Hardening a Docker Mail Server on Sakura VPS

This is a follow-up to Building a mail server with Sakura VPS + Docker + Freenom , in which I tighten up the security a little

If the server from last time is running under docker, stop it

$ docker-compose down

Closing imap and submission

In the previous article I confirmed that imaps and smtps communication works, so I close imap and submission

docker-compose.yml (only the changed parts are shown)

# - "143:143"  # IMAP4 (explicit TLS => STARTTLS)
# - "587:587"  # ESMTP (explicit TLS => STARTTLS)

mailserver.env

The docker-mailserver I am using this time bundles a whole range of security-related packages such as Amabis, Spamassasin, Postgey and Fail2ban, and they are disabled by default, so I will try enabling them

The environment settings for these are read from mailserver.env inside docker-compose.yml, so I edit mailserver.env

29c29
< ONE_DIR=0
---
> ONE_DIR=1
82c82
< ENABLE_CLAMAV=0
---
> ENABLE_CLAMAV=1
99c99
< ENABLE_FAIL2BAN=0
---
> ENABLE_FAIL2BAN=1
126c126
< SSL_TYPE=
---
> SSL_TYPE=letsencrypt
234c234
< ENABLE_SPAMASSASSIN=0
---
> ENABLE_SPAMASSASSIN=1
338c338
< ENABLE_POSTGREY=0
---
> ENABLE_POSTGREY=1

This time I enable spamassassin, clamav, fail2ban, postgrey and letsencrypt

As a caveat, it says that once you enable fail2ban you should add a cap_add entry to docker-compose.yml, but the default docker-compose.yml already spells it out, so I only checked it

# If you enable Fail2Ban, don't forget to add the following lines to your `docker-compose.yml`:
#    cap_add:
#      - NET_ADMIN

Running docker-mailserver

$ docker-compose up -d

Checking outgoing mail

I send a message from this server to the outside and look at the details of the mail received there

Authentication-Results: mx.google.com;
       dkim=pass header.i=@example.com header.s=mail header.b=C63+umjQ;
       spf=neutral (google.com: 11.22.33.44 is neither permitted nor denied by best guess record for domain of luca@example.com) smtp.mailfrom=luca@example.com
X-Virus-Scanned: Yes
Message-ID: <58537768-c77f-dd1e-86e5-974bbde830bd@example.com>
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=example.com; s=mail; t=1629964527; bh=pL1ua6FIYyAoJ8aaVxx8tGucm6c4TPztQ6rqOsE2j/w=; h=To:From:Subject; b=C63+umjQRGivlaHV5GV7c7HjHUmwXhgvvXS8C6GDcW487VdgX/9gpaa/Fw73dW3vu
	 QZZJbkIG79fQZbQQjrOeOkZYOE+DEsaFWQoQeHbCVevDLlrL5NbKtEqhiU/wuE68v8
…

Both DKIM and the behaviour of Amavis (X-Virus-Scanned) can be confirmed here

Receiving test

I sent mail from outside to this address ([email protected] ) and checked the message received on this server

X-Virus-Scanned: Yes
X-Spam-Flag: NO
X-Spam-Score: 2.038
X-Spam-Level: **
X-Spam-Status: No, score=2.038 tagged_above=2 required=6.31
	tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1,
	DKIM_VALID_EF=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25,
	FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, PYZOR_CHECK=1.985,
	RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_PASS=-0.001]
	autolearn=no autolearn_force=no
…

I confirmed that both the virus scan by Amavis and the spam check by Spamassasin are being performed

Other notes

The services it includes are as follows, and it looks like LDAP authentication is possible too, so it is a remarkably complete package

Postfix with SMTP or LDAP auth
Dovecot for SASL, IMAP (or POP3), with LDAP Auth, Sieve and quotas
Amavis
SpamAssassin supporting custom rules
ClamAV with automatic updates
OpenDKIM
OpenDMARC
Fail2ban
Fetchmail
Postscreen
Postgrey
LetsEncrypt and self-signed certificates
Setup script to easily configure and maintain your mailserver
Basic Sieve support using dovecot
SASLauthd with LDAP auth
Persistent data and state
CI/CD
Extension Delimiters ([email protected] go to [email protected])

Incidentally, the Sakura VPS I tested on had 2GB of memory, so I was worried whether that would be enough, but when I looked into the memory consumed inside Docker it came to about 1GB.
There was almost no mail load at the time, so once Amavis and Spamassasin start working it may well consume more memory.

See also