| SYSTEM INFORMATION | |
|---|---|
| OS type and version | Ubuntu Linux 22.04.3 LTS |
| Virtualmin version | 7.9.0 |
It all started because I couldn’t set up my email account on my iOS device.
I’ve come a long way and read a lot of topics, but now I really need your help!
I summarized my steps, hoping that someone could give me a hand!
I installed Virtualmin on a clean install of Ubuntu;
I configured a virtual server with Virtualmin;
I set up the nameservers on the registrar, aiming for Cloudflare;
On Cloudflare, I entered all the DNS correctly (I reported them just in case):
#xxx.xxx.xxx.xxx is the IP of my VPS:
A admin xxx.xxx.xxx.xxx
A autoconfig xxx.xxx.xxx.xxx
A autodiscover xxx.xxx.xxx.xxx
A mail xxx.xxx.xxx.xxx
A trelune.tech xxx.xxx.xxx.xxx
A webmail xxx.xxx.xxx.xxx
A www xxx.xxx.xxx.xxx
MX domain.tld 5 mail.domain.tld
TXT xxxxxx._domainkey v=DKIM1; k=rsa; t=s; p=PUBLIC_KEY
TXT _dmarc v=DMARC1....
TXT domain.tld v=spf1 ip4:xxx.xxx.xxx.xxx
-I installed via virtualmin scripts roundcube, in the domain.tld/roundcube folder
-I instead installed WordPress in the top-level domain (directly in the public_html folder).
-I have done several tests, and this does not affect the result in the slightest.
-I have successfully configured SSL certificates via let’sEncrypt.
-I configured fail2ban correctly, but the IP address of my device does not appear in the “jail”. Even by stopping the “fail2ban” service, the problem does not change.
The outcome of the configuration is:
Current SSL certificate details:
...
Issuer organization
Let's Encrypt
Other domain names
admin.domain.tld, autoconfig.domain.tld, autodiscover.domain.tld, mail.domain.tld, domain.tld, webmail.domain.tld, www.domain.tld.
Used by services
Webmin (domain.tld), Usermin (host domain.tld), Dovecot (host domain.tld), Postfix (host domain.tld)
My site domain.tld works perfectly (https ON).
-I created a new user via Virtualmin’s edit user screen.
The new user created is user@domain.tld
For this user, the Login permissions enabled are Email and FTP
The Create extra Unix user on Postfix systems when using user@domain format] flag in the advanced options of the Virtualmin Configuration in System Settings is also set to Yes
(I specify this because I saw that it was a solution recommended in other topics).
Suppose I try to connect to the address domain.tld/roundcube, I can correctly log in to the email account.
I can send and receive messages. Systems like mail-tester.com tell me that my configurations (DKIM, SPF, dmarc…) are ok and that I am not being labeled as spam.
Everything works perfectly.
Checking the email log in /var/log/, I see when roundcube checks for new emails (once a minute) and I see the new emails arriving in the inbox. This is an example of an incoming email from Gmail:
Dec 18 20:49:36 vmixxxxxxxx dovecot: imap-login: Login: user=<user@domain.tld>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=77094, secured, session=<qmO8DM4MgIR/AAAB>
Dec 18 20:49:36 vmixxxxxxxx dovecot: imap(user@domain.tld)<77094><qmO8DM4MgIR/AAAB>: Disconnected: Logged out in=332 out=2305 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Dec 18 20:49:38 vmixxxxxxxx postfix/smtpd[77095]: connect from mail-ot1-f66.google.com[209.85.210.66]
Dec 18 20:49:39 vmixxxxxxxx postfix/smtpd[77095]: AB16619A0B68: client=mail-ot1-f66.google.com[209.85.210.66]
Dec 18 20:49:39 vmixxxxxxxx postfix/cleanup[77100]: AB16619A0B68: message-id=<CAKExcJG_=6xxxxxxxxxxxxxxxxxxxxxxj_8-+g@mail.gmail.com>
Dec 18 20:49:39 vmixxxxxxxx opendkim[679]: AB16619A0B68: DKIM verification successful
Dec 18 20:49:39 vmixxxxxxxx opendkim[679]: AB16619A0B68: s=20230601 d=gmail.com a=rsa-sha256 SSL
Dec 18 20:49:39 vmixxxxxxxx postfix/qmgr[74661]: AB16619A0B68: from=<normalgmailaccount@gmail.com>, size=2997, nrcpt=1 (queue active)
Dec 18 20:49:39 vmixxxxxxxx postfix/smtpd[77095]: disconnect from mail-ot1-f66.google.com[209.85.210.66] ehlo=2 starttls=1 mail=1 rcpt=1 bdat=1 quit=1 commands=7
Dec 18 20:49:40 vmixxxxxxxx spamd[924]: spamd: connection from 127.0.0.1 [127.0.0.1]:56162 to port 783, fd 5
Dec 18 20:49:40 vmixxxxxxxx spamd[924]: spamd: setuid to user@domain.tld succeeded
Dec 18 20:49:40 vmixxxxxxxx spamd[924]: spamd: processing message <CAKExcJG_=6xxxxxxxxxxxxxxxxxxxxxxj_8-+g@mail.gmail.com> for user@domain.tld:1007
Dec 18 20:49:40 vmixxxxxxxx spamd[924]: spamd: clean message (-0.2/5.0) for user@domain.tld:1007 in 0.5 seconds, 3329 bytes.
Dec 18 20:49:40 vmixxxxxxxx spamd[924]: spamd: result: . 0 - DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM,HTML_MESSAGE,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE scantime=0.5,size=3329,user=user@domain.tld,uid=1007,required_score=5.0,rhost=127.0.0.1,raddr=127.0.0.1,rport=56162,mid=<CAKExcJG_=6xxxxxxxxxxxxxxxxxxxxxxj_8-+g@mail.gmail.com>,autolearn=ham autolearn_force=no
Dec 18 20:49:40 vmixxxxxxxx postfix/local[77101]: AB16619A0B68: to=<user-domain.tld@vmixxxxxxxx.contaboserver.net>, orig_to=<user@domain.tld>, relay=local, delay=1.2, delays=0.1/0.01/0/1.1, dsn=2.0.0, status=sent (delivered to command: /usr/bin/procmail-wrapper -o -a $DOMAIN -d $LOGNAME)
Dec 18 20:49:40 vmixxxxxxxx postfix/qmgr[74661]: AB16619A0B68: removed
Dec 18 20:49:40 vmixxxxxxxx spamd[831]: prefork: child states: II
Dec 18 20:49:45 vmixxxxxxxx dovecot: imap-login: Login: user=<user@domain.tld>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=77127, secured, session=<zvo7Dc4MkOB/AAAB>
Dec 18 20:49:45 vmixxxxxxxx dovecot: imap(user@domain.tld)<77127><zvo7Dc4MkOB/AAAB>: Disconnected: Logged out in=514 out=5988 deleted=0 expunged=0 trashed=0 hdr_count=8 hdr_bytes=2141 body_count=0 body_bytes=0
So, from the web interface, everything work correctly.
This log puzzles me because I see a redirect to the user-domain.tld (Dec 18 20:49:40 vmixxxxxxxx postfix/local…)
Checking the Virtual Domains in Webmin → Servers → Postfix Mail Server, I see that
Name Maps to
user@domain.tld user-domain.tld
so probably it is ok.
For completeness, I also report the /etc/postfix/main.cf file
(Removing check_policy_service inet:127.0.0.1:10023 from the smtpd_recipient_restrictions resolved the issue where incoming emails were not delivered).
# See /usr/share/postfix/main.cf.dist for a commented, more complete version
# Debian specific: Specifying a file name will cause the first
# line of that file to be used as the name. The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no
# appending .domain is the MUA's job.
append_dot_mydomain = no
# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h
readme_directory = no
# See http://www.postfix.org/COMPATIBILITY_README.html -- default to 3.6 on
# fresh installs.
compatibility_level = 3.6
# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_tls_security_level = may
smtp_tls_CApath=/etc/ssl/certs
smtp_tls_security_level = dane
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = vmixxxxxxx.contaboserver.net
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = $myhostname, vmixxxxxxx.contaboserver.net, localhost.contaboserver.net, , localhost
relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_command = /usr/bin/procmail-wrapper -o -a $DOMAIN -d $LOGNAME
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all
virtual_alias_maps = hash:/etc/postfix/virtual
sender_bcc_maps = hash:/etc/postfix/bcc
sender_dependent_default_transport_maps = hash:/etc/postfix/dependent
home_mailbox = Maildir/
smtpd_sasl_auth_enable = yes
smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated reject_unauth_destination
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
smtp_dns_support_level = dnssec
smtp_host_lookup = dns
allow_percent_hack = no
resolve_dequoted_address = no
tls_server_sni_maps = hash:/etc/postfix/sni_map
milter_default_action = accept
smtpd_milters = inet:127.0.0.1:8891
non_smtpd_milters = inet:127.0.0.1:8891
The thing that seems strange to me here is:
myhostname = vmixxxxxxx.contaboserver.net
and that it is not my virtualserver of course, but could be the basic configuration of virtualmin to run multiple virtual servers on the same VPS (?).
So, this is all about my situation.
The thing I can’t do at all is configure a mail client, whether it’s Thunderbird or iOS mail (iOS is more important to me)
The autoconfig system works, so much that by visiting the site
https://domain.tld/cgi-bin/autoconfig.cgi?emailaddress=user@domain.tld, the XML file is returned to me:
<clientConfig version="1.1">
<emailProvider id="domain.tld">
<domain>domain.tld</domain>
<displayName/>
<displayShortName/>
<incomingServer type="imap">
<hostname>mail.domain.tld</hostname>
<port>993</port>
<socketType>SSL</socketType>
<authentication>password-cleartext</authentication>
<username>user@domain.tld</username>
</incomingServer>
<incomingServer type="pop3">
<hostname>mail.domain.tld</hostname>
<port/>
<socketType>SSL</socketType>
<authentication/>
<username>user@domain.tld</username>
</incomingServer>
<outgoingServer type="smtp">
<hostname>mail.domain.tld</hostname>
<port>587</port>
<socketType>STARTTLS</socketType>
<authentication>password-cleartext</authentication>
<username>user@domain.tld</username>
</outgoingServer>
</emailProvider>
</clientConfig>
Thunderbird successfully detects the configuration from the server, but then, once the correct password is entered, after a few minutes, Thunderbird says it is unable to authenticate. Your configuration, username or password may be incorrect.
I remember that, however, the same username and password allow login into the roundcube webmail on domain.tld/roundcube.
The password is basic and long for testing purposes but without any special characters.
There is no way to add the account on iOS either.
Checking the logs, I don’t even see Thunderbird’s connection attempt failing.
I understand that the saslauthd process is involved, but
journalctl -fu saslauthd
doesn’t return new logs when I try to connect via Thunderbird (only the failed attempts by bruteforce hosts that are then banned thanks to fail2ban).
I checked again by logging in via the domain.tld/roundcube, everything works, and the emails arrive both incoming and outgoing.
Please, I’ve been going crazy for days on this configuration and can’t find any solutions.
I know it’s a very long topic, but I tried to summarize all the steps, hoping to make life easier for anyone with the same problem!
Thanks for your help!
