connor557/mailinabox repository overview

⁠Mail-in-a-Box

By @JoshData⁠ and contributors⁠.

Mail-in-a-Box helps individuals take back control of their email by defining a one-click, easy-to-deploy SMTP+everything else server: a mail server in a box.

Please see https://mailinabox.email⁠ for the project's website and setup guide!

I am trying to:

• Make deploying a good mail server easy.
• Promote decentralization⁠, innovation, and privacy on the web.
• Have automated, auditable, and idempotent⁠ configuration.
• Not make a totally unhackable, NSA-proof server.
• Not make something customizable by power users.

This setup is what has been powering my own personal email since September 2013.

⁠The Box

Mail-in-a-Box turns a fresh Ubuntu 14.04 LTS 64-bit machine into a working mail server by installing and configuring various components.

It is a one-click email appliance (see the setup guide⁠). There are no user-configurable setup options. It "just works".

The components installed are:

• SMTP (postfix⁠), IMAP (dovecot⁠), CardDAV/CalDAV (ownCloud⁠), Exchange ActiveSync (z-push⁠)
• Webmail (Roundcube⁠), static website hosting (nginx⁠)
• Spam filtering (spamassassin⁠), greylisting (postgrey⁠)
• DNS (nsd4⁠) with SPF⁠, DKIM (OpenDKIM⁠), DMARC⁠, DNSSEC⁠, DANE TLSA⁠, and SSHFP⁠ records automatically set
• Firewall (ufw⁠), intrusion protection (fail2ban⁠), system monitoring (munin⁠)

It also includes:

• A control panel and API for adding/removing mail users, aliases, custom DNS records, etc. and detailed system monitoring.
• Our own builds of postgrey and dovecot-lucene distributed via the Mail-in-a-Box PPA⁠ on Launchpad.

For more information on how Mail-in-a-Box handles your privacy, see the security details page⁠.

⁠The Security

See the security guide⁠ for more information about the box's security configuration (TLS, password storage, etc).

I sign the release tags on git. To verify that a tag is signed by me, you can perform the following steps:

# Download my PGP key.
$ curl -s https://keybase.io/joshdata/key.asc | gpg --import
gpg: key C10BDD81: public key "Joshua Tauberer <[email protected]>" imported

# Clone this repository.
$ git clone https://github.com/mail-in-a-box/mailinabox
$ cd mailinabox

# Verify the tag.
$ git verify-tag v0.10
gpg: Signature made ..... using RSA key ID C10BDD81
gpg: Good signature from "Joshua Tauberer <[email protected]>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 5F4C 0E73 13CC D744 693B  2AEA B920 41F4 C10B DD81

The key ID and fingerprint above should match my Keybase.io key⁠ and the fingerprint I publish on my homepage⁠.

⁠The Acknowledgements

This project was inspired in part by the "NSA-proof your email in 2 hours"⁠ blog post by Drew Crawford, Sovereign⁠ by Alex Payne, and conversations with @shevski⁠, @konklone⁠, and @GregElin⁠.

Mail-in-a-Box is similar to iRedMail⁠ and Modoboa⁠.

⁠The History

• In 2007 I wrote a relatively popular Mozilla Thunderbird extension that added client-side SPF and DKIM checks to mail to warn users about possible phishing: add-on page⁠, source⁠.
• In August 2013 I began Mail-in-a-Box by combining my own mail server configuration with the setup in "NSA-proof your email in 2 hours"⁠ and making the setup steps reproducible with bash scripts.
• Mail-in-a-Box was a semifinalist in the 2014 Knight News Challenge⁠, but it was not selected as a winner.
• Mail-in-a-Box hit the front page of Hacker News in April⁠ 2014, September⁠ 2014, and May⁠ 2015.