FreeBSD15.1 : Mailサーバー(Postfix,Dovecot)構築と SSL/TLS化

# service apache24 stop
# certbot certonly --standalone -d mail.<domain name>
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificate for mail.<domain name>

Successfully received certificate.
Certificate is saved at: /usr/local/etc/letsencrypt/live/mail.<domain name>/fullchain.pem
Key is saved at:         /usr/local/etc/letsencrypt/live/mail.<domain name>/privkey.pem
This certificate expires on 2026-09-15.
These files will be updated when the certificate renews.

NEXT STEPS:
- The certificate will need to be renewed before it expires. Certbot can automatically renew the certificate in the background, but you may need to take steps to enable that functionality. See https://certbot.org/renewal-setup for instructions.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 

# pkg install procmail

# vi /usr/local/etc/pkgtools.conf

404行目追記
MAKE_ARGS = {
    'security/cyrus-sasl2' => 'WITHOUT_OTP=yes',
    'security/cyrus-sasl2-saslauthd' => 'WITH_BDB=yes',
    'mail/postfix' => 'WITH_SASL2=yes WITH_TLS=yes',
}

# pkg install cyrus-sasl cyrus-sasl-saslauthd

# cd /usr/ports/mail/postfix
# make WITH_SASL2=yes WITH_TLS=yes WITH_BDB=yes install clean

# vi /usr/local/etc/postfix/main.cf

100行目に追記
myhostname = mail.<domain>
107行目に追記
mydomain = <domain>
122行目コメント解除
myorigin = $mydomain
136行目コメント解除
inet_interfaces = all
184行目コメント解除
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
286行目コメント解除して、自ネットワークに変更
mynetworks = 127.0.0.0/8, 192.168.11.0/24
320行目コメント解除して追記
relay_domains = $mydestination
410行目あたりコメント解除
alias_maps = hash:/etc/aliases
420行目あたりコメント解除
alias_database = hash:/etc/aliases
442行目あたりコメント解除
home_mailbox = Maildir/ #←Maildir形式
472行目あたりに追記
mailbox_command = /usr/local/bin/procmail #←procmailのパスを指定

#末尾に追加
# Cyrus-SASL configuration
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = $myhostname
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination

# TLS設定
# TLS configuration
smtpd_tls_cert_file = /usr/local/etc/letsencrypt/live/mail.<domain>/fullchain.pem
smtpd_tls_key_file = /usr/local/etc/letsencrypt/live/mail.<domain>/privkey.pem
smtpd_tls_session_cache_database = btree:/usr/local/etc/postfix/smtpd_scache

# vi /usr/local/etc/postfix/master.cf

19行目以降submissionの項目で下記の通り一部コメント解除
submission inet n       -       n       -       -       smtpd
#  -o syslog_name=postfix/submission
#  -o smtpd_forbid_unauth_pipelining=no
    -o smtpd_tls_security_level=encrypt
    -o smtpd_sasl_auth_enable=yes
#  -o smtpd_tls_auth_only=yes
#  -o local_header_rewrite_clients=static:all
#  -o smtpd_hide_client_session=yes
#  -o smtpd_reject_unlisted_recipient=no
#     Instead of specifying complex smtpd_<xxx>_restrictions here,
#     specify "smtpd_<xxx>_restrictions=$mua_<xxx>_restrictions"
#     here, and specify mua_<xxx>_restrictions in main.cf (where
#     "<xxx>" is "client", "helo", "sender", "relay", or "recipient").
#  -o smtpd_client_restrictions=
#  -o smtpd_helo_restrictions=
#  -o smtpd_sender_restrictions=
#  -o smtpd_relay_restrictions=
    -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
    -o milter_macro_daemon_name=ORIGINATING

40行目以降submissionsの項目で下記の通り一部コメント解除
submissions     inet  n       -       n       -       -       smtpd
    -o syslog_name=postfix/submissions
#  -o smtpd_forbid_unauth_pipelining=no
    -o smtpd_tls_wrappermode=yes
    -o smtpd_sasl_auth_enable=yes                                                                                          
#  -o local_header_rewrite_clients=static:all                                                                              
#  -o smtpd_hide_client_session=yes                                                                                        
#  -o smtpd_reject_unlisted_recipient=no                                                                                   
#     Instead of specifying complex smtpd_<xxx>_restrictions here,                                                         
#     specify "smtpd_<xxx>_restrictions=$mua_<xxx>_restrictions"                                                           
#     here, and specify mua_<xxx>_restrictions in main.cf (where                                                           
#     "<xxx>" is "client", "helo", "sender", "relay", or "recipient").                                                     
#  -o smtpd_client_restrictions=                                                                                           
#  -o smtpd_helo_restrictions=                                                                                             
#  -o smtpd_sender_restrictions=                                                                                           
#  -o smtpd_relay_restrictions=                                                                                            
#  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject                                                        
#  -o milter_macro_daemon_name=ORIGINATING          

# vi /etc/rc.conf
…以下追記
saslauthd_enable="YES"
saslauthd_flags="-a sasldb"

起動
# /usr/local/etc/rc.d/saslauthd start
Starting saslauthd.

# vi /usr/local/lib/sasl2/smtpd.conf
…以下記述
pwcheck_method: auxprop

# saslpasswd2 -c -u [domain] huong
Password: 
Again (for verification):

メールユーザ確認
# sasldblistusers2
huong@[domain]: cmusaslsecretOTP
huong@[domain]: userPassword

# chown cyrus:mail /usr/local/etc/sasldb2.db
# chmod 640 /usr/local/etc/sasldb2.db

# /etc/rc.d/sendmail stop
Stopping sendmail.
Waiting for PIDS: 915.
sendmail_submit not running? (check /var/run/sendmail.pid).
Stopping sendmail_msp_queue.
Waiting for PIDS: 933.

# vi /etc/rc.conf
…以下追記
sendmail_enable="NO"
sendmail_submit_enable="NO"
sendmail_outbound_enable="NO"
sendmail_msp_queue_enable="NO"

# vi /etc/periodic.conf
…以下記述
daily_clean_hoststat_enable="NO"
daily_status_mail_rejects_enable="NO"
daily_status_include_submit_mailq="NO"
daily_submit_queuerun="NO"

# mv /etc/mail/mailer.conf /etc/mail/mailer.conf.org
# vi /etc/mail/mailer.conf
…以下記述
sendmail    /usr/local/sbin/sendmail
send-mail   /usr/local/sbin/sendmail
mailq       /usr/local/sbin/sendmail
newaliases  /usr/local/sbin/sendmail

# vi /etc/make.conf
…以下記述
NO_MAILWRAPPER=YES
NO_SENDMAIL=YES

# vi /etc/rc.conf
…以下追記
postfix_enable="YES"

# /usr/local/etc/rc.d/postfix start
postfix/postfix-script: starting the Postfix mail system

# cd /usr/ports/mail/dovecot
# make BATCH=yes install clean

# cp -r /usr/local/etc/dovecot/example-config/* /usr/local/etc/dovecot/
# chmod 640 /usr/local/etc/dovecot/dovecot.conf

# vi /usr/local/etc/dovecot/dovecot.conf

25行目追記
protocols = imap pop3

30行目コメント解除
listen = *, ::

# vi /usr/local/etc/dovecot/conf.d/10-ssl.conf 
6行目コメント解除
ssl = yes

12,13行目取得したkeyに書き換え
ssl_cert = < /usr/local/etc/letsencrypt/live/mail.<domain>/fullchain.pem
ssl_key = < /usr/local/etc/letsencrypt/live/mail.<domain>/privkey.pem

# vi  /usr/local/etc/dovecot/conf.d/10-master.conf
19行目変更
service imap-login {
  inet_listener imap {
    #port = 143　→　port = 0
  }
22,23行目コメント解除
  inet_listener imaps {
    port = 993
    ssl = yes
  }
}
40行目変更
service pop3-login {
  inet_listener pop3 {
    #port = 110  →　port = 0
  }
43,44行目コメント解除
  inet_listener pop3s {
    port = 995
    ssl = yes
  }
}

110-112行目コメント解除し追記
# Postfix smtp-auth
  unix_listener /var/spool/postfix/private/auth {
    mode = 0666
    user = postfix
    group = postfix
  }
}

# vi  /usr/local/etc/dovecot/conf.d/10-auth.conf

10行目コメント解除し変更
disable_plaintext_auth = no

100行目追記
auth_mechanisms = plain login

# vi /usr/local/etc/dovecot/conf.d/10-mail.conf

31行目追記
mail_location = maildir:~/Maildir

# vi /etc/rc.conf
…以下追記
dovecot_enable="YES"

# /usr/local/etc/rc.d/dovecot start
Starting dovecot.

# vi /etc/aliases
18行目追記
# root: me@my.domain
root: [自身のmail address]

# postalias /etc/aliases

# pkg install bash
# bash

# mkdir -p /home/huong/Maildir/{cur,new,tmp}
# chmod -R 700 /home/huong/Maildir
# chmod -R 700 /home/huong/Maildir/{cur,new,tmp}
# chown -R huong:huong /home/huong/Maildir

# mkdir -p /usr/share/skel/Maildir/{cur,new,tmp}
# chmod -R 700 /usr/share/skel/Maildir/

# sh

# vi  /usr/local/etc/procmailrc 

SHELL=/bin/sh
PATH=/bin:/usr/bin:/usr/local/bin
DROPPRIVS=yes
MAILDIR=$HOME/Maildir
DEFAULT=$MAILDIR/
#LOGFILE=$MAILDIR/procmail.log

#remove finance
:0
* ^Subject: .*finance.*
/dev/null

# vi  /usr/local/etc/ipfw.rules

…以下追記 ※XXXには適当な値

$IPF XXX allow tcp from any to any 465 in
$IPF XXX allow tcp from any to any 465 out
$IPF XXX allow tcp from any to any 993 in
$IPF XXX allow tcp from any to any 993 out
$IPF XXX allow tcp from any to any 995 in
$IPF XXX allow tcp from any to any 995 out

# /etc/rc.d/ipfw restart
Firewall rules loaded.

# telnet localhost 25
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 mail.<domain> ESMTP Postfix
EHLO localhost
250-mail.<domain>
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-AUTH PLAIN LOGIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-DSN
250-SMTPUTF8
250 CHUNKING
quit
221 2.0.0 Bye
Connection closed by foreign host.

# telnet localhost 587
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 mail.<domain> ESMTP Postfix
EHLO localhost
250-mail.<domain>
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-AUTH PLAIN LOGIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-DSN
250-SMTPUTF8
250 CHUNKING
quit
221 2.0.0 Bye
Connection closed by foreign host.