18. オンラインストレージサーバ構築 – Nextcloud [さくらのVPS/CentOS7]

・Nextcloud のインストール

#-- 変数に必要な値を代入
HTTPS_DOCROOT=/var/www/html/https_root

#-- 必要な phpパッケージをインストール
yum install -y php73-php-{zip,mcrypt,smbclient,imap,gmp,apcu,redis,memcached}
systemctl restart php73-php-fpm

#-- nextcloud のインストール
cd ~/work/git
git clone https://github.com/nextcloud/server.git nextcloud
cd nextcloud
VERSION=$(git tag | egrep -iv "rc|beta" | sed 's/^v//' | sort -n | tail -1)
git checkout v${VERSION}
git submodule update --init
cp -pr ~/work/git/nextcloud ${HTTPS_DOCROOT}/nextcloud
chown -R nginx. ${HTTPS_DOCROOT}/nextcloud/

#-- nextcloud の database を作成
mysql -e "create database nextcloud character set utf8 collate utf8_bin;"
#-- database の password は お好みで
mysql -e "GRANT ALL PRIVILEGES ON nextcloud.* TO 'ncuser'@'localhost' IDENTIFIED BY 'ncpassword' ;"
mysql -e "FLUSH PRIVILEGES;"

#-- nextcloud 用 nginx の設定作成
cat <<'_EOL_' > /etc/nginx/conf.d/https.d/nextcloud.conf
  # for nextcloud
  add_header X-Content-Type-Options nosniff;
  add_header X-XSS-Protection "1; mode=block";
  add_header X-Robots-Tag none;
  add_header X-Download-Options noopen;
  add_header X-Permitted-Cross-Domain-Policies none;
  add_header Referrer-Policy no-referrer;
  fastcgi_hide_header X-Powered-By;

  location = /robots.txt {
    allow all;
    log_not_found off;
    access_log off;
  }

  location ^~ /nextcloud {

    # set max upload size
    client_max_body_size 512M;
    fastcgi_buffers 64 4K;

    # Enable gzip but do not remove ETag headers
    gzip on;
    gzip_vary on;
    gzip_comp_level 4;
    gzip_min_length 256;
    gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
    gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;

    # Uncomment if your server is build with the ngx_pagespeed module
    # This module is currently not supported.
    #pagespeed off;

    location /nextcloud {
      rewrite ^ /nextcloud/index.php$request_uri;
    }

    location ~ ^/nextcloud/(?:build|tests|config|lib|3rdparty|templates|data)/ {
      deny all;
    }
    location ~ ^/nextcloud/(?:\.|autotest|occ|issue|indie|db_|console) {
      deny all;
    }

    location ~ ^/nextcloud/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+)\.php(?:$|/) {
      fastcgi_split_path_info ^(.+?\.php)(/.*)$;
      include fastcgi_params;
      fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
      fastcgi_param PATH_INFO $fastcgi_path_info;
      fastcgi_param HTTPS on;
      #Avoid sending the security headers twice
      fastcgi_param modHeadersAvailable true;
      fastcgi_param front_controller_active true;
      fastcgi_pass 127.0.0.1:9000;
      fastcgi_intercept_errors on;
      fastcgi_request_buffering off;
    }

    location ~ ^/nextcloud/(?:updater|ocs-provider)(?:$|/) {
      try_files $uri/ =404;
      index index.php;
    }

    # Adding the cache control header for js and css files
    # Make sure it is BELOW the PHP block
    location ~ \.(?:css|js|woff2?|svg|gif)$ {
      try_files $uri /nextcloud/index.php$request_uri;
      add_header Cache-Control "public, max-age=15778463";
      # Add headers to serve security related headers  (It is intended
      # to have those duplicated to the ones above)
      # Before enabling Strict-Transport-Security headers please read
      # into this topic first.
      # add_header Strict-Transport-Security "max-age=15768000;
      # includeSubDomains; preload;";
      add_header X-Content-Type-Options nosniff;
      add_header X-XSS-Protection "1; mode=block";
      add_header X-Robots-Tag none;
      add_header X-Download-Options noopen;
      add_header X-Permitted-Cross-Domain-Policies none;
      add_header Referrer-Policy no-referrer;

      # Optional: Don't log access to assets
      access_log off;
    }

    location ~ \.(?:png|html|ttf|ico|jpg|jpeg)$ {
      try_files $uri /nextcloud/index.php$request_uri;
      # Optional: Don't log access to other assets
      access_log off;
    }
  }
_EOL_

systemctl restart nginx

管理者アカウントをWeb画面から作成できるので直ぐに作成すること
https://masdon.life/nextcloud/
mysql を使用する場合は、ストレージとデータベースをクリックして必要な項目を入力する

・ Redis を使用する設定を追加

vi /var/www/html/https_root/nextcloud/config
-- 追加する設定 ここから
  'memcache.local' => '\OC\Memcache\Redis',
  'memcache.locking' => '\OC\Memcache\Redis',
  'redis' => array(
     'host' => 'localhost',
     'port' => 6379,
      )
-- ここまで

17. チャットサーバ構築 – mattermost [さくらのVPS/CentOS7]

・mattermostのインストール

#-- 変数に必要な値を代入
DOMAIN=masdon.life
#-- admin@masdon.life のパスワード
PASSWORD=********
VERSION=5.6.2
HTTPS_DOCROOT=/var/www/html/https_root

#-- mattermost のダウンロードとインストール
cd ~/work/src
curl -O https://releases.mattermost.com/${VERSION}/mattermost-team-${VERSION}-linux-amd64.tar.gz
tar xpf mattermost-team-${VERSION}-linux-amd64.tar.gz
mv mattermost /opt/
mkdir -p /opt/mattermost/data
adduser mattermost
chown -R mattermost. /opt/mattermost
chmod -R g+w /opt/mattermost

#-- mattermost database を作成 (データ投入は初回起動時に自動で行われる)
mysql -e "create database mattermost character set utf8 collate utf8_bin;"
#-- database の password は お好みで
mysql -e "GRANT ALL PRIVILEGES ON mattermost.* TO 'mmuser'@'localhost' IDENTIFIED BY 'mostest' ;"
mysql -e "FLUSH PRIVILEGES;"

#-- mattermost の設定
cp -p /opt/mattermost/config/config.json{,.org}
sed -i -e 's/dockerhost/127.0.0.1/' \
-e 's/mattermost_test/mattermost/' \
-e "s#SiteURL.*#SiteURL\": \"https://${DOMAIN}/mattermost/\",#" \
-e 's/SendEmailNotifications.*/SendEmailNotifications": true,/' \
-e 's/FeedbackName.*/FeedbackName": "Mattermost",/' \
-e "s/FeedbackEmail.*/FeedbackEmail\": \"admin@${DOMAIN}\",/" \
-e 's/EnableSMTPAuth.*/EnableSMTPAuth": true,/' \
-e "s/SMTPUsername.*/SMTPUsername\": \"admin@${DOMAIN}\",/" \
-e "s/SMTPPassword.*/SMTPPassword\": \"${PASSWORD}\",/" \
-e "s/SMTPServer.*/SMTPServer\": \"${DOMAIN}\",/" \
-e 's/SMTPPort.*/SMTPPort": "465",/' \
-e 's/RequireEmailVerification.*/RequireEmailVerification": true,/' \
-e 's/"en"/"ja"/' /opt/mattermost/config/config.json

sed -i -e '186s/ConnectionSecurity.*/ConnectionSecurity": "TLS",/' /opt/mattermost/config/config.json

sed -i -e 's#"Directory": "./data/"#"Directory": "/opt/mattermost/data/"#' \
-e 's#"Directory": "./plugins"#"Directory": "/opt/mattermost/plugins"#' \
-e 's#"ClientDirectory": "./client/plugins"#"Directory": "/opt/mattermost/client/plugins"#' /opt/mattermost/config/config.json

#-- mattermost の起動ルール
cat <<_EOF_> /etc/systemd/system/mattermost.service
[Unit]
Description=Mattermost
After=mysqld.service postfix.service

[Service]
Type=simple
WorkingDirectory=/opt/mattermost/bin
User=mattermost
ExecStart=/opt/mattermost/bin/mattermost
PIDFile=/var/spool/mattermost/pid/master.pid
LimitNOFILE=49152

[Install]
WantedBy=multi-user.target
_EOF_

#-- mattermost 起動
systemctl enable mattermost
systemctl start mattermost

#-- mattermost 用の nginx の設定追加
cp -p /etc/nginx/conf.d/https.conf{,.org}
cat <<'_EOF_'>> /etc/nginx/conf.d/https.conf

upstream backend {
  server 127.0.0.1:8065;
  keepalive 32;
}

proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=mattermost_cache:10m max_size=200m inactive=120m use_temp_path=off;
_EOF_

cat <<'_EOF_'> /etc/nginx/conf.d/https.d/mattermost.conf
  location ^~ /mattermost {
    location ~ /mattermost/api/v[0-9]+/(users/)?websocket$ {
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
      client_max_body_size 50M;
      proxy_set_header Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_set_header X-Frame-Options SAMEORIGIN;
      proxy_buffers 256 16k;
      proxy_buffer_size 16k;
      client_body_timeout 60;
      send_timeout 300;
      lingering_timeout 5;
      proxy_connect_timeout 90;
      proxy_send_timeout 300;
      proxy_read_timeout 90s;
      proxy_pass http://backend;
    }

    location /mattermost/ {
      client_max_body_size 50M;
      proxy_set_header Connection "";
      proxy_set_header Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_set_header X-Frame-Options SAMEORIGIN;
      proxy_buffers 256 16k;
      proxy_buffer_size 16k;
      proxy_read_timeout 600s;
      proxy_cache mattermost_cache;
      proxy_cache_revalidate on;
      proxy_cache_min_uses 2;
      proxy_cache_use_stale timeout;
      proxy_cache_lock on;
      proxy_http_version 1.1;
      proxy_pass http://backend;
    }
  }
_EOF_

systemctl restart nginx

#-- mattermostの日本語全文検索対応
mysql mattermost -u mmuser -pmostest -e "ALTER TABLE \`Posts\` ENGINE = Mroonga;"

最初に作成するアカウントが管理者となる為、直ぐにアカウントを作成すること
https://masdon.life/mattermost/

16. RSSクライアント/サーバ構築 – Tiny Tiny RSS [さくらのVPS/CentOS7]

・Tiny Tiny RSS の用途

  1. 広告排除が可能なRSSクライアント
  2. スマフォアプリから参照可能なRSSサーバ (fever pluginの有効化が必要)

・Tiny Tiny RSS のインストール

#-- 変数に必要な値を代入
DOMAIN=masdon.life
HTTPS_DOCROOT=/var/www/html/https_root

#-- git clone は激遅
git clone https://tt-rss.org/git/tt-rss.git ~/work/git/tt-rss

#-- ttrss database の作成
mysql -e "create database ttrss character set utf8;"
#-- database の password は お好みで
mysql -e "grant all privileges on ttrss.* to ttrss@localhost identified by 'ttrsspass';"
mysql -e "flush privileges;"

cp -pr ~/work/git/tt-rss ${HTTPS_DOCROOT}/tt-rss
cp -p ${HTTPS_DOCROOT}/tt-rss/config.php{-dist,}

#-- diff の結果を参考に設定を編集する
vi ${HTTPS_DOCROOT}/tt-rss/config.php

diff ${HTTPS_DOCROOT}/tt-rss/config.php{-dist,}
6c6
< 	define('DB_TYPE', "pgsql"); // or mysql
---
> 	define('DB_TYPE', "mysql"); // or mysql
8,11c8,11
< 	define('DB_USER', "fox");
< 	define('DB_NAME', "fox");
< 	define('DB_PASS', "XXXXXX");
< 	define('DB_PORT', ''); // usually 5432 for PostgreSQL, 3306 for MySQL
---
> 	define('DB_USER', "ttrss");
> 	define('DB_NAME', "ttrss");
> 	define('DB_PASS', "ttrsspass");
> 	define('DB_PORT', '3306'); // usually 5432 for PostgreSQL, 3306 for MySQL
21c21
< 	define('SELF_URL_PATH', 'http://example.org/tt-rss/');
---
> 	define('SELF_URL_PATH', 'https://masdon.life/tt-rss/');
159c159,168
< 	define('PLUGINS', 'auth_internal, note');
---
> 	define('PLUGINS', 'auth_remote, auth_internal, note, updater, auth_ldap');
> 	define('LDAP_AUTH_SERVER_URI', 'ldap://localhost:389/');
> 	define('LDAP_AUTH_USETLS', FALSE);
> 	define('LDAP_AUTH_ALLOW_UNTRUSTED_CERT', TRUE);
> 	define('LDAP_AUTH_BINDDN', '');
> 	define('LDAP_AUTH_BINDPW', '');
> 	define('LDAP_AUTH_BASEDN', '');
> 	define('LDAP_AUTH_ANONYMOUSBEFOREBIND', FALSE);
> 	define('LDAP_AUTH_SEARCHFILTER', '(mailRoutingAddress=???)');
>

#-- auth_ldap plugin をインストール
git clone https://github.com/hydrian/TTRSS-Auth-LDAP ~/work/git/TTRSS-Auth-LDAP
cp -pr ~/work/git/TTRSS-Auth-LDAP/plugins/auth_ldap ${HTTPS_DOCROOT}/tt-rss/plugins

#-- fever-plugin をインストール
git clone https://github.com/DigitalDJ/tinytinyrss-fever-plugin ~/work/git/tinytinyrss-fever-plugin
cp -pr ~/work/git/tinytinyrss-fever-plugin ${HTTPS_DOCROOT}/tt-rss/plugins/fever

chown -R nginx. ${HTTPS_DOCROOT}/tt-rss

#-- database に初期データ投入
mysql -u ttrss -pttrsspass ttrss < ${HTTPS_DOCROOT}/tt-rss/schema/ttrss_schema_mysql.sql

#-- cron で定期的にデータを更新
echo "*/3 * * * * nginx php73 /var/www/html/https_root/tt-rss/update.php --feeds > /dev/null 2>&1" >> /etc/cron.d/${DOMAIN}-cron

メールアドレスでログインし、設定から fever plugin を有効にしてパスワードを設定する。fever に対応した RSS reader を使えば超便利。

15. 監視サーバ構築 – Zabbix [さくらのVPS/CentOS7]

・zabbixのインストール

#-- 変数に必要な値を代入
HTTPS_DOCROOT=/var/www/html/https_root

#-- zabbix 4.x のリポジトリを追加
rpm -Uvh http://repo.zabbix.com/zabbix/4.0/rhel/7/x86_64/zabbix-release-4.0-1.el7.noarch.rpm

#-- zabbix のインストール
yum install -y zabbix-server zabbix-server-mysql zabbix-web-mysql zabbix-web-japanese zabbix-agent zabbix-get zabbix-sender

#-- 不要なパッケージまでインストールされるので削除
yum remove -y zabbix-server-pgsql-4.0.3-1.el7.x86_64

#-- 必要な php パッケージをインストール
yum install -y php73-php-bcmath
systemctl restart php73-php-fpm

#-- zabbix database の作成 
mysql -e "create database zabbix character set utf8 collate utf8_bin;"
#-- database の password は お好みで
mysql -e "grant all on zabbix.* to zabbix@localhost identified by 'zabbixpass';"
mysql -e "FLUSH PRIVILEGES;"

#-- database に初期データの登録
zcat /usr/share/doc/zabbix-server-mysql-4.0.*/create.sql.gz | mysql -u zabbix -pzabbixpass zabbix

#-- zabbix-server の設定
sed -i "/^# DBPassword=/a DBPassword=zabbixpass" /etc/zabbix/zabbix_server.conf

#-- zabbix-server, zabbix-agent の起動
systemctl enable zabbix-server zabbix-agent
systemctl start zabbix-server zabbix-agent

#-- zabbix-web の設定
cat <<'_EOL_'> /etc/zabbix/web/zabbix.conf.php
<?php
// Zabbix GUI configuration file.
global $DB;

$DB['TYPE']     = 'MYSQL';
$DB['SERVER']   = 'localhost';
$DB['PORT']     = '0';
$DB['DATABASE'] = 'zabbix';
$DB['USER']     = 'zabbix';
$DB['PASSWORD'] = 'zabbixpass';

// Schema name. Used for IBM DB2 and PostgreSQL.
$DB['SCHEMA'] = '';

$ZBX_SERVER      = 'localhost';
$ZBX_SERVER_PORT = '10051';
$ZBX_SERVER_NAME = 'zabbix';

$IMAGE_FORMAT_DEFAULT = IMAGE_FORMAT_PNG;
_EOL_

#-- Zabbix server の監視開始
mysql -uzabbix -pzabbixpass zabbix -e "update hosts set status=0 where host = 'Zabbix server' ;"

#-- 下記は yum update 時も実施する必要がある
chown -R nginx. /etc/zabbix/web
ln -s /usr/share/zabbix ${HTTPS_DOCROOT}/zabbix

admin アカウントのパスワードはデフォルトのため、直ぐに変更すること
https://masdon.life/zabbix/
user: Admin , pass: zabbix

14. LDAP管理サーバ構築 – phpldapadmin [さくらのVPS/CentOS7]

・phpldapadmin の用途

  1. LDAPのレコード管理

・phpldapadmin のインストール

#-- 変数に必要な値を代入
HTTPS_DOCROOT=/var/www/html/https_root

#-- phpldapadmin本家は php7.x に対応していない為、 fork されたものを clone する
git clone https://github.com/breisig/phpLDAPadmin.git ~/work/git/phpldapadmin

cp -pr ~/work/git/phpldapadmin ${HTTPS_DOCROOT}/phpldapadmin
cp -p ${HTTPS_DOCROOT}/phpldapadmin/config/config.php{.example,}
chown -R nginx. ${HTTPS_DOCROOT}/phpldapadmin

#-- 複数ドメインがある場合は、カンマ区切りで追加する
sed -i -e "301i \$servers->setValue('server','base',array('dc=masdon,dc=life'));" ${HTTPS_DOCROOT}/phpldapadmin/config/config.php

#-- 使用しないテンプレートを移動
mkdir ${HTTPS_DOCROOT}/phpldapadmin/templates/creation_backup
for x in courierMailAccount.xml courierMailAlias.xml mozillaOrgPerson.xml sambaDomain.xml sambaGroupMapping.xml sambaMachine.xml sambaSamAccount.xml
do
  mv ${HTTPS_DOCROOT}/phpldapadmin/templates/creation/${x} ${HTTPS_DOCROOT}/phpldapadmin/templates/creation_backup
done

ログインユーザは RootDN

13. Webメールサーバ構築 – roundcube/rainloop [さくらのVPS/CentOS7]

・roundcubeの用途

  1. Webメール
  2. アカウントのパスワード変更
  3. メールのフォルダ振り分け/転送の設定

・roundcubeのインストール

#-- 変数に必要な値を代入
DOMAIN=masdon.life
HTTPS_DOCROOT=/var/www/html/https_root

#-- 1.3系の最新版を入手
git clone https://github.com/roundcube/roundcubemail.git ~/work/git/roundcubemail
cd ~/work/git/roundcubemail
VERSION=$(git for-each-ref --sort=-taggerdate --format='%(tag)' refs/tags | grep -m 1 "1\.3\.")
git checkout ${VERSION}
cp -pr ../roundcubemail ${HTTPS_DOCROOT}/roundcubemail-${VERSION}
ln -s ${HTTPS_DOCROOT}/roundcubemail-${VERSION} ${HTTPS_DOCROOT}/roundcube

#-- roundcube の DB を作成
mysql -e "create database roundcubemail character set utf8 collate utf8_bin;"
#-- database の password は お好みで
mysql -e "grant all on roundcubemail.* to roundcube@localhost identified by 'roundcube';"
mysql -e "FLUSH PRIVILEGES;"
mysql roundcubemail < ${HTTPS_DOCROOT}/roundcube/SQL/mysql.initial.sql

#-- 必要なPHPのライブラリをインストール
yum install -y php73-php-{pdo,xml,pear,mbstring,intl,pecl-imagick,gd,mysqlnd,pspell,pecl-zip}
yum install -y php-pear-Mail-mimeDecode php-kolab-net-ldap3 php-pear-Net-IDNA2 php-pear-Auth-SASL php-pear-Net-SMTP php-pear-Net-Sieve

#-- php-fpm の再起動
systemctl restart php73-php-fpm

#-- roundcube の設定
cat <<'_EOF_'> ${HTTPS_DOCROOT}/roundcube/config/config.inc.php
<?php
$config['db_dsnw'] = 'mysql://roundcube:roundcube@localhost/roundcubemail';
$config['default_host'] = array('_DOMAIN_');
$config['default_port'] = 993;
$config['smtp_server'] = '_DOMAIN_';
$config['smtp_port'] = 465;
$config['smtp_user'] = '%u';
$config['smtp_pass'] = '%p';
$config['support_url'] = '';
$config['product_name'] = 'Roundcube Webmail';
$config['des_key'] = 'rcmail-!24ByteDESkey*Str';
$config['plugins'] = array('managesieve', 'password', 'archive', 'zipdownload');
$config['managesieve_host'] = 'localhost';
$config['spellcheck_engine'] = 'pspell';
$config['skin'] = 'larry';
_EOF_

sed -i "s#_DOMAIN_#ssl://${DOMAIN}#" ${HTTPS_DOCROOT}/roundcube/config/config.inc.php

cp -p ${HTTPS_DOCROOT}/roundcube/plugins/managesieve/config.inc.php{.dist,}
sed -i -e "s/managesieve_vacation'] = 0/managesieve_vacation'] = 1/" ${HTTPS_DOCROOT}/roundcube/plugins/managesieve/config.inc.php

cp -p ${HTTPS_DOCROOT}/roundcube/plugins/password/config.inc.php{.dist,}

sed -i -e "s/'sql'/'ldap'/" \
       -e "s/'ou=people,dc=example,dc=com'/''/" \
       -e "s/'dc=exemple,dc=com'/''/" \
       -e "s/'uid=%login,ou=people,dc=exemple,dc=com'/'uid=%name,ou=People,%dc'/" \
       -e "s/'(uid=%login)'/'(uid=%name,ou=People,%dc)'/" ${HTTPS_DOCROOT}/roundcube/plugins/password/config.inc.php

chown -R nginx. ${HTTPS_DOCROOT}/roundcubemail-${VERSION}
cd ${HTTPS_DOCROOT}/roundcube/bin
./install-jsdeps.sh

mv ${HTTPS_DOCROOT}/roundcube/installer ${HTTPS_DOCROOT}/roundcube/_installer

・rainloop のインストール

#-- 変数に必要な値を代入
DOMAIN=masdon.life
HTTPS_DOCROOT=/var/www/html/https_root

#-- rainloop のインストール
mkdir -p ${HTTPS_DOCROOT}/rainloop
cd ${HTTPS_DOCROOT}/rainloop
curl -sL https://repository.rainloop.net/installer.php | php
chown -R nginx. ${HTTPS_DOCROOT}/rainloop
curl -s https://${DOMAIN}/rainloop/

#-- rainloop の設定
for x in $(ldapsearch -x mailroutingaddress | awk -F@ '/^mailRoutingAddress/{print $2}' | sort | uniq)
do
cat <<_EOL_> ${HTTPS_DOCROOT}/rainloop/data/_data_/_default_/domains/${x}.ini
imap_host = "${DOMAIN}"
imap_port = 993
imap_secure = "SSL"
imap_short_login = Off
sieve_use = Off
sieve_allow_raw = Off
sieve_host = ""
sieve_port = 4190
sieve_secure = "None"
smtp_host = "${DOMAIN}"
smtp_port = 465
smtp_secure = "SSL"
smtp_short_login = Off
smtp_auth = On
smtp_php_mail = Off
_EOL_
  chown nginx. ${HTTPS_DOCROOT}/rainloop/data/_data_/_default_/domains/${x}.ini
done

sed -i 's/$/,gmail.com/' ${HTTPS_DOCROOT}/rainloop/data/_data_/_default_/domains/disabled

cat <<_EOL_> /etc/nginx/conf.d/https.d/rainloop.conf
  location ^~ /rainloop/data {
    deny all;
  }
_EOL_

#-- nginx の再起動
systemctl reload nginx

admin アカウントのパスワードはデフォルトのため、直ぐに変更すること
https://masdon.life/rainloop/?ADMIN
user: admin , pass: 12345

12. メールサーバ構築(6) – Thunderbird の Autoconfig [さくらのVPS/CentOS7]

・thunderbird autoconfig の用途

  1. Thunderbird へのメールアカウント追加時にメールアドレスとパスワードのみでSMTP/IMAP設定を完了させる設定

・xmlを作成

#-- 変数に必要な値を代入
DOMAIN=masdon.life

#-- https://masdon.life/.well-known/autoconfig/mail/config-v1.1.xml を作成
mkdir -p /var/www/html/https_root/.well-known/autoconfig/mail
chown -R nginx. /var/www/html/https_root/.well-known
cat <<'_EOL_'>/var/www/html/https_root/.well-known/autoconfig/mail/config-v1.1.xml
<?xml version="1.0"?>
<clientConfig version="1.1">
    <emailProvider id="sakuravps">
      <domain>_DOMAIN_</domain>
      <displayName>_DOMAIN_</displayName>
      <displayShortName>_DOMAIN_</displayShortName>
      <incomingServer type="imap">
         <username>%EMAILADDRESS%</username>
         <hostname>_DOMAIN_</hostname>
         <port>993</port>
         <socketType>SSL</socketType>
         <authentication>password-cleartext</authentication>
      </incomingServer>
      <incomingServer type="pop3">
         <username>%EMAILADDRESS%</username>
         <hostname>_DOMAIN_</hostname>
         <port>995</port>
         <socketType>SSL</socketType>
         <authentication>password-cleartext</authentication>
         <pop3>
            <leaveMessagesOnServer>true</leaveMessagesOnServer>
            <downloadOnBiff>true</downloadOnBiff>
            <daysToLeaveMessagesOnServer>14</daysToLeaveMessagesOnServer>
         </pop3>
      </incomingServer>
      <outgoingServer type="smtp">
         <username>%EMAILADDRESS%</username>
         <hostname>_DOMAIN_</hostname>
         <port>465</port>
         <socketType>SSL</socketType>
         <authentication>password-cleartext</authentication>
      </outgoingServer>
    </emailProvider>
    <clientConfigUpdate url="http://_DOMAIN_/mail/config-v1.1.xml" />
</clientConfig>
_EOL_

sed -i "s/_DOMAIN_/${DOMAIN}/g" /var/www/html/https_root/.well-known/autoconfig/mail/config-v1.1.xml

11. メールサーバ構築(5) – nginx/php-fpm [さくらのVPS/CentOS7]

・nginxの用途

  1. メールプロキシーサーバ(SMTP-Submission/SMTPS/POPS/IMAPS)
  2. メール認証サーバ(HTTP)
  3. Webサーバ(HTTPS)

・nginx のインストール

#-- 変数に必要な値を代入
DOMAIN=masdon.life
VERSION=1.17.0
IPV4=$(ip addr show eth0 | awk '/inet /{print $2}' | sed 's#/.*##')
IPV6=$(ip addr show eth0 | awk '/inet6 /&&/global/{print $2}' | sed 's#/.*##')

#-- nginx ユーザ/グループの作成と起動スクリプトを用意する為、OS標準の nginx をインストールしてアンインストール
yum install -y nginx
cp -p /usr/lib/systemd/system/nginx.service /var/tmp
yum remove -y nginx

#-- ldapに登録したメールアカウントで basic 認証ができるように nginx-auth-ldap をダウンロード
mkdir ~/work/git
git clone https://github.com/kvspb/nginx-auth-ldap.git ~/work/git/nginx-auth-ldap

#-- nginx の source のダウンロード (TLS1.3 に対応するため、source からインストールする)
cd ~/work/src
curl -L -O https://nginx.org/download/nginx-${VERSION}.tar.gz
tar xvzf nginx-${VERSION}.tar.gz && cd nginx-${VERSION}

#- build
./configure \
--prefix=/usr/local/nginx-${VERSION} \
--conf-path=/etc/nginx/nginx.conf \
--error-log-path=/var/log/nginx/error.log \
--http-log-path=/var/log/nginx/access.log \
--pid-path=/var/run/nginx.pid \
--lock-path=/var/run/nginx.lock \
--http-client-body-temp-path=/var/cache/nginx/client_temp \
--http-proxy-temp-path=/var/cache/nginx/proxy_temp \
--http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp \
--http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp \
--http-scgi-temp-path=/var/cache/nginx/scgi_temp \
--user=nginx \
--group=nginx \
--with-http_ssl_module \
--with-http_realip_module \
--with-http_addition_module \
--with-http_sub_module \
--with-http_dav_module \
--with-http_flv_module \
--with-http_mp4_module \
--with-http_gunzip_module \
--with-http_gzip_static_module \
--with-http_random_index_module \
--with-http_secure_link_module \
--with-http_stub_status_module \
--with-mail \
--with-mail_ssl_module \
--with-file-aio \
--with-cc-opt=-O2 \
--with-http_v2_module \
--add-module=../../git/nginx-auth-ldap \
--with-openssl=../openssl-1.1.1d \
--with-openssl-opt=enable-tls1_3 \
--with-stream \
--with-stream_ssl_module
make
make install
ln -s nginx-${VERSION} /usr/local/nginx
/usr/bin/cp -pf conf/* /etc/nginx/

mkdir /var/lib/nginx
chown nginx. /var/lib/nginx

#-- nginx の起動設定を修正
mv /var/tmp/nginx.service /usr/lib/systemd/system/nginx.service
sed -i -e 's#/usr/sbin/nginx#/usr/local/nginx/sbin/nginx#' \
       -e '/^PIDFile/a ExecStartPre=/usr/local/bin/ipv6upchk.sh nginx' /usr/lib/systemd/system/nginx.service

・php7.3とphp-fpm のインストール

#-- remi レポジトリの追加
rpm -Uvh https://rpms.remirepo.net/enterprise/remi-release-7.rpm

#-- php-fpm のインストール
yum install -y php73-php php73-php-{fpm,ldap,devel}

#-- php-fpm の設定
cp -p /etc/opt/remi/php73/php-fpm.d/www.conf{,.org}

sed -i "s/apache/nginx/" /etc/opt/remi/php73/php-fpm.d/www.conf
chown nginx /var/opt/remi/php73/log/php-fpm
chgrp nginx /var/opt/remi/php73/lib/php/*

cp -p /etc/opt/remi/php73/php.ini{,.org}

sed -i -e "s/^max_execution_time = 30/max_execution_time = 300/" \
       -e "s/^max_input_time = 60/max_input_time = 300/" \
       -e "s/^post_max_size = 8M/post_max_size = 20M/" \
       -e "s/^upload_max_filesize = 2M/upload_max_filesize = 20M/" \
       -e "s/^;date.timezone =/date.timezone = 'Asia\/Tokyo'/" /etc/opt/remi/php73/php.ini

ln -s php73 /usr/bin/php
ln -s /var/opt/remi/php73/log/php-fpm /var/log/php-fpm

#-- php を update した場合、permission が apache になるのでその対策
cat <<_EOL_>> /etc/cron.d/${DOMAIN}-cron
* * * * * root chown nginx /var/opt/remi/php73/log/php-fpm >/dev/null 2>&1
* * * * * root chgrp nginx /var/opt/remi/php73/lib/php/{opcache,session,wsdlcache} >/dev/null 2>&1
_EOL_

・nginxの設定

#-- nginx mail proxy サーバの設定
cat <<_EOL_> /etc/nginx/mail.conf
mail {
  auth_http  127.0.0.1/nginx_mail_proxy/ldap_authentication.php ;
  proxy on;
  proxy_pass_error_message on;
  include /etc/nginx/default.d/${DOMAIN}_ssl.conf;
  ssl_session_cache shared:MAIL:10m;
  smtp_capabilities PIPELINING 8BITMIME "SIZE 20480000";
  pop3_capabilities TOP USER UIDL;
  imap_capabilities IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=LOGIN;
  smtp_auth login plain;

  server {
    listen     ${IPV4}:587;
    listen     [${IPV6}]:587;
    protocol   smtp;
    starttls   on;
    xclient    on;
    resolver   127.0.0.1;
    auth_http_header PORT 587;
  }
  server {
    listen     ${IPV4}:465 ssl;
    listen     [${IPV6}]:465 ssl;
    protocol   smtp;
    xclient    on;
    resolver   127.0.0.1;
    auth_http_header PORT 465;
  }
#  server {
#    listen     ${IPV4}:110;
#    listen     [${IPV6}]:110;
#    protocol   pop3;
#    starttls   on;
#    auth_http_header PORT 110;
#  }
  server {
    listen     ${IPV4}:995 ssl;
    listen     [${IPV6}]:995 ssl;
    protocol   pop3;
    auth_http_header PORT 995;
  }
#  server {
#    listen     ${IPV4}:143;
#    listen     [${IPV6}]:143;
#    protocol   imap;
#    starttls   on;
#    auth_http_header PORT 143;
#  }
  server {
    listen     ${IPV4}:993 ssl;
    listen     [${IPV6}]:993 ssl;
    protocol   imap;
    auth_http_header PORT 993;
  }
}
_EOL_

cp -p /etc/nginx/nginx.conf{,.org}

#-- nginx.conf の作成
cat <<'_EOL_'> /etc/nginx/nginx.conf
user  nginx;
worker_processes  2;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    limit_req_zone $binary_remote_addr zone=limit_req_by_ip:10m rate=1r/m;
    limit_req_log_level error;
    limit_req_status 503;

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    #gzip  on;

    include /etc/nginx/default.d/ldap.conf;
    include /etc/nginx/conf.d/*.conf;

    client_max_body_size 10485760; # 10MB
}
include /etc/nginx/mail.conf;
_EOL_

#-- basic認証でldapを参照する設定
cat <<_EOL_> /etc/nginx/default.d/ldap.conf
auth_ldap_cache_enabled on;
auth_ldap_cache_expiration_time 600000;
auth_ldap_cache_size 100;

ldap_server ldap1 {
    url ldap://127.0.0.1/?mailroutingaddress?sub?(objectClass=*);
    satisfy any;
}
_EOL_

#-- TLSの設定
cat <<_EOL_> /etc/nginx/default.d/masdon.life_ssl.conf
ssl_protocols TLSv1.2 TLSv1.3 ;
ssl_ciphers EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH;
ssl_ecdh_curve prime256v1;
ssl_prefer_server_ciphers on;
ssl_session_timeout  5m;
ssl_certificate /etc/letsencrypt/live/masdon.life/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/masdon.life/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/masdon.life/chain.pem;
resolver          127.0.0.1 8.8.8.8 valid=300s;
resolver_timeout  10s;
_EOL_

#-- 127.0.0.1:80 は nginx mail proxy の認証で使用
#-- global は TLS証明書の更新時に使用
cat <<_EOL_> /etc/nginx/conf.d/http.conf
server {
  listen 127.0.0.1:80;
  server_name ${DOMAIN};
  index index.html, index.php;
  access_log /var/log/nginx/access_auth.log main;
  error_log  /var/log/nginx/error_auth.log  error;
  root /var/www/html/http_root;
  server_tokens off;
  charset     utf-8;

  location ~ \.php\$ {
    allow 127.0.0.1;
    fastcgi_pass 127.0.0.1:9000;
    fastcgi_index index.php;
    fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;
    include fastcgi_params;
    deny all;
  }

  error_page 500 502 503 504 /50x.html;
    location = /50x.html {
  }
}

server {
  listen     ${IPV4}:80;
  listen     [${IPV6}]:80;
  server_name _;
  index index.html, index.php;
  access_log /var/log/nginx/access.log main;
  error_log  /var/log/nginx/error.log  error;
  root /var/www/html/http_root;
  server_tokens off;
  charset     utf-8;

  location ^~ /.well-known/acme-challenge/ {}
  location ^~ /mail/ {}
  location /nginx_mail_proxy/ { deny all; }

  error_page 500 502 503 504 /50x.html;
    location = /50x.html {
  }
}
_EOL_

mkdir -p /var/www/html/http{,s}_root /var/log/nginx /var/cache/nginx/client_temp /etc/nginx/conf.d/https.d
cp -p /usr/local/nginx-${VERSION}/html/50x.html /var/www/html/http_root/
cp -p /usr/local/nginx-${VERSION}/html/50x.html /var/www/html/https_root/
chown -R nginx. /var/www/html/ /var/log/nginx /var/cache/nginx/client_temp

cat <<'_EOL_'> /etc/nginx/conf.d/https.conf
server {
  listen 443 ssl http2 default_server;
  listen [::]:443 ssl http2 default_server;
  server_name masdon.life;
  include /etc/nginx/default.d/masdon.life_ssl.conf;
  index index.html, index.php;
  access_log /var/log/nginx/access_ssl.log main;
  error_log  /var/log/nginx/error_ssl.log  error;
  root /var/www/html/https_root;
  server_tokens off;
  charset     utf-8;

  #-- for roundcube attache file
  client_max_body_size 20m;

  ssl_session_cache shared:WEB:10m;
  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
  ssl_stapling on ;
  ssl_stapling_verify on ;

  include /etc/nginx/conf.d/https.d/*.conf;

  location ~ \.php$ {
    fastcgi_pass 127.0.0.1:9000;
    fastcgi_index index.php;
    fastcgi_param SCRIPT_FILENAME $document_root/$fastcgi_script_name;
    include fastcgi_params;
  }
}
_EOL_

・メールプロキシー認証スクリプトの作成

mkdir -p /var/www/html/http_root/nginx_mail_proxy

cat <<'_EOL_'> /var/www/html/http_root/nginx_mail_proxy/ldap_authentication.php
<?php

error_reporting(0);

// write syslog
function _writelog($message) {
  openlog("nginx-mail-proxy", LOG_PID, LOG_MAIL);
  syslog(LOG_INFO,"$message") ;
  closelog();
}

// ldap authentication
function _ldapauth($server,$port,$dn,$passwd) {
  $conn = ldap_connect($server, $port);
  if ($conn) {
    ldap_set_option($conn, LDAP_OPT_PROTOCOL_VERSION, 3);
    $bind = ldap_bind($conn, $dn, $passwd);
    if ($bind) {
      ldap_close($conn);
      return True;
    } else {
      ldap_close($conn);
      return False;
    }
  } else {
    return False;
  }
}

function _mail_proxy($server,$port,$base,$filter,$attribute,$proxyport) {
  $message = "" ;
  $proxyhost = _ldapsearch($server,$port,$base,$filter,$attribute);

  if ( $proxyhost === '' ) {
    // proxyhost is not found
    $message = "proxy=failure" ;
    header('Content-type: text/html');
    header('Auth-Status: Invalid login') ;
  } else {
    // proxyhost is found
    $proxyip = gethostbyname($proxyhost);

    $message = sprintf('proxy=%s:%s', $proxyhost, $proxyport );
    header('Content-type: text/html');
    header('Auth-Status: OK') ;
    header("Auth-Server: $proxyip") ;
    header("Auth-Port: $proxyport") ;
  }
  return $message ;
}

// ldap search
function _ldapsearch($server,$port,$base,$filter,$attribute) {

  $conn = ldap_connect($server, $port);
  if ($conn) {
    ldap_set_option($conn, LDAP_OPT_PROTOCOL_VERSION, 3);
    $sresult = ldap_search($conn, $base, $filter, array($attribute));
    $info = ldap_get_entries($conn, $sresult);
    if ( $info[0][$attribute][0] != "" ) {
      return $info[0][$attribute][0];
    }
  }
  return "" ;
}

// set $env from nginx
$env['meth']    = getenv('HTTP_AUTH_METHOD');
$env['user']    = getenv('HTTP_AUTH_USER');
$env['passwd']  = getenv('HTTP_AUTH_PASS');
$env['salt']    = getenv('HTTP_AUTH_SALT');
$env['proto']   = getenv('HTTP_AUTH_PROTOCOL');
$env['attempt'] = getenv('HTTP_AUTH_LOGIN_ATTEMPT');
$env['client']  = getenv('HTTP_CLIENT_IP');
$env['host']    = getenv('HTTP_CLIENT_HOST');
$env['port']    = getenv('HTTP_PORT');
$env['helo']    = getenv('HTTP_AUTH_SMTP_HELO');
$env['from']    = getenv('HTTP_AUTH_SMTP_FROM');
$env['to']      = getenv('HTTP_AUTH_SMTP_TO');

$log = "" ;

// protocol port map
$portmap = array(
  "smtp" => 25,
  "pop3" => 110,
  "imap" => 143,
);

// port searvice name map
$protomap = array(
  "995" => "pops",
  "993" => "imaps",
  "110" => "pop",
  "143" => "imap",
  "587" => "smtp",
  "465" => "smtps",
);

// ldap setting
$ldap = array(
  "host" => "127.0.0.1",
  "port" => 389,
  "basedn" => "",
  "filter" => "(mailRoutingAddress=" . $env['user'] . ")",
  "attribute" => "mailhost",
  "dn" => "",
  "passwd" => "",
);

// split uid and domain
$spmra = preg_split('/\@/', $env['user']) ;

// make dn
foreach (preg_split("/\./", $spmra[1]) as $value) {
        $ldap['dn'] = $ldap['dn'] . 'dc=' . $value . ',' ;
}
$tmpdn = preg_split('/,$/',$ldap['dn']);
$ldap['dn'] = 'uid=' . $spmra[0] . ',ou=People,' . $tmpdn[0];

// set search attribute
if ( $env['proto'] === 'smtp' ) {
  $ldap['attribute'] = 'sendmailmtahost' ;
}

// set log
$log = sprintf('meth=%s, user=%s, client=%s, proto=%s', $env['meth'], $env['user'], $env['client'], $protomap[$env['port']]);

// set password
$ldap['passwd'] = urldecode($env['passwd']) ;

// ldap authentication
if ( _ldapauth($ldap['host'],$ldap['port'],$ldap['dn'],$ldap['passwd'])) {
  // authentication successful
  $log = sprintf ('auth=successful, %s', $log) ;
  $proxyport = $portmap[$env['proto']];
  $result = _mail_proxy($ldap['host'],$ldap['port'],$ldap['basedn'],$ldap['filter'],$ldap['attribute'],$proxyport);
  $log = sprintf ('%s, %s', $log,$result) ;
} else {
  // authentication failure
  $log = sprintf('auth=failure, %s, passwd=%s', $log, $ldap['passwd']);
  // $log = sprintf('auth=failure, %s', $log);
  header('Content-type: text/html');
  header('Auth-Status: Invalid login') ;
}

_writelog($log);
exit;
?>
_EOL_

・nginxとphp-fpmの起動

#-- php-fpm の起動
systemctl daemon-reload
systemctl enable nginx php73-php-fpm
systemctl start nginx php73-php-fpm

#-- firewall の解放
firewall-cmd --permanent --add-port={25,587,465,993,995,443}/tcp
firewall-cmd --reload

10. メールサーバ構築(4) – postfix [さくらのVPS/CentOS7]

・postfixの用途

  1. SMTPサーバ(OUTBOUND/INBOUND)
  2. STARTTLS の TLS1.3 対応

・postfix のインストール

#-- 変数に必要な値を代入
DOMAIN=masdon.life
VERSION=3.4.5
RSPAMD_SERVER=127.0.0.1
RSPAMD_PORT=11332
IPV4=$(ip addr show eth0 | awk '/inet /{print $2}' | sed 's#/.*##')
IPV6=$(ip addr show eth0 | awk '/inet6 /&&/global/{print $2}' | sed 's#/.*##')
OUTBOUND_MTA_SERVER=127.0.0.1
LDAP_SERVER=127.0.0.1
XAUTH_HOST=127.0.0.1
LMTP_PORT=24

#-- 既存の起動スクリプトのバックアップ後、OS標準の postfix, sendmail をアンインストール
grep -v ExecStartPre= /usr/lib/systemd/system/postfix.service > /var/tmp/postfix.service
yum remove -y postfix sendmail

#-- 必要なパッケージインストール
yum install -y {cyrus-sasl,openldap,pcre,libdb}-devel

#-- source ファイルのダウンロード
cd ~/work/src
curl -O http://www.ftp.saix.net/MTA/postfix/official/postfix-${VERSION}.tar.gz
tar xvzf postfix-${VERSION}.tar.gz && cd postfix-${VERSION}

#-- postfix の build (buildオプションはcentos7のpostfixのbuildオプションを真似たつもり)
CCARGS="-Wmissing-prototypes -Wformat -Wno-comment -fPIC \
-DHAS_LDAP -DLDAP_DEPRECATED=1 -DHAS_PCRE -I/usr/include/pcre \
-DHAS_MYSQL -I/usr/include/mysql -DUSE_SASL_AUTH -DUSE_CYRUS_SASL \
-I/usr/include/sasl -DUSE_TLS -I/usr/local/openssl-1.1.1d/include \
-DDEF_CONFIG_DIR=\\\"/etc/postfix\\\""

AUXLIBS="-lldap -llber -lpcre -L/usr/lib64/mysql -lmysqlclient \
-lm -L/usr/lib64/sasl2 -lsasl2 -L/usr/local/openssl-1.1.1d/lib -lssl \
-lcrypto  -pie -Wl,-z,relro,-z,now"

make -f Makefile.init makefiles CCARGS="${CCARGS}" AUXLIBS="${AUXLIBS}"
make
make install
#-- ディレクトリ設定などは全て default を選択

#-- postfix の起動
mv /var/tmp/postfix.service /usr/lib/systemd/system/
systemctl enable postfix
systemctl start postfix

・postfix の設定

#-- postmulti で inbound/outbound で設定を分ける
postmulti -e init
postmulti -I postfix-inbound -e create

postconf -c /etc/postfix -e inet_interfaces=${OUTBOUND_MTA_SERVER}
postconf -c /etc/postfix -e inet_protocols=all
postconf -c /etc/postfix -e smtpd_milters=inet:${RSPAMD_SERVER}:${RSPAMD_PORT}
postconf -c /etc/postfix -e non_smtpd_milters=inet:${RSPAMD_SERVER}:${RSPAMD_PORT}
postconf -c /etc/postfix -e smtpd_authorized_xclient_hosts=${XAUTH_HOST}
postconf -c /etc/postfix -e smtpd_sasl_auth_enable=yes
postconf -c /etc/postfix -e smtpd_sender_restrictions=reject_sender_login_mismatch
postconf -c /etc/postfix -e smtpd_sender_login_maps=ldap:/etc/postfix/ldapsendercheck.cf
postconf -c /etc/postfix -e alias_maps=hash:/etc/aliases

postconf -c /etc/postfix-inbound -e inet_interfaces=${IPV4},${IPV6}
postconf -c /etc/postfix-inbound -e inet_protocols=all
postconf -c /etc/postfix-inbound -e myhostname=${DOMAIN}
postconf -c /etc/postfix-inbound -e recipient_delimiter=+
postconf -c /etc/postfix-inbound -e smtpd_milters=inet:${RSPAMD_SERVER}:${RSPAMD_PORT}
postconf -c /etc/postfix-inbound -e smtpd_helo_restrictions=reject_invalid_hostname
postconf -c /etc/postfix-inbound -e transport_maps=ldap:/etc/postfix-inbound/ldaptransport.cf
postconf -c /etc/postfix-inbound -e virtual_alias_maps=ldap:/etc/postfix-inbound/ldapvirtualalias.cf
postconf -c /etc/postfix-inbound -e relay_domains=/etc/postfix-inbound/relay_domains
postconf -c /etc/postfix-inbound -e authorized_submit_users=static:anyone
postconf -c /etc/postfix-inbound -e alias_maps=hash:/etc/aliases
postconf -c /etc/postfix-inbound -X master_service_disable

#-- postconf が面倒になったので、、、
cat <<_EOL_>> /etc/postfix-inbound/main.cf
smtpd_recipient_restrictions =
    check_recipient_access ldap:/etc/postfix-inbound/ldaprcptcheck.cf
    reject
_EOL_

for cf in /etc/postfix/main.cf /etc/postfix-inbound/main.cf
do
cat <<_EOL_>> ${cf}
milter_default_action = tempfail
milter_protocol = 6
smtpd_junk_command_limit = 20
smtpd_helo_required = yes
smtpd_hard_error_limit = 5
message_size_limit = 20480000
milter_command_timeout=15s
milter_content_timeout=20s
# anvil_rate_time_unit = 60s
# smtpd_recipient_limit = 50
# smtpd_client_connection_count_limit = 15
# smtpd_client_message_rate_limit = 100
# smtpd_client_recipient_rate_limit = 200
# smtpd_client_connection_rate_limit = 100
disable_vrfy_command = yes
smtpd_discard_ehlo_keywords = dsn, enhancedstatuscodes, etrn
lmtp_host_lookup = native
smtp_host_lookup = native
_EOL_
done

cat <<_EOL_>/etc/postfix-inbound/ldaprcptcheck.cf
server_host = ${LDAP_SERVER}
bind = no
version = 3
scope = sub
timeout = 15
query_filter = (&(objectClass=inetLocalMailRecipient)(mailLocalAddress=%s))
result_attribute = mailRoutingAddress
result_format = OK
_EOL_

cat <<_EOL_>/etc/postfix-inbound/ldaptransport.cf
server_host = ${LDAP_SERVER}
bind = no
version = 3
scope = sub
timeout = 15
query_filter = (&(objectClass=inetLocalMailRecipient)(mailLocalAddress=%s))
result_attribute = mailHost
result_format = lmtp:[%s]:${LMTP_PORT}
_EOL_

cp /etc/postfix-inbound/ldaprcptcheck.cf /etc/postfix-inbound/ldapvirtualalias.cf
sed -i 's/result_format = OK/result_format = %s/' /etc/postfix-inbound/ldapvirtualalias.cf

cat <<_EOL_>/etc/postfix/ldapsendercheck.cf
server_host = ${LDAP_SERVER}
bind = no
version = 3
scope = sub
timeout = 15
query_filter = (&(objectClass=inetLocalMailRecipient)(mailRoutingAddress=%s))
result_attribute = mailRoutingAddress
result_format = %s
_EOL_

#-- マルチドメインの場合は、ドメインを全て記述する
cat <<_EOL_>/etc/postfix-inbound/relay_domains
${DOMAIN}
_EOL_

#-- TLS関連設定
cat <<_EOL_>> /etc/postfix-inbound/main.cf
smtp_tls_CAfile = /etc/pki/tls/certs/ca-bundle.crt
smtp_tls_cert_file = /etc/letsencrypt/live/${DOMAIN}/fullchain.pem
smtp_tls_key_file  = /etc/letsencrypt/live/${DOMAIN}/privkey.pem
smtp_tls_loglevel = 1
smtp_tls_security_level = may
smtp_use_tls =yes
smtpd_tls_CAfile = /etc/pki/tls/certs/ca-bundle.crt
smtpd_tls_ask_ccert = yes
smtpd_tls_cert_file = /etc/letsencrypt/live/${DOMAIN}/fullchain.pem
smtpd_tls_key_file  = /etc/letsencrypt/live/${DOMAIN}/privkey.pem
smtpd_tls_ciphers = high
smtpd_tls_loglevel = 1
smtpd_tls_mandatory_ciphers = high
smtpd_tls_mandatory_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1
smtpd_tls_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_database = btree:/var/lib/postfix-inbound/smtpd_tls_session_cache
smtpd_use_tls = yes
tls_high_cipherlist  = EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
tls_preempt_cipherlist = yes
tls_random_source = dev:/dev/urandom
tls_ssl_options = NO_RENEGOTIATION
_EOL_

cat <<_EOL_>> /etc/postfix/main.cf
smtp_tls_CAfile = /etc/pki/tls/certs/ca-bundle.crt
smtp_tls_cert_file = /etc/letsencrypt/live/${DOMAIN}/fullchain.pem
smtp_tls_key_file  = /etc/letsencrypt/live/${DOMAIN}/privkey.pem
smtp_tls_loglevel = 1
smtp_tls_security_level = may
smtp_use_tls =yes
tls_high_cipherlist  = EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
tls_preempt_cipherlist = yes
tls_random_source = dev:/dev/urandom
_EOL_

#-- postfix 再起動
systemctl restart postfix

postmulti -i postfix-inbound -e enable
postmulti -i postfix-inbound -p start

09. DBサーバ構築 – mysql [さくらのVPS/CentOS7]

・mysql の用途

  1. postfix のコンパイルにmysqlのライブラリが必要
  2. 各Webアプリ(Roundcube、Tiny Tiny RSS、NextCloud、Wordpressなど)
  3. Mattermost (日本語全文検索を簡単に有効にする為、postgresqlではなくmysql 5.7 を選択)

・mysql 5.7 のインストール

#-- mysql の root パスワードを設定
PASSWORD=********

#-- 関連リポジトリの追加
yum remove -y mysql-community-release
yum install -y https://dev.mysql.com/get/mysql57-community-release-el7-11.noarch.rpm
yum install -y https://packages.groonga.org/centos/groonga-release-1.3.0-1.noarch.rpm

#-- mroonga は mattermost での日本語検索で必要(mattermostをインストールしないなら必要なし)
yum install -y mysql57-community-mroonga mysql-community-devel

#-- mysql の設定
cp -p /etc/my.cnf{,.org}
cat <<_EOL_>> /etc/my.cnf

character-set-server = utf8mb4
innodb_large_prefix = ON
innodb_file_format = Barracuda
innodb_file_format_max = Barracuda
#validate_password_length=7
#validate_password_policy=LOW

#[mysql]
#default-character-set = utf8mb4
_EOL_

#-- mysqld の起動
systemctl enable mysqld
systemctl start mysqld

#-- .my.cnf の作成
TMPPASS="$(awk '/temporary password/{print $NF}' /var/log/mysqld.log)"

cat <<_EOL_> /root/.my.cnf
[client]
host     = localhost
user     = root
password = "${TMPPASS}"
socket   = /var/lib/mysql/mysql.sock
_EOL_

chmod 600 /root/.my.cnf
export HOME=/root

#-- パスワードポリシーの緩和
mysql --connect-expired-password -e "SET GLOBAL validate_password_policy=LOW;" ;
mysql --connect-expired-password -e "SET GLOBAL validate_password_length=7;"

mysqladmin -u root -p${TMPPASS} password "${PASSWORD}"
sed -i "s/^password.*/password = ${PASSWORD}/" ~/.my.cnf

mysql -e "SET GLOBAL validate_password_policy=LOW;" ;
mysql -e "SET GLOBAL validate_password_length=7;"

sed -i 's/^#validate/validate/' /etc/my.cnf

・ これ以降、mysql の update には下記のコマンドを実行する

yum update -y mysql-community-server mysql-community-client
yum reinstall -y mysql57-community-mroonga