Apologies for the length of this, but I'm not sure what parts of the various config files may be messed up, so I'm uploading them all.
I recently migrated an old VPS to a new VPS. The old VPS had a working postfix + dovecot mail system (which also supported/required ssl & tls).
The recent set of breaking changes to dovecot 2.4 mean that most of my working dovecot configuration information is incorrect. I tried searching for how to set up a modern configuration, but I've done something because, while postfix and dovecot both happily run on the new VPS, my email clients cannot connect to them anymore (I'm using Thunderbird to test the new setup).
OS: Debian 13.7
postfix: 3.10.13
dovecot: 2.4.1-4 (7d8c0e5759)
My server uses letsencrypt to manage ssl. I migrated all the letsencrypt files over from the old VPS to the new VPS. I believe those are working, because I also use letsencrypt certificates for https access to various WordPress sites I hose, and that's working fine.
Here are what I believe all the config files.
dovecot.conf
## Dovecot configuration file # If you're in a hurry, see https://doc.dovecot.org/latest/core/config/guides/quick.html # "doveconf -n" command gives a clean output of the changed settings. Use it # instead of copy&pasting files when posting to the Dovecot mailing list. # '#' character and everything after it is treated as comments. Extra spaces # and tabs are ignored. If you want to use either of these explicitly, put the # value inside quotes, eg.: key = "# char and trailing whitespace " dovecot_config_version = 2.4.1 dovecot_storage_version = 2.4.1 protocols { imap = yes lmtp = yes } auth_allow_cleartext = no auth_mechanisms = plain passdb passwd-file { passwd_file_path = /etc/dovecot/passwd } userdb passwd-file { passwd_file_path = /etc/dovecot/passwd } mail_home = /var/vmail/%{user | domain}/%{user | username} mail_driver = maildir mail_path = %{mail_home}/Maildir mail_uid = vmail mail_gid = vmail service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { mode = 0660 user = postfix group = postfix } } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0660 user = postfix group = postfix } } ssl = required ssl_min_protocol = TLSv1.2 ssl_client_ca_dir = /etc/ssl/certs ssl_server_dh_file = /usr/share/dovecot/dh.pem ssl_server_prefer_ciphers = server ssl_server_cert_file = /etc/letsencrypt/live/mail.alldomains/fullchain.pem ssl_server_key_file = /etc/letsencrypt/live/mail.alldomains/privkey.pem postfix main.cf
# See /usr/share/postfix/main.cf.dist for a commented, more complete version # See [http://www.postfix.org/COMPATIBILITY_README.html](http://www.postfix.org/COMPATIBILITY_README.html) compatibility_level = 3.9` myorigin = /etc/mailname` # Text that follows the 220 code in the SMTP server's greeting banner. # You MUST specify $myhostname at the start due to an RFC requirement. smtpd_banner = $myhostname ESMTP $mail_name (Debian) # IP protocols to use: ipv4, ipv6, or all # (set this explicitly so post-install upgrade-configuration wont complain) inet_protocols = all # List of "trusted" SMTP clients (maptype:mapname allowed) that have more # privileges than "strangers". If mynetworks is not specified (the default), # mynetworks_style is used to compute its value. #mynetworks_style = class #mynetworks_style = subnet mynetworks_style = host mynetworks = [127.0.0.0/8](http://127.0.0.0/8) [::ffff:127.0.0.0]/104 [::1]/128 # Uncomment the next line to generate "delayed mail" warnings` #delay_warning_time = 4h` # List of domains (maptype:mapname allowed) that this machine considers` # itself the final destination for.` mydestination = $myhostname, theboilingfrog.net, hwsrv-1339591.hostwindsdns.com, localhost.hostwindsdns.com, localhost # Maximum size of a user mailbox` mailbox_size_limit = 0 # Optional external command to use instead of mailbox delivery. If set, # you must set up an alias to forward root mail to a real user. mailbox_command = # List of alias maps to use to lookup local addresses. # Per Debian Policy it should be /etc/aliases. alias_maps = hash:/etc/aliases # List of alias maps to make indexes on, when running newaliases. alias_database = hash:/etc/aliases # Notify (or not) local biff service when new mail arrives. # Rarely used these days. biff = no # Separator between user name and address extension (user+foo@domain) recipient_delimiter = + # A host to send "other" mail to #relayhost = $mydomain #relayhost = [gateway.example.com] #relayhost = [ip.add.re.ss]:port #relayhost = uucphost relayhost = # Where to look for Cyrus SASL configuration files. Upstream default is unset # (use compiled-in SASL library default), Debian Policy says it should be # /etc/postfix/sasl. cyrus_sasl_config_path = /etc/postfix/sasl # SMTP server RSA key and certificate in PEM format smtpd_tls_key_file = /etc/letsencrypt/live/mail.alldomains/fullchain.pem smtpd_tls_cert_file = /etc/letsencrypt/live/mail.alldomains/privkey.pem # SMTP Server security level: none|may|encrypt smtpd_tls_security_level = may smtpd_tls_loglevel = 1 smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache #Enforce TLSv1.3 or TLSv1.2 smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 # List of CAs for SMTP Client to trust # Prefer this over _CApath when smtp is running chrooted smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt # SMTP Client TLS security level: none|may|encrypt|... smtp_tls_security_level = may # SMTP Client TLS session cache smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache myhostname = [hwsrv-1339591.hostwindsdns.com](http://hwsrv-1339591.hostwindsdns.com) inet_interfaces = all # SASL Authentication via Dovecot smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth smtpd_sasl_auth_enable = yes broken_sasl_auth_clients = yes smtpd_sasl_security_options = noanonymous, noplaintext smtpd_sasl_tls_security_options = noanonymous smtpd_tls_auth_only = yes smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated reject_unauth_destination reject_rbl_client zen.spamhaus.org bl.spamcop.net cbl.abuseat.org reject_unknown_client_hostname # smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination # Email Hand-off via Dovecot LMTP virtual_transport = lmtp:unix:private/dovecot-lmtp` virtual_mailbox_domains = [example.com](http://example.com) virtual_mailbox_base = /var/mail/vhosts virtual_mailbox_maps = hash:/etc/postfix/vmailbox virtual_minimum_uid = 100 virtual_uid_maps = static:5000 virtual_gid_maps = static:5000 virtual_alias_maps = hash:/etc/postfix/virtual postfix master.cf
# Postfix master process configuration file. For details on the format # of the file, see the master(5) manual page (command: "man 5 master" or # on-line: https://www.postfix.org/master.5.html). # # Do not forget to execute "postfix reload" after editing this file. # # ========================================================================== # service type private unpriv chroot wakeup maxproc command + args # (yes) (yes) (no) (never) (100) # ========================================================================== smtp inet n - y - - smtpd submission inet n - y - - smtpd -o syslog_name=postfix/submission -o smtpd_tls_security_level=encrypt -o smtpd_tls_wrappermode=no -o smtpd_sasl_auth_enable=yes -o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject -o smtpd_relay_restrictions=permit_sasl_authenticated,reject -o smtpd_sasl_type=dovecot -o smtpd_sasl_path=private/auth smtps inet n - y - - smtpd -o syslog_name=postfix/smtps -o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes -o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject -o smtpd_relay_restrictions=permit_sasl_authenticated,reject -o smtpd_sasl_type=dovecot -o smtpd_sasl_path=private/auth #628 inet n - y - - qmqpd pickup unix n - y 60 1 pickup cleanup unix n - y - 0 cleanup qmgr unix n - n 300 1 qmgr #qmgr unix n - n 300 1 oqmgr tlsmgr unix - - y 1000? 1 tlsmgr rewrite unix - - y - - trivial-rewrite bounce unix - - y - 0 bounce defer unix - - y - 0 bounce trace unix - - y - 0 bounce verify unix - - y - 1 verify flush unix n - y 1000? 0 flush proxymap unix - - n - - proxymap proxywrite unix - - n - 1 proxymap smtp unix - - y - - smtp relay unix - - y - - smtp -o syslog_name=${multi_instance_name?{$multi_instance_name}:{postfix}}/$service_name # -o smtp_helo_timeout=5 -o smtp_connect_timeout=5 showq unix n - y - - showq error unix - - y - - error retry unix - - y - - error discard unix - - y - - discard local unix - n n - - local virtual unix - n n - - virtual lmtp unix - - y - - lmtp anvil unix - - y - 1 anvil scache unix - - y - 1 scache postlog unix-dgram n - n - 1 postlogd # # ==================================================================== # Interfaces to non-Postfix software. Be sure to examine the manual # pages of the non-Postfix software to find out what options it wants. # # Many of the following services use the Postfix pipe(8) delivery # agent. See the pipe(8) man page for information about ${recipient} # and other message envelope options. # ==================================================================== # # maildrop. See the Postfix MAILDROP_README file for details. # Also specify in main.cf: maildrop_destination_recipient_limit=1 # maildrop unix - n n - - pipe flags=DRXhu user=vmail argv=/usr/bin/maildrop -d ${recipient} # omitted many comment lines # start the SPF policy daemon policyd-spf unix - n n - 0 spawn user=policyd-spf argv=/usr/bin/policyd-spf The files defining virtual users and virtual mailboxes were migrated over from the old VPS
postfix virtual
do-not-reply@theboilingfrog.net nobody do-not-reply@ardsleyhigh73.com nobody do-not-reply@make-america-smart-again.com nobody admin@ardsleyhigh73.com mark@ardsleyhigh73.com mark@arcabama.com website@ardsleyhigh73.com mark@ardsleyhigh73.com mark@arcabama.com topics@theboilingfrog.net mark@theboilingfrog.net seth@theboilingfrog.net postfix vmailbox
support@jumpforjoysoftware.com jumpforjoysoftware.com/mark/ mark@jumpforjoysoftware.com jumpforjoysoftware.com/mark/ mark@ardsleyhigh73.com ardsleyhigh73.com/mark/ mark@make-america-smart-again.com make-america-smart-again.com/mark/ The dovecot passwd file was regenerated on the new VPS using doveadm to generate the keys (SHA-512)
dovecot passwd (key text omitted)
mark@jumpforjoysoftware.com:{SHA512-CRYPT}... mark@ardsleyhigh73.com:{SHA512-CRYPT}... mark@make-america-smart-again.com:{SHA512-CRYPT}... Whew! Thanx for reading all the way to the end!
Source: r/selfhosted · by /u/MotorcycleMayor