You'll need a registered domain name and a VPS (Virtual Private Server) provider that allows uploading of iso images for the OS.

I use contabo.com as my VPS provider, and they work great for this, and have improved a lot over the past year. Contabo allows uploading of ISO and Qcow2 custom
images to use for your OS. If you get a VPS at contabo for setting up a mailserver I'd highly recommend getting a VPS with a minimum of 16gb memory and 6 CPU
cores. I've tried the cheaper VPS with 8gb memory and 4 CPU cores, and it was pretty sluggish for a mailserver.

Note! Been having trouble lately with Contabo. I Just ordered another VPS from them, and custom images will not work properly on this new VPS. I think it's because
they changed something about how the new VPS's work with custom images. I got Contabo support to help, but they couldn't fix it. I've got 3 other VPS's with Contabo
that work perfect with custom images. Hopefully they will get this fixed soon.

netcup.com didn't workout for me. Their prices were great, and their VPS and Root Servers were great, but to use their nameservers you have to get your domain through
them. I've got too many domains already, and don't want or need anymore. Netcup seems like a very eccentric company to me, they have their own way of doing things,
but you may want to check them out. They do have some very good servers to choose from, and you'll probably get twice the performance for the same money as Contabo.

After you have your domain name and a VPS go to the DNS Zone Management panel at your domain name or VPS provider and setup the DNS records for the server.
This includes the SPF records, DMARC records, and DKIM key.

Note! - I switched back to using Contabo's nameservers, because Namecheap's nameservers are open resolvers, which means anyone can use them, and open resolvers
will not work with spamhaus for filtering spam.

Resource record      TTL      Type      Priority      Data
---------------------------------------------------------------------
mail.example.org            3600      A           0     ip.address
example.org                 3600      A           0     ip.address
www.example.org             3600      A           0     ip.address
example.org                 3600      MX          10    mail.example.org
example.org                 3600      TXT         0     v=spf1 mx -all
_dmarc.example.org          3600      TXT         0     v=DMARC1;p=quarantine;pct=100;fo=1;rua=mailto:admin@example.org
dkim._domainkey.example.org 3600      TXT         0     v=DKIM1;p=dkim.public.key

Then setup the reverse DNS at your VPS provider with:

IP Address                      PTR Record
----------------------------------------------
your.server.ip.address        mail.example.org

Install FreeBSD

a. Qcow2 Install - (Alternative to ISO Install)

These qcow2 FreeBSD images have the PF firewall enabled and running. The /etc/pf.conf file is where you configure the PF firewall. I think I have the PF firewall setup
properly now. I'm new to PF, so it took some RTFM to get it setup.

Important! - Make sure to read this How-To for directions on how to set these qcow2 images up properly at your provider!

After you have uploaded one of the two qcow2 images below to your VPS provider as a custom image, you can initiate the install to your VPS. You'll need a VNC client
to logon to the server with the VNC ip the provider provided you. I use TigerVNC for my VNC client. TigerVNC is availible for Windows, Mac, Linux, and FreeBSD.

The qcow2 image below uses the ufs filesystem.
FreeBSD-14.3-p5-vps-ufs-12072025.qcow2 (2.73gb) SHA256: 9ca94b25387df72f6adededea967836366378bd31e2e07f0c5547340fe3e70d4

The qcow2 image below uses the zfs filesystem.
FreeBSD-14.3-p5-vps-zfs-12072025.qcow2 (3.44gb) SHA256: 099c2538692ddc35ba075e85a924e9be946849ac921bc2423eeb0a4eef52748c

After you install one of the above qcow2 images at your VPS provider, and have followed the How-To on how to set them up, you can go directly to the SlackerMail-FreeBSD
install script if you want to install SlackerMail. This script is not ready yet, but you can do the manual SlackerMail install starting below, until the install script is ready.

b. ISO Install - (Traditional Install)

After the FreeBSD 14.3 ISO has been uploaded to your provider, initiate the install process in their control panel. Then you'll need to VNC to the ip address given for VNC
access to your FreeBSD server. I use TigerVNC for my VNC client. TigerVNC is availible for Windows, Mac, Linux, and FreeBSD.

FreeBSD-14.3 is the easiest and fastest OS install I've ever seen. When you VNC to your FreeBSD server you'll be met with the install menus below.

01. Welcome - I choose "Install".
02. Keymap Selection - Pick your proper regional keymap.
03. Set Hostname - Enter your FQDN (Fully Qualified Doman Name) eg. mail.example.org.
04. Distribution Select - Choose what you want to install. The default selection looks good, but we'll also need to install "src" and
    "ports" because you may need to recompile the kernel at some point, and we'll need to build some ports for the SlackerMail mail server.
05. Partitioning - Pick your preferred disk setup. I pick either "Auto (ZFS)" or "Auto (UFS)", then I choose "Entire Disk", then I choose
    "GPT GUID Partition Table"
06. ZFS Configuration - I accept the defaults, and in the next dialog box I choose "Stripe", because I have only 1 disk. Then I choose
    "da0 QEMU QEMU HARDDISK" to create the zpool on, and lastly I enter "Yes" to create the drive.
07. FreeBSD is installed
08. Setting the root password - Set a password for root.
09. Network Configuration - I Choose my network interface, then I choose "Yes" to configure IPv4, then "Yes" to configure "DHCP", then
    "No" to configure IPv6. Lastly is the network "Resolver Configuration", and if all looks well choose "OK".
10. Time Zone Selector - Choose your time zone.
11. System Configuration - Choose what services will be started at boot. I pick sshd, moused, ntpd, and ntpd_sync_on_start.
12. System Hardening - I leave all of these unchecked.
13. Add User Accounts - Enter Username, then Full name. I then just hit enter for all the default selections, except for "Invite user
    into other groups?", I enter "wheel", because you'll need to be in the wheel group to be able to su to root. Lastly you'll need to
    enter a password for the user.
14. Final Configuration - If everything looks okay, Exit, to apply configuration and exit installer.
15. Reboot - Reboot and logon to your server using PuTTY with the user you added during install, then to become root run "su - root", 
    and enter the root password.

You can edit with "vi" or with "mc -u". "mc -u" (Midnight Commander) is a very nice command line filemanager, and a lot easier to edit with, but you'll have to
install the "mc" package first. If you want to install mc, first run "pkg update", then run "pkg install mc". After mc is installed you can then run "mc -u" to search
for and edit files.

FreeBSD Server Initial Setup

You've probably already setup your hostname on the install, but if you didn't you need to do that now. Run the command
below to set your hostname, and adjust for your actual FQDN:

sysrc hostname="mail.example.org"

echo "127.0.0.1 mail.example.org mail localhost" > /etc/hosts

pkg update
pkg upgrade
freebsd-update fetch
freebsd-update install

reboot

pkg install -y gcc gmake cmake python php84 php84-pecl-imagick bind-tools 7-zip m4 git gnupg \
openssl mc htop bash neofetch gzip unzip shared-mime-info ca_root_nss bzip2-1.0.8_1 sudo

service ntpd fetch

reboot

PF Firewall Setup

fetch https://the-slacker.com/download/pf.conf
mv -f pf.conf /etc/

Next enable PF firewall and logging to be started at boot, then reboot:

service pf enable
service pflog enable
reboot

pfctl -s info

tcpdump -n -e -ttt -r /var/log/pflog

You can also setup SlackerMail by hand by following all the directions below. It takes about 5 minutes to install from the script. It will take
1-2 days to install by hand, but it's a good learning experience.

Install Webmin as the server control panel - Optional

pkg install -y p5-DateTime-Locale p5-DateTime-TimeZone p5-Data-Dumper p5-Digest-MD5 p5-Digest-SHA p5-Encode-Detect p5-File-Path p5-Time-HiRes \
p5-Time-Local p5-Time-Piece p5-Authen-PAM p5-Net-SSLeay p5-IO-Tty gzip unzip shared-mime-info p5-Mail-DKIM p5-DBD-mysql

pkg install webmin

then run:
/usr/local/lib/webmin/setup.sh

Make sure to answer:
Use SSL (y/n): y

Then enable webmin to start at boot:
service webmin enable

Then start webmin:
service webmin start

I edit /usr/local/etc/webmin/miniserv.conf and add the line "allow=your.ip.address" # Do this if you
want to only allow your ip address to login with Webmin.

The reason I install Webmin so early into the setup is because it makes editing files and reading logs so easy.
It'll save you many hours over using just the console, and is safe if you add the line "allow=your.ip.address"
in /usr/local/etc/webmin/miniserv.conf.

*Notice
Webmin doesn't recognize the FreeBSD ZFS filesystem, so it doesn't report a disk.

Apache or Nginx Web Server

First off we need to secure PHP, since the web server and other services use it.

Copy the entire block below, then paste it in Putty and run it.

sed -i '' 's/disable_functions =/disable_functions = system,posix_uname,eval,pcntl_wexitstatus,posix_getpwuid,xmlrpc_entity_decode,pcntl_wifstopped,pcntl_wifexited,pcntl_wifsignaled,phpAds_XmlRpc,pcntl_strerror,ftp_exec,pcntl_wtermsig,mysql_pconnect,proc_nice,pcntl_sigtimedwait,posix_kill,pcntl_sigprocmask,fput,phpinfo,phpAds_remoteInfo,ftp_login,inject_code,posix_mkfifo,highlight_file,escapeshellcmd,show_source,pcntl_wifcontinued,fp,pcntl_alarm,pcntl_wait,ini_alter,posix_setpgid,parse_ini_file,ftp_raw,pcntl_waitpid,pcntl_getpriority,ftp_connect,pcntl_signal_dispatch,pcntl_wstopsig,ini_restore,ftp_put,passthru,proc_terminate,posix_setsid,pcntl_signal,pcntl_setpriority,phpAds_xmlrpcEncode,pcntl_exec,ftp_nb_fput,ftp_get,phpAds_xmlrpcDecode,pcntl_sigwaitinfo,shell_exec,pcntl_get_last_error,ftp_rawlist,pcntl_fork,posix_setuid/g' /usr/local/etc/php.ini

openssl dhparam -out dh2048_param.pem 2048
mv -f dh2048_param.pem /etc/ssl/

fetch https://the-slacker.com/download/www.conf.freebsd
mv -f www.conf.freebsd /usr/local/etc/php-fpm.d/www.conf

Apache:

pkg install apache24

fetch https://the-slacker.com/download/freebsd-httpd.conf
mv -f freebsd-httpd.conf /usr/local/etc/apache24/httpd.conf

Change ServerAdmin to your email address.
Change ServerName to your domain name.

Change the NO to YES  in the line apache24_http_accept_enable="NO"
This allows the use of a kernel module that can help the performance of Apache.

service apache24 enable

service php_fpm enable

service apache24 onestart
service php_fpm start

If you want to install a robots.txt file that is set to allow good robots and disallow bad robots, then download and install the following:

fetch https://the-slacker.com/download/robots.txt
mv -f robots.txt /usr/local/www/apache24/data/

Nginx:

First we need to install Nginx:

pkg install nginx

service nginx enable
service php_fpm enable

service nginx start
service php_fpm start

If you want to install a robots.txt file that is set to allow good robots and disallow bad robots, then download and install the following:

fetch https://the-slacker.com/download/robots.txt
mv -f robots.txt /usr/local/www/nginx/

Let's Encrypt SSL Certs

First we'll need to install "certbot", so we can aquire and update our SSL Certificates:

pkg install py311-certbot

Let's Encrypt setup with Apache web server

mkdir -p /usr/local/www/apache24/data/.well-known/acme-challenge

http://example.org # Adjust for your actual domain name.

certbot certonly --webroot -w /usr/local/www/apache24/data -d mail.example.org -d www.example.org -d example.org 

Down at the bottom of the file:
Uncomment #Include etc/apache24/extra/httpd-ssl.conf

fetch https://the-slacker.com/download/freebsd-httpd-ssl.conf
mv -f freebsd-httpd-ssl.conf /usr/local/etc/apache24/extra/httpd-ssl.conf

Change ServerName to match your domain name.
Change ServerAdmin to match your email.

Uncomment and change to match your Let's Encrypt certs.
#SSLCertificateFile "/usr/local/etc/letsencrypt/live/mail.example.org/fullchain.pem"
#SSLCertificateKeyFile "/usr/local/etc/letsencrypt/live/mail.example.org/privkey.pem"

Put the following just below Listen 80:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

service apache24 restart

Lastly, set certbot to check every week if a renew is needed for the Let's Encrpyt certs.
Copy, paste, and run the echo command below to enable the weekly renew check:

echo -e '#!/bin/sh

#500.certbot
weekly_certbot_enable="YES"
weekly_certbot_post_hook="service apache24 restart"' > /usr/local/etc/periodic.conf

echo -e '#!/bin/sh

#500.certbot
weekly_certbot_enable="YES"
weekly_certbot_post_hook="service apache24 restart && service postfix restart && service dovecot restart && service webmin restart"' > /usr/local/etc/periodic.conf

chmod 0755 /usr/local/etc/periodic/weekly/500.certbot-3.11

Let's Encrypt setup with Nginx web server

mkdir -p /usr/local/www/nginx/.well-known/acme-challenge

http://example.org # Adjust for your actual domain name.

certbot certonly --webroot -w /usr/local/www/nginx -d mail.example.org -d www.example.org -d example.org 

fetch https://the-slacker.com/download/nginx.freebsd.conf
mv -f nginx.freebsd.conf /usr/local/etc/nginx/nginx.conf

mkdir -p /usr/local/etc/nginx/conf.d

fetch https://the-slacker.com/download/mailserver.freebsd.conf
mv -f mailserver.freebsd.conf /usr/local/etc/nginx/conf.d/mailserver.conf

Uncomment and change to match your domain:

#ssl_certificate /usr/local/etc/letsencrypt/live/mail.example.org/fullchain.pem;
#ssl_certificate_key /usr/local/etc/letsencrypt/live/mail.example.org/privkey.pem;

service nginx restart

Lastly, set certbot to check every week if a renew is needed for the Let's Encrpyt certs.
Copy, paste, and run the echo command below to enable the weekly renew check:

echo -e '#!/bin/sh

#500.certbot
weekly_certbot_enable="YES"
weekly_certbot_post_hook="service nginx restart"' > /usr/local/etc/periodic.conf

echo -e '#!/bin/sh

#500.certbot
weekly_certbot_enable="YES"
weekly_certbot_post_hook="service nginx restart && service postfix restart && service dovecot restart && service webmin restart"' > /usr/local/etc/periodic.conf

chmod 0755 /usr/local/etc/periodic/weekly/500.certbot-3.11

Use Let's Encrypt certs with Webmin

Edit the /usr/local/etc/webmin/miniserv.conf file. Delete the "keyfile=" line, and add the following:
Of course adjust for your domain.

keyfile=/usr/local/etc/letsencrypt/live/mail.example.org/privkey.pem
certfile=/usr/local/etc/letsencrypt/live/mail.example.org/fullchain.pem

service webmin restart

MySQL (Oracle)

Notice!
Oracle MySQL isn't the same as MariaDB MySQL. FreeBSD defaults to Oracle MySQL, so prebuilt FreeBSD packages that
are built with MySQL support are built with Oracle MySQL support. I'll be installing and using Oracle MySQL, so I can use
the FreeBSD prebuilt packages.

pkg install mysql80-server mysql80-client

service mysql-server enable
service mysql-server start

mysql_secure_installation

mysql -u root -p

pkg install php84-pdo_mysql

performance_schema = 0
character-set-server = utf8mb4
collation-server = utf8mb4_unicode_ci
log-error = /var/log/mysql/mysql.log

innodb_buffer_pool_size = 1G

mkdir /var/log/mysql
chown mysql:mysql /var/log/mysql

service mysql-server restart

Dovecot

mysql -u root -p
CREATE DATABASE vmail;
CREATE USER 'vmail'@'localhost' IDENTIFIED BY 'vmailpassword';
GRANT ALL PRIVILEGES ON vmail.* TO 'vmail'@'localhost';
FLUSH PRIVILEGES;
QUIT;

pw groupadd -n vmail -g 150
pw useradd -n vmail -d /var/vmail -s /usr/sbin/nologin -u 150 -g 150
mkdir /var/vmail
chmod 770 /var/vmail
chown vmail:vmail /var/vmail

pkg install dovecot-mysql

cp -R /usr/local/etc/dovecot/example-config/* /usr/local/etc/dovecot

echo -e "ssl_min_protocol = TLSv1.2
ssl = required
verbose_ssl = no
ssl_cert = </usr/local/etc/letsencrypt/live/mail.example.org/fullchain.pem
ssl_key = </usr/local/etc/letsencrypt/live/mail.example.org/privkey.pem
ssl_dh = </etc/ssl/dh2048_param.pem
# Fix 'The Logjam Attack'
ssl_cipher_list = EECDH+CHACHA20:EECDH+AESGCM:EDH+AESGCM:AES256+EECDH
ssl_prefer_server_ciphers = yes" > /usr/local/etc/dovecot/conf.d/10-ssl.conf

service dovecot enable
service dovecot start

echo -e "driver = mysql
connect = host=127.0.0.1 port=3306 dbname=vmail user=vmail password=vmailpassword
default_pass_scheme = SHA512-CRYPT

password_query = \\
  SELECT username as user, password, '/var/vmail/%d/%n' as \\
  userdb_home, 'maildir:/var/vmail/%d/%n' as userdb_mail, \\
  150 as userdb_uid, 150 as userdb_gid \\
  FROM mailbox WHERE username = '%u' AND active = '1'

user_query = \\
  SELECT '/var/vmail/%d/%n' as home, 'maildir:/var/vmail/%d/%n' \\
  as vmail, 150 AS uid, 150 AS gid, \\
  concat('dirsize:storage=', quota) AS quota \\
  FROM mailbox WHERE username = '%u' AND active = '1'" > /usr/local/etc/dovecot/dovecot-sql.conf.ext

chmod 0600 /usr/local/etc/dovecot/dovecot-sql.conf.ext

echo -e 'disable_plaintext_auth = yes
auth_mechanisms        = plain login
!include auth-sql.conf.ext' >  /usr/local/etc/dovecot/conf.d/10-auth.conf

echo -e 'mail_location   = maildir:/var/vmail/%d/%n
mail_uid        = vmail
mail_gid        = vmail
first_valid_uid = 150
last_valid_uid  = 150' >> /usr/local/etc/dovecot/conf.d/10-mail.conf

fetch https://the-slacker.com/download/10-master.conf
mv -f 10-master.conf /usr/local/etc/dovecot/conf.d/

First make /var/log/dovecot directory:

mkdir -p /var/log/dovecot

Then run echo command below:

echo -e '## Log destination.
##
log_path       = /var/log/dovecot/dovecot.log
info_log_path  = /var/log/dovecot/dovecot-info.log' >> /usr/local/etc/dovecot/conf.d/10-logging.conf

Install dovecot-pigeonhole with MySQL support:

pkg install dovecot-pigeonhole-mysql

cp /usr/local/share/doc/dovecot/example-config/conf.d/90-sieve.conf /usr/local/etc/dovecot/conf.d/
cp /usr/local/share/doc/dovecot/example-config/conf.d/90-sieve-extprograms.conf /usr/local/etc/dovecot/conf.d/
cp /usr/local/share/doc/dovecot/example-config/conf.d/20-managesieve.conf /usr/local/etc/dovecot/conf.d/

Create new /usr/local/etc/dovecot/conf.d/20-lmtp.conf file with the following echo command, and edit for your domain.

echo -e 'protocol lmtp {
  postmaster_address = admin@example.org
  mail_plugins       = $mail_plugins sieve quota
  log_path           = /var/log/dovecot/dovecot-lmtp-errors.log
  info_log_path      = /var/log/dovecot/dovecot-lmtp.log
}' > /usr/local/etc/dovecot/conf.d/20-lmtp.conf

echo -e 'protocol lda {
  postmaster_address = admin@example.org
  mail_plugins       = $mail_plugins sieve quota
  auth_socket_path   = /var/run/dovecot/auth-master
  log_path           = /var/log/dovecot/dovecot-lda-errors.log
  info_log_path      = /var/log/dovecot/dovecot-lda.log
}' > /usr/local/etc/dovecot/conf.d/15-lda.conf

echo -e 'mail_home       = /var/vmail/%d/%n/sieve' >> /usr/local/etc/dovecot/conf.d/10-mail.conf

echo -e 'protocols = $protocols sieve

service managesieve-login {
  inet_listener sieve {
    port = 4190
  }
}

service managesieve {
  process_limit = 1024
}

protocol sieve {
  log_path                          = /var/log/dovecot/dovecot-sieve-errors.log
  info_log_path                     = /var/log/dovecot/dovecot-sieve.log
  managesieve_max_line_length       = 65536
  managesieve_implementation_string = Dovecot Pigeonhole
}' > /usr/local/etc/dovecot/conf.d/20-managesieve.conf

echo -e 'plugin {
    sieve = file:/var/vmail/%d/%n/sieve;active=/var/vmail/%d/%n/sieve/.dovecot.sieve
    sieve_default = /usr/local/etc/dovecot/sieve/default.sieve
    sieve_global = /usr/local/etc/dovecot/sieve/global/
}
lda_mailbox_autocreate = yes
lda_mailbox_autosubscribe = yes' > /usr/local/etc/dovecot/conf.d/90-sieve.conf

mkdir -p /usr/local/etc/dovecot/sieve/global
chown -R vmail:vmail /usr/local/etc/dovecot/sieve/
mkdir /var/log/dovecot
chown vmail:vmail /var/log/dovecot

echo -e 'require "fileinto";
if header :contains "X-Spam-Flag" "YES" {
    fileinto "Junk";
}' > /usr/local/etc/dovecot/sieve/default.sieve

chown vmail:vmail /usr/local/etc/dovecot/sieve/default.sieve

pw groupmod vmail -m www

Postfix

pkg install postfix-mysql

sysrc postfix_enable="YES"
sysrc sendmail_enable="NONE"

install -d /usr/local/etc/mail
install -m 0644 /usr/local/share/postfix/mailer.conf.postfix /usr/local/etc/mail/mailer.conf

mkdir -p /usr/local/etc/postfix/mysql

First the /usr/local/etc/postfix/mysql/mysql_virtual_alias_domainaliases_maps.cf file:

echo -e "user = vmail 
password = vmailpassword
hosts = 127.0.0.1:3306 
dbname = vmail 
query = SELECT goto FROM alias,alias_domain 
  WHERE alias_domain.alias_domain = '%d' 
  AND alias.address=concat('%u', '@', alias_domain.target_domain) 
  AND alias.active = 1" > /usr/local/etc/postfix/mysql/mysql_virtual_alias_domainaliases_maps.cf

echo -e "user = vmail
password = vmailpassword
hosts = 127.0.0.1:3306
dbname = vmail
table = alias
select_field = goto 
where_field = address
additional_conditions = and active = '1'" > /usr/local/etc/postfix/mysql/mysql_virtual_alias_maps.cf

echo -e "user = vmail
password = vmailpassword
hosts = 127.0.0.1:3306
dbname = vmail
table = domain
select_field = domain 
where_field = domain
additional_conditions = and backupmx = '0' and active = '1'" > /usr/local/etc/postfix/mysql/mysql_virtual_domains_maps.cf

echo -e "user = vmail
password = vmailpassword
hosts = 127.0.0.1:3306
dbname = vmail
query = SELECT maildir FROM mailbox, alias_domain
  WHERE alias_domain.alias_domain = '%d' 
  AND mailbox.username=concat('%u', '@', alias_domain.target_domain )
  AND mailbox.active = 1" > /usr/local/etc/postfix/mysql/mysql_virtual_mailbox_domainaliases_maps.cf

echo -e "user = vmail
password = vmailpassword
hosts = 127.0.0.1:3306
dbname = vmail
table = mailbox
select_field = CONCAT(domain, '/', local_part) 
where_field = username
additional_conditions = and active = '1'" > /usr/local/etc/postfix/mysql/mysql_virtual_mailbox_maps.cf

chmod 0600 /usr/local/etc/postfix/mysql/*

fetch https://the-slacker.com/download/main.cf.freebsd
mv -f main.cf.freebsd /usr/local/etc/postfix/main.cf

fetch https://the-slacker.com/download/aliases
mv -f aliases /usr/local/etc/postfix/

Edit /usr/local/etc/postfix/aliases - At the bottom of the file change admin@example.org
to the address you want to get root's mail, then run:

newaliases

fetch https://the-slacker.com/download/master.cf.freebsd
mv -f master.cf.freebsd /usr/local/etc/postfix/master.cf

pw groupmod dovecot -m postfix

service postfix start
service dovecot restart

PostfixAdmin:

pkg install postfixadmin33-php84
cd /usr/local/www
ln -s postfixadmin33 postfixadmin
cd postfixadmin
mkdir -p templates_c
chown www:www templates_c

cp /usr/local/www/postfixadmin/config.inc.php /usr/local/www/postfixadmin/config.local.php
chown root:www /usr/local/www/postfixadmin/config.local.php
chmod 0640 /usr/local/www/postfixadmin/config.local.php

mkdir -p /root/SlackerMail
PASSWD=$(cat /dev/urandom | LC_CTYPE=C tr -dc 'a-zA-Z0-9' | fold -w 24 | head -n 1)
echo $PASSWD > /root/SlackerMail/postfixadmin_setup.pass
SETUPPASS=$(cat /root/SlackerMail/postfixadmin_setup.pass)
HASHPASS=$(doveadm pw -p $SETUPPASS)
echo $HASHPASS | cut -c 8- > /root/SlackerMail/postfixadmin_setup_hashed.pass
chmod 0600 /root/SlackerMail/postfixadmin_setup.pass /root/SlackerMail/postfixadmin_setup_hashed.pass

$CONF['configured'] = true;
$CONF['setup_password'] = 'hashed-setup-password-here';

$CONF['database_type'] = 'mysqli';
$CONF['database_host'] = 'localhost';
$CONF['database_user'] = 'vmail';
$CONF['database_password'] = "vmailpassword";
$CONF['database_name'] = 'vmail';

$CONF['database_port'] = '3306';
//$CONF['database_socket'] = ''; Comment out, since we are using port instead of socket.

$CONF['admin_email'] = 'admin@example.org';

$CONF['encrypt'] = 'dovecot:SHA512-CRYPT';
$CONF['dovecotpw'] = "/usr/local/bin/doveadm pw"; # FreeBSD

$CONF['default_aliases'] = array (
    'abuse' => 'admin@example.org',
    'hostmaster' => 'admin@example.org',
    'postmaster' => 'admin@example.org',
    'webmaster' => 'admin@example.org',
    'virusalert' => 'admin@example.org',
    'root' => 'admin@example.org'
);
 
$CONF['domain_path'] = 'NO';
$CONF['domain_in_mailbox'] = 'YES';

$CONF['footer_text'] = 'Return to example.org';
$CONF['footer_link'] = 'https://example.org';

$CONF['emailcheck_resolve_domain']='NO';

$CONF['password_expiration'] = 'NO';

php /usr/local/www/postfixadmin/public/upgrade.php

chmod 0755 /usr/local/www/postfixadmin/scripts/postfixadmin-cli
/usr/local/www/postfixadmin/scripts/postfixadmin-cli admin add admin@example.org --superadmin 1 --active 1 --password admin-password --password2 admin-password

/usr/local/www/postfixadmin/scripts/postfixadmin-cli domain add example.org --aliases 100 --mailboxes 1000 --active 1 --description example.org

/usr/local/www/postfixadmin/scripts/postfixadmin-cli mailbox add admin@example.org --name admin --quota 0 --active 1 --password roundcube-mailbox-password --password2 roundcube-mailbox-password

service apache24 restart
service php_fpm restart

service nginx restart
service php_fpm restart

Roundcube Webmail Client:

You can use the following commands to create a roundcube database password for you, or you can make up your
own password in the mysql creation of the roundcubemail database. You can adjust the length of the password by
changing "fold -w 24" to any number you want. The resulting password will be at:
/root/SlackerMail/roundcube_password.pass

PASSWD=$(cat /dev/urandom | LC_CTYPE=C tr -dc 'a-zA-Z0-9' | fold -w 24 | head -n 1)
echo $PASSWD > /root/SlackerMail/roundcube_password.pass
chmod 0600 /root/SlackerMail/roundcube_password.pass

mysql -u root -p
CREATE DATABASE roundcubemail CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'roundcube'@'localhost' IDENTIFIED BY 'roundcube_password';
GRANT ALL PRIVILEGES ON roundcubemail.* TO 'roundcube'@'localhost';
FLUSH PRIVILEGES;
QUIT;

pkg install roundcube-php84 php84-gd php84-curl
Then run:
chown -R www /usr/local/www/roundcube
Then run the following:
cd /usr/local/www/roundcube
mysql -u roundcube roundcubemail -proundcube_password < SQL/mysql.initial.sql

echo '#submission header checks file' >> /usr/local/etc/postfix/submission_header_checks

DESKEY=$(cat /dev/urandom | LC_CTYPE=C tr -dc 'a-zA-Z0-9' | fold -w 24 | head -n 1)
echo $DESKEY > /root/SlackerMail/roundcubemail.deskey

Then download the needed /usr/local/www/roundcube/config/config.inc.php file, and adjust
for your domain, roudcube password, and 24-character-DES-Key with the following:

fetch https://the-slacker.com/download/config.inc.php.rcm.freebsd
mv -f config.inc.php.rcm.freebsd /usr/local/www/roundcube/config/config.inc.php
chown www:www /usr/local/www/roundcube/config/config.inc.php
chmod 0600 /usr/local/www/roundcube/config/config.inc.php

$config['db_dsnw'] = 'mysql://roundcube:roundcube-password-here@localhost/roundcubemail';
$config['support_url'] = 'https://example.org';
$config['des_key'] = '24-character-Des-Key';

fetch https://the-slacker.com/download/config.inc.php.rcmp.freebsd
mv -f config.inc.php.rcmp.freebsd /usr/local/www/roundcube/plugins/password/config.inc.php
chmod 0600 /usr/local/www/roundcube/plugins/password/config.inc.php
chown www /usr/local/www/roundcube/plugins/password/config.inc.php

$config['password_db_dsn'] = 'mysql://vmail:mysql-vmail-database-password-here@localhost/vmail';

Lastly you'll need to remove the /usr/local/www/roundcube/installer directory for security reasons:

rm -rf /usr/local/www/roundcube/installer

service nginx restart
service php_fpm restart

Amavisd with ClamAV and SpamAssassin:

pkg install amavisd-new
service amavisd enable

fetch https://the-slacker.com/download/amavisd.freebsd.conf
mv -f amavisd.freebsd.conf /usr/local/etc/amavisd.conf
chown root:vscan /usr/local/etc/amavisd.conf
chmod 0640 /usr/local/etc/amavisd.conf

Spamassassin is installed with Amavisd-New, so we need to update it's database:

sa-update
sa-compile

pkg install clamav

sed -i '' 's/#LocalSocketGroup virusgroup/LocalSocketGroup vscan/g' /usr/local/etc/clamd.conf

service clamav_freshclam enable
service clamav_clamd enable

pw groupmod clamav -m vscan
pw groupmod vscan -m clamav

service clamav_freshclam start
Wait for about 1 minute, then:
service clamav_clamd start

openssl genrsa -out example.org.priv 2048
openssl rsa -in example.org.priv -pubout > example.org.pub

mkdir -p /usr/local/etc/ssl/example.org
mv -f example.org.priv /usr/local/etc/ssl/example.org/example.org.pem
mv -f example.org.pub /usr/local/etc/ssl/example.org/
chown vscan:vscan /usr/local/etc/ssl/example.org/example.org.pem /usr/local/etc/ssl/example.org/example.org.pub
chmod 600 /usr/local/etc/ssl/example.org/example.org.pem 
chmod 644 /usr/local/etc/ssl/example.org/example.org.pub

Uncomment the dkim_key line, and change for your domain.
#dkim_key('example.org', 'dkim', '/usr/local/etc/ssl/example.org/example.org.pem');

sed '1d;$d' "/usr/local/etc/ssl/example.org/example.org.pub" | sed '1s/.*/v=DKIM1;p=&/' | tr -d '\n' > /root/SlackerMail/example.org.pub.txt

reboot

mail-tester.com - Great place to check if your mail server is sending mail properly. With this server I get a 10/10 score.

SSL Labs - Great place to check how your SSL implementation is working. I get a score of A+ with this server. You can
do this test with Let's Encrypt certs, but not self signed certs.

Fail2ban - Optional:

First we need to setup our PF firewall to work with Fail2ban. Edit /etc/pf.conf and put the following:
And of course adjust "vtnet0" to match your network interface.

ext_if = "vtnet0"
icmp_types = "{ echoreq unreach }"
table <fail2ban> persist
table <bruteforce> persist
table <rfc6890> { 0.0.0.0/8 10.0.0.0/8 100.64.0.0/10 127.0.0.0/8 169.254.0.0/16          \
                  172.16.0.0/12 192.0.0.0/24 192.0.0.0/29 192.0.2.0/24 192.88.99.0/24    \
                  192.168.0.0/16 198.18.0.0/15 198.51.100.0/24 203.0.113.0/24            \
                  240.0.0.0/4 255.255.255.255/32 }  
set skip on lo
scrub in all fragment reassemble max-mss 1440
antispoof for $ext_if
block in on $ext_if from <rfc6890>
block return out on egress to <rfc6890>
block all
block quick proto tcp from <fail2ban> to any
pass in on $ext_if proto tcp to ($ext_if) port { 22 25 80 110 143 443 587 993 995 10000 } keep state
pass out all keep state
pass inet proto icmp icmp-type $icmp_types
pass log quick proto tcp from any to any port { 22,25,80,443 } 

pkg install py311-fail2ban
service fail2ban enable

echo "[Definition]
# Option: loglevel. Default is ERROR
# Available options: CRITICAL, ERROR, WARNING, NOTICE, INFO, DEBUG
loglevel = INFO
# Set the log target
logtarget = /var/log/fail2ban.log" > /usr/local/etc/fail2ban/fail2ban.local

echo "[DEFAULT]
# time is in seconds. 3600 = 1 hour, 86400 = 24 hours (1 day)
findtime    = 3600
bantime     = 604800
maxretry    = 3
action      = %(action_)s
banaction   = pf
ignoreip    = 127.0.0.1 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16" > /usr/local/etc/fail2ban/jail.local

Now we'll make a sshd fail2ban jail with the echo command below:

echo "[sshd]
enabled = true
port = ssh
filter = sshd" > /usr/local/etc/fail2ban/jail.d/sshd.conf

fetch https://the-slacker.com/download/freebsd-fail2ban-sshd.conf
mv -f freebsd-fail2ban-sshd.conf /usr/local/etc/fail2ban/filter.d/sshd.conf

reboot

Fail2ban Alternative:

I tried FreeBSD's blacklistd, but really couldn't get it to do what I wanted, plus it hasn't been maintained for 8 years. I
really don't like Fail2ban, so I'm going to see if I can do what I need to do without it. I may have to go back to fail2ban,
but maybe not.

1. SSHD - Optional:

Note! - The easiest and best way to prevent about 80%+ of sshd attacks is to change the port from 22 to some other port,
6000 for instance. I knew a guy that was a server provider for 20+ years, and that's the first thing he would do, and he proved
to me how well it worked.

Fail2ban will prevent malicious sshd attacks by limiting the number of sshd login attempts from an ip within a set amount
of time, and then ban them for a set amount of time. What I'm going to do with sshd is only allow a specific ip, or specific
ip's, to be able to ssh the server.

You'll need to edit /etc/host.allow:

At the top of the file comment:
#ALL : ALL : allow
Then somewhere below that add:

# sshd
sshd : 192.201.2.241 : allow
sshd : 127.0.0.1 : allow
sshd : ALL : deny

That's it for sshd. No need at all for Fail2ban with sshd. Nice and simple!

2. Postfix and Dovecot:

I've got the settings in the Postfix and Dovecot config files so they will prevent many attacks. I'm sure there are attacks I don't
have covered, but I'm going to try it like this without using Fail2ban to see how it goes.

3. Roundcube - Optional:

To prevent anyone but my ip address to access Roundcube I added some php code to /usr/local/www/roundcube/index.php:

Add the below code to the top of /usr/local/www/roundcube/index.php, just below <?php

$allowed_ip = '11.222.33.444'; // Replace with your allowed IP address

// Get the user's IP address
if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
    $user_ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
} elseif (isset($_SERVER['HTTP_CLIENT_IP'])) {
    $user_ip = $_SERVER['HTTP_CLIENT_IP'];
} else {
    $user_ip = $_SERVER['REMOTE_ADDR'];
}

// Check if the user's IP matches the allowed IP
if ($user_ip !== $allowed_ip) {
    die("Access denied."); // Stop script execution if IP does not match
}

4. Postfixadmin - Optional:

To prevent anyone but my ip address to access Postfixadmin I added some php code to /usr/local/www/postfixadmin/public/index.php:

Add the below code to the top of /usr/local/www/postfixadmin/public/index.php, just below <?php

$allowed_ip = '11.222.33.444'; // Replace with your allowed IP address

// Get the user's IP address
if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
    $user_ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
} elseif (isset($_SERVER['HTTP_CLIENT_IP'])) {
    $user_ip = $_SERVER['HTTP_CLIENT_IP'];
} else {
    $user_ip = $_SERVER['REMOTE_ADDR'];
}

// Check if the user's IP matches the allowed IP
if ($user_ip !== $allowed_ip) {
    die("Access denied."); // Stop script execution if IP does not match
}

Logwatch - Optional:

Install logwatch:

pkg install logwatch

echo '#!/bin/sh

/usr/local/sbin/logwatch.pl --output mail' > /usr/local/etc/periodic/daily/logwatch

chmod 0755 /usr/local/etc/periodic/daily/logwatch

periodic daily

That should do it for Logwatch.

Postgrey - Optional:

Install Postgrey:

pkg install postgrey

sed -i '' 's/smtpd_recipient_restrictions = reject_unauth_pipelining, permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_recipient, reject_unknown_recipient_domain, reject_unauth_destination, permit/smtpd_recipient_restrictions = reject_unauth_pipelining, permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_recipient, reject_unknown_recipient_domain, reject_unauth_destination, check_policy_service inet:127.0.0.1:10023, permit/g' /usr/local/etc/postfix/main.cf

service postgrey enable

service postfix restart

Netdata - Optional:

Install Netdata:

First we need to install a required python package:

pkg install py311-mysql-connector-python-9.4.0

pkg install netdata

Create a netdata mysql user, and grant netdata ALL PRIVILEGES. Put your chosen password in the "mysql-netdata-password" field.

mysql -u root -p
CREATE USER 'netdata'@'localhost' IDENTIFIED BY 'mysql-netdata-password';
GRANT ALL PRIVILEGES ON *.* TO 'netdata'@'localhost';
FLUSH PRIVILEGES;
QUIT;

I have Netdata set so authentication is required to sign into netdata, so you'll need to create a netdata.users file with username
and password. I have the user name set to netdata as you can see in the printf command below, but feel free to change that if
you want. You'll need to put the password you want in the password field in the printf command. The password will be hashed
in the /usr/local/etc/apache24/netdata.users or /usr/local/etc/nginx/netdata.users file.

For Apache webserver run the following:

printf "netdata:$(openssl passwd -apr1 password)" > /usr/local/etc/apache24/netdata.users
chown www:www /usr/local/etc/apache24/netdata.users
chmod 0400 /usr/local/etc/apache24/netdata.users

printf "netdata:$(openssl passwd -apr1 password)" > /usr/local/etc/nginx/netdata.users
chown www:www /usr/local/etc/nginx/netdata.users
chmod 0400 /usr/local/etc/nginx/netdata.users

service netdata enable
service netdata start

nginx:

Got nginx to show up in netdata by doing the following:

touch /usr/local/etc/netdata/go.d/nginx.conf
chown netdata:netdata /usr/local/etc/netdata/go.d/nginx.conf
chmod 0640 /usr/local/etc/netdata/go.d/nginx.conf

jobs:
  - name: local
    url: https://127.0.0.1/stub_status
    tls_skip_verify: yes

Got apache to show up in netdata by doing the following:

touch /usr/local/etc/netdata/go.d/apache.conf
chown netdata:netdata /usr/local/etc/netdata/go.d/apache.conf
chmod 0640 /usr/local/etc/netdata/go.d/apache.conf

jobs:
  - name: local
    url: https://127.0.0.1/server-status?auto
    tls_skip_verify: yes

Got mysql to show up in netdata by doing the following:

touch /usr/local/etc/netdata/go.d/mysql.conf
chown netdata:netdata /usr/local/etc/netdata/go.d/mysql.conf
chmod 0400 /usr/local/etc/netdata/go.d/mysql.conf

jobs:
  - name: local
    dsn: netdata:mysql-netdata-password@tcp(127.0.0.1:3306)/

Got php-fpm to show up in netdata by doing the following:

touch /usr/local/etc/netdata/go.d/phpfpm.conf
chown netdata:netdata /usr/local/etc/netdata/go.d/phpfpm.conf
chmod 0640 /usr/local/etc/netdata/go.d/phpfpm.conf

jobs:
  - name: local
    url: https://127.0.0.1/status
    tls_skip_verify: yes

service netdata restart

SlackerMail-FreeBSD Install Script: