Hi, I freshly installed mailcow, everything works for now, but I have additional questions: Is there any way to avoid exposing this management panel to the world? Now I have a VPS, obviously there is 1 IP address, but ultimately I want to put it on a physical server with 2 addresses, a local and external static IP - is it possible to limit access to the panel only locally? Can this be cut in FW? Apparently you can disable such access in nginx, but I don’t know how to do it. Where can I view mail accounts and the contents of mailboxes from the terminal (e.g. in Postfix, I know there is also Postfix here)? How can I copy messages to mailcow from another mail server (postfix), it is like a continuation of the previous question, because the old and new one will be the same domain. How to do it?

I found the location of the emails /var/lib/docker/volumes/vmail-vol-1, but the messages are encrypted. How can I read them from the console page, what should I do? If mailcow is in the container, how can you manage mail backup now?

Remote access, nginx, email access

jumper11

Hi,
I freshly installed mailcow, everything works for now, but I have additional questions:

Is there any way to avoid exposing this management panel to the world? Now I have a VPS, obviously there is 1 IP address, but ultimately I want to put it on a physical server with 2 addresses, a local and external static IP - is it possible to limit access to the panel only locally?
Can this be cut in FW?
Apparently you can disable such access in nginx, but I don’t know how to do it.
Where can I view mail accounts and the contents of mailboxes from the terminal (e.g. in Postfix, I know there is also Postfix here)?
How can I copy messages to mailcow from another mail server (postfix), it is like a continuation of the previous question, because the old and new one will be the same domain. How to do it?

ETNyx

Hello,

1) Easiest would be to enforce 2FA auth for all admin, that is usually strong enough in case of security. Otherwise I would add proxy in front of Mailcow and manger necessary routing from there https://docs.mailcow.email/post_installation/reverse-proxy/r_p/

2) I’m not sure if it’s a good idea to hacking into containers or volumes if you do must ask if there is Postfix? where is Postifx? if it’s related to 3) skip this. Otherwise there are containers and volumes, yes there is one for Postfix, but mails are stored in specific volume by default like “vmail” https://docs.mailcow.email/troubleshooting/debug-attach_service/

3) Best way would be to use integrated imapsync from admin.

jumper11

Hi,
Thanks 🙂
Regarding point 3 - Is there anything integrated in mailcow for synchronization? Did I understand you correctly?

Ultimately, I need to transfer the contents of all mailboxes from the currently operating Postfix/Dovecot server to mailcow.
Mailcow must run on the same domain as your current mail server.
In what order should you go about it?
For now, I have my emails configured on a different test domain.

esackbauer

jumper11 Is there anything integrated in mailcow for synchronization?

https://docs.mailcow.email/post_installation/firststeps-sync_jobs_migration/

Create sync jobs for all mailboxes (or have the users do it, as you need to enter the passwords of the old server). Wait until everything is synced, then point the MX record to mailcow.
If everything works, you can delete the sync jobs.

jumper11

But it won’t synchronize all my mailboxes at once, but each one separately?

esackbauer

jumper11
One sync job per mailbox. But you can have multiple sync jobs running at the same time.

If you are already on dovecot you might want to try to copy the maildir structure:
https://community.mailcow.email/d/1485-local-migration-from-dovecot-maildir

ETNyx

I did try to copy mails like this, from mine former setup, sadly did not work form me, but you can test it 👍️ . integrated imapsync was much more reliable

jumper11

I found the location of the emails /var/lib/docker/volumes/vmail-vol-1, but the messages are encrypted.
How can I read them from the console page, what should I do?
If mailcow is in the container, how can you manage mail backup now?

ETNyx

1) https://docs.mailcow.email/manual-guides/Dovecot/u_e-dovecot-mail-crypt/
2) https://docs.mailcow.email/backup_restore/b_n_r-backup/ (and several pages around this topic)

jumper11

Thanks

Is it possible to backup all mail containers from Docker or is it unnecessary?
How to restore it, because this is also an important issue 🙂

ETNyx

Please read the doc, think about it, than read it again and once again. From docs

this show how to backup specific part of stack

# Syntax:
# ./helper-scripts/backup_and_restore.sh backup (vmail|crypt|redis|rspamd|postfix|mysql|all|--delete-days)

this show how to backup all

# Backup all, delete backups older than 3 days
./helper-scripts/backup_and_restore.sh backup all --delete-days 3

What strategy you choose is up to you, safe bet is backup all,…

How to restore it? You do not see Restore page in menu? There

Also read another backup topics like cold-stanby, manual backups, mailcow-internal backups

jumper11

thanks 🙂

jumper11

I have two more questions:

When I log in to the “mailcow” panel, it shows me that the connection is “unsecured” - have I missed something in the configuration?
How can I upload an external SSL certificate that I have purchased to my mailcow?

I don’t have RevDNS configured.

ETNyx

1) Most-likely,.. Out of box Mailcow use Let’s Encrypt (LE) certificate, it could somehow failed, please inspect your logs if there are some clues whats wrong, focus on acme and nginx container.

2) Yes, but LE is free and sufficient solution, so I would advice to fix problem 1), otherwise https://docs.mailcow.email/post_installation/firststeps-ssl/#how-to-use-your-own-certificate

EDIT: before we discuss using proxy before Mailcow, did you implemented it. If so problem is most-likely in your proxy not Mailcow,…

jumper11

In ACME: Certificates were successfully validated, no changes or renewals required, sleeping for another day

Where can I find nginx logs, because I don’t see them in the logs tab

edit:
I guess everything is ok.
I added https before the domain name and the certificate appeared.
Thanks.

ETNyx

Browser docker logs https://docs.mailcow.email/post_installation/firststeps-logging/

[unknown] I added https before the domain name and the certificate appeared.

Hmm this should be automatic, most-likely redirect on web server level, to prevent downgrade attack, are you using proxy? or did you change something related to this?

jumper11

I don’t use a proxy and I haven’t changed anything.

jumper11

fail2ban in mailcow works on what ports? only postfix, dovecot or also on sshd?
Where can I check the logs of this service, how it works and whether it blocks attacks?

ETNyx

Mailcow is using Netfilter (it’s just like fail2ban so sometimes we spoke fail2ban but it is netfilter what we think). So in log you have tab Netfilter, also you can see netfilter container.

Netfilter does not works on port, it reads logs and against defined regexp block IP address. (This is how fail2ban works also)

Mailcow does not include sshd so no it will not block ssh connection to your server. Basically you have something like this

internet -> server -> docker -> docker_network -> mailcow

your ssh is working on server
mailcow netfiter is working on docker_network

You can tweak what and how netfilter ban in UI
https://docs.mailcow.email/manual-guides/mailcow-UI/u_e-mailcow_ui-netfilter/

jumper11

I have another question about transferring e-mails from the old mail server to the new “mailcow”.

The old and new server are the same domain.
How to start configuring emails if the old server is still working, how to transfer emails to the new server if it is the same domain?
The old mail server runs on postfix.

That’s why I kept asking how I could get to the emails to read them, because if Postfix had been installed in the same way, I would have transferred the messages to the mailboxes with normal rsync, but it’s not that easy and I don’t know how to do it.
Please help.