Serveur mail Postfix + Dovecot : config avancée et hardening

Internet → Port 25 (SMTP) → Postfix → OpenDKIM → Delivery
        → Port 587 (Submission) → Postfix (SASL via Dovecot) → Delivery
        → Port 993 (IMAPS) → Dovecot

Delivery : Postfix → dovecot-lmtp → Maildir (/var/mail/vhosts/domaine/user/)

## Enregistrement A pour le serveur mail
mail.domaine.fr.        IN  A       203.0.113.42

## MX — priorité 10
domaine.fr.             IN  MX  10  mail.domaine.fr.

## SPF — autoriser uniquement le MX et l'IP du serveur
domaine.fr.             IN  TXT     "v=spf1 mx ip4:203.0.113.42 -all"

## DMARC — politique quarantine, rapports activés
_dmarc.domaine.fr.      IN  TXT     "v=DMARC1; p=quarantine; sp=quarantine; rua=mailto:postmaster@domaine.fr; ruf=mailto:postmaster@domaine.fr; fo=1; adkim=s; aspf=s"

## PTR (à configurer côté hébergeur VPS)
42.113.0.203.in-addr.arpa.  IN  PTR  mail.domaine.fr.

dig mail.domaine.fr A +short
dig domaine.fr MX +short
dig domaine.fr TXT +short
dig -x 203.0.113.42 +short

sudo apt update && sudo apt upgrade -y

sudo apt install -y \
  postfix \
  postfix-policyd-spf-python \
  dovecot-core \
  dovecot-imapd \
  dovecot-lmtpd \
  dovecot-sieve \
  dovecot-managesieved \
  opendkim \
  opendkim-tools \
  certbot \
  fail2ban \
  mailutils

sudo hostnamectl set-hostname mail.domaine.fr
echo "203.0.113.42    mail.domaine.fr    mail" | sudo tee -a /etc/hosts

## S'assurer que le port 80 est libre
sudo systemctl stop nginx apache2 2>/dev/null

## Obtenir le certificat
sudo certbot certonly —standalone -d mail.domaine.fr —agree-tos —email admin@domaine.fr —non-interactive

## Vérifier
sudo ls -la /etc/letsencrypt/live/mail.domaine.fr/

sudo bash -c 'cat > /etc/letsencrypt/renewal-hooks/deploy/mail-reload.sh << "HOOKEOF"
#!/bin/bash
systemctl reload postfix
systemctl reload dovecot
HOOKEOF'

sudo chmod +x /etc/letsencrypt/renewal-hooks/deploy/mail-reload.sh

sudo cp /etc/postfix/main.cf /etc/postfix/main.cf.bak
sudo tee /etc/postfix/main.cf << 'POSTFIXEOF'
## Postfix main.cf — Configuration production
## Serveur : mail.domaine.fr

## Identification
smtpd_banner = $myhostname ESMTP
biff = no
append_dot_mydomain = no
readme_directory = no
compatibility_level = 3.6

## Hostname et domaine
myhostname = mail.domaine.fr
mydomain = domaine.fr
myorigin = $mydomain
mydestination = localhost

## Réseau
inet_interfaces = all
inet_protocols = ipv4
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128

## Virtual mailboxes
virtual_mailbox_domains = domaine.fr
virtual_mailbox_base = /var/mail/vhosts
virtual_mailbox_maps = hash:/etc/postfix/vmailbox
virtual_minimum_uid = 1000
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000
virtual_alias_maps = hash:/etc/postfix/virtual
virtual_transport = lmtp:unix:private/dovecot-lmtp

## TLS entrant (SMTP reçu)
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.domaine.fr/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/mail.domaine.fr/privkey.pem
smtpd_use_tls = yes
smtpd_tls_security_level = may
smtpd_tls_auth_only = yes
smtpd_tls_protocols = >=TLSv1.2
smtpd_tls_mandatory_protocols = >=TLSv1.2
smtpd_tls_mandatory_ciphers = medium
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_tls_loglevel = 1

## TLS sortant (SMTP envoyé)
smtp_tls_security_level = may
smtp_tls_protocols = >=TLSv1.2
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtp_tls_loglevel = 1

## SASL via Dovecot
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous, noplaintext
smtpd_sasl_tls_security_options = noanonymous

## Restrictions SMTP — anti-spam basique
smtpd_helo_required = yes
smtpd_helo_restrictions =
    permit_mynetworks,
    reject_invalid_helo_hostname,
    reject_non_fqdn_helo_hostname

smtpd_sender_restrictions =
    permit_mynetworks,
    reject_non_fqdn_sender,
    reject_unknown_sender_domain

smtpd_recipient_restrictions =
    permit_sasl_authenticated,
    permit_mynetworks,
    reject_unauth_destination,
    reject_non_fqdn_recipient,
    reject_unknown_recipient_domain,
    check_policy_service unix:private/policyd-spf

smtpd_relay_restrictions =
    permit_mynetworks,
    permit_sasl_authenticated,
    defer_unauth_destination

## Limites
message_size_limit = 26214400
mailbox_size_limit = 0
recipient_delimiter = +

## OpenDKIM
milter_protocol = 6
milter_default_action = accept
smtpd_milters = inet:localhost:12301
non_smtpd_milters = inet:localhost:12301

## SPF policy daemon
policyd-spf_time_limit = 3600
POSTFIXEOF

sudo tee /etc/postfix/master.cf << 'MASTEREOF'
## Postfix master.cf

## Service SMTP standard (port 25)
smtp      inet  n       -       y       -       -       smtpd

## Service Submission (port 587) — envoi authentifié
submission inet n       -       y       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_tls_auth_only=yes
  -o smtpd_reject_unlisted_recipient=no
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING

## Processus internes Postfix
pickup    unix  n       -       y       60      1       pickup
cleanup   unix  n       -       y       -       0       cleanup
qmgr      unix  n       -       n       300     1       qmgr
tlsmgr    unix  -       -       y       1000?   1       tlsmgr
rewrite   unix  -       -       y       -       -       trivial-rewrite
bounce    unix  -       -       y       -       0       bounce
defer     unix  -       -       y       -       0       bounce
trace     unix  -       -       y       -       0       bounce
verify    unix  -       -       y       -       1       verify
flush     unix  n       -       y       1000?   0       flush
proxymap  unix  -       -       n       -       -       proxymap
proxywrite unix -       -       n       -       1       proxymap
smtp      unix  -       -       y       -       -       smtp
relay     unix  -       -       y       -       -       smtp
  -o syslog_name=postfix/$service_name
showq     unix  n       -       y       -       -       showq
error     unix  -       -       y       -       -       error
retry     unix  -       -       y       -       -       error
discard   unix  -       -       y       -       -       discard
local     unix  -       n       n       -       -       local
virtual   unix  -       n       n       -       -       virtual
lmtp      unix  -       -       y       -       -       lmtp
anvil     unix  -       -       y       -       1       anvil
scache    unix  -       -       y       -       1       scache
postlog   unix-dgram n  -       n       -       1       postlogd

## SPF policy daemon
policyd-spf  unix  -    n       y       -       0       spawn
  user=policyd-spf argv=/usr/bin/policyd-spf
MASTEREOF

## Fichier vmailbox — une ligne par boîte mail
sudo tee /etc/postfix/vmailbox << 'EOF'
contact@domaine.fr    domaine.fr/contact/
postmaster@domaine.fr domaine.fr/postmaster/
info@domaine.fr       domaine.fr/info/
EOF

## Fichier virtual — alias
sudo tee /etc/postfix/virtual << 'EOF'
postmaster@domaine.fr   contact@domaine.fr
abuse@domaine.fr        contact@domaine.fr
EOF

## Générer les hash maps
sudo postmap /etc/postfix/vmailbox
sudo postmap /etc/postfix/virtual

sudo groupadd -g 5000 vmail
sudo useradd -g vmail -u 5000 -d /var/mail/vhosts -s /usr/sbin/nologin vmail
sudo mkdir -p /var/mail/vhosts/domaine.fr
sudo chown -R vmail:vmail /var/mail/vhosts

sudo mkdir -p /etc/opendkim/keys/domaine.fr

## Générer la clé (sélecteur : mail)
sudo opendkim-genkey -b 2048 -s mail -d domaine.fr -D /etc/opendkim/keys/domaine.fr
sudo chown -R opendkim:opendkim /etc/opendkim/keys/

sudo tee /etc/opendkim.conf << 'DKIMEOF'
## OpenDKIM configuration
AutoRestart             Yes
AutoRestartRate         10/1h
SyslogSuccess           Yes
LogWhy                  Yes

Canonicalization        relaxed/simple
ExternalIgnoreList      refile:/etc/opendkim/TrustedHosts
InternalHosts           refile:/etc/opendkim/TrustedHosts
KeyTable                refile:/etc/opendkim/KeyTable
SigningTable            refile:/etc/opendkim/SigningTable

Mode                    sv
PidFile                 /run/opendkim/opendkim.pid
SignatureAlgorithm      rsa-sha256
UserID                  opendkim:opendkim
Socket                  inet:12301@localhost

OversignHeaders         From
DKIMEOF

## TrustedHosts
sudo tee /etc/opendkim/TrustedHosts << 'EOF'
127.0.0.1
localhost
domaine.fr
mail.domaine.fr
EOF

## KeyTable
sudo tee /etc/opendkim/KeyTable << 'EOF'
mail._domainkey.domaine.fr domaine.fr:mail:/etc/opendkim/keys/domaine.fr/mail.private
EOF

## SigningTable
sudo tee /etc/opendkim/SigningTable << 'EOF'
*@domaine.fr mail._domainkey.domaine.fr
EOF

sudo cat /etc/opendkim/keys/domaine.fr/mail.txt

sudo tee /etc/dovecot/conf.d/10-mail.conf << 'EOF'
## Emplacement des mails — virtual mailboxes
mail_location = maildir:/var/mail/vhosts/%d/%n
mail_privileged_group = vmail

namespace inbox {
  inbox = yes
}
EOF

sudo tee /etc/dovecot/conf.d/10-auth.conf << 'EOF'
disable_plaintext_auth = yes
auth_mechanisms = plain login

## Désactiver l'auth système, utiliser passwd-file
#!include auth-system.conf.ext
!include auth-passwdfile.conf.ext
EOF

sudo tee /etc/dovecot/conf.d/auth-passwdfile.conf.ext << 'EOF'
passdb {
  driver = passwd-file
  args = scheme=BLF-CRYPT username_format=%u /etc/dovecot/users
}

userdb {
  driver = static
  args = uid=vmail gid=vmail home=/var/mail/vhosts/%d/%n
}
EOF

## Générer un mot de passe hashé
sudo doveadm pw -s BLF-CRYPT
## Entrer le mot de passe souhaité, copier le hash

## Créer le fichier users
sudo tee /etc/dovecot/users << 'EOF'
contact@domaine.fr:{BLF-CRYPT}$2y$05$HASH_ICI
postmaster@domaine.fr:{BLF-CRYPT}$2y$05$HASH_ICI
info@domaine.fr:{BLF-CRYPT}$2y$05$HASH_ICI
EOF

sudo chmod 600 /etc/dovecot/users
sudo chown dovecot:dovecot /etc/dovecot/users

sudo tee /etc/dovecot/conf.d/10-ssl.conf << 'EOF'
ssl = required
ssl_cert = </etc/letsencrypt/live/mail.domaine.fr/fullchain.pem
ssl_key = </etc/letsencrypt/live/mail.domaine.fr/privkey.pem
ssl_min_protocol = TLSv1.2
ssl_prefer_server_ciphers = yes
EOF

sudo tee /etc/dovecot/conf.d/10-master.conf << 'EOF'
service imap-login {
  inet_listener imap {
    port = 0
  }
  inet_listener imaps {
    port = 993
    ssl = yes
  }
}

service imap {
}

service lmtp {
  unix_listener /var/spool/postfix/private/dovecot-lmtp {
    mode = 0600
    user = postfix
    group = postfix
  }
}

service auth {
  unix_listener /var/spool/postfix/private/auth {
    mode = 0660
    user = postfix
    group = postfix
  }
  unix_listener auth-userdb {
    mode = 0600
    user = vmail
  }
}

service auth-worker {
  user = vmail
}
EOF

sudo tee /etc/dovecot/conf.d/20-lmtp.conf << 'EOF'
protocol lmtp {
  mail_plugins = $mail_plugins sieve
}
EOF

sudo tee /etc/dovecot/conf.d/90-sieve.conf << 'EOF'
plugin {
  sieve = file:~/sieve;active=~/.dovecot.sieve
  sieve_default = /var/mail/vhosts/default.sieve
  sieve_default_name = default
}
EOF

## Sieve par défaut : classer le spam
sudo tee /var/mail/vhosts/default.sieve << 'EOF'
require ["fileinto", "mailbox"];

if header :contains "X-Spam-Flag" "YES" {
  fileinto :create "Junk";
  stop;
}
EOF

sudo sievec /var/mail/vhosts/default.sieve
sudo chown vmail:vmail /var/mail/vhosts/default.sieve*

sudo tee /etc/fail2ban/jail.d/mail.conf << 'EOF'
[postfix]
enabled = true
port = smtp,465,submission
filter = postfix[mode=aggressive]
logpath = /var/log/mail.log
maxretry = 3
findtime = 600
bantime = 3600

[dovecot]
enabled = true
port = pop3,pop3s,imap,imaps
filter = dovecot[mode=aggressive]
logpath = /var/log/mail.log
maxretry = 3
findtime = 600
bantime = 3600

[postfix-sasl]
enabled = true
port = smtp,465,submission
filter = postfix[mode=auth]
logpath = /var/log/mail.log
maxretry = 3
findtime = 600
bantime = 7200
EOF

sudo systemctl restart fail2ban

sudo ufw allow 25/tcp comment 'SMTP'
sudo ufw allow 587/tcp comment 'Submission'
sudo ufw allow 993/tcp comment 'IMAPS'
sudo ufw reload
sudo ufw status numbered

## Vérifier la config Postfix
sudo postfix check

## Vérifier la config Dovecot
sudo doveconf -n | head -50

## Redémarrer tous les services
sudo systemctl restart opendkim postfix dovecot fail2ban

## Activer au démarrage
sudo systemctl enable opendkim postfix dovecot fail2ban

## Vérifier les statuts
sudo systemctl status opendkim postfix dovecot fail2ban —no-pager

## Vérifier que Postfix écoute
ss -tlnp | grep -E ':(25|587)'

## Envoyer un mail de test
echo "Test serveur mail production" | mail -s "Test SMTP" test@gmail.com

## Vérifier les logs
sudo tail -f /var/log/mail.log

## Test connexion IMAP SSL
openssl s_client -connect mail.domaine.fr:993 -quiet
## Taper : a login contact@domaine.fr MOTDEPASSE
## Puis : a list "" "*"
## Puis : a logout

## Vérifier que la clé DKIM est publiée
dig mail._domainkey.domaine.fr TXT +short

## Envoyer un mail et vérifier les headers reçus
## Le header doit contenir : DKIM-Signature: ... d=domaine.fr;

sudo tee /usr/local/bin/mail-adduser << 'SCRIPT'
#!/bin/bash
set -euo pipefail

if [ $# -ne 1 ]; then
  echo "Usage: $0 user@domaine.fr"
  exit 1
fi

EMAIL="$1"
DOMAIN=$(echo "$EMAIL" | cut -d@ -f2)
USER=$(echo "$EMAIL" | cut -d@ -f1)

## Vérifier que le domaine est géré
if ! grep -q "$DOMAIN" /etc/postfix/vmailbox 2>/dev/null; then
  echo "Domaine $DOMAIN non configuré dans vmailbox."
  echo "Ajouter d'abord le domaine dans virtual_mailbox_domains."
  exit 1
fi

## Générer le hash du mot de passe
echo "Définir le mot de passe pour $EMAIL :"
HASH=$(doveadm pw -s BLF-CRYPT)

## Ajouter dans le fichier users de Dovecot
echo "$EMAIL:$HASH" >> /etc/dovecot/users

## Ajouter la mailbox dans Postfix
echo "$EMAIL    $DOMAIN/$USER/" >> /etc/postfix/vmailbox
postmap /etc/postfix/vmailbox

## Créer le répertoire Maildir
mkdir -p "/var/mail/vhosts/$DOMAIN/$USER"
chown -R vmail:vmail "/var/mail/vhosts/$DOMAIN/$USER"

echo "Boîte mail $EMAIL créée."
echo "Config IMAP : mail.$DOMAIN:993 (SSL/TLS)"
echo "Config SMTP : mail.$DOMAIN:587 (STARTTLS)"
SCRIPT

sudo chmod +x /usr/local/bin/mail-adduser

sudo mail-adduser nouveau@domaine.fr

sudo tee /usr/local/bin/mail-status << 'MONSCRIPT'
#!/bin/bash
echo "=== État des services ==="
for svc in postfix dovecot opendkim fail2ban; do
  STATUS=$(systemctl is-active $svc)
  printf "%-15s %s\n" "$svc" "$STATUS"
done

echo ""
echo "=== File d'attente Postfix ==="
mailq | tail -1

echo ""
echo "=== Dernières connexions IMAP ==="
grep -c "imap-login" /var/log/mail.log 2>/dev/null || echo "0 connexions"

echo ""
echo "=== IPs bannies (fail2ban) ==="
fail2ban-client status postfix 2>/dev/null | grep "Banned" || echo "Aucune"
fail2ban-client status dovecot 2>/dev/null | grep "Banned" || echo "Aucune"

echo ""
echo "=== Espace disque mail ==="
du -sh /var/mail/vhosts/ 2>/dev/null || echo "N/A"

echo ""
echo "=== Certificat TLS ==="
openssl x509 -in /etc/letsencrypt/live/mail.domaine.fr/cert.pem -noout -enddate 2>/dev/null || echo "Certificat non trouvé"
MONSCRIPT

sudo chmod +x /usr/local/bin/mail-status

## Vérifier SPF
dig domaine.fr TXT +short | grep spf

## Vérifier DKIM
dig mail._domainkey.domaine.fr TXT +short

## Vérifier DMARC
dig _dmarc.domaine.fr TXT +short

## Vérifier le PTR
dig -x 203.0.113.42 +short

## Vérifier les headers d'un mail envoyé
## Dans Gmail : "Afficher l'original" → chercher Authentication-Results

## Vérifier que le socket auth existe
ls -la /var/spool/postfix/private/auth

## Tester l'authentification
sudo doveadm auth test contact@domaine.fr

## Vérifier les logs
sudo grep -i "sasl" /var/log/mail.log | tail -20

## Vérifier que le répertoire existe
ls -la /var/mail/vhosts/domaine.fr/

## Vérifier les permissions
stat /var/mail/vhosts/domaine.fr/contact/

## Recréer si nécessaire
sudo mkdir -p /var/mail/vhosts/domaine.fr/contact
sudo chown -R vmail:vmail /var/mail/vhosts/domaine.fr/contact

## Tester la connexion TLS sur le port 587
openssl s_client -starttls smtp -connect mail.domaine.fr:587 -servername mail.domaine.fr

## Tester le port 993 (IMAPS)
openssl s_client -connect mail.domaine.fr:993

## Vérifier l'expiration du certificat
openssl x509 -in /etc/letsencrypt/live/mail.domaine.fr/cert.pem -noout -dates

## Forcer le renouvellement
sudo certbot renew —force-renewal

## Diagnostic complet
sudo doveconf -n

## Chercher les erreurs
sudo journalctl -u dovecot —no-pager -n 50

## Vérifier la syntaxe
sudo dovecot -F

## Voir la file d'attente
mailq

## Forcer le traitement
sudo postfix flush

## Supprimer tous les messages bloqués (attention)
sudo postsuper -d ALL

## 1. Ajouter le domaine dans main.cf
sudo sed -i 's/virtual_mailbox_domains = domaine.fr/virtual_mailbox_domains = domaine.fr, autredomaine.com/' /etc/postfix/main.cf

## 2. Ajouter les boîtes mail
echo "contact@autredomaine.com    autredomaine.com/contact/" | sudo tee -a /etc/postfix/vmailbox
sudo postmap /etc/postfix/vmailbox

## 3. Créer les répertoires
sudo mkdir -p /var/mail/vhosts/autredomaine.com/contact
sudo chown -R vmail:vmail /var/mail/vhosts/autredomaine.com

## 4. Ajouter l'utilisateur Dovecot
sudo doveadm pw -s BLF-CRYPT
echo "contact@autredomaine.com:{BLF-CRYPT}HASH" | sudo tee -a /etc/dovecot/users

## 5. Ajouter les DNS pour le nouveau domaine (MX, SPF, DKIM, DMARC)
## 6. Ajouter dans OpenDKIM TrustedHosts, KeyTable, SigningTable

sudo systemctl reload postfix