Comentario comments on workaround.org

Stephan | workaround.org | Comentario

Stephan — Mon, 21 Sep 2026 15:02:10 +0000

Now I started using postfixadmin for the user management.

I am writing it down here for documentation purposes (also for myself). I did this some time back so hopefully I didn't forget something.

I just installed the latest 4.X version and configured this in config.local.php:

$CONF['database_host'] = '127.0.0.1';
$CONF['database_user'] = 'mailadmin';
$CONF['database_password'] = 'yourdbpassword';
$CONF['database_name'] = 'mailserver';
$CONF['database_prefix'] = 'postfixadmin_';

$CONF['encrypt'] = 'php_crypt:SHA256::{SHA256-CRYPT}';

Start it and let it create it's tables - they will be prefixed with postfixadmin_

Postfixadmin is using a different database layout, so here is the trick to make it work.

1st thing is to migrate the data to the postfixadmin tables in the format that postfixadmin expects:

Copy Domains

INSERT INTO postfixadmin_domain (domain, description, maxaliases, mailboxes, maxquota, transport, backupmx, active)
SELECT name, 'Migrated from ISPmail', 0, 0, 0, 'virtual', 0, 1 FROM virtual_domains;

Copy Users/Mailboxes

INSERT INTO postfixadmin_mailbox (username, password, name, maildir, quota, local_part, domain, active)
SELECT 
    vd.name AS domain,
    vu.email AS username, 
    vu.password AS password, 
    vu.email AS name, 
    CONCAT(vd.name, '/', SUBSTRING_INDEX(vu.email, '@', 1), '/') AS maildir, 
    vu.quota AS quota, 
    SUBSTRING_INDEX(vu.email, '@', 1) AS local_part, 
    1 AS active
FROM virtual_users vu
JOIN virtual_domains vd ON vu.domain_id = vd.id;

Copy Aliases

INSERT INTO postfixadmin_alias (address, goto, domain, active)
SELECT 
    va.source AS address, 
    va.destination AS goto, 
    vd.name AS domain, 
    1 AS active
FROM virtual_aliases va
JOIN virtual_domains vd ON va.domain_id = vd.id;

Now, the trick
Move existing tables out of the way:

RENAME TABLE virtual_users TO virtual_users_bak;
RENAME TABLE virtual_aliases TO virtual_aliases_bak;
RENAME TABLE virtual_domains TO virtual_domains_bak;

..and replace them with the following views:

CREATE VIEW virtual_users AS
SELECT 
    ROW_NUMBER() OVER (ORDER BY m.username) AS id,
    vd.id AS domain_id,
    m.password AS password,
    m.username AS email,
    m.quota AS quota
FROM 
    postfixadmin_mailbox m
JOIN 
    virtual_domains vd ON m.domain = vd.name;

CREATE VIEW virtual_domains AS
SELECT 
    ROW_NUMBER() OVER (ORDER BY domain) AS id,
    domain AS name
FROM 
    postfixadmin_domain 
WHERE 
    domain != 'ALL';

CREATE VIEW virtual_aliases AS 
SELECT 
    ROW_NUMBER() OVER (ORDER BY a.address) AS id,
    vd.id AS domain_id,
    a.address AS source,
    a.goto AS destination 
FROM postfixadmin_alias a 
JOIN virtual_domains vd ON a.domain = vd.name;

Finally, postfixadmin needs one alias pointing to the mailbox itself - this can be done like this:

INSERT INTO postfixadmin_alias (address, goto, domain, created, modified, active)
SELECT username, username, domain, NOW(), NOW(), active 
FROM postfixadmin_mailbox 
WHERE username NOT IN (SELECT address FROM postfixadmin_alias);

Now postfixadmin can be used to manage users, domains and aliases and the views let postfix/dovecot continue to work without changing any configuration.
Alternatively you can also change the postfix/dovecot configuration to use the postfixadmin layout.

Stephan | workaround.org | Comentario

Stephan — Fri, 18 Sep 2026 09:52:54 +0000

I ignored the advice to start on a fresh machine. I just moved the current dovecot configuration out of the way, did a "full-upgrade" and configured dovecot from scratch as per this tutorial. Much easier than all the other migration steps that would have been necessary otherwise - at least for me.

Carlos | workaround.org | Comentario

Carlos — Tue, 15 Sep 2026 09:44:29 +0000

I think I spotted a little piece missing.

If you have setup that you can send from other aliases in the Sending / Relaying chapter you also have to replace the MAILSERVER-PASSWORD in the /etc/postfix/mariadb-sender-login-maps.cf file.

sed -i "s|MAILSERVER-PASSWORD-HERE|$PW_MAILSERVER|g" \
    /etc/postfix/mariadb-sender-login-maps.cf

Christoph Haas | workaround.org | Comentario

Christoph Haas — Sat, 01 Aug 2026 23:44:10 +0000

I am very late with my response – sorry for that. Thanks for pointing that out. I have added it to the DKIM chapter. I could verify that without this setting any mismatch between logged-in user and sender-address will rspamd omit a DKIM signature.

Nuri | workaround.org | Comentario

Nuri — Sat, 01 Aug 2026 17:44:37 +0000

Hello Christoph, compared to what you've done, mine pales in comparison. I should be the one thanking you many times over. I'm very glad that I was able to be of some use, even if it was small :)

Christoph Haas | workaround.org | Comentario

Christoph Haas — Sat, 01 Aug 2026 17:11:31 +0000

Hi Nuri. I did not yet thank you for your hint and it's already 7 months ago. But I have added that to https://workaround.org/ispmail-trixie/dovecot/#99-ispmail-sqlconf

jkirk | workaround.org | Comentario

jkirk — Wed, 08 Jul 2026 13:31:46 +0000

I just checked the default /etc/roundcube/config.inc.php file and the examples does not show an array for the plugins:

// List of active plugins (in plugins/ directory)
// Debian: install roundcube-plugins first to have any
$config['plugins'] = [
    // 'archive',  
    // 'zipdownload',
];

Do you mean to replace the list with an array?

And:

The last two lines make sure that this config file is only accessible to everyone.

Should this read something like this (s/only/not/)?
"The last two lines make sure that this config file is not accessible to everyone."?

jkirk | workaround.org | Comentario

jkirk — Sun, 28 Jun 2026 16:53:42 +0000

I received ERROR 1046 (3D000) at line 1: No database selected

I think you need something like this:

# Delete example data
mariadb mailserver <<EOF
DELETE FROM virtual_domains where name='example.org';
EOF

jkirk | workaround.org | Comentario

jkirk — Sun, 28 Jun 2026 13:36:50 +0000

I also stumbled over this one (more or less).

I manually installed postfix (postfix-mysql) with apt install postfix-mysql (without DEBIAN_FRONTEND=noninteractive as described in https://workaround.org/ispmail-trixie/install-the-software-packages/) but I accidentally answered the debconf question with "Local only" instead of "Internet configuration" (which seems to be the "noninteractive" default).

This changes the default /etc/postfix/main.cf to

inet_interfaces = loopback-only
default_transport = error
relay_transport = error

inet_interfaces needs to be changed to inet_interfaces = all and the default_transport + relay_transport lines must be removed to make this guide work.

Took me some hours to figure that out.

Also see the comment from another user: https://workaround.org/ispmail-trixie/relaying/#comentario-0c252881-ea6e-4bbd-9d3d-eb5611a97af0

I can't stress this enough: This is such an awesome guide! Thank you very much, Christoph!

jkirk | workaround.org | Comentario

jkirk — Sun, 21 Jun 2026 08:12:27 +0000

FYI: php-intl php-mbstring are dependencies of roundcube. No need to install them explicitly.

php-xml is not a dependency nor in the list of recommends, see: https://packages.debian.org/trixie/roundcube-core
Do we really need it?

(Thx for this cool tutorial. I am following it for over a decade now.)

Zeraphim | workaround.org | Comentario

Zeraphim — Sun, 14 Jun 2026 22:25:17 +0000

yeah, I have researched it as well, but couldn't find a good setup. Especially in conjunction with the SQL setup. It would be good if I could somehow set in the database to use oauth2 instead of password so I could let the users migrate slowly. There is another bummer: Most clients don't support this, or only support it for special providers.

Pawel | workaround.org | Comentario

Pawel — Tue, 09 Jun 2026 16:26:06 +0000

Took me a long time to finally migrate my old server to Debian 13. One thing I had problems with was that while sending with swaks worked, neither roundcube nor thunderbird could connect to submissions until I changed inet_interfaces = loopback-only to inet_interfaces = all in main.cf. Just hope that I didn't make the server insecure, but it would not work otherwise.

Jan Schoonderbeek | workaround.org | Comentario

Jan Schoonderbeek — Sun, 07 Jun 2026 19:40:42 +0000

I wrestled with Redis for a while; it wouldn'd start, couldn't find any usable diagnostic information. Then found out something called "valkey" was occupying the port that I tried Redis to start on. Then I discovered Valkey is actually the open source alternative to Redis. My suggestion: install Valkey native instead of Redis (apt install valkey-server) and mention in passing that it replaces Redis. Like you did with MariaDB.

Christoph Haas | workaround.org | Comentario

Christoph Haas — Wed, 29 Apr 2026 18:38:29 +0000

I have researched quite a bit but could not find a good solution yet. Dovecot supports it in general (https://doc.dovecot.org/main/core/config/auth/databases/oauth2.html).

Open-xchange seems to tell Postfix to use the dovecot authentication. (https://documentation.open-xchange.com/8/middleware/mail/dovecot/oauth_2.0_with_postfix_and_dovecot.html) I am not sure if that would make SMTP use oauth2. Worth a try.

Zeraphim | workaround.org | Comentario

Zeraphim — Mon, 27 Apr 2026 22:12:53 +0000

any idea on how to setup oauth2 in this configuration?

Christoph Haas | workaround.org | Comentario

Christoph Haas — Wed, 25 Mar 2026 20:07:57 +0000

Have you tried setting the "ssl" option in fetchmail? I'm not sure if it supports STARTSSL though.

Alternatively you can add another service to your /etc/postfix/master.cf like:

# Dedicated local-only listener with opportunistic TLS
127.0.0.1:10025 inet n  -       y       -       -       smtpd
  -o smtpd_tls_security_level=may
  -o smtpd_sasl_auth_enable=no
  -o smtpd_client_restrictions=permit_mynetworks,reject
  -o smtpd_tls_auth_only=no
  -o smtpd_restriction_classes=
  -o smtpd_delay_reject=no
  -o smtpd_milters=
  -o local_recipient_maps=
  -o relay_recipient_maps=

…and then use localhost:10025 as a target.

Martin | workaround.org | Comentario

Martin — Wed, 25 Mar 2026 19:59:48 +0000

One thing I had active on my old version of ISPstyle mailserver was fetchmail (for people who change over here and want to receive thier old addresses).
In this version I have to lower smtpd_tls_security_level to "may", or fetchmail would not be able to talk to postfix ("SMTP server requires StartTLS, keeping message").
Is there a better way to accomplish this, by only offering opportunistic encryption for local delivery while keeping it mandatory for external partners?

Hetass'r El-Balb'r | workaround.org | Comentario

Hetass'r El-Balb'r — Tue, 24 Mar 2026 09:36:07 +0000

hmmm apparently restarting the server worked. I must have forgotten to restart a service after modifying the configuration

thanks

Christoph Haas | workaround.org | Comentario

Christoph Haas — Tue, 24 Mar 2026 09:25:04 +0000

Hi and welcome. The cause is very likely to be found in your logs. Try "journalctl -u postfix" and look for the timestamp when this happened. Or "journalctl -u postfix -f" to follow the logs live.

Hetass'r El-Balb'r | workaround.org | Comentario

Hetass'r El-Balb'r — Tue, 24 Mar 2026 09:04:51 +0000

Hi
this is a great tutorial. I used iredmail until recently, but as I migrated my server I decided to install everything by myself.

but I have a problem when testing with swaks :
I use postgresql as a backend, but I adapted the queries and the configuration so the postmap -q tests were OK, as were the doveadm tests, however when I try to send a test email, I get

root@mail:/etc/postfix# swaks --server localhost --to [email protected]" rel="nofollow">[email protected]
=== Trying localhost:25...
=== Connected to localhost.
<- 220 mail.localdomain ESMTP Postfix (Debian/GNU)
-> EHLO mail.YYYY.fr
<- 250-mail.localdomain
<- 250-PIPELINING
<- 250-SIZE 10240000
<- 250-VRFY
<- 250-ETRN
<- 250-ENHANCEDSTATUSCODES
<- 250-8BITMIME
<- 250-DSN
<- 250-SMTPUTF8
<- 250 CHUNKING
-> MAIL FROM:[email protected]" rel="nofollow">[email protected]
<- 250 2.1.0 Ok
-> RCPT TO:< [email protected]" rel="nofollow">[email protected]>
<** 451 4.3.0 < [email protected]" rel="nofollow">[email protected]>: Temporary lookup failure
-> QUIT
<- 221 2.0.0 Bye
=== Connection closed with remote host.

my DNS records are OK, I can ping the mail server on both ipv4 and ipv6, both on localhost and "real" hostname
no errror found in syslog

is there something I missed somewhere ?

thanks

Martin | workaround.org | Comentario

Martin — Thu, 19 Mar 2026 15:30:45 +0000

Thank you Christoph for this super-fast reply! I guess that's out of my reach then.
And yes... I was and am aware of the security risk of still running Wheezy, but compared to earlier times family and children became important factors in my life taking their time. :-)

Christoph Haas | workaround.org | Comentario

Christoph Haas — Thu, 19 Mar 2026 09:33:17 +0000

Hi Martin. Wheezy 2014 might not be the best choice nowadays without the security support. :) But I'm sure you are aware of that. Yeah, thanks for the report. Glad that you followed the guide for so long.

I have given your question to my least mistrusted AI chat. It said that it may be possible. You may be able to do some trickery and lete baikal query the virtual_users table. However the final catch is the storage of the passwords. I am using what Dovecot is defaulting to. But Baikal (according to AI) only supports either plaintext passwords in the database or a special format of MD5 hashing. The AI told me to "just" alter the code of Baikal… yeah, right.

I am using Nextcloud with CalDAV and CardDAV myself. And the accounts are not synced. I have considered using some OIDC server for single-sign-on. But that is another beast.

So… no easy solution I'm afraid.

Cheers, Christoph

Martin | workaround.org | Comentario

Martin — Thu, 19 Mar 2026 09:14:53 +0000

Hi Christoph,

I've been following your guides from around 2008 when I first set up my mailserver in Debian Etch. I got a bit lazy lately, so the Wheezy version from 2014 is still running... which I'm upgrading to Trixie these days.
Thank you so much for your guidance!

There's one thing I want to ask, although it's not part of your tutorials really:
Some years ago I had added baikal to extend my server with CalDAV/CardDAV for (only two) users who want to have synced contacts/calendars without sharing those with big companies. Baikal is using MariaDB as well. I have a seperate database called "baikal" which contains a table calles "users".
I'm not good with databases ... is there a chance that I drop this table and somehow create a link to the "virtual_users" table in our "mailserver" database, so that each account on our mailserver can automatically login to baikal too?

Thanks and best regards,
Martin

Caio Olivera | workaround.org | Comentario

Caio Olivera — Sat, 28 Feb 2026 02:42:02 +0000

Can I send the setup using PostgreSQL too?

Caio Olivera | workaround.org | Comentario

Caio Olivera — Sat, 28 Feb 2026 02:37:20 +0000

Can you please add this:

postconf inet_protocols=all

This fixes SMTP not connecting in some cases