Web & Mail Servers: Apache, Postfix, SMTP, POP3, IMAP, HTTPS, DNS, Security

Core Concepts

Web Servers: The Foundation of the Internet

Web servers are software applications that process client requests via HTTP/HTTPS and deliver web content (HTML, CSS, JS, images). They handle:

• Static content (pre-built files)
• Dynamic content (generated via scripts like PHP, Python)
• Routing requests to backend services

classDiagram
    class Client {
        +send HTTP request
        +receive HTTP response
    }
    class WebServer {
        +process request
        +serve static/dynamic content
        +handle HTTPS encryption
    }
    class Database {
        +store user data
        +execute queries
    }
    Client --> WebServer : HTTP/HTTPS
    WebServer --> Database : SQL/API

Key Components:

Apache Web Server: Configuration and Security

Configuration Files

Apache uses .conf files (main: /etc/apache2/apache2.conf or /etc/httpd/conf/httpd.conf). Key directives:

<VirtualHost *:80>
    ServerName example.com
    DocumentRoot /var/www/html
    <Directory "/var/www/html">
        Options Indexes FollowSymLinks
        AllowOverride All
        Require all granted
    </Directory>
</Virtual
Host>

Worked Example: Hosting Multiple Sites on One Server Assume a server with IP 203.127.127.127 hosting:

• esewa.com (DocumentRoot: /var/www/esewa)
• ncell.com (DocumentRoot: /var/www/ncell)

<VirtualHost 203.127.127.127:80>
    ServerName esewa.com
    DocumentRoot /var/www/esewa
</VirtualHost>

<VirtualHost 203.127.127.127:80>
    ServerName ncell.com
    DocumentRoot /var/www/ncell
</VirtualHost>

Real-World Tie-In: eSewa’s web server uses Apache/Nginx with:

• Load balancing across multiple servers to handle 1M+ daily transactions.
• HTTPS (TLS 1.3) for secure payments (using Let’s Encrypt certificates).
• Reverse proxy to route requests to backend payment processing systems.

Email Servers: Protocols and Workflow

SMTP, POP3, and IMAP

Email Delivery Workflow:

sequenceDiagram
    participant Alice as Alice (Client)
    participant MX1 as eSewa's MX Server
    participant MX2 as Ncell's MX Server
    participant Bob as Bob (Recipient)

    Alice->>MX1: SMTP (HELO, MAIL FROM, RCPT TO)
    MX1->>MX2: SMTP (MX record lookup via DNS)
    MX2-->>MX1: SMTP (250 OK)
    MX1->>Bob: SMTP (Deliver email)
    Bob->>Alice: SMTP (250 Accepted)

Security: Hardening Web and Mail Servers

Common Threats and Mitigations

Worked Example: Securing eSewa’s Web Server

1. HTTPS Enforcement:

   <VirtualHost *:443>
       SSLEngine on
       SSLCertificateFile /etc/letsencrypt/live/esewa.com/fullchain.pem
       SSLCertificateKeyFile /etc/letsencrypt/live/esewa.com/privkey.pem
       Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
   </VirtualHost>
   

2. Email Security:
   • SPF Record: v=spf1 include:_spf.google.com ~all (for Gmail integration).
   • DKIM: Sign emails with a private key to prove authenticity.

Mail Server Configuration: Postfix and Dovecot

Postfix (MTA) Configuration

Postfix (/etc/postfix/main.cf) handles email routing. Key settings:

myhostname = mail.esewa.com
mydestination = $myhostname, localhost.$mydomain, localhost
relayhost = [smtp.gmail.com]:587
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.esewa.com/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/mail.esewa.com/privkey.pem

Dovecot (IMAP/POP3) Configuration

Dovecot (/etc/dovecot/dovecot.conf) manages email retrieval:

protocols = imap pop3
ssl_cert = </etc/letsencrypt/live/mail.esewa.com/fullchain.pem
ssl_key = </etc/letsencrypt/live/mail.esewa.com/privkey.pem

Real-World Tie-In: Ncell’s Email Service

• Uses Postfix for SMTP relaying to global providers (e.g., Google, Yahoo).
• Dovecot for IMAP access via Ncell’s app.
• DMARC Policy: p=reject to block spoofed emails (e.g., support@ncell.com from unauthorized senders).

Exam Tip

1. Configuration Files: Memorize key directives for Apache (VirtualHost, DocumentRoot) and Postfix (mydestination, relayhost).
2. Protocols: Know the ports (SMTP:25, IMAP:143, HTTPS:443) and their roles. Draw the SMTP handshake sequence diagram.
3. Security: Explain HTTPS (TLS handshake), SPF/DKIM/DMARC, and Apache security modules (e.g., mod_security).
4. Worked Examples: Be ready to configure a virtual host for a Nepalese company (e.g., Daraz) or secure an email server for a bank.
5. Troubleshooting: Common exam questions ask how to fix:
   • "Apache not serving a website" → Check DocumentRoot and permissions.
   • "Emails not reaching Gmail" → Verify SPF/DKIM records and Postfix relayhost.

Visual Summary:

mindmap
  root((Web & Mail Servers))
    Apache
      Configuration
      Virtual Hosts
      Security (mod_security, HTTPS)
    Email Protocols
      SMTP (Port 25)
      IMAP/POP3 (Ports 143/110)
    Postfix/Dovecot
      MTA (Postfix)
      MDA (Dovecot)
    Security
      TLS/SSL
      SPF/DKIM/DMARC
    Real-World
      eSewa (HTTPS + Load Balancing)
      Ncell (Postfix + DMARC)