Perhaps you will be interested in this version:
https://github.com/brunonymous/vpopmail
The list of changes can be consulted here:
https://github.com/brunonymous/vpopmail/blob/main/ChangeLog

Créer un script init_sqmail

https://notes.sagredo.eu/en/qmail-notes-185/configuring-qmail-83.html

Voir l'utilité de la clé DKIM Default

Add support for vpopmail limits in dovecots

# This file is commonly accessed via passdb {} or userdb {} section in
# conf.d/auth-sql.conf.ext

# This file is opened as root, so it should be owned by root and mode 0600.
#
# http://wiki2.dovecot.org/AuthDatabase/SQL
#
# For the sql passdb module, you'll need a database with a table that
# contains fields for at least the username and password. If you want to
# use the user@domain syntax, you might want to have a separate domain
# field as well.
#
# If your users all have the same uig/gid, and have predictable home
# directories, you can use the static userdb module to generate the home
# dir based on the username and domain. In this case, you won't need fields
# for home, uid, or gid in the database.
#
# If you prefer to use the sql userdb module, you'll want to add fields
# for home, uid, and gid. Here is an example table:
#
# CREATE TABLE users (
#     username VARCHAR(128) NOT NULL,
#     domain VARCHAR(128) NOT NULL,
#     password VARCHAR(64) NOT NULL,
#     home VARCHAR(255) NOT NULL,
#     uid INTEGER NOT NULL,
#     gid INTEGER NOT NULL,
#     active CHAR(1) DEFAULT 'Y' NOT NULL
# );

# Database driver: mysql, pgsql, sqlite
driver = mysql

# Database connection string. This is driver-specific setting.
#
# HA / round-robin load-balancing is supported by giving multiple host
# settings, like: host=sql1.host.org host=sql2.host.org
#
# pgsql:
#   For available options, see the PostgreSQL documentation for the
#   PQconnectdb function of libpq.
#   Use maxconns=n (default 5) to change how many connections Dovecot can
#   create to pgsql.
#
# mysql:
#   Basic options emulate PostgreSQL option names:
#     host, port, user, password, dbname
#
#   But also adds some new settings:
#     client_flags           - See MySQL manual
#     connect_timeout        - Connect timeout in seconds (default: 5)
#     read_timeout           - Read timeout in seconds (default: 30)
#     write_timeout          - Write timeout in seconds (default: 30)
#     ssl_ca, ssl_ca_path    - Set either one or both to enable SSL
#     ssl_cert, ssl_key      - For sending client-side certificates to server
#     ssl_cipher             - Set minimum allowed cipher security (default: HIGH)
#     ssl_verify_server_cert - Verify that the name in the server SSL certificate
#                              matches the host (default: no)
#     option_file            - Read options from the given file instead of
#                              the default my.cnf location
#     option_group           - Read options from the given group (default: client)
# 
#   You can connect to UNIX sockets by using host: host=/var/run/mysql.sock
#   Note that currently you can't use spaces in parameters.
#
# sqlite:
#   The path to the database file.
#
# Examples:
#   connect = host=192.168.1.1 dbname=users
#   connect = host=sql.example.com dbname=virtual user=virtual password=blarg
#   connect = /etc/dovecot/authdb.sqlite
#
connect = host=localhost dbname=vpopmail user=vpopmail password=

# Default password scheme.
#
# List of supported schemes is in
# http://wiki2.dovecot.org/Authentication/PasswordSchemes
#
default_pass_scheme = MD5-CRYPT

# passdb query to retrieve the password. It can return fields:
#   password - The user's password. This field must be returned.
#   user - user@domain from the database. Needed with case-insensitive lookups.
#   username and domain - An alternative way to represent the "user" field.
#
# The "user" field is often necessary with case-insensitive lookups to avoid
# e.g. "name" and "nAme" logins creating two different mail directories. If
# your user and domain names are in separate fields, you can return "username"
# and "domain" fields instead of "user".
#
# The query can also return other fields which have a special meaning, see
# http://wiki2.dovecot.org/PasswordDatabase/ExtraFields
#
# Commonly used available substitutions (see http://wiki2.dovecot.org/Variables
# for full list):
#   %u = entire user@domain
#   %n = user part of user@domain
#   %d = domain part of user@domain
#
# Note that these can be used only as input to SQL query. If the query outputs
# any of these substitutions, they're not touched. Otherwise it would be
# difficult to have eg. usernames containing '%' characters.
#
# Example:
#   password_query = SELECT userid AS user, pw AS password \
#     FROM users WHERE userid = '%u' AND active = 'Y'
#
# (Thanks to Arturo Blanco for his hints concerning vpopmail limits
#  and to Alexandre Fonceca for quota_rule addition)
#
# NB: This query requires that the sql-aliasdomains patch has been installed
#     and that you have the aliasdomains dbtable
#     More info here https://notes.sagredo.eu/en/qmail-notes-185/dovecot-vpopmail-auth-driver-removal-migrating-to-the-sql-driver-241.html
password_query = \
	SELECT \
		CONCAT(vpopmail.pw_name, '@', vpopmail.pw_domain) AS user, \
  		vpopmail.pw_passwd AS password, \
                vpopmail.pw_dir AS userdb_home, \
                89 AS userdb_uid, \
                89 AS userdb_gid, \
                CONCAT('*:bytes=', REPLACE(SUBSTRING_INDEX(vpopmail.pw_shell, 'S', 1), 'NOQUOTA', '0')) AS userdb_quota_rule \
	FROM `vpopmail` \
		LEFT JOIN aliasdomains ON aliasdomains.alias='%d' \
		LEFT JOIN limits ON limits.domain = '%d' \
	WHERE \
		vpopmail.pw_name='%n' \
		AND \
		(vpopmail.pw_domain='%d' OR vpopmail.pw_domain=aliasdomains.domain) \
		AND \
		('%a'!='995' OR !(vpopmail.pw_gid & 2)) \
		AND \
		('%r'!='<WEBMAIL-IP>' OR !(vpopmail.pw_gid & 4)) \
		AND \
		('%r'='<WEBMAIL-IP>' OR '%a'!='993' OR !(vpopmail.pw_gid & 8)) \
		AND \
		('%r'!='<WEBMAIL-IP>' OR COALESCE(disable_webmail,0)!=1) \
		AND \
		('%r'='<WEBMAIL-IP>' OR COALESCE(disable_imap,0)!=1)

# <WEBMAIL-IP> is the IP of your webmail web server.
# I'm assuming that the imap connection is only on port 993 and the pop3 connection is on port 995.
# Adjust to your needs
#
# logically this means:
#
# ************************** USER LIMITS via vpopmail.pw_gid filed
# SELECT user
# WHEN POP is not disabled for that user connecting on port 995 (995 is the pop3s port allowed from remote in my configuration)
# AND WHEN webmail access is not disabled for that user when connecting from <WEBMAIL-IP>
# AND WHEN IMAP is not disabled for that user connecting on port 993 (993 is the imap port allowed from remote
# in my configuration) unless his remote ip the one belonging to the webmail
#
# ************************* DOMAIN LIMITS via limits table
# AND WHEN WEBMAIL access for the domain is not disabled
# AND WHEN IMAP access for the domain is not disabled when not connecting from <WEBMAIL-IP>


# userdb query to retrieve the user information. It can return fields:
#   uid - System UID (overrides mail_uid setting)
#   gid - System GID (overrides mail_gid setting)
#   home - Home directory
#   mail - Mail location (overrides mail_location setting)
#
# None of these are strictly required. If you use a single UID and GID, and
# home or mail directory fits to a template string, you could use userdb static
# instead. For a list of all fields that can be returned, see
# http://wiki2.dovecot.org/UserDatabase/ExtraFields
#
# Examples:
#   user_query = SELECT home, uid, gid FROM users WHERE userid = '%u'
#   user_query = SELECT dir AS home, user AS uid, group AS gid FROM users where userid = '%u'
#   user_query = SELECT home, 501 AS uid, 501 AS gid FROM users WHERE userid = '%u'
#
# This query is for the iteration feature (no need to use aliasdomains here)
user_query = \
	SELECT \
		vpopmail.pw_dir AS home, \
	  	89 AS uid, \
  		89 AS gid \
  	FROM vpopmail \
  	WHERE \
  		vpopmail.pw_name='%n' \
		AND \
		vpopmail.pw_domain='%d'

# Query to get a list of all usernames.
iterate_query = SELECT CONCAT(pw_name,'@',pw_domain) AS user FROM vpopmail

Better mysql support for SpamAssassin

https://wiki.koumbit.net/SpamAssassinConfiguration
https://p5r.uk/blog/2017/spamassassin-with-mariadb.html

Rendre paramètrable le serveur RLSB

vusaged | A mettre en services

Now copy the startup script ro /etc/rc.d (Slackware) or init.d and run it. This is a Slackware example:

cp contrib/rc.vusaged /etc/rc.d/
/etc/rc.d/rc.vusaged start

Vérifier que tlsdestinations fonctionne en docker

echo "*:" >> /var/qmail/control/tlsdestinations

Modifier deamontools pour gérer le kill docker

Ajouter des tests

https://notes.sagredo.eu/en/qmail-notes-185/testing-qmail-smtp-and-auth-22.html

Error in initialisation of certs

In script init-certs.sh, ACME create domain folder with "_ecc"

Update SpamAssassin to 4.0.0

Remplacer autoresponder

https://github.com/bruceg/qmail-autoresponder

Ajouter un support sieve

https://notes.sagredo.eu/en/qmail-notes-185/sieve-interpreter-dovecot-managesieve-31.html

Add ezmlm-browse

https://notes.sagredo.eu/en/qmail-notes-185/ezmlm-browse-40.html