fs.aio-max-nr = 655360
kernel.domainname = mail.example.com
net.core.optmem_max = 40960
net.core.rmem_default = 16777216
net.core.rmem_max = 16777216
net.core.wmem_default = 16777216
net.core.wmem_max = 16777216
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.rp_filter=1
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.rp_filter=1
net.ipv4.tcp_keepalive_intvl = 10
net.ipv4.tcp_keepalive_probes = 3
net.ipv4.tcp_keepalive_time = 60
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_syncookies=1
net.ipv4.tcp_wmem = 4096 65536 16777216
vm.swappiness = 0

# if needed, reserve ports in high port range
# e.g. this would reserve all ports below 30000:
#net.ipv4.ip_local_port_range=30000 65535

GRUB_CMDLINE_LINUX="transparent_hugepage=never apparmor=0"

# only changed config parameters listed here, leave rest at default!

banaction = iptables-ipset-proto6
banaction_allports = iptables-ipset-proto6-allports

[sshd]
port    = 22
logpath = %(sshd_log)s
backend = %(sshd_backend)s

[sshd]
enabled = true

version 6

# replace 'eth0' with the name of your public interface 
# eth0
IFACE_ETH0="eth0"               # public network interface
IFACE_ETH0_IP="1.2.3.4"         # IP address
IFACE_ETH0_NET="1.2.3.4/XX"     # IP address with netmask, e.g. 1.2.3.4/28

# eth1
# enable only if your server has a second NIC with a private IP address
IFACE_ETH1="eth1"               # private network interface
IFACE_ETH1_IP="10.1.50.100"     # IP address
IFACE_ETH1_NET="10.1.50.100/24" # IP address with netmask


# public interface eth0
interface4 "${IFACE_ETH0}" eth0_pub dst "${IFACE_ETH0_IP}"
  policy              drop
  protection          strong
#  server ICMP         accept  # only enable if you want to be able to ping the server
  server http         accept
  server https        accept
#  server imap         accept  # unencrypted connections shouldn't be used anymore, enable only for legacy clients
  server imaps        accept
#  server pop3         accept  # unencrypted connections shouldn't be used anymore, enable only for legacy clients
  server pop3s        accept
  server smtp         accept
  server smtps        accept
  server ssh          accept
  server submission   accept
  client all          accept   # allow all outgoing traffic
  # prevent logging of dropped unmatched traffic
  # https://firehol.org/faq/#firehol-logging
  server anystateless nolog  drop

# eth1
# enable only if your server has a second NIC with a private IP address
# we assume that the private network is safe
# if this is not the case, remove "policy accept" and add your own rules!
#interface4 "${IFACE_ETH1}" eth1_lan dst "${IFACE_ETH1_IP}"
#  policy accept

# fail2ban
postprocess -warn /usr/bin/fail2ban-client reload || return 1

# only changed config parameters listed here, leave other values at their default!

WAIT_FOR_IFACE="eth0"
FIREHOL_LOG_MODE="NFLOG"

~# systemctl enable fail2ban.service
~# systemctl enable ulogd2.service
~# systemctl enable firehol.service

~# systemctl start fail2ban.service
~# systemctl start ulogd2.service

~# apt install postfix postfix-ldap postfix-pcre sasl2-bin apache2 mariadb-server-10.1 php-mapi \
               kopano-core kopano-dagent kopano-gateway kopano-ical kopano-monitor kopano-search kopano-server kopano-spooler \
               kopano-webapp-apache2 kopano-webapp-plugin-desktopnotifications kopano-webapp-plugin-spell \
               kopano-webapp-plugin-titlecounter kopano-utils kopano-backup \
               z-push z-push-backend-kopano z-push-common z-push-ipc-memcached

# for LetsEncrypt integration also install:
~# apt install dehydrated dehydrated-apache2 

~# mysql -uroot -p
mysql> create database kopano CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;;
mysql> grant all on kopano.* to 'kopano'@'localhost' identified by 'secret';
mysql> flush privileges;

SLAPD_SERVICES="ldap:/// ldapi:///"

<VirtualHost 1.2.3.4:80>

  ServerName      lam.example.com
  ServerAdmin     webmaster@example.com

  RewriteEngine   On
  RewriteCond     %{HTTPS} off
  RewriteRule     ^(.*)$   https://%{SERVER_NAME}%{REQUEST_URI} [L,R]

</VirtualHost>

<VirtualHost 1.2.3.4:443>
  ServerName              lam.example.com
  ServerAdmin             webmaster@example.com


  SSLEngine               on
  SSLCertificateFile      /etc/ssl/private/lam.example.com/cert.pem
  SSLCertificateKeyFile   /etc/ssl/private/lam.example.com/privkey.pem
  SSLCertificateChainFile /etc/ssl/private/lam.example.com/chain.pem
  SSLCACertificateFile    /etc/ssl/private/lam.example.com/fullchain.pem
  SSLProtocol             all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
  SSLHonorCipherOrder     on
  SSLCompression          off
  SSLSessionTickets       off
  SSLOpenSSLConfCmd       DHParameters "/etc/apache2/dhparams_4096.pem"
  SSLCipherSuite          ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256

  Protocols               h2 h2c http/1.1

  Include                 /etc/apache2/conf-available/ldap-account-manager.conf

  ErrorLog  /var/log/apache2/lam-error.log
  CustomLog /var/log/apache2/lam-access.log combined

</VirtualHost>

[Unit]
Description=Kopano Server
Before=kopano-dagent.service kopano-gateway.service kopano-ical.service kopano-monitor.service kopano-search.service kopano-spamd.service kopano-spooler.service 
After=network.target postfix.service

[Service]
Type=forking
AmbientCapabilities=CAP_NET_BIND_SERVICE
Environment=SERVER_CONFIG="/etc/kopano/server.cfg"
Environment=SERVER_OPTS=""
Environment=KOPANO_USERSCRIPT_LOCALE="C"
ExecStart=/usr/sbin/kopano-server -c ${SERVER_CONFIG} 
ExecStop=/bin/kill -s TERM $MAINPID
PIDFile=/run/kopano/server.pid
TimeoutStopSec=60
Restart=always
User=kopano
Group=kopano
RuntimeDirectory=kopano
RuntimeDirectoryMode=2755

PrivateTmp=yes
PrivateDevices=yes
ProtectHome=yes
ReadOnlyDirectories=/
ReadWriteDirectories=-/var/lib/kopano
ReadWriteDirectories=-/var/log/kopano
ReadWriteDirectories=-/run/kopano
NoNewPrivileges=true
ProtectSystem=full

[Install]
WantedBy=multi-user.target

# replace the last line in the script with this:
exec "/usr/lib/x86_64-linux-gnu/kopano/kscriptrun" /usr/lib/kopano/userscripts/createuser.d /etc/kopano/userscripts/createuser.d

server_listen           = 127.0.0.1:236
server_pipe_name        = /var/run/kopano/server.sock
server_pipe_priority    = /var/run/kopano/prio.sock
server_name             = kopanoserver
server_hostname         = mail.example.com
database_engine         = mysql
local_admin_users       = root kopano
system_email_address    = postmaster@example.com
pid_file                = /run/kopano/server.pid
log_method              = file
log_file                = /var/log/kopano/server.log
log_level               = 6
log_timestamp           = yes
log_buffer_size         = 0
mysql_host              = localhost
mysql_user              = kopano
mysql_password          = secret
mysql_socket            = /run/mysqld/mysqld.sock
mysql_database          = kopano
attachment_storage      = files
attachment_files_fsync  = yes
attachment_path         = /var/lib/kopano/attachments
attachment_compression  = 6
server_listen_tls       =
user_plugin             = ldap
user_plugin_config      = /etc/kopano/ldap.cfg
storename_format        = %f_%c
loginname_format        = %u

# set to 'true'  for  multi  tenancy!
enable_hosted_kopano    = false

# enable all 'features' per default
# possible values: imap pop3 mobile outlook webapp
disabled_features =

!include /usr/share/kopano/ldap.openldap.cfg
#!include /usr/share/kopano/ldap.active-directory.cfg

# LDAP host name/IP address
ldap_host = localhost

# LDAP port
# Optional, default = 389
# Use 636 for ldaps
ldap_port = 389

# LDAP search base
# specify this if you get weird LDAP authentication errors
# https://forum.kopano.io/topic/533/ad-and-kopano-not-working-after-migration-form-zarafa/2
#ldap_search_base = dc=example,dc=com

# The DN of the user to bind as for normal operations (not used for
# authentication if ldap_authentication_method is set to "bind".
# When empty, uses anonymous binding.
# The userPassword attribute must be readable for this user if the
# ldap_authentication_method option is set to password.
ldap_bind_user = cn=kopanoservice,dc=example,dc=com

# LDAP bind password
ldap_bind_passwd = secret

# When an object (user/group/company) is changed, this attribute will also change:
# Active directory: uSNChanged
# LDAP: modifyTimestamp
ldap_last_modification_attribute = modifyTimestamp

##########
# Object settings

# attribute name which is/(should: was) used in ldap_user_search_filter
ldap_user_type_attribute_value = kopano-user
ldap_group_type_attribute_value = kopano-group

##########
# User settings

ldap_user_search_filter = (objectClass=kopano-user)
ldap_user_unique_attribute = entryUUID

##########
# Group settings
ldap_group_search_filter = (objectClass=kopano-group)

##########
# Company settings
ldap_company_search_filter = (objectClass=kopano-company)

##########
# Quota settings
ldap_quota_multiplier = 1048576

DAGENT_ENABLED=yes
DAGENT_CONFIG=/etc/kopano/dagent.cfg
DAGENT_OPTS="-d"

log_timestamp         = yes
log_buffer_size       = 0
lmtp_listen           = 127.0.0.1:2003
spam_header_name      = X-Spam-Status
spam_header_value     = Yes

log_method             = file
log_level              = 4
log_file               = /var/log/kopano/gateway.log
log_timestamp          = yes
log_buffer_size        = 0
#pop3_listen            = *:110
pop3s_listen           = *:995
#imap_listen            = *:143
imaps_listen           = *:993
server_socket          = http://localhost:236/
server_hostname        = example.com
imap_max_messagesize   = 20M
imap_max_fail_commands = 5
ssl_private_key_file   = /etc/ssl/private/mail.example.com/privkey.pem
ssl_certificate_file   = /etc/ssl/private/mail.example.com/fullchain.pem
ssl_protocols          = TLSv1.1 TLSv1.2
ssl_prefer_server_ciphers = yes

log_method           = file
log_level            = 4
log_file             = /var/log/kopano/ical.log
log_timestamp        = yes
log_buffer_size      = 0
server_timezone      = Europe/Berlin
ssl_private_key_file = /etc/ssl/private/mail.example.com/privkey.pem
ssl_certificate_file = /etc/ssl/private/mail.example.com/fullchain.pem
ssl_protocols        = TLSv1.1 TLSv1.2
ssl_prefer_server_ciphers = yes

log_method          = file
log_level           = 4
log_file            = /var/log/kopano/search.log
log_timestamp       = yes
term_cache_size     = 256M
index_processes     = 2
index_drafts        = no
index_junk          = yes
index_attachments   = yes
index_attachment_max_size = 50M

run_as_user         = kopano
run_as_group        = _rspamd
log_method          = file
log_level           = 5
log_file            = /var/log/kopano/spamd.log
log_timestamp       = 1
sa_group            = _rspamd
header_tag          = X-Spam-Status

log_method          = file
log_level           = 4
log_file            = /var/log/kopano/spooler.log
log_timestamp       = yes
log_buffer_size     = 0
enable_dsn          = yes

<VirtualHost 1.2.3.4:80>

  ServerName      webmail.example.com
  ServerAdmin     webmaster@example.com

  RewriteEngine   On
  RewriteCond     %{HTTPS} off
  RewriteRule     ^(.*)$   https://%{SERVER_NAME}%{REQUEST_URI} [L,R]

</VirtualHost>

<VirtualHost 1.2.3.4:443>
  ServerName              webmail.example.com
  ServerAdmin             webmaster@example.com


  SSLEngine               on
  SSLCertificateFile      /etc/ssl/private/webmail.example.com/cert.pem
  SSLCertificateKeyFile   /etc/ssl/private/webmail.example.com/privkey.pem
  SSLCertificateChainFile /etc/ssl/private/webmail.example.com/chain.pem
  SSLCACertificateFile    /etc/ssl/private/webmail.example.com/fullchain.pem
  SSLProtocol             all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
  SSLHonorCipherOrder     on
  SSLCompression          off
  SSLSessionTickets       off
  SSLOpenSSLConfCmd       DHParameters "/etc/apache2/dhparams_4096.pem"
  SSLCipherSuite          ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256

  Protocols               h2 h2c http/1.1

  Include /etc/apache2/sites-available/kopano-webapp.conf 
  Include /etc/apache2/conf-available/z-push.conf
  Include /etc/apache2/conf-available/z-push-autodiscover.conf

  ErrorLog  /var/log/apache2/kopano-error.log
  CustomLog /var/log/apache2/kopano-access.log combined

</VirtualHost>

# comment out this line:
#Alias /webapp /usr/share/kopano-webapp

# add this instead:
DocumentRoot /usr/share/kopano-webapp

requirepass secret      # <-- put a really long random string here!
maxmemory   256M        # set redis memory limit to something sane. depends on your environment and the load that you are expecting

# local.d/antivirus.conf
virustotal {
  # Obtained from Virustotal
  apikey = "<YOUR-VIRUSTOTAL-API-KEY>";
}

backend = "redis";
new_schema = true;
expire = 315360000;     # 10 years
min_learns = 1;
store_tokens = true;
signatures = true;

# enable autolearn here if you want it:
autolearn = false;
autolearn {
  spam_threshold = 6.0; # When to learn spam (score >= threshold)
  ham_threshold = -0.5; # When to learn ham (score <= threshold)
  check_balance = true; # Check spam and ham balance
  min_balance = 0.9;    # Keep diff for spam/ham learns for at least this value
}

enabled = false;

authenticated_headers = ["authentication-results"];
use = ["x-spamd-result","x-spam-level","x-spamd-bar", "my-x-spam-score","x-spam-status", "authentication-results"];

# add X-Spam-Score header (like SA does)
# Source: https://groups.google.com/forum/#!topic/rspamd/fEdbnG0J18I
custom {
   my-x-spam-score = <<EOD
     return function(task, common_meta)
       local sc = common_meta['metric_score'] or task:get_metric_score()
       -- return no error
       return nil,
       -- header(s) to add
       {['X-Spam-Score'] = string.format('%.2f', sc[1])},
       -- header(s) to remove
       {['X-Spam-Score'] = 1},
       -- metadata to store
       {}
   end
EOD;
}

enabled = true;

local_addrs = "127.0.0.0/8, ::1";

openphish_enabled = true;
phishtank_enabled = true;

servers = "127.0.0.1";
password = "<REDIS-PASSWORD>";     # the really long string we defined in as 'requirepass' in redis.conf
#disabled_modules = ["ratelimit"]; # List of modules that should not use redis from this section
timeout = 3s;

enabled = true;
action = "no action";
score = 1.0;
learn_fuzzy = true;
learn_spam = true;
map = file://$LOCAL_CONFDIR/maps.d/spamtrap.map;

enabled = true;

enabled = true;

count = 2;
enable_password = "$2$rI8h.....";  # pw strng generated with 'rspamadm pw'

count = 2;
backend = "redis";
expire = 90d;
allow_update = ["127.0.0.1", "::1"];

spam_header = "X-Spam-Status";

extended_spam_headers = true;

use_domain = "header";

# Enable DKIM signing for alias sender addresses
allow_username_mismatch = true;

domain {
  example.com {
    path = "/var/lib/rspamd/dkim/mailexamplecom.key";
    selector = "mail";
  }
}

[paths]
# path to look for spam emls
spam_dir = /var/lib/kopano/spamd/spam
# path to look for ham emls
ham_dir = /var/lib/kopano/spamd/ham

[spam]
# command to pipe the spam into
spamcmd = /usr/bin/rspamc learn_spam
# command to pipe the ham into
hamcmd = /usr/bin/rspamc learn_ham

[mode]
# should we delete emls after processing
delete = True
# should we scan and process existing spam/ham in the watch directories
scan = True
# after scanning and processing of existing spam/ham exit the script. (crontab mode)
oneshot = False

[logging]
# levels possible are DEBUG INFO WARN ERROR CRITICAL
loglevel = INFO
# empty means log to console, use journalctl to read the logs when run from systemd service
logfile = /var/log/kopano/learnspam.log

[Unit]
Description=Inotify Spamlearn
After=kopano-spamd.service

[Service]
User=kopano
Group=_rspamd
Type=simple
ExecStart= /usr/local/sbin/inotify-spamlearn.py 
ExecReload=/bin/kill -HUP $MAINPID

[Install]
WantedBy=multi-user.target

# We will be rejecting much mail which is listed in multiple DNSBLs.
# We're not proud of some of the lists we are using, thus have given
# them lower scores in postscreen_dnsbl_sites listing. So this checks
# the DNSBL name postscreen(8) gets from dnsblog(8), and if it's not
# one of our Tier 1 DNSBL sites, it changes what the sender will see:

!/^zen\.spamhaus\.org$/         multiple DNS-based blocklists

~# postmap -q <insert-username-here>@example.com ldap:/etc/postfix/ldap-users.cf
~# postmap -q <insert-user-alias-here>@example.com ldap:/etc/postfix/ldap-aliases.cf

[Unit]
RequiredBy=postfix.service
Before=runlevel2.target runlevel3.target runlevel4.target runlevel5.target shutdown.target
After=local-fs.target remote-fs.target
Conflicts=shutdown.target

[Service]
User=root
Group=sasl
Type=forking
Restart=no
TimeoutSec=5min
IgnoreSIGPIPE=no
ExecStart=/usr/sbin/saslauthd -a rimap -O 127.0.0.1 -c -m /var/spool/postfix/var/run/saslauthd -r -n 0

[Install]
WantedBy=multi-user.target

pwcheck_method: saslauthd
mech_list: plain login

# minute (0-59),
# |     hour (0-23),
# |     |       day of the month (1-31),
# |     |       |       month of the year (1-12),
# |     |       |       |       day of the week (0-7 with 0=7=Sunday).
# |     |       |       |       |       user
# |     |       |       |       |       |       command

# sync LDAP to Kopano regularly
*/30    *       *       *       *       root    /usr/sbin/kopano-admin --sync
 
# purge soft-deleted items after 30 days
30      3       *       *       *       root    /usr/sbin/kopano-srvadm --purge-softdelete=30