Installing OpenDKIM

April 29, 2016 Lloyd Day

Follow these steps to install OpenDKIM on Ubuntu and Plesk.
I will use domain.tld (as the primary domain) and example.com as my domains, I have enabled subdomains so mail from the server mail.domain.tld gets signed too as in this case mail.domain.tld is also the Posfix hostname and mailname…

1. First login as root as run…

# apt-get update
# apt-get install opendkim opendkim-tools

1 2	# apt-get update # apt-get install opendkim opendkim-tools

2. Create the folder structure…

# mkdir -p /etc/opendkim/keys/domain.tld
# mkdir -p /etc/opendkim/keys/example.com

1 2	# mkdir -p /etc/opendkim/keys/domain.tld # mkdir -p /etc/opendkim/keys/example.com

3. Create a key, I’ll use “dkim” as the selector and create 1024bit keys
You will have two files in the folder, dkim.private and dkim.txt, the latter contains the DNS record for you to add in Plesk or at your domains registrar.

# cd /etc/opendkim/keys/domain.tld
# opendkim-genkey -s dkim -d domain.tld
# chown opendkim:opendkim dkim.private
# chmod 600 dkim.private

# cd /etc/opendkim/keys/domain.tld

# opendkim-genkey -s dkim -d domain.tld

# chown opendkim:opendkim dkim.private

# chmod 600 dkim.private

# cd /etc/opendkim/keys/example.com
# opendkim-genkey -s dkim -d example.com
# chown opendkim:opendkim dkim.private
# chmod 600 dkim.private

# cd /etc/opendkim/keys/example.com

# opendkim-genkey -s dkim -d example.com

# chown opendkim:opendkim dkim.private

# chmod 600 dkim.private

4. Now we’ll create the SigningTable and the KeyTable…

# vi /etc/opendkim/SigningTable

1	# vi /etc/opendkim/SigningTable

The contents should look like…

domain.tld dkim._domainkey.domain.tld
mail.domain.tld dkim._domainkey.domain.tld
example.com dkim._domainkey.example.com
mail.example.com dkim._domainkey.example.com

domain.tld dkim._domainkey.domain.tld

mail.domain.tld dkim._domainkey.domain.tld

example.com dkim._domainkey.example.com

mail.example.com dkim._domainkey.example.com

5. And the KeyTable…

# vi /etc/opendkim/KeyTable

1	# vi /etc/opendkim/KeyTable

The contents should look like…

dkim._domainkey.domain.tld domain.tld:dkim:/etc/opendkim/keys/domain.tld/dkim.private
dkim._domainkey.domain.tld mail.domain.tld:dkim:/etc/opendkim/keys/domain.tld/dkim.private
dkim._domainkey.example.com example.com:dkim:/etc/opendkim/keys/example.com/dkim.private
dkim._domainkey.example.com mail.example.com:dkim:/etc/opendkim/keys/example.com/dkim.private

dkim._domainkey.domain.tld domain.tld:dkim:/etc/opendkim/keys/domain.tld/dkim.private

dkim._domainkey.domain.tld mail.domain.tld:dkim:/etc/opendkim/keys/domain.tld/dkim.private

dkim._domainkey.example.com example.com:dkim:/etc/opendkim/keys/example.com/dkim.private

dkim._domainkey.example.com mail.example.com:dkim:/etc/opendkim/keys/example.com/dkim.private

You can see the subdomains point to the same key as the domain.

6. Next we have to create the internal hosts file…

# vi /etc/opendkim/dkim-InternalHosts

1	# vi /etc/opendkim/dkim-InternalHosts

and add your IP and host names…

127.0.0.1/8
192.168.0.50/32 # where this is your Server IP
localhost
domain.tld
mail.domain.tld
example.com
mail.example.com

127.0.0.1/8

192.168.0.50/32 # where this is your Server IP

localhost

domain.tld

mail.domain.tld

example.com

mail.example.com

7. Now edit /etc/opendkim.conf

# vi /etc/opendkim.conf

1	# vi /etc/opendkim.conf

And define these settings…

Syslog			yes
UMask			002
Domain		        domain.tld
KeyFile		        /etc/opendkim/keys/domain.tld/dkim.private
Selector	        dkim
Canonicalization        relaxed/relaxed
Mode                    sv
SignatureAlgorithm      rsa-sha256
SubDomains              yes
LogWhy                  yes
UserID                  opendkim:opendkim
KeyTable                /etc/opendkim/KeyTable
SigningTable            /etc/opendkim/SigningTable
InternalHosts           /etc/opendkim/dkim-InternalHosts
Statistics              /var/log/opendkim/dkim-stats.log
OversignHeaders		From

Syslog yes

UMask 002

Domain domain.tld

KeyFile /etc/opendkim/keys/domain.tld/dkim.private

Selector dkim

Canonicalization relaxed/relaxed

Mode sv

SignatureAlgorithm rsa-sha256

SubDomains yes

LogWhy yes

UserID opendkim:opendkim

KeyTable /etc/opendkim/KeyTable

SigningTable /etc/opendkim/SigningTable

InternalHosts /etc/opendkim/dkim-InternalHosts

Statistics /var/log/opendkim/dkim-stats.log

OversignHeaders From

8. Make sure you create the log directory, and the log file is owned by opendkim:opendkim

# mkdir -p /var/log/opendkim/
# touch /var/log/opendkim/dkim-stats.log
# chown opendkim:opendkim /var/log/opendkim/dkim-stats.log

# mkdir -p /var/log/opendkim/

# touch /var/log/opendkim/dkim-stats.log

# chown opendkim:opendkim /var/log/opendkim/dkim-stats.log

9. We now need to define the socket…

# vi /etc/default/opendkim

1	# vi /etc/default/opendkim

And uncomment…

SOCKET="inet:12345@localhost" # listen on loopback on port 12345

1	SOCKET="inet:12345@localhost" # listen on loopback on port 12345

10. And restart opendkim

# service opendkim restart

1	# service opendkim restart

11. Our last step is too add this milter to our postfix configuration file…

# vi /etc/postfix/main.cf

1	# vi /etc/postfix/main.cf

milter_default_action = accept
milter_protocol = 6
smtpd_milters = inet:127.0.0.1:12768, inet:127.0.0.1:12345
non_smtpd_milters = inet:127.0.0.1:12345

milter_default_action = accept

milter_protocol = 6

smtpd_milters = inet:127.0.0.1:12768, inet:127.0.0.1:12345

non_smtpd_milters = inet:127.0.0.1:12345

Restart Postfix…

# service postfix restart

1	# service postfix restart

And you should be good.

Plesk

Moving Plesks Mail Directory

April 3, 2016 Lloyd Day

This is an update to a kb article at Plesk KB6312 on How to move the Plesk Mail Directory.
I will use the example folder /var/vmail

1. Edit psa.conf

vi /etc/psa/psa.conf

1	vi /etc/psa/psa.conf

Changing “PLESK_MAILNAMES_D” to the desired location…

# Location of qmail maildirs
PLESK_MAILNAMES_D /var/vmail/mailnames

1 2	# Location of qmail maildirs PLESK_MAILNAMES_D /var/vmail/mailnames

2. Then run the following command which will create the new folder and copy the contents of the qmail directory to the new directory…

cp -a /var/qmail /var/vmail

1	cp -a /var/qmail /var/vmail

3. And change the maildirs in Dovecot…

vi /etc/dovecot/conf.d/15-maildir.conf

1	vi /etc/dovecot/conf.d/15-maildir.conf

Adding the following…

# Plesk Maildirs layout.
mail_home = /var/vmail/mailnames/%Ld/%Ln
mail_location = maildir:/var/vmail/mailnames/%Ld/%Ln/Maildir

# Plesk Maildirs layout.

mail_home = /var/vmail/mailnames/%Ld/%Ln

mail_location = maildir:/var/vmail/mailnames/%Ld/%Ln/Maildir

4. Run…

/opt/psa/admin/bin/mchk --with-spam

1	/opt/psa/admin/bin/mchk --with-spam

This will update the following configuration files

/etc/postfix/main.cf
/etc/postfix/master.cf
/etc/default/spamassassin

with the correct paths to your new Maildir.

5. We need to edit the spamtrain script…

vi /opt/psa/admin/sbin/spamtrain

1	vi /opt/psa/admin/sbin/spamtrain

You will see line 8…

maildir="/var/qmail/mailnames"

1	maildir="/var/qmail/mailnames"

Simply change this to…

maildir="/var/vmail/mailnames"

1	maildir="/var/vmail/mailnames"

6. Now create the Spamassasin Home Directory…

cd /var/vmail/popuser
mkdir .spamassassin
chown -R popuser:popuser .spamassassin

cd /var/vmail/popuser

mkdir .spamassassin

chown -R popuser:popuser .spamassassin

7. Lastly we need to update the default file in /etc/default/spamassassin to reflect our change…

Plesk

Secure Redirects in Plesk

February 29, 2016 Lloyd Day

More and more sites are only available via https, now with the Let’s Encrypt extension available in Plesk 12.5 it’s even easier to make your site secure. As such I thought it would be a good time to write this guide.

This guide assumes…

- You have already setup your SSL Certificate in Plesk for your domain,
- You are using Apache (FastCGI or FPM) and Nginx is serving static files,
- You want your site to be https only, redirecting all http requests to https
- You have set preferred domain in Plesk to www.domain.tld

Apache

I’ll start with Apache, browse to your domain in Plesk and click on Additional Apache & Nginx settings. under Additional directives for HTTP use this redirect..

<IfModule mod_rewrite.c>
	RewriteEngine On
	RewriteCond %{HTTPS} off
	RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L,QSA]
</IfModule>

RewriteEngine On

RewriteCond %{HTTPS} off

RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L,QSA]

</IfModule>

And Additional directives for HTTPS…

<IfModule mod_headers.c>
       Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
</IfModule>

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

</IfModule>

If you use Plesk’s built in SEO Safe redirect (preferred domain) from domain.tld to www.domain.tld, you will need to turn this off and add the following in the Additional HTTPS directives…

<IfModule mod_rewrite.c>
	RewriteEngine On
	RewriteCond %{HTTP_HOST} ^domain.tld$ [NC]
	RewriteRule ^(.*)$ https://www.domain.tld$1 [L,R=301]
</IfModule>

RewriteEngine On

RewriteCond %{HTTP_HOST} ^domain.tld$ [NC]

RewriteRule ^(.*)$ https://www.domain.tld$1 [L,R=301]

</IfModule>

Nginx

Now onto the Nginx directives…

if ($scheme != https) {
    return 301 https://$host$request_uri;
}

if ($scheme != https) {

return 301 https://$host$request_uri;

}

Notice I’m using $scheme rather than the more common $host, as using the $host rewrite affected ssllabs scores in that domain.tld and www.domain.tld would score differently after adding HPKP and HSTS headers in Apache.

I hope that helps someone.

Updated to reflect changes at: https://hstspreload.org/

My Blog

Installing OpenDKIM

Moving Plesks Mail Directory

Secure Redirects in Plesk

Apache

Nginx

Servers and Security