MailAD

This page is also available in the following languages: [ Español 🇪🇸 🇨🇺] [ Deutsch 🇩🇪]

This is a handy tool to provision a mail server on linux linked to an Active Directory (AD from now on) server (Samba or Windows) with some constraints in mind, as this is a typical mail config to be used in Cuba as regulated by law and security enforcement requirements. You can see a simple provision in this asciinema movie.

We have a docker development on going on another repository, take a peek and test it or contribute: MailAD-Docker

⚠️ ⚠️ ⚠️ ⚠️ ⚠️ ⚠️

WARNING: Since the end of February 2020 we changed the integration with AD to be more simpler, you need to check this document if you want to upgrade your setup.

Users of new installs have no problem, just follow the install procedure and you are set.

Rationale

This repository is intended to be cloned on your fresh OS install under /root (you can use a LXC instance, VM, etc) and setup on a main conf file as per the file comments, then run the steps on a makefile and follow the steps to configure your server.

After a few steps you will have a mail server up and running in about 15 minutes tops. (this time is based on a 2Mbps internet connection to a repository, if you have a local repository it will be less)

This tool is tested and supported on:

• Ubuntu Bionic 18.04 (former LTS).
• Ubuntu Focal 20.04 (actual LTS and actual dev env).
• Debian Buster 10 (see note below please).
• Debian Bullseye 11 (see note below please).

Note: If you are using a Debian Container on LXC (Proxmox for example) you need to tweak the dovecot install or it will not work, see this fix for more info

It's recommended that the instance of MailAD sits within your DMZ segment with a firewall between it and your users and a mail gateway like Proxmox Mail Gateway between it and the external network.

Features

This will provision a mail server for an enterprise serving corporate users. You can see the major features in the Features.md file, among others you will find:

0. Low resource footprint.
1. Advanced (and optional) mail filtering features that includes attachments, SPF, AntiVirus & Spam.
2. Encrypted LDAP communication as an option.
3. In place protection to major and known SSL & mail service attacks.
4. Automatic alias using AD groups.
5. Manual alias, manual ban, manual headers & body checks.
6. On demand backup and restore of raw configurations.
7. Really painless upgrades.
8. Daily mail traffic summary to your inbox.
9. Optional user privilege access via AD groups (local/national/international).
10. Optional disclaimer/notice/warning on every outgoing mail.
11. Optional aggressive SPAM fight measures.

TODO

There is a TODO list, which serves as a kind of "roadmap" for new features, but as I (the only dev so far) have a life, a family and a daily job, you know...

All dev is made on weekend or late at night (seriously take a peek on the commit dates!) if you need a feature or fix ASAP, please take into account making a donation or found me and I will be happy to help you ASAP, my contact info is on the bottom of this page.

Constraints and requirements

Do you remember the comment at top of the page about "...with some constraints in mind..."? Yeah, here they are:

0. Your user base and config came from AD as mentioned, we prefer Samba AD but it works on Windows too; see the AD requirements for this tool
1. The mail storage will be a folder in /home/vmail, all mail will belong to a user named vmail with uid:5000 & gid:5000. Tip: that folder can be a NFS mount or any other type of network storage (configurable)
2. You use a Windows PC to control and manage the domain (must be a domain member and have the RSAT installed and activated), we recommend a Windows 10 LTSC/Professional
3. The communication with the server is done in this way: (See this question on the FAQ file to know more)
   • Port 25 (SMTP) is used to receive incoming traffic from the outside world or from a mail gateway.
   • Port 587 (SUBMISSION) is used to receive emails from the users to be delivered locally or relayed to other servers.
   • Port 465 (SMTPS) is used like port 587 but is only enabled as a legacy option, its use is discouraged in favor of port 587.
   • Port 993 (IMAPS) the preffered method to retrieve the email form the server.
   • Port 995 (POP3S) used like the 993, but discouraged in favor of IMAPS (unless you are in a very slow link)

How to install or try it?

We have a INSTALL.md file just for that, and also a FAQ file with common problems.

This is free software!

Have a comment, question, contributions or fix?

Use the Issues tab in the repository URL or drop me a message via Twitter or Telegram

Contributors ✨

Thanks goes to these wonderful people (emoji key):

danny920825 ⚠️ 🤔	HugoFlorentino 🤔 💡	Armando Felipe 🤔	Koratsuki 🤔 💻 🌍	Gabriel A. López López 🌍	oneohthree 🤔	Eddy Ernesto del Valle Pino 📖
dienteperro 📖 💵 🤔	Joe1962 🤔 ⚠️	Sandy Napoles Umpierre 🤔 ⚠️

Please read the CONTRIBUTING.md file if you want to contribute to MailAD to know the details of how to do it. All kinds of contributions are welcomed, ideas, fixes, bugs, improvements and even a phone top-up to keep me online.

This project follows the all-contributors specification. Contributions of any kind welcome!