• VPS @Omnitec, 2CPU, 2GB, 100GB
• Base IP: 206.197.251.210

• Standard Debian 9

• Telnet client for testing
• Web - php, php-mysql, mb, php-imap; split vhost logs
• DNS
• Email
• Lists

• master DNS zone is on Bock but NOT published as NS.

• Public DNS is provided via BuddyNS [.org], for which SLUUG contributes a few bucks a year.

• Finished mysql configuration of postfix
• Connected smtp & smtpd to sluug.org wildcard cert
• Disabled postgrey
• All other filters already disabled
• Verify postfixadmin before cutover
• PLAIN login method changed to TLS
  • (requires TLS connection before sending password)

• Configure maildir for new users in postfixadmin
• Setup and enable postgrey
• Setup and enable SpamAssassin or rspamd
• Setup and enable clamav
• Setup and enable Amavisd?
• Setup and configure Webalizer

Security Notes

a2enmod ssl.load a2enmod info

  * certbot from github is curreent, required for wildcard certs
  * Install requires dev libraries for headers:
    * aptitude install python2.7-dev
    * aptitude install libffi-dev
    * aptitude install libssl-dev
  * Setup:
''python setup.py install''
  * Generate:
''certbot certonly --manual -d *.sluug.org --agree-tos --no-bootstrap --manual-public-ip-logging-ok --preferred-challenges dns-01 --server https://acme-v02.api.letsencrypt.org/directory ''
  * Result: (If someone can figure out how to force plain text, please fix!!)
''Please deploy a DNS TXT record under the name                                                                                                                 
_acme-challenge.sluug.org with the following value:                                                                                                           
                                                                          
EGAoTq2e_Cf8TwYV4EN7zBLNfdgHodgoy9yX_WaLrGY

                                                                                                          
                                                                                                                                                
IMPORTANT NOTES:                                                                      
 - Congratulations! Your certificate and chain have been saved at:                    
   /etc/letsencrypt/live/sluug.org/fullchain.pem                   
   Your key file has been saved at:                                                   
   /etc/letsencrypt/live/sluug.org/privkey.pem                                                                                                                
   Your cert will expire on 2018-09-18. To obtain a new or tweaked                      
   version of this certificate in the future, simply run certbot    
   again. To non-interactively renew *all* of your certificates, run                                    
   "certbot renew"                                                                                                                                            
 - Your account credentials have been saved in your Certbot            
   configuration directory at /etc/letsencrypt. You should make a                       
   secure backup of this folder now. This configuration directory will                                      
   also contain certificates and private keys obtained by Certbot so
   making regular backups of this folder is ideal.
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le
</nowiki>- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -                                                                               
Please deploy a DNS TXT record under the name                                                                                                                 
_acme-challenge.sluug.org with the following value:                                                                                                           
                                                                          
EGAoTq2e_Cf8TwYV4EN7zBLNfdgHodgoy9yX_WaLrGY                                                                                                                   
                                                                       
Before continuing, verify the record is deployed.                         
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -                         
Press Enter to Continue                                                   
Waiting for verification...                                                                                                                                   
Cleaning up challenges                                                                                                               
                                                                          
IMPORTANT NOTES:                                                                      
 - Congratulations! Your certificate and chain have been saved at:                    
   /etc/letsencrypt/live/sluug.org/fullchain.pem                   
   Your key file has been saved at:                                                   
   /etc/letsencrypt/live/sluug.org/privkey.pem                                                                                                                
   Your cert will expire on 2018-09-18. To obtain a new or tweaked                      
   version of this certificate in the future, simply run certbot    
   again. To non-interactively renew *all* of your certificates, run                                    
   "certbot renew"                                                                                                                                            
 - Your account credentials have been saved in your Certbot            
   configuration directory at /etc/letsencrypt. You should make a                       
   secure backup of this folder now. This configuration directory will                                      
   also contain certificates and private keys obtained by Certbot so
   making regular backups of this folder is ideal.
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le''
   
   

  This also installed:  lynx-common

This also installed: libgmime-2.6-0 libgpgme11 libnotmuch4 libtalloc2 libtokyocabinet9

For a list of installed packages and when, a good resource is /var/log/apt/history.log*

Documentation /usr/source/Docuwiki

Edit /etc/ssh/sshd_config to change PermitRootLogin value from yes to forced-commands-only.

Add all users in the sudo group to the adm and systemd-journal groups to allow them to see logs without being root. See https://wiki.debian.org/SystemGroups