From 2df31069474d37f19d8ed46194bbbce6428d020b Mon Sep 17 00:00:00 2001 From: Sachin-Suresh Date: Wed, 21 Jun 2023 23:12:54 +0900 Subject: [PATCH 1/6] How to Set up an Email Server using Postfix and Dovecot - Tech Edits --- .../how-to-setup-an-email-server/index.md | 1382 +++++++++++++++++ 1 file changed, 1382 insertions(+) create mode 100644 docs/guides/email/how-to-setup-an-email-server/index.md diff --git a/docs/guides/email/how-to-setup-an-email-server/index.md b/docs/guides/email/how-to-setup-an-email-server/index.md new file mode 100644 index 00000000000..c1537064712 --- /dev/null +++ b/docs/guides/email/how-to-setup-an-email-server/index.md @@ -0,0 +1,1382 @@ +--- +slug: how-to-setup-an-email-server +title: "How to Set up an Email Server using Postfix and Dovecot" +description: 'How to set up a mail server using Dovecot and Postfix. Understand what it takes, the benefits and challenges, of running an email server.' +keywords: ['Set up an email server', 'Dovecot and Postfix', 'MTA mail transfer agent', 'MDA Mail delivery Agent', 'IMAP/POP3 server'] +tags: ['mariadb', 'email', 'postfix'] +license: '[CC BY-ND 4.0](https://creativecommons.org/licenses/by-nd/4.0)' +authors: ["David Robert Newman"] +published: 2023-06-12 +modified_by: + name: Linode +external_resources: +- '[Dovecot](https://dovecot.org/)' +- '[PostfixAdmin](https://postfixadmin.github.io/postfixadmin/)' +- '[GitHub page for PostfixAdmin](https://github.com/postfixadmin/postfixadmin/releases)' +- '[Simple Mail Transfer Protocol (SMTP)](https://www.rfc-editor.org/rfc/rfc5321)' +- '[Post Office Protocol (POP)](https://www.rfc-editor.org/rfc/rfc1939)' +--- + +Email may be the one true universal app, but no provider’s offering is truly “free.” Large-scale service providers mine users’ data for sale to advertisers. Others charge usage fees by the message, user, domain, and/or megabyte. To truly get control over your messaging, your best bet is to run your own email server. + +While email server configuration is not trivial, it provides you with much greater privacy and flexibility. You have complete control over which domains and users you host, and how much storage you allot to each. You also gain a deeper knowledge of the key email protocols and how they work together. + +This guide walks you through how to build an email server at Linode using [Postfix](https://www.postfix.org/) and [Dovecot](https://dovecot.org/), two popular open-source email server packages. You also learn how to set up virtual domains, users, and aliases using [PostfixAdmin](https://postfixadmin.github.io/postfixadmin/), a web-based front end for managing Postfix and Dovecot. + +Before delving into the details, first, consider why you wouldn’t want to run your own email server. Setup isn’t difficult, but it is time-consuming; you need to set aside a significant chunk of time (several hours, at minimum) to ensure your server functions properly. You also need to commit to ongoing maintenance of your server, both to keep it regularly patched and to troubleshoot any delivery issues. If you don’t have time for system administration tasks or don’t mind the privacy tradeoffs, consider using a commercial email service instead. + +## Email Systems: A Quick Introduction + +The email server you are going to build uses three and possibly four main protocols: [Simple Mail Transfer Protocol (SMTP)](https://www.rfc-editor.org/rfc/rfc5321), [message submission](https://www.rfc-editor.org/rfc/rfc6409), [Internet Message Access Protocol (IMAP)](https://www.rfc-editor.org/rfc/rfc9051), and possibly the older [Post Office Protocol (POP)](https://www.rfc-editor.org/rfc/rfc1939). + +SMTP works for message delivery, optionally from client to server and always between servers. Clients often use a separate protocol called submission to move messages from mail clients, called mail user agents (MUAs), to mail servers, called mail transfer agents (MTAs). MTAs always communicate over **SMTP**. + +IMAP and POP are *message retrieval* protocols. They operate exclusively between a local mail server and an MUA. + +None of the mail protocols, by themselves, encrypt data in transit. In this guide, you learn how to use Transport Layer Security (TLS) mechanisms to build encrypted tunnels between MUAs and your mail server. Your server is going to be capable of TLS-encrypting traffic with other servers, but only if remote servers also support TLS. The free [Letsencrypt](https://letsencrypt.org/) service provides certificates and private keys on which TLS relies. + +Postfix is one of the most widely used open-source SMTP servers available. It’s included in most Linux/Unix distributions, including Ubuntu, which you are using here. Similarly, Dovecot is among the most common IMAP and POP servers. It too is available as an Ubuntu package. + + +## First, Some Assumptions + +Before you begin, it’s important to understand five key assumptions this guide makes: + +1. As a developer, you should already be familiar with the Linux command line, the vi text editor (or any other editor capable of editing plain text files), and basic networking concepts. Linode has technical guides on SMTP and IMAP/POP to bring you up to speed on the way these protocols work. + +1. Although Postfix and Dovecot servers can operate in the _system_ or _virtual_ mode*, you only use virtual mode here. + +In system mode, only users with local logins can send and receive emails. They do so with lookups against the operating system’s `/etc/passwd` file. Also, all system-mode users reside in a single domain. In contrast, the virtual mode allows an unlimited number of domains, users, and aliases, all unrelated to the underlying operating system. + +1. This guide sets up a mail server called "`mail.linoderocks.com`", but you should substitute your own hostname and domain name for each step that calls for one. Same thing with passwords; anywhere you see a password in a configuration file, be sure to substitute it with your own. This guide reminds you to do so along the way. + +1. Use Ubuntu 22 LTS to create the Linode instance. Ubuntu LTS distributions are a good choice for servers because [they are fully supported with security patches for five years following the release date](https://ubuntu.com/about/release-cycle), or longer with an extended service subscription from Canonical, which develops and maintains Ubuntu. + +1. You should execute all commands here as a non-privileged user using "sudo" to gain access to privileged commands. It’s much safer to use sudo than execute commands as root since the former gives you an audit trail of each privileged command. [Make sure sudo is properly configured to allow root access before beginning this guide](https://www.linode.com/docs/guides/how-to-add-and-remove-sudo-access-in-ubuntu/). + +With those caveats in mind, you can move on to building your email server. + + +### Step 1: Linode Server Creation + +1. [Log in to your Linode account](https://login.linode.com/login) and click **Create** to set up a virtual server. + + This project uses the following specifications, all of which are sane starting points for an email server serving a small to medium enterprise: + + - Ubuntu 22.04 LTS image + - us-west region (For this one, choose the Linode location closest to your users) + - Dedicated CPU plan of 8GB Linode / 8 GB RAM / 4 vCPUs / 160 GB disk / 5 TB transfer + +1. For the Linode label, this project uses `mail.linoderocks.com`. Substitute your hostname here. + + +1. Set a strong root password and add an ssh key. [This allows you to log in without a password using key authentication](https://www.linode.com/docs/guides/use-public-key-authentication-with-ssh/). + +4. [Set the system's timezone using timedatectl](https://www.hostinger.com/tutorials/how-to-change-timezone-in-ubuntu/) so you can read logs in your local timezone. Without this step, the server timestamps all log entries using UTC. + +1. You can skip the virtual LAN (VLAN) setup unless you're adding the server to an existing private-cloud instance at Linode. + +1. Enable backups for your server. This is strongly recommended. + +1. Once you've made all your configuration choices and clicked provision, you may see a warning message as shown below: + + {{< note type="warning" >}} + SMTP ports may be restricted on this Linode. Need to send email? Review our [mail server guide](https://www.linode.com/docs/email/best-practices/running-a-mail-server/), then [open a support ticket](https://cloud.linode.com/support/tickets). + {{< /note >}} + + **<--Screenshot here-->** + +1. Once setup completes, choose SSH or LISH virtual console access. + +1. You should now be at the root command line. In case the Ubuntu setup routine did not ask you to create an ordinary user account, you can do so now. Ubuntu has both `adduser` and `useradd` commands. This guide uses both, but for now, you should know that of the two, `useradd` is a lower-level option and offers the simplest way to add a user to a second group. + + To add an account for "jane" (or whomever) to the sudo group, allowing privileged commands from a non-privileged account, use the following command: + + ```command + useradd -m jane -G sudo + ``` + +1. Reboot the server and log in as user "jane". + +1. Update installed packages and the operating system using the following command: + + ```command + sudo apt update && sudo apt upgrade -y && sudo apt dist-upgrade -y && sudo apt autoremove -y + ``` + +1. Configure the Domain Name System (DNS). Although this may seem unrelated to email, working DNS is the *single most important requirement in this guide*. DNS misconfiguration is a very common source of delivery problems. + +1. Email servers require at least two DNS records: + + - An "A" record to bind a hostname like `mail.linoderocks.com` to an IPv4 address. + - An "MX" (Mail eXchanger) record indicates this server handles email for this domain. + + You probably also want to add an "AAAA" record to bind `mail.linoderocks.com` to an IPv6 address. + +1. Linode offers free DNS service. Follow these steps: + + - Click the **Domains** menu at the left of the main dashboard. + - Create a domain with your domain name (e.g., `linoderocks.com`). + - Add A, MX, and any other records as needed. + - Update your domain registration (at Linode or another registrar) to point to the NS records Linode provides. + + **<--Screenshot here-->** + + Linode does not actually block SMTP ports in the us-west data center, so it’s safe to ignore this warning. If your data center does block inbound traffic on TCP ports `25`, `465`, or `587`, go ahead and open a support ticket asking that inbound and outbound access to these ports be opened for your server. + +1. (Optional, but recommended) You can update your reverse DNS (RDNS) information so that at least one of your server’s IP addresses points back to the hostname `mail.linoderocks.com`. + +1. To edit RDNS, follow these steps: + + - Click on the Linodes tab of the main Linode dashboard. + - Select the **Network** tab. + - In the **IP addresses** section on the right, you can set RDNS for each IP address. Each RDNS setting creates a pointer (PTR) record that associates an IP address with a hostname. + +1. Before proceeding further, it's crucial to verify that the DNS records for your server are working correctly. You can use the "dig" tool to validate each record. Here are example commands to verify the A, AAAA, MX, and PTR records exist for the server: + + + - To validate the A record for `mail.linoderocks.com`: + + ```command + dig +short -t a mail.linoderocks.com + ``` + + - To validate the AAAA record for `mail.linoderocks.com`: + + ```command + dig +short -t aaaa mail.linoderocks.com + ``` + + - To validate the MX record for `linoderocks.com`: + + ```command + dig +short -t mx linoderocks.com + ``` + + - To validate the PTR record for the IPv6 address, `2600:3c01::f03c:93ff:fefd:e763`: + + ```command + dig +short -x 2600:3c01::f03c:93ff:fefd:e763 + ``` + + +### Step 2: Install Postfix + +1. Install the Postfix SMTP server package using the command below: + + ```command + sudo apt install postfix + ``` + + The installer prompts you to pick a server type, the default option is **Internet Site**. Enter a hostname, such as `mail.linoderocks.com`, and optionally choose whether to restart services. + +1. As an aside: When you upgrade Postfix in the future, you may encounter the same setup screen again. Choose **No configuration** this time to retain your current settings. + + **<--Screenshot here-->** + +1. After the installation completes, verify that you have the correct version of Postfix: + + ```command + sudo postconf mail_version + ``` + + The version, 3.6.4, is displayed which is standard on Ubuntu 22 LTS. + + ```output + mail_version = 3.6.4 + ``` + +1. Verify that Postfix is listening for incoming connection attempts: + + ```command + sudo ss -lnpt | grep master + ``` + + The following output is displayed: + + ```output + $ sudo ss -lnpt | grep master + LISTEN 0 100 0.0.0.0:25 0.0.0.0:* users:(("master",pid=79013,fd=13)) + LISTEN 0 100 [::]:25 [::]:* users:(("master",pid=79013,fd=14)) + ``` + + The lines in the output above indicate that the Postfix server is listening for incoming connections on TCP port `25` for both IPv4 and IPv6 on any IP address. + +1. Verify that your server can make outbound SMTP connections: + + ```command + sudo nc gmail-smtp-in.l.google.com 25 + ``` + + You should see the following output: + + ```output + $ sudo nc gmail-smtp-in.l.google.com 25 + 220 mx.google.com ESMTP s4-20020a17090ad48400b0022bb99803d9si6350891pju.164 - gsmtp + ``` + + If you see the above response, you're all set. If not, check internal and/or firewall rules to ensure outbound TCP port `25` is allowed. You can exit this session by pressing Ctrl + C. + +1. Set the hostname in Postfix. Open the main Postfix configuration file: + + ```command + sudo vi /etc/postfix/main.cf + ``` + + Find the `myhostname` parameter and set it to the desired hostname. + + ```command + myhostname = mail.linoderocks.com + ``` + + Save and close the file. Then reload Postfix: + + ```command + sudo systemctl reload postfix + ``` + +1. Update the `/etc/aliases` file to receive messages from the system itself. + + ```command + sudo vi /etc/aliases + ``` + + Edit the file to set `root` to a real address where you can receive mail. + + ```command + root: david@linoderocks.com + ``` + + Save and close the file. Then rebuild the alias database: + + ```command + sudo newaliases + ``` + +1. Verify that the system can send an outgoing message to an external address where you can receive email. + + ```command + echo "test email" | sudo sendmail someuser@gmail.com + ``` + + Verify that you received the message on the remote end. If not, you may need to check `/var/log/mail.log` for troubleshooting. + + +### Step 3: Letsencrypt and Nginx + +As configured so far, Postfix does not encrypt traffic in flight. To avoid having traffic intercepted, enable Transport Layer Security (TLS) to set up encrypted tunnels between mail clients and your server. TLS relies on certificates, which in turn require a working Web server and access to the free [Letsencrypt](https://letsencrypt.org/) service. + +1. Install `certbot`, a tool that automates Letsencrypt certificate creation and maintenance. + + ```command + sudo apt install certbot + ``` + +1. Install the Nginx web server, which is required for Letsencrypt setup and later for PostfixAdmin. This guide uses the [Nginx](https://nginx.org/) web server: + + + ```command + sudo apt install nginx python3-certbot-nginx + ``` + +1. Define a virtual host for Nginx by creating a file `/etc/nginx/conf.d/mail.linoderocks.com.conf`. + + ```command + sudo vi /etc/nginx/conf.d/mail.linoderocks.com.conf + ``` + + Add the following contents to the file, replacing `linoderocks.com` with your domain name: + + {{< file "/etc/nginx/conf.d/mail.linoderocks.com.conf" conf >}} + server { + listen 80; + listen [::]:80; + server_name mail.linoderocks.com; + + root /usr/share/nginx/html/; + + location ~ /.well-known/acme-challenge { + allow all; + } + } + {{< /file >}} + + Ensure that the `/usr/share/nginx/html` directory exists by creating it if necessary. + + ```command + sudo mkdir -p /usr/share/nginx/html + ``` + +1. Restart Nginx to load the new virtual host configuration and verify that it is running. + + ```command + sudo systemctl restart nginx + sudo systemctl status nginx + ``` + +1. Generate a Letsencrypt certificate. Test your setup by including the `--dry-run` parameter in the certificate request, replacing `linoderocks.com` with your domain name. + + ```command + sudo certbot certonly --dry-run -a nginx --agree-tos --no-eff-email --staple-ocsp --email postmaster@linoderocks.com -d mail.linoderocks.com + ``` + + If the response indicates that the dry run was successful, proceed to obtain the certificate for real by running the same command without the `--dry-run` switch. + + ```command + sudo certbot certonly -a nginx --agree-tos --no-eff-email --staple-ocsp --email postmaster@linoderocks.com -d mail.linoderocks.com + ``` + + You should get a response indicating success. Note the locations of the certificate and key files indicated in the success response. + + ```output + Successfully received certificate. + Certificate is saved at: /etc/letsencrypt/live/mail.linoderocks.com/fullchain.pem + Key is saved at: /etc/letsencrypt/live/mail.linoderocks.com/privkey.pem + This certificate expires on 2023-05-09. + These files will be updated when the certificate renews. + Certbot has set up a scheduled task to automatically renew this certificate in the background. + ``` + +1. Configure Postfix to use the newly created certificate and key. Open the Postfix configuration file. + + ```command + sudo vi /etc/postfix/main.cf + ``` + + Find the `smtpd_tls_cert_file` parameter and replace the next two lines as follows, replacing `linoderocks.com` with your domain name. + + ```command + # TLS parameters + smtpd_tls_cert_file=/etc/letsencrypt/live/mail.linoderocks.com/fullchain.pem + smtpd_tls_key_file=/etc/letsencrypt/live/mail.linoderocks.com/privkey.pem + smtpd_tls_loglevel = 1 + smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache + ``` + + If the following lines are not already present, add these lines to `main.cf` to enable TLS transport and enforce TLSv1.2 or TLSv1.3. + + {{< note >}} + TLS prior to version 1.2 and all versions of Secure Sockets Layer (SSL) are insecure, and you should disallow them. + {{< /note >}} + + ```command + # Enable TLS Encryption when Postfix sends outgoing emails + smtp_tls_security_level = may + smtp_tls_loglevel = 1 + smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache + + # Enforce TLSv1.2 or TLSv1.3 + smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 + smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 + smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 + smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 + ``` + +1. Restart Postfix to apply the changes. + + ```command + sudo systemctl restart postfix + ``` + +### Step 4: Submission + +To enable mail clients to submit outgoing mail to your server using the submission protocol instead of SMTP, follow the steps below. This is necessary because many ISPs block SMTP (TCP port `25`) but allow outgoing submission connections (TCP ports `465` and/or `587`). Additionally, separating SMTP and submission functions can help with troubleshooting. + +1. Open the `/etc/postfix/master.cf` file for editing. + + ```command + sudo vi /etc/postfix/master.cf + ``` + +1. Add the following lines to enable the submission protocol. + + ```command + submission inet n - y - - smtpd + -o syslog_name=postfix/submission + -o smtpd_tls_security_level=encrypt + -o smtpd_tls_wrappermode=no + -o smtpd_sasl_auth_enable=yes + -o smtpd_relay_restrictions=permit_sasl_authenticated,reject + -o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject + -o smtpd_sasl_type=dovecot + -o smtpd_sasl_path=private/auth + ``` + + If you or your users run Outlook and need to use the Secure SMTP (smtps) protocol on TCP port `465`, add the following lines as well: + + ```command + smtps inet n - y - - smtpd + -o syslog_name=postfix/smtps + -o smtpd_tls_wrappermode=yes + -o smtpd_sasl_auth_enable=yes + -o smtpd_relay_restrictions=permit_sasl_authenticated,reject + -o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject + -o smtpd_sasl_type=dovecot + -o smtpd_sasl_path=private/auth + ``` + +1. Save and close the file. + +1. Restart Postfix to apply the changes. + + ```command + sudo systemctl restart postfix + ``` + +1. Verify that Postfix is now listening on port `587` (submission) and optionally on port `465` (smtps) on all IPv4 and IPv6 addresses. + + ```command + sudo ss -lnpt | grep master + ``` + + The output should include lines similar to the following: + + ```output + LISTEN 0 100 0.0.0.0:25 0.0.0.0:* users:(("master",pid=83541,fd=13)) + LISTEN 0 100 0.0.0.0:587 0.0.0.0:* users:(("master",pid=83541,fd=18)) + LISTEN 0 100 0.0.0.0:465 0.0.0.0:* users:(("master",pid=83541,fd=22)) + LISTEN 0 100 [::]:25 [::]:* users:(("master",pid=83541,fd=14)) + LISTEN 0 100 [::]:587 [::]:* users:(("master",pid=83541,fd=19)) + LISTEN 0 100 [::]:465 [::]:* users:(("master",pid=83541,fd=23)) + ``` + +### Step 5: Dovecot + +The Postfix server allows your new server to send outgoing messages, and to receive emails from others. However, you need a different server – *Dovecot* – for your clients to retrieve mail from the server. Follow the steps below: + +1. Install Dovecot using the following command: + + ```command + sudo apt install dovecot-core dovecot-imapd + sudo apt install dovecot-core dovecot-imapd dovecot-pop3d + ``` + + The `dovecot-pop3d` package is optional. Unless you have users who specifically require the older POP3 protocol, it's recommended to use IMAP instead. + + +1. You can verify the Dovecot installation by running the following command: + + ```command + dovecot --version + ``` + + For Ubuntu 22 LTS, the Dovecot version is 2.3.16. + +1. Configure IMAP and/or POP protocols by opening the file `/etc/dovecot/dovecot.conf` and adding the following line under `Enable installed protocols`: + + ```command + protocols = imap lmtp pop3 + ``` + + LMTP is explained in the [next section](/docs/guides/how-to-setup-an-email-server/#step-6-local-message-storage-lmtp). You can omit `pop3` if you're only running IMAP. Save and close the file. + + +1. Set the mail folder location and storage type by editing the file `/etc/dovecot/conf.d/10-mail.conf`. + + ```command + sudo vi /etc/dovecot/conf.d/10-mail.conf + ``` + + - Find the line below: + + ```command + mail_location = mbox:~/mail:INBOX=/var/mail/%u + ``` + + - Change mbox to `Maildir`: + + ```command + mail_location = maildir:~/Maildir + ``` + + - Save and close the file. + +1. Add the Dovecot user to the `mail` group to ensure proper permissions. + + ```command + sudo adduser dovecot mail + ``` + + It should display the following output: + + ```output + Adding user `dovecot' to group `mail' ... + Adding user dovecot to group mail + Done. + ``` + +### Step 6: Local Message Storage (LMTP) + +Because Postfix also uses `mbox` and not `Maildir` by default, you need to do some additional configuration to ensure messages land in Dovecot in `Maildir` format. Instead of using Postfix’s built-in local delivery agent (LDA), which by default uses mbox, instead configure LMTP, a local version of SMTP, to deliver messages to Dovecot in `Maildir` format. + +1. Install LMTP by running the following command: + + ```command + sudo apt install dovecot-lmtpd + ``` + +1. Open the Dovecot 10-master.conf file: + + ```command + sudo vi /etc/dovecot/conf.d/10-master.conf + ``` + +1. Search for the following section: + + ```command + service lmtp { + unix_listener lmtp { + #mode = 0666 + } + } + ``` + + Replace it with the following code, ensuring the opening and closing braces match. + + ```command + service lmtp { + unix_listener /var/spool/postfix/private/dovecot-lmtp { + mode = 0600 + user = postfix + group = postfix + } + } + ``` + +1. At the end of the file, add the following section to allow PostfixAdmin to read statistics from Dovecot. + + ```command + service stats { + unix_listener stats-reader { + user = www-data + group = www-data + mode = 0660 + } + unix_listener stats-writer { + user = www-data + group = www-data + mode = 0660 + } + } + ``` + +1. Enable Simple Authentication and Security Layer (SASL) communications between Postfix and Dovecot. In the same file, `/etc/dovecot/conf.d/10-master.conf`, locate the line beginning with `service auth` and comment out the existing `unix_listener` line. Add the following section for Postfix: + + ```command + service auth { + unix_listener /var/spool/postfix/private/auth { + mode = 0660 + user = postfix + group = postfix + } + } + ``` + + **<--Screenshot here-->** + + {{< note type="warning" >}} + Ensure the file maintains matching sets of opening and closing curly braces. The vi editor’s `%` key can help with this by jumping between sets of matched braces. If there is a mismatched set, dovecot does not start or restart. If you get an error when starting or restarting Dovecot, check `/var/log/syslog` to find the offending line in the `10-master.conf` configuration file. + {{< /note >}} + +1. Save and close the file. + +1. Add the Nginx user, `www-data`, to the dovecot group and grant permissions using ACLs. + + ```command + sudo gpasswd -a www-data dovecot + sudo apt install acl + sudo setfacl -R -m u:www-data:rwx /var/run/dovecot/stats-reader /var/run/dovecot/stats-writer + ``` + +1. Restart the Dovecot service using the following command: + + ```command + sudo systemctl restart dovecot + ``` + +1. Open the main Postfix configuration file using the vi editor: + + ```command + sudo vi /etc/postfix/main.cf + ``` + +1. At the end of the file, add the following two lines: + + ```command + mailbox_transport = lmtp:unix:private/dovecot-lmtp + smtputf8_enable = no + ``` + + The first line tells Postfix to use a Unix socket to communicate over LMTP to the Dovecot service you just created. The second line disables [an extension for internationalized mail](https://www.rfc-editor.org/rfc/rfc6531) that Dovecot doesn’t support as of version 2.3.16, the version included with Ubuntu 22 LTS. + + +1. Save and close the file. + +### Step 7: Dovecot Authentication and Encryption + +Just as you configured Postfix to use TLS to encrypt Postfix data in transit, you also need to do the same for Dovecot traffic. Follow the below steps: + +1. Open the `/etc/dovecot/conf.d/10-auth.conf` file: + + ```command + sudo vi /etc/dovecot/conf.d/10-auth.conf + ``` + +1. Disable plaintext authentication when TLS encryption is not used. + + - Uncomment the following line: + + ```command + disable_plaintext_auth = yes + ``` + + - Add the `login` authentication method. Find the line starting with `auth_mechanisms` and add a `login` to the list: + + ```command + auth_mechanisms = plain login + ``` + + - Save and close the file. + +1. Enable the TLS encryption. + + - Open the `/etc/dovecot/conf.d/10-ssl.conf` file. + + ```command + sudo vi /etc/dovecot/conf.d/10-ssl.conf + ``` + + + ```command + ssl = required + ``` + + - Point to the Let's Encrypt certificate and key files generated during Postfix configuration. Replace `mail.linoderocks.com` with your hostname and domain name. Preserve the `<` character before each filename; Dovecot uses it to read each file. + + ```command + ssl_cert = + +1. Answer `Y` to all remaining questions, which disable anonymous access, disable remote access (so logins only work from the same server), drop the test database, and flush database privileges. Your database server is now secured against the most common attacks. + + +### Step 9: PostfixAdmin + +PostfixAdmin is a simple management tool for Postfix/Dovecot that simplifies email administration tasks. After installing PostfixAdmin, you can manage your domains, users, and alias accounts from any web browser. + +While PostfixAdmin makes email server management easy, installation takes multiple steps. None of them are difficult. This guide breaks down the instructions into several subsections explained below. Although the configuration steps may seem like a lot, bear in mind that most of the following steps are required for virtual email support, with or without a graphical management interface. + +#### Step 9a: DNS Configuration + +Even though PostfixAdmin runs on the same host, use a different hostname such as `postfixadmin.linoderocks.com` for email management. If you do this, you also need to add DNS A and/or AAAA records for this new hostname. If you’re using Linode as your DNS provider, you can do this in the **Domains** menu at the left of the Linode dashboard, the same as you did in [Step 1](/docs/guides/how-to-setup-an-email-server/#step-1-linode-server-creation). You can point `postfixadmin.linoderocks.com` to the same IP address(es) you are using for `mail.linoderocks.com`. + +#### Step 9b: Download the Latest PostfixAdmin + +To ensure the best experience with PostfixAdmin and avoid potential issues, it is recommended to install it from the GitHub repository instead of using the Ubuntu package. Here's why: + +- Upgrades and compatibility: The included PostfixAdmin version in Ubuntu packages may not always be up-to-date with the latest features and bug fixes. Additionally, upgrades to the underlying Ubuntu operating system can potentially break the included version. + +- Avoiding login errors: The Ubuntu package version of PostfixAdmin may sometimes result in "Invalid token!" errors when attempting to log in. Installing from the GitHub repository can help mitigate these issues and provide a smoother experience. + +- Consistency with Nginx: Since you have already installed Nginx as your web server, the Ubuntu package version of PostfixAdmin may attempt to install and use Apache, which can lead to conflicts and configuration issues. Installing from the GitHub repository ensures consistency and compatibility with Nginx. + +To ensure the latest version of PostfixAdmin is installed, follow the steps below to download it from the GitHub repository: + +1. Open a terminal or SSH session to your server. + +1. Change to the `/tmp` directory using the following command: + + ```command + cd /tmp + ``` + +1. Install the `wget` package if it's not already installed. Run the following command to install it: + + ```command + sudo apt install wget + ``` + +1. Visit the [GitHub page for PostfixAdmin](https://github.com/postfixadmin/postfixadmin/releases) and note the latest release version. As of writing this guide, the current release is version **3.3.13**. If there is a newer release available, substitute `postfixadmin-3.3.13.tar.gz` in the command below with the appropriate filename for the latest release. + + ```command + wget https://github.com/postfixadmin/postfixadmin/archive/refs/tags/postfixadmin-3.3.13.tar.gz + ``` + +1. Once the download is complete, extract the archive and move it to the `/var/www` directory. Use the following commands: + + ```command + sudo mkdir -p /var/www + sudo tar xvf postfixadmin-3.3.13.tar.gz -C /var/www + sudo mv /var/www/postfixadmin-postfixadmin-3.3.13 /var/www/postfixadmin + ``` + +1. Remove the downloaded archive file to clean up the `/tmp` directory. + + ```command + sudo rm postfixadmin-3.3.13.tar.gz + ``` + +You now have the latest version of PostfixAdmin downloaded and extracted to the `/var/www/postfixadmin` directory. This ensures you have the most up-to-date features and fixes for managing your email server. + +#### Step 9c: Install Required PHP Modules for PostfixAdmin + +PostfixAdmin is a PHP-based application and requires several PHP modules to function properly. You can install all the necessary modules with a single command. Run the following command: + +```command +sudo apt install php8.1-fpm php8.1-imap php8.1-mbstring php8.1-mysql php8.1-curl php8.1-zip php8.1-xml php8.1-bz2 php8.1-intl php8.1-gmp php8.1-redis +``` + +These modules provide essential functionality for PostfixAdmin to work properly. + +#### Step 9d: Database Initialization + +To store email settings, you need to create a MariaDB database for PostfixAdmin and a corresponding user. Follow the steps below: + +1. Log in to MariaDB as the root user. Run the following command: + + ```command + mysql -u root + ``` + +1. Create a PostfixAdmin database and user. You can choose any name for the database and user, but for consistency in this guide, use `postfixadmin` for both. Remember to replace `postfixadmin_password` with a strong password of your choice. Execute the following commands: + + ```command + create database postfixadmin; + create user 'postfixadmin'@'localhost' identified by 'postfixadmin_password'; + ``` + +1. Grant all privileges on the `postfixadmin` database to the user you just created. Execute the following command: + + ```command + grant all privileges on postfixadmin.* to 'postfixadmin'@'localhost'; + ``` + +1. Flush the MariaDB privileges to ensure that your changes take effect. + + ```command + flush privileges; + ``` + +1. Exit the MariaDB prompt. + + ```command + exit; + ``` + +#### Step 9e: Postfix-MariaDB Integration + +In this step, you configure Postfix to send and receive mail on behalf of virtual users and domains, not just those with accounts on the local operating system. This requires installing a package that adds MySQL/MariaDB mapping support to Postfix. + +1. Install the postfix-mysql package: + + ```command + sudo apt install postfix-mysql + ``` + +1. Edit the main Postfix configuration file: + + ```command + sudo vi /etc/postfix/main.cf + ``` + +1. Add the following lines to the end of the file: + + ```command + virtual_mailbox_domains = proxy:mysql:/etc/postfix/sql/mysql_virtual_domains_maps.cf + virtual_mailbox_maps = + proxy:mysql:/etc/postfix/sql/mysql_virtual_mailbox_maps.cf, + proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_domain_mailbox_maps.cf + virtual_alias_maps = + proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_maps.cf, + proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_domain_maps.cf, + proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_domain_catchall_maps.cf + ``` + +1. Allow Dovecot to deliver messages to virtual users by adding the following line to the end of the `Postfix main.cf` file. + + ```command + virtual_transport = lmtp:unix:private/dovecot-lmtp + ``` + + Save and close the `main.cf` file. + +1. Create a directory for the virtual domains, users, and aliases you just pointed to using the following command: + + ```command + mkdir -p /etc/postfix/sql + ``` + +1. Create the following six files in the `/etc/postfix/sql` directory, substituting the password you used in the previous step when setting up the `postfixadmin` database. Use appropriate commands such as vi to create and edit each file. + + - The `mysql_virtual_domains_maps.cf` file contents are as follows: + + ```file {title="/etc/postfix/sql/mysql_virtual_domains_maps.cf"} + user = postfixadmin + password = password + hosts = localhost + dbname = postfixadmin + query = SELECT domain FROM domain WHERE domain='%s' AND active = '1' + ``` + + - The `mysql_virtual_mailbox_maps.cf` file contents are as follows: + + ```file {title="/etc/postfix/sql/mysql_virtual_mailbox_maps.cf"} + user = postfixadmin + password = password + hosts = localhost + dbname = postfixadmin + query = SELECT domain FROM domain WHERE domain='%s' AND active = '1' + #query = SELECT domain FROM domain WHERE domain='%s' + #optional query to use when relaying for backup MX + #query = SELECT domain FROM domain WHERE domain='%s' AND backupmx = '0' AND active = '1' + #expansion_limit = 100 + ``` + + - The `mysql_virtual_alias_domain_mailbox_maps.cf` file contents are as follows: + + ```file {title="/etc/postfix/sql/mysql_virtual_alias_domain_mailbox_maps.cf"} + user = postfixadmin + password = password + hosts = localhost + dbname = postfixadmin + query = SELECT maildir FROM mailbox,alias_domain WHERE alias_domain.alias_domain = '%d' and mailbox.username = CONCAT('%u', '@', alias_domain.target_domain) AND mailbox.active = 1 AND alias_domain.active='1' + ``` + + - The `mysql_virtual_alias_maps.cf` file contents are as follows: + + ```file {title="/etc/postfix/sql/mysql_virtual_alias_maps.cf"} + user = postfixadmin + password = password + hosts = localhost + dbname = postfixadmin + query = SELECT goto FROM alias WHERE address='%s' AND active = '1' + #expansion_limit = 100 + ``` + + - The `mysql_virtual_alias_domain_maps.cf` file contents are as follows: + + ```file {title="/etc/postfix/sql/mysql_virtual_alias_domain_maps.cf"} + user = postfixadmin + password = password + hosts = localhost + dbname = postfixadmin + query = SELECT goto FROM alias,alias_domain WHERE alias_domain.alias_domain = '%d' and alias.address = CONCAT('%u', '@', alias_domain.target_domain) AND alias.active = 1 AND alias_domain.active='1' + ``` + + - The `mysql_virtual_alias_domain_catchall_maps.cf` file contents are as follows: + + ```file {title="/etc/postfix/sql/mysql_virtual_alias_domain_catchall_maps.cf"} + user = postfixadmin + password = password + hosts = localhost + dbname = postfixadmin + query = SELECT goto FROM alias,alias_domain WHERE alias_domain.alias_domain = '%d' and alias.address = CONCAT('@', alias_domain.target_domain) AND alias.active = 1 AND alias_domain.active='1' + ``` + +1. Lock down the ownership and permissions of the files in the `/etc/postfix/sql` directory so that they are only readable by postfix and root. + + ```command + sudo chmod 0640 /etc/postfix/sql/* + sudo setfacl -R -m u:postfix:rx /etc/postfix/sql/ + ``` + + During [Postfix installation in step 2](/docs/guides/how-to-setup-an-email-server/#step-2-install-postfix), the `mydestination` parameter may have been set to include the canonical hostname (e.g., `mail.linoderocks.com`). However, since you've enabled virtual users and domains, the canonical hostname is no longer needed. + + - Open the main Postfix configuration file for editing. + + ```command + sudo vi /etc/postfix/main.cf + ``` + + - Locate the `mydestination` parameter and modify it to remove the canonical hostname entry (e.g., `linoderocks.com`). Keep only the necessary entries, such as `localhost` or any other relevant entries. Save the file and close the editor. + + ```command + mydestination = $myhostname, localhost.linoderocks.com, localhost + ``` + + - At the end of `main.cf`, add the following four lines to configure Postfix for virtual users, domains, and aliases. + + ```command + virtual_mailbox_base = /var/vmail + virtual_minimum_uid = 2000 + virtual_uid_maps = static:2000 + virtual_gid_maps = static:2000 + ``` + + - Save and close the `main.cf` file. + + +1. Create a user named `vmail` with user and group ID `2000`, as defined in the previous step. + + ```command + sudo adduser vmail --system --group --uid 2000 --disabled-login --no-create-home + ``` + +1. Create a base directory for virtual mail and assign ownership to the `vmail` user. + + ```command + sudo mkdir -p /var/vmail + sudo chown -R vmail:vmail /var/vmail + ``` + +1. Restart the Postfix service to apply the changes. + + ```command + sudo systemctl restart postfix + ``` + + +#### Step 9f: Dovecot-MariaDB Integration + +As you just did with Postfix, you need to configure Dovecot to work with the `postfixadmin` database. Start by installing the package that enables Dovecot-SQL integration. + +1. Install the package by running the following command: + + ```command + sudo apt install dovecot-mysql + ``` + +1. Reconfigure Dovecot to handle virtual users instead of users with system accounts. Open the `10-mail.conf` file. + + ```command + sudo vi /etc/dovecot/conf.d/10-mail.conf + ``` + + - Find the `mail_location` line and modify it as follows, adding a new `mail_home` parameter for virtual users. + + ```command + mail_location = maildir:~/Maildir + mail_home = /var/vmail/%d/%n/ + ``` + + - Save and close the file. Now open and edit Dovecot's authentication file. + + ```command + sudo vi /etc/dovecot/conf.d/10-auth.conf + ``` + + - Locate the `auth_username_format` parameter. If it is set to `%n`, change it to `%Lu` to convert usernames to lowercase characters. This is because, by default, postfix uses the entire email address (e.g., `SomeUser@example.com`) as the username. The `L` converts usernames to lowercase characters (e.g., `someuser@example.com`) before sending them to the database. + + ```command + auth_username_format = %Lu + ``` + + - Uncomment the following line to enable SQL queries of the MariaDB database. + + ```command + !include auth-sql.conf.ext + ``` + + - Add the following two lines at the bottom of the file for initial troubleshooting, and then save and close the file. These send login errors to `/var/log/mail.log`. Once you’ve verified that users can log in successfully, it’s OK to delete these lines. + + + ```command + auth_debug = yes + auth_debug_passwords = yes + ``` + + - Save and close the file. + +1. Now, open the `dovecot-sql.conf.ext` file. + + ```command + sudo vi /etc/dovecot/dovecot-sql.conf.ext + ``` + + - All lines in this file are commented out. You may want to keep the existing comments, which are useful as documentation. Add the following lines at the bottom of the file, making sure to replace the `password` in the `connect` line with the `postfixadmin` database password you created earlier. It’s OK to leave the word `password` as is in the `password_query` line. + + ```command + driver = mysql + + connect = host=localhost dbname=postfixadmin user=postfixadmin password=password + + default_pass_scheme = ARGON2I + + password_query = SELECT username AS user, password FROM mailbox WHERE username = '%u' AND active='1' + + user_query = SELECT maildir, 2000 AS uid, 2000 AS gid FROM mailbox WHERE username = '%u' AND active='1' + + iterate_query = SELECT username AS user FROM mailbox + ``` + + - Save and close the file. Then restart Dovecot to apply the changes. + + ```command + sudo systemctl restart dovecot + ``` + +#### Step 9g: Access Control Lists (ACLs) + +PostfixAdmin uses a `templates_c` directory, and the Nginx web server needs access to that directory. As in [step 6](/docs/guides/how-to-setup-an-email-server/#step-6-local-message-storage-lmtp), you can use ACLs to grant access. + + +1. Create the `templates_c` directory and set the appropriate permissions. + + ```command + sudo mkdir -p /var/www/postfixadmin/templates_c + sudo setfacl -R -m u:www-data:rwx /var/www/postfixadmin/templates_c/ + ``` + +1. Ensure that the Nginx web server can read the Letsencrypt certificate and key you previously created. + + ```command + sudo setfacl -R -m u:www-data:rx /etc/letsencrypt/live/ /etc/letsencrypt/archive/ + ``` + +#### Step 9h: PostfixAdmin Configuration + +By default, PostfixAdmin stores configuration data in the `/var/www/postfixadmin/config.inc.php` file. However, to avoid potential conflicts during upgrades, it is recommended to create and edit a separate `config.local.php` file for server-specific settings. + +1. Create and open the `config.local.php` file for editing: + + ```command + sudo vi /var/www/postfixadmin/config.local.php + ``` + +1. Add the following content to the `config.local.php` file, replacing `password` with the actual `postfixadmin` database password you previously created. + + ```file {title="/var/www/postfixadmin/config.local.php"} + + +1. After entering the password, you see a hashed version of it. Copy the entire hashed string, which is used in the PostfixAdmin `config.local.php` file. + + ```command + $CONF['setup_password'] = '$2y$10$vAuLxxX382702NfI/v8DYu7FQFGji/2nAqzEuLIdR3VTj2otP/Lsa'; + ``` + +1. Open the PostfixAdmin config file for editing. + + ```command + sudo vi /var/www/postfixadmin/config.local.php + ``` + +1. Paste the setup password string as the last line of the config file. + + <**Screenshot here**> + + +1. To allow the `www-data` user access to read the Letsencrypt certificate and Dovecot stats, run the following commands: + + ```command + sudo setfacl -R -m u:www-data:rx /etc/letsencrypt/live/ /etc/letsencrypt/archive/ + sudo setfacl -R -m u:www-data:rwx /var/run/dovecot/stats-reader /var/run/dovecot/stats-writer + ``` + + If you encounter an ARGON2I error later on during the PostfixAdmin account setup, rerun these two commands. + +1. Reload the setup page in your browser, and if requested, log in using the setup password you entered earlier. You may encounter some database warnings, but you can ignore them as they pertain to database types not used in this setup. + +1. Enter a super-admin password, along with a valid email address, and the new super-admin password. + + <**Screenshot here**> + +1. After entering the password, click the link at the bottom of the page to access the main login page. Alternatively, you can use the following login URL: + + ```command + https://postfixadmin.linoderocks.com/login.php + ``` + +#### Step 9l: Virtual Mail Setup in PostfixAdmin + +1. Open a web browser and navigate to `https://postfixadmin.linoderocks.com/login.php` (replace `linoderocks.com` with your domain name). Log in using the credentials you previously set up. + +1. In the top menu, click on **Domain List** and select **New Domain**. Enter the name of the domain you want to create. It is recommended to include your server's native domain since we are assuming all accounts on this system are virtual. For example, use `linoderocks.com` (replace with your server's domain). + + <**Screenshot here**> + +1. You can specify the maximum number of aliases and users per domain. The default is `10` for each, but you can set these values as desired. Use `0` to indicate an unlimited number. Regarding other settings on this page: + + - Since you are setting up a primary server, leave the option for this to be a backup mail exchanger (MX) unchecked. + - Choose whether to enable or disable the virtual domain. It is recommended to enable the domain unless there are specific reasons to disable it, such as scheduling it to operate within certain dates. + - Keep the **Default mail aliases** box checked to set up standard management aliases. These aliases are commonly used for administrative and troubleshooting purposes: + + - `abuse@linoderocks.com` + - `hostmaster@linoderocks.com` + - `postmaster@linoderocks.com` + - `webmaster@linoderocks.com` + + - The **Pass Expire** field sets a maximum age for users' passwords in that domain. The default setting of 365 days is recommended, but you can adjust it according to your preferences. + +1. Now, you can create your first user account. Click on the **Virtual Lists** menu at the top of the page and select **New Mailbox**. + + <**Screenshot here**> + +1. Enter a username and select the domain from the dropdown menu. Since you have only created one virtual domain so far, there is only one option in the menu. + +1. Choose a strong password and enter it twice, along with the user's full name. + +1. (Optional) Set a quota (maximum storage limit in megabytes) for the user. Leave the **active** and **welcome email** boxes checked unless you have a specific reason to disable them. It is a good practice to enter an alternative email address (preferably from a separate domain on a separate server) for password recovery purposes. + + +#### Step 9m: Client Setup and Server Validation + +1. To validate your email server, add a new account to an email client such as [Mozilla Thunderbird](https://www.thunderbird.net/en-US/), [GNOME Evolution](https://help.gnome.org/users/evolution/stable/), or [Microsoft Outlook](https://www.microsoft.com/en-us/microsoft-365/outlook/email-and-calendar-software-microsoft-outlook). While the specific configuration of each client is beyond the scope of this guide, there are a few common settings to check: + + - For sending and receiving emails, use the entire email address as the username (e.g., `someuser@example.com` instead of just `someuser`). + - For receiving email, specify IMAP on TCP port `993` using TLS/SSL. + - For sending email, specify either submission on TCP port `587` using STARTTLS or, for Microsoft Outlook clients, TCP port `465` using TLS/SSL. + +1. After configuring an account in your mail client, test your setup by sending and receiving emails to and from another address on a different server. You should be able to both receive and send emails using your new account. You now have a working email service. + +1. If you encounter any errors during the setup, don't worry. Instead of starting over, check the following log files for specific error messages: `/var/log/mail.log` and `/var/log/syslog`. These log entries should provide clues about the source of the problem. You can also search the web using the specific error message along with "dovecot postfix" to find relevant information and solutions. + +1. There are a few housekeeping tasks to complete: + + - In PostfixAdmin, edit the four standard aliases created when you configured a domain. By default, these aliases point to dummy addresses such as `abuse@change-this-to-your.domain.tld`. Now that you have a working email address, you should edit these (under Virtual List/Virtual List) to point to your actual email address. + + - In the `/etc/dovecot/conf.d/10-auth.conf` file, you added two lines for verbose debugging. Both lines begin with the string “auth_debug”. To avoid log bloat, you can comment out or delete both lines and then restart Dovecot. + + - Consider configuring valid Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) records in your DNS to combat spam. Optionally, you can also set up a Domain Message Authentication, Reporting & Conformance (DMARC) record to specify how your server handles failed SPF and/or DKIM validations, as well as request reports from other servers. Linode provides a [separate email server guide](https://www.linode.com/docs/guides/configure-spf-and-dkim-in-postfix-on-debian-8/) for SPF, DKIM, and DMARC configuration. + + - Stay vigilant about [security vulnerabilities](https://ubuntu.com/security/notices) by keeping your operating system and server software up to date. Regularly applying patches and updates is crucial for maintaining a secure server. + + - Make regular backups of your server. Consider using [Linode's Backups service](https://www.linode.com/docs/products/storage/backups/), which can automate your backups with a single click. + +## Conclusion + +You now know how to set up an email server. You know how to put key email protocols to work, and how to integrate them with DNS, databases, and graphical management tools. Properly configured, your new email server can run for years, making it a good pairing with Ubuntu’s LTS run on a Linode. Email represents one of the most useful services you can provide, and Linode’s cloud platform offers an ideal platform on which to provision your next server. \ No newline at end of file From 646ab812a43a216f0d0e52868af3553850822153 Mon Sep 17 00:00:00 2001 From: Sachin-Suresh Date: Thu, 22 Jun 2023 22:56:53 +0900 Subject: [PATCH 2/6] Fix for link error --- docs/guides/email/how-to-setup-an-email-server/index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/guides/email/how-to-setup-an-email-server/index.md b/docs/guides/email/how-to-setup-an-email-server/index.md index c1537064712..3ff5dac3695 100644 --- a/docs/guides/email/how-to-setup-an-email-server/index.md +++ b/docs/guides/email/how-to-setup-an-email-server/index.md @@ -52,7 +52,7 @@ In system mode, only users with local logins can send and receive emails. They d 1. Use Ubuntu 22 LTS to create the Linode instance. Ubuntu LTS distributions are a good choice for servers because [they are fully supported with security patches for five years following the release date](https://ubuntu.com/about/release-cycle), or longer with an extended service subscription from Canonical, which develops and maintains Ubuntu. -1. You should execute all commands here as a non-privileged user using "sudo" to gain access to privileged commands. It’s much safer to use sudo than execute commands as root since the former gives you an audit trail of each privileged command. [Make sure sudo is properly configured to allow root access before beginning this guide](https://www.linode.com/docs/guides/how-to-add-and-remove-sudo-access-in-ubuntu/). +1. You should execute all commands here as a non-privileged user using "sudo" to gain access to privileged commands. It’s much safer to use sudo than execute commands as root since the former gives you an audit trail of each privileged command. [Make sure sudo is properly configured to allow root access before beginning this guide](/docs/guides/how-to-add-and-remove-sudo-access-in-ubuntu/). With those caveats in mind, you can move on to building your email server. @@ -70,7 +70,7 @@ With those caveats in mind, you can move on to building your email server. 1. For the Linode label, this project uses `mail.linoderocks.com`. Substitute your hostname here. -1. Set a strong root password and add an ssh key. [This allows you to log in without a password using key authentication](https://www.linode.com/docs/guides/use-public-key-authentication-with-ssh/). +1. Set a strong root password and add an ssh key. [This allows you to log in without a password using key authentication](/docs/guides/use-public-key-authentication-with-ssh/). 4. [Set the system's timezone using timedatectl](https://www.hostinger.com/tutorials/how-to-change-timezone-in-ubuntu/) so you can read logs in your local timezone. Without this step, the server timestamps all log entries using UTC. From 4d2700c3ed0b9c8fa8bd17e212311db4adb22e44 Mon Sep 17 00:00:00 2001 From: Adam Overa Date: Fri, 14 Jun 2024 16:58:02 -0400 Subject: [PATCH 3/6] Tech Edit 1 --- ci/vale/dictionary.txt | 1 + .../how-to-setup-an-email-server/index.md | 1382 -------------- .../PostFixAdmin-Add-Mailbox.png | Bin 0 -> 52154 bytes .../PostFixAdmin-New-Domain.png | Bin 0 -> 38744 bytes .../PostFixAdmin-Setup-Page.png | Bin 0 -> 103620 bytes .../PostFixAdmin-SuperAdmin-Creation-Page.png | Bin 0 -> 20140 bytes .../how-to-setup-an-email-server/index.md | 1603 +++++++++++++++++ 7 files changed, 1604 insertions(+), 1382 deletions(-) delete mode 100644 docs/guides/email/how-to-setup-an-email-server/index.md create mode 100644 docs/guides/email/postfix/how-to-setup-an-email-server/PostFixAdmin-Add-Mailbox.png create mode 100644 docs/guides/email/postfix/how-to-setup-an-email-server/PostFixAdmin-New-Domain.png create mode 100644 docs/guides/email/postfix/how-to-setup-an-email-server/PostFixAdmin-Setup-Page.png create mode 100644 docs/guides/email/postfix/how-to-setup-an-email-server/PostFixAdmin-SuperAdmin-Creation-Page.png create mode 100644 docs/guides/email/postfix/how-to-setup-an-email-server/index.md diff --git a/ci/vale/dictionary.txt b/ci/vale/dictionary.txt index 707262f1218..c6d099b67d2 100644 --- a/ci/vale/dictionary.txt +++ b/ci/vale/dictionary.txt @@ -1292,6 +1292,7 @@ len lennart Lerna letsencrypt +Letsencrypt lf li181 li263 diff --git a/docs/guides/email/how-to-setup-an-email-server/index.md b/docs/guides/email/how-to-setup-an-email-server/index.md deleted file mode 100644 index 3ff5dac3695..00000000000 --- a/docs/guides/email/how-to-setup-an-email-server/index.md +++ /dev/null @@ -1,1382 +0,0 @@ ---- -slug: how-to-setup-an-email-server -title: "How to Set up an Email Server using Postfix and Dovecot" -description: 'How to set up a mail server using Dovecot and Postfix. Understand what it takes, the benefits and challenges, of running an email server.' -keywords: ['Set up an email server', 'Dovecot and Postfix', 'MTA mail transfer agent', 'MDA Mail delivery Agent', 'IMAP/POP3 server'] -tags: ['mariadb', 'email', 'postfix'] -license: '[CC BY-ND 4.0](https://creativecommons.org/licenses/by-nd/4.0)' -authors: ["David Robert Newman"] -published: 2023-06-12 -modified_by: - name: Linode -external_resources: -- '[Dovecot](https://dovecot.org/)' -- '[PostfixAdmin](https://postfixadmin.github.io/postfixadmin/)' -- '[GitHub page for PostfixAdmin](https://github.com/postfixadmin/postfixadmin/releases)' -- '[Simple Mail Transfer Protocol (SMTP)](https://www.rfc-editor.org/rfc/rfc5321)' -- '[Post Office Protocol (POP)](https://www.rfc-editor.org/rfc/rfc1939)' ---- - -Email may be the one true universal app, but no provider’s offering is truly “free.” Large-scale service providers mine users’ data for sale to advertisers. Others charge usage fees by the message, user, domain, and/or megabyte. To truly get control over your messaging, your best bet is to run your own email server. - -While email server configuration is not trivial, it provides you with much greater privacy and flexibility. You have complete control over which domains and users you host, and how much storage you allot to each. You also gain a deeper knowledge of the key email protocols and how they work together. - -This guide walks you through how to build an email server at Linode using [Postfix](https://www.postfix.org/) and [Dovecot](https://dovecot.org/), two popular open-source email server packages. You also learn how to set up virtual domains, users, and aliases using [PostfixAdmin](https://postfixadmin.github.io/postfixadmin/), a web-based front end for managing Postfix and Dovecot. - -Before delving into the details, first, consider why you wouldn’t want to run your own email server. Setup isn’t difficult, but it is time-consuming; you need to set aside a significant chunk of time (several hours, at minimum) to ensure your server functions properly. You also need to commit to ongoing maintenance of your server, both to keep it regularly patched and to troubleshoot any delivery issues. If you don’t have time for system administration tasks or don’t mind the privacy tradeoffs, consider using a commercial email service instead. - -## Email Systems: A Quick Introduction - -The email server you are going to build uses three and possibly four main protocols: [Simple Mail Transfer Protocol (SMTP)](https://www.rfc-editor.org/rfc/rfc5321), [message submission](https://www.rfc-editor.org/rfc/rfc6409), [Internet Message Access Protocol (IMAP)](https://www.rfc-editor.org/rfc/rfc9051), and possibly the older [Post Office Protocol (POP)](https://www.rfc-editor.org/rfc/rfc1939). - -SMTP works for message delivery, optionally from client to server and always between servers. Clients often use a separate protocol called submission to move messages from mail clients, called mail user agents (MUAs), to mail servers, called mail transfer agents (MTAs). MTAs always communicate over **SMTP**. - -IMAP and POP are *message retrieval* protocols. They operate exclusively between a local mail server and an MUA. - -None of the mail protocols, by themselves, encrypt data in transit. In this guide, you learn how to use Transport Layer Security (TLS) mechanisms to build encrypted tunnels between MUAs and your mail server. Your server is going to be capable of TLS-encrypting traffic with other servers, but only if remote servers also support TLS. The free [Letsencrypt](https://letsencrypt.org/) service provides certificates and private keys on which TLS relies. - -Postfix is one of the most widely used open-source SMTP servers available. It’s included in most Linux/Unix distributions, including Ubuntu, which you are using here. Similarly, Dovecot is among the most common IMAP and POP servers. It too is available as an Ubuntu package. - - -## First, Some Assumptions - -Before you begin, it’s important to understand five key assumptions this guide makes: - -1. As a developer, you should already be familiar with the Linux command line, the vi text editor (or any other editor capable of editing plain text files), and basic networking concepts. Linode has technical guides on SMTP and IMAP/POP to bring you up to speed on the way these protocols work. - -1. Although Postfix and Dovecot servers can operate in the _system_ or _virtual_ mode*, you only use virtual mode here. - -In system mode, only users with local logins can send and receive emails. They do so with lookups against the operating system’s `/etc/passwd` file. Also, all system-mode users reside in a single domain. In contrast, the virtual mode allows an unlimited number of domains, users, and aliases, all unrelated to the underlying operating system. - -1. This guide sets up a mail server called "`mail.linoderocks.com`", but you should substitute your own hostname and domain name for each step that calls for one. Same thing with passwords; anywhere you see a password in a configuration file, be sure to substitute it with your own. This guide reminds you to do so along the way. - -1. Use Ubuntu 22 LTS to create the Linode instance. Ubuntu LTS distributions are a good choice for servers because [they are fully supported with security patches for five years following the release date](https://ubuntu.com/about/release-cycle), or longer with an extended service subscription from Canonical, which develops and maintains Ubuntu. - -1. You should execute all commands here as a non-privileged user using "sudo" to gain access to privileged commands. It’s much safer to use sudo than execute commands as root since the former gives you an audit trail of each privileged command. [Make sure sudo is properly configured to allow root access before beginning this guide](/docs/guides/how-to-add-and-remove-sudo-access-in-ubuntu/). - -With those caveats in mind, you can move on to building your email server. - - -### Step 1: Linode Server Creation - -1. [Log in to your Linode account](https://login.linode.com/login) and click **Create** to set up a virtual server. - - This project uses the following specifications, all of which are sane starting points for an email server serving a small to medium enterprise: - - - Ubuntu 22.04 LTS image - - us-west region (For this one, choose the Linode location closest to your users) - - Dedicated CPU plan of 8GB Linode / 8 GB RAM / 4 vCPUs / 160 GB disk / 5 TB transfer - -1. For the Linode label, this project uses `mail.linoderocks.com`. Substitute your hostname here. - - -1. Set a strong root password and add an ssh key. [This allows you to log in without a password using key authentication](/docs/guides/use-public-key-authentication-with-ssh/). - -4. [Set the system's timezone using timedatectl](https://www.hostinger.com/tutorials/how-to-change-timezone-in-ubuntu/) so you can read logs in your local timezone. Without this step, the server timestamps all log entries using UTC. - -1. You can skip the virtual LAN (VLAN) setup unless you're adding the server to an existing private-cloud instance at Linode. - -1. Enable backups for your server. This is strongly recommended. - -1. Once you've made all your configuration choices and clicked provision, you may see a warning message as shown below: - - {{< note type="warning" >}} - SMTP ports may be restricted on this Linode. Need to send email? Review our [mail server guide](https://www.linode.com/docs/email/best-practices/running-a-mail-server/), then [open a support ticket](https://cloud.linode.com/support/tickets). - {{< /note >}} - - **<--Screenshot here-->** - -1. Once setup completes, choose SSH or LISH virtual console access. - -1. You should now be at the root command line. In case the Ubuntu setup routine did not ask you to create an ordinary user account, you can do so now. Ubuntu has both `adduser` and `useradd` commands. This guide uses both, but for now, you should know that of the two, `useradd` is a lower-level option and offers the simplest way to add a user to a second group. - - To add an account for "jane" (or whomever) to the sudo group, allowing privileged commands from a non-privileged account, use the following command: - - ```command - useradd -m jane -G sudo - ``` - -1. Reboot the server and log in as user "jane". - -1. Update installed packages and the operating system using the following command: - - ```command - sudo apt update && sudo apt upgrade -y && sudo apt dist-upgrade -y && sudo apt autoremove -y - ``` - -1. Configure the Domain Name System (DNS). Although this may seem unrelated to email, working DNS is the *single most important requirement in this guide*. DNS misconfiguration is a very common source of delivery problems. - -1. Email servers require at least two DNS records: - - - An "A" record to bind a hostname like `mail.linoderocks.com` to an IPv4 address. - - An "MX" (Mail eXchanger) record indicates this server handles email for this domain. - - You probably also want to add an "AAAA" record to bind `mail.linoderocks.com` to an IPv6 address. - -1. Linode offers free DNS service. Follow these steps: - - - Click the **Domains** menu at the left of the main dashboard. - - Create a domain with your domain name (e.g., `linoderocks.com`). - - Add A, MX, and any other records as needed. - - Update your domain registration (at Linode or another registrar) to point to the NS records Linode provides. - - **<--Screenshot here-->** - - Linode does not actually block SMTP ports in the us-west data center, so it’s safe to ignore this warning. If your data center does block inbound traffic on TCP ports `25`, `465`, or `587`, go ahead and open a support ticket asking that inbound and outbound access to these ports be opened for your server. - -1. (Optional, but recommended) You can update your reverse DNS (RDNS) information so that at least one of your server’s IP addresses points back to the hostname `mail.linoderocks.com`. - -1. To edit RDNS, follow these steps: - - - Click on the Linodes tab of the main Linode dashboard. - - Select the **Network** tab. - - In the **IP addresses** section on the right, you can set RDNS for each IP address. Each RDNS setting creates a pointer (PTR) record that associates an IP address with a hostname. - -1. Before proceeding further, it's crucial to verify that the DNS records for your server are working correctly. You can use the "dig" tool to validate each record. Here are example commands to verify the A, AAAA, MX, and PTR records exist for the server: - - - - To validate the A record for `mail.linoderocks.com`: - - ```command - dig +short -t a mail.linoderocks.com - ``` - - - To validate the AAAA record for `mail.linoderocks.com`: - - ```command - dig +short -t aaaa mail.linoderocks.com - ``` - - - To validate the MX record for `linoderocks.com`: - - ```command - dig +short -t mx linoderocks.com - ``` - - - To validate the PTR record for the IPv6 address, `2600:3c01::f03c:93ff:fefd:e763`: - - ```command - dig +short -x 2600:3c01::f03c:93ff:fefd:e763 - ``` - - -### Step 2: Install Postfix - -1. Install the Postfix SMTP server package using the command below: - - ```command - sudo apt install postfix - ``` - - The installer prompts you to pick a server type, the default option is **Internet Site**. Enter a hostname, such as `mail.linoderocks.com`, and optionally choose whether to restart services. - -1. As an aside: When you upgrade Postfix in the future, you may encounter the same setup screen again. Choose **No configuration** this time to retain your current settings. - - **<--Screenshot here-->** - -1. After the installation completes, verify that you have the correct version of Postfix: - - ```command - sudo postconf mail_version - ``` - - The version, 3.6.4, is displayed which is standard on Ubuntu 22 LTS. - - ```output - mail_version = 3.6.4 - ``` - -1. Verify that Postfix is listening for incoming connection attempts: - - ```command - sudo ss -lnpt | grep master - ``` - - The following output is displayed: - - ```output - $ sudo ss -lnpt | grep master - LISTEN 0 100 0.0.0.0:25 0.0.0.0:* users:(("master",pid=79013,fd=13)) - LISTEN 0 100 [::]:25 [::]:* users:(("master",pid=79013,fd=14)) - ``` - - The lines in the output above indicate that the Postfix server is listening for incoming connections on TCP port `25` for both IPv4 and IPv6 on any IP address. - -1. Verify that your server can make outbound SMTP connections: - - ```command - sudo nc gmail-smtp-in.l.google.com 25 - ``` - - You should see the following output: - - ```output - $ sudo nc gmail-smtp-in.l.google.com 25 - 220 mx.google.com ESMTP s4-20020a17090ad48400b0022bb99803d9si6350891pju.164 - gsmtp - ``` - - If you see the above response, you're all set. If not, check internal and/or firewall rules to ensure outbound TCP port `25` is allowed. You can exit this session by pressing Ctrl + C. - -1. Set the hostname in Postfix. Open the main Postfix configuration file: - - ```command - sudo vi /etc/postfix/main.cf - ``` - - Find the `myhostname` parameter and set it to the desired hostname. - - ```command - myhostname = mail.linoderocks.com - ``` - - Save and close the file. Then reload Postfix: - - ```command - sudo systemctl reload postfix - ``` - -1. Update the `/etc/aliases` file to receive messages from the system itself. - - ```command - sudo vi /etc/aliases - ``` - - Edit the file to set `root` to a real address where you can receive mail. - - ```command - root: david@linoderocks.com - ``` - - Save and close the file. Then rebuild the alias database: - - ```command - sudo newaliases - ``` - -1. Verify that the system can send an outgoing message to an external address where you can receive email. - - ```command - echo "test email" | sudo sendmail someuser@gmail.com - ``` - - Verify that you received the message on the remote end. If not, you may need to check `/var/log/mail.log` for troubleshooting. - - -### Step 3: Letsencrypt and Nginx - -As configured so far, Postfix does not encrypt traffic in flight. To avoid having traffic intercepted, enable Transport Layer Security (TLS) to set up encrypted tunnels between mail clients and your server. TLS relies on certificates, which in turn require a working Web server and access to the free [Letsencrypt](https://letsencrypt.org/) service. - -1. Install `certbot`, a tool that automates Letsencrypt certificate creation and maintenance. - - ```command - sudo apt install certbot - ``` - -1. Install the Nginx web server, which is required for Letsencrypt setup and later for PostfixAdmin. This guide uses the [Nginx](https://nginx.org/) web server: - - - ```command - sudo apt install nginx python3-certbot-nginx - ``` - -1. Define a virtual host for Nginx by creating a file `/etc/nginx/conf.d/mail.linoderocks.com.conf`. - - ```command - sudo vi /etc/nginx/conf.d/mail.linoderocks.com.conf - ``` - - Add the following contents to the file, replacing `linoderocks.com` with your domain name: - - {{< file "/etc/nginx/conf.d/mail.linoderocks.com.conf" conf >}} - server { - listen 80; - listen [::]:80; - server_name mail.linoderocks.com; - - root /usr/share/nginx/html/; - - location ~ /.well-known/acme-challenge { - allow all; - } - } - {{< /file >}} - - Ensure that the `/usr/share/nginx/html` directory exists by creating it if necessary. - - ```command - sudo mkdir -p /usr/share/nginx/html - ``` - -1. Restart Nginx to load the new virtual host configuration and verify that it is running. - - ```command - sudo systemctl restart nginx - sudo systemctl status nginx - ``` - -1. Generate a Letsencrypt certificate. Test your setup by including the `--dry-run` parameter in the certificate request, replacing `linoderocks.com` with your domain name. - - ```command - sudo certbot certonly --dry-run -a nginx --agree-tos --no-eff-email --staple-ocsp --email postmaster@linoderocks.com -d mail.linoderocks.com - ``` - - If the response indicates that the dry run was successful, proceed to obtain the certificate for real by running the same command without the `--dry-run` switch. - - ```command - sudo certbot certonly -a nginx --agree-tos --no-eff-email --staple-ocsp --email postmaster@linoderocks.com -d mail.linoderocks.com - ``` - - You should get a response indicating success. Note the locations of the certificate and key files indicated in the success response. - - ```output - Successfully received certificate. - Certificate is saved at: /etc/letsencrypt/live/mail.linoderocks.com/fullchain.pem - Key is saved at: /etc/letsencrypt/live/mail.linoderocks.com/privkey.pem - This certificate expires on 2023-05-09. - These files will be updated when the certificate renews. - Certbot has set up a scheduled task to automatically renew this certificate in the background. - ``` - -1. Configure Postfix to use the newly created certificate and key. Open the Postfix configuration file. - - ```command - sudo vi /etc/postfix/main.cf - ``` - - Find the `smtpd_tls_cert_file` parameter and replace the next two lines as follows, replacing `linoderocks.com` with your domain name. - - ```command - # TLS parameters - smtpd_tls_cert_file=/etc/letsencrypt/live/mail.linoderocks.com/fullchain.pem - smtpd_tls_key_file=/etc/letsencrypt/live/mail.linoderocks.com/privkey.pem - smtpd_tls_loglevel = 1 - smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache - ``` - - If the following lines are not already present, add these lines to `main.cf` to enable TLS transport and enforce TLSv1.2 or TLSv1.3. - - {{< note >}} - TLS prior to version 1.2 and all versions of Secure Sockets Layer (SSL) are insecure, and you should disallow them. - {{< /note >}} - - ```command - # Enable TLS Encryption when Postfix sends outgoing emails - smtp_tls_security_level = may - smtp_tls_loglevel = 1 - smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache - - # Enforce TLSv1.2 or TLSv1.3 - smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 - smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 - smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 - smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 - ``` - -1. Restart Postfix to apply the changes. - - ```command - sudo systemctl restart postfix - ``` - -### Step 4: Submission - -To enable mail clients to submit outgoing mail to your server using the submission protocol instead of SMTP, follow the steps below. This is necessary because many ISPs block SMTP (TCP port `25`) but allow outgoing submission connections (TCP ports `465` and/or `587`). Additionally, separating SMTP and submission functions can help with troubleshooting. - -1. Open the `/etc/postfix/master.cf` file for editing. - - ```command - sudo vi /etc/postfix/master.cf - ``` - -1. Add the following lines to enable the submission protocol. - - ```command - submission inet n - y - - smtpd - -o syslog_name=postfix/submission - -o smtpd_tls_security_level=encrypt - -o smtpd_tls_wrappermode=no - -o smtpd_sasl_auth_enable=yes - -o smtpd_relay_restrictions=permit_sasl_authenticated,reject - -o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject - -o smtpd_sasl_type=dovecot - -o smtpd_sasl_path=private/auth - ``` - - If you or your users run Outlook and need to use the Secure SMTP (smtps) protocol on TCP port `465`, add the following lines as well: - - ```command - smtps inet n - y - - smtpd - -o syslog_name=postfix/smtps - -o smtpd_tls_wrappermode=yes - -o smtpd_sasl_auth_enable=yes - -o smtpd_relay_restrictions=permit_sasl_authenticated,reject - -o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject - -o smtpd_sasl_type=dovecot - -o smtpd_sasl_path=private/auth - ``` - -1. Save and close the file. - -1. Restart Postfix to apply the changes. - - ```command - sudo systemctl restart postfix - ``` - -1. Verify that Postfix is now listening on port `587` (submission) and optionally on port `465` (smtps) on all IPv4 and IPv6 addresses. - - ```command - sudo ss -lnpt | grep master - ``` - - The output should include lines similar to the following: - - ```output - LISTEN 0 100 0.0.0.0:25 0.0.0.0:* users:(("master",pid=83541,fd=13)) - LISTEN 0 100 0.0.0.0:587 0.0.0.0:* users:(("master",pid=83541,fd=18)) - LISTEN 0 100 0.0.0.0:465 0.0.0.0:* users:(("master",pid=83541,fd=22)) - LISTEN 0 100 [::]:25 [::]:* users:(("master",pid=83541,fd=14)) - LISTEN 0 100 [::]:587 [::]:* users:(("master",pid=83541,fd=19)) - LISTEN 0 100 [::]:465 [::]:* users:(("master",pid=83541,fd=23)) - ``` - -### Step 5: Dovecot - -The Postfix server allows your new server to send outgoing messages, and to receive emails from others. However, you need a different server – *Dovecot* – for your clients to retrieve mail from the server. Follow the steps below: - -1. Install Dovecot using the following command: - - ```command - sudo apt install dovecot-core dovecot-imapd - sudo apt install dovecot-core dovecot-imapd dovecot-pop3d - ``` - - The `dovecot-pop3d` package is optional. Unless you have users who specifically require the older POP3 protocol, it's recommended to use IMAP instead. - - -1. You can verify the Dovecot installation by running the following command: - - ```command - dovecot --version - ``` - - For Ubuntu 22 LTS, the Dovecot version is 2.3.16. - -1. Configure IMAP and/or POP protocols by opening the file `/etc/dovecot/dovecot.conf` and adding the following line under `Enable installed protocols`: - - ```command - protocols = imap lmtp pop3 - ``` - - LMTP is explained in the [next section](/docs/guides/how-to-setup-an-email-server/#step-6-local-message-storage-lmtp). You can omit `pop3` if you're only running IMAP. Save and close the file. - - -1. Set the mail folder location and storage type by editing the file `/etc/dovecot/conf.d/10-mail.conf`. - - ```command - sudo vi /etc/dovecot/conf.d/10-mail.conf - ``` - - - Find the line below: - - ```command - mail_location = mbox:~/mail:INBOX=/var/mail/%u - ``` - - - Change mbox to `Maildir`: - - ```command - mail_location = maildir:~/Maildir - ``` - - - Save and close the file. - -1. Add the Dovecot user to the `mail` group to ensure proper permissions. - - ```command - sudo adduser dovecot mail - ``` - - It should display the following output: - - ```output - Adding user `dovecot' to group `mail' ... - Adding user dovecot to group mail - Done. - ``` - -### Step 6: Local Message Storage (LMTP) - -Because Postfix also uses `mbox` and not `Maildir` by default, you need to do some additional configuration to ensure messages land in Dovecot in `Maildir` format. Instead of using Postfix’s built-in local delivery agent (LDA), which by default uses mbox, instead configure LMTP, a local version of SMTP, to deliver messages to Dovecot in `Maildir` format. - -1. Install LMTP by running the following command: - - ```command - sudo apt install dovecot-lmtpd - ``` - -1. Open the Dovecot 10-master.conf file: - - ```command - sudo vi /etc/dovecot/conf.d/10-master.conf - ``` - -1. Search for the following section: - - ```command - service lmtp { - unix_listener lmtp { - #mode = 0666 - } - } - ``` - - Replace it with the following code, ensuring the opening and closing braces match. - - ```command - service lmtp { - unix_listener /var/spool/postfix/private/dovecot-lmtp { - mode = 0600 - user = postfix - group = postfix - } - } - ``` - -1. At the end of the file, add the following section to allow PostfixAdmin to read statistics from Dovecot. - - ```command - service stats { - unix_listener stats-reader { - user = www-data - group = www-data - mode = 0660 - } - unix_listener stats-writer { - user = www-data - group = www-data - mode = 0660 - } - } - ``` - -1. Enable Simple Authentication and Security Layer (SASL) communications between Postfix and Dovecot. In the same file, `/etc/dovecot/conf.d/10-master.conf`, locate the line beginning with `service auth` and comment out the existing `unix_listener` line. Add the following section for Postfix: - - ```command - service auth { - unix_listener /var/spool/postfix/private/auth { - mode = 0660 - user = postfix - group = postfix - } - } - ``` - - **<--Screenshot here-->** - - {{< note type="warning" >}} - Ensure the file maintains matching sets of opening and closing curly braces. The vi editor’s `%` key can help with this by jumping between sets of matched braces. If there is a mismatched set, dovecot does not start or restart. If you get an error when starting or restarting Dovecot, check `/var/log/syslog` to find the offending line in the `10-master.conf` configuration file. - {{< /note >}} - -1. Save and close the file. - -1. Add the Nginx user, `www-data`, to the dovecot group and grant permissions using ACLs. - - ```command - sudo gpasswd -a www-data dovecot - sudo apt install acl - sudo setfacl -R -m u:www-data:rwx /var/run/dovecot/stats-reader /var/run/dovecot/stats-writer - ``` - -1. Restart the Dovecot service using the following command: - - ```command - sudo systemctl restart dovecot - ``` - -1. Open the main Postfix configuration file using the vi editor: - - ```command - sudo vi /etc/postfix/main.cf - ``` - -1. At the end of the file, add the following two lines: - - ```command - mailbox_transport = lmtp:unix:private/dovecot-lmtp - smtputf8_enable = no - ``` - - The first line tells Postfix to use a Unix socket to communicate over LMTP to the Dovecot service you just created. The second line disables [an extension for internationalized mail](https://www.rfc-editor.org/rfc/rfc6531) that Dovecot doesn’t support as of version 2.3.16, the version included with Ubuntu 22 LTS. - - -1. Save and close the file. - -### Step 7: Dovecot Authentication and Encryption - -Just as you configured Postfix to use TLS to encrypt Postfix data in transit, you also need to do the same for Dovecot traffic. Follow the below steps: - -1. Open the `/etc/dovecot/conf.d/10-auth.conf` file: - - ```command - sudo vi /etc/dovecot/conf.d/10-auth.conf - ``` - -1. Disable plaintext authentication when TLS encryption is not used. - - - Uncomment the following line: - - ```command - disable_plaintext_auth = yes - ``` - - - Add the `login` authentication method. Find the line starting with `auth_mechanisms` and add a `login` to the list: - - ```command - auth_mechanisms = plain login - ``` - - - Save and close the file. - -1. Enable the TLS encryption. - - - Open the `/etc/dovecot/conf.d/10-ssl.conf` file. - - ```command - sudo vi /etc/dovecot/conf.d/10-ssl.conf - ``` - - - ```command - ssl = required - ``` - - - Point to the Let's Encrypt certificate and key files generated during Postfix configuration. Replace `mail.linoderocks.com` with your hostname and domain name. Preserve the `<` character before each filename; Dovecot uses it to read each file. - - ```command - ssl_cert = - -1. Answer `Y` to all remaining questions, which disable anonymous access, disable remote access (so logins only work from the same server), drop the test database, and flush database privileges. Your database server is now secured against the most common attacks. - - -### Step 9: PostfixAdmin - -PostfixAdmin is a simple management tool for Postfix/Dovecot that simplifies email administration tasks. After installing PostfixAdmin, you can manage your domains, users, and alias accounts from any web browser. - -While PostfixAdmin makes email server management easy, installation takes multiple steps. None of them are difficult. This guide breaks down the instructions into several subsections explained below. Although the configuration steps may seem like a lot, bear in mind that most of the following steps are required for virtual email support, with or without a graphical management interface. - -#### Step 9a: DNS Configuration - -Even though PostfixAdmin runs on the same host, use a different hostname such as `postfixadmin.linoderocks.com` for email management. If you do this, you also need to add DNS A and/or AAAA records for this new hostname. If you’re using Linode as your DNS provider, you can do this in the **Domains** menu at the left of the Linode dashboard, the same as you did in [Step 1](/docs/guides/how-to-setup-an-email-server/#step-1-linode-server-creation). You can point `postfixadmin.linoderocks.com` to the same IP address(es) you are using for `mail.linoderocks.com`. - -#### Step 9b: Download the Latest PostfixAdmin - -To ensure the best experience with PostfixAdmin and avoid potential issues, it is recommended to install it from the GitHub repository instead of using the Ubuntu package. Here's why: - -- Upgrades and compatibility: The included PostfixAdmin version in Ubuntu packages may not always be up-to-date with the latest features and bug fixes. Additionally, upgrades to the underlying Ubuntu operating system can potentially break the included version. - -- Avoiding login errors: The Ubuntu package version of PostfixAdmin may sometimes result in "Invalid token!" errors when attempting to log in. Installing from the GitHub repository can help mitigate these issues and provide a smoother experience. - -- Consistency with Nginx: Since you have already installed Nginx as your web server, the Ubuntu package version of PostfixAdmin may attempt to install and use Apache, which can lead to conflicts and configuration issues. Installing from the GitHub repository ensures consistency and compatibility with Nginx. - -To ensure the latest version of PostfixAdmin is installed, follow the steps below to download it from the GitHub repository: - -1. Open a terminal or SSH session to your server. - -1. Change to the `/tmp` directory using the following command: - - ```command - cd /tmp - ``` - -1. Install the `wget` package if it's not already installed. Run the following command to install it: - - ```command - sudo apt install wget - ``` - -1. Visit the [GitHub page for PostfixAdmin](https://github.com/postfixadmin/postfixadmin/releases) and note the latest release version. As of writing this guide, the current release is version **3.3.13**. If there is a newer release available, substitute `postfixadmin-3.3.13.tar.gz` in the command below with the appropriate filename for the latest release. - - ```command - wget https://github.com/postfixadmin/postfixadmin/archive/refs/tags/postfixadmin-3.3.13.tar.gz - ``` - -1. Once the download is complete, extract the archive and move it to the `/var/www` directory. Use the following commands: - - ```command - sudo mkdir -p /var/www - sudo tar xvf postfixadmin-3.3.13.tar.gz -C /var/www - sudo mv /var/www/postfixadmin-postfixadmin-3.3.13 /var/www/postfixadmin - ``` - -1. Remove the downloaded archive file to clean up the `/tmp` directory. - - ```command - sudo rm postfixadmin-3.3.13.tar.gz - ``` - -You now have the latest version of PostfixAdmin downloaded and extracted to the `/var/www/postfixadmin` directory. This ensures you have the most up-to-date features and fixes for managing your email server. - -#### Step 9c: Install Required PHP Modules for PostfixAdmin - -PostfixAdmin is a PHP-based application and requires several PHP modules to function properly. You can install all the necessary modules with a single command. Run the following command: - -```command -sudo apt install php8.1-fpm php8.1-imap php8.1-mbstring php8.1-mysql php8.1-curl php8.1-zip php8.1-xml php8.1-bz2 php8.1-intl php8.1-gmp php8.1-redis -``` - -These modules provide essential functionality for PostfixAdmin to work properly. - -#### Step 9d: Database Initialization - -To store email settings, you need to create a MariaDB database for PostfixAdmin and a corresponding user. Follow the steps below: - -1. Log in to MariaDB as the root user. Run the following command: - - ```command - mysql -u root - ``` - -1. Create a PostfixAdmin database and user. You can choose any name for the database and user, but for consistency in this guide, use `postfixadmin` for both. Remember to replace `postfixadmin_password` with a strong password of your choice. Execute the following commands: - - ```command - create database postfixadmin; - create user 'postfixadmin'@'localhost' identified by 'postfixadmin_password'; - ``` - -1. Grant all privileges on the `postfixadmin` database to the user you just created. Execute the following command: - - ```command - grant all privileges on postfixadmin.* to 'postfixadmin'@'localhost'; - ``` - -1. Flush the MariaDB privileges to ensure that your changes take effect. - - ```command - flush privileges; - ``` - -1. Exit the MariaDB prompt. - - ```command - exit; - ``` - -#### Step 9e: Postfix-MariaDB Integration - -In this step, you configure Postfix to send and receive mail on behalf of virtual users and domains, not just those with accounts on the local operating system. This requires installing a package that adds MySQL/MariaDB mapping support to Postfix. - -1. Install the postfix-mysql package: - - ```command - sudo apt install postfix-mysql - ``` - -1. Edit the main Postfix configuration file: - - ```command - sudo vi /etc/postfix/main.cf - ``` - -1. Add the following lines to the end of the file: - - ```command - virtual_mailbox_domains = proxy:mysql:/etc/postfix/sql/mysql_virtual_domains_maps.cf - virtual_mailbox_maps = - proxy:mysql:/etc/postfix/sql/mysql_virtual_mailbox_maps.cf, - proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_domain_mailbox_maps.cf - virtual_alias_maps = - proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_maps.cf, - proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_domain_maps.cf, - proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_domain_catchall_maps.cf - ``` - -1. Allow Dovecot to deliver messages to virtual users by adding the following line to the end of the `Postfix main.cf` file. - - ```command - virtual_transport = lmtp:unix:private/dovecot-lmtp - ``` - - Save and close the `main.cf` file. - -1. Create a directory for the virtual domains, users, and aliases you just pointed to using the following command: - - ```command - mkdir -p /etc/postfix/sql - ``` - -1. Create the following six files in the `/etc/postfix/sql` directory, substituting the password you used in the previous step when setting up the `postfixadmin` database. Use appropriate commands such as vi to create and edit each file. - - - The `mysql_virtual_domains_maps.cf` file contents are as follows: - - ```file {title="/etc/postfix/sql/mysql_virtual_domains_maps.cf"} - user = postfixadmin - password = password - hosts = localhost - dbname = postfixadmin - query = SELECT domain FROM domain WHERE domain='%s' AND active = '1' - ``` - - - The `mysql_virtual_mailbox_maps.cf` file contents are as follows: - - ```file {title="/etc/postfix/sql/mysql_virtual_mailbox_maps.cf"} - user = postfixadmin - password = password - hosts = localhost - dbname = postfixadmin - query = SELECT domain FROM domain WHERE domain='%s' AND active = '1' - #query = SELECT domain FROM domain WHERE domain='%s' - #optional query to use when relaying for backup MX - #query = SELECT domain FROM domain WHERE domain='%s' AND backupmx = '0' AND active = '1' - #expansion_limit = 100 - ``` - - - The `mysql_virtual_alias_domain_mailbox_maps.cf` file contents are as follows: - - ```file {title="/etc/postfix/sql/mysql_virtual_alias_domain_mailbox_maps.cf"} - user = postfixadmin - password = password - hosts = localhost - dbname = postfixadmin - query = SELECT maildir FROM mailbox,alias_domain WHERE alias_domain.alias_domain = '%d' and mailbox.username = CONCAT('%u', '@', alias_domain.target_domain) AND mailbox.active = 1 AND alias_domain.active='1' - ``` - - - The `mysql_virtual_alias_maps.cf` file contents are as follows: - - ```file {title="/etc/postfix/sql/mysql_virtual_alias_maps.cf"} - user = postfixadmin - password = password - hosts = localhost - dbname = postfixadmin - query = SELECT goto FROM alias WHERE address='%s' AND active = '1' - #expansion_limit = 100 - ``` - - - The `mysql_virtual_alias_domain_maps.cf` file contents are as follows: - - ```file {title="/etc/postfix/sql/mysql_virtual_alias_domain_maps.cf"} - user = postfixadmin - password = password - hosts = localhost - dbname = postfixadmin - query = SELECT goto FROM alias,alias_domain WHERE alias_domain.alias_domain = '%d' and alias.address = CONCAT('%u', '@', alias_domain.target_domain) AND alias.active = 1 AND alias_domain.active='1' - ``` - - - The `mysql_virtual_alias_domain_catchall_maps.cf` file contents are as follows: - - ```file {title="/etc/postfix/sql/mysql_virtual_alias_domain_catchall_maps.cf"} - user = postfixadmin - password = password - hosts = localhost - dbname = postfixadmin - query = SELECT goto FROM alias,alias_domain WHERE alias_domain.alias_domain = '%d' and alias.address = CONCAT('@', alias_domain.target_domain) AND alias.active = 1 AND alias_domain.active='1' - ``` - -1. Lock down the ownership and permissions of the files in the `/etc/postfix/sql` directory so that they are only readable by postfix and root. - - ```command - sudo chmod 0640 /etc/postfix/sql/* - sudo setfacl -R -m u:postfix:rx /etc/postfix/sql/ - ``` - - During [Postfix installation in step 2](/docs/guides/how-to-setup-an-email-server/#step-2-install-postfix), the `mydestination` parameter may have been set to include the canonical hostname (e.g., `mail.linoderocks.com`). However, since you've enabled virtual users and domains, the canonical hostname is no longer needed. - - - Open the main Postfix configuration file for editing. - - ```command - sudo vi /etc/postfix/main.cf - ``` - - - Locate the `mydestination` parameter and modify it to remove the canonical hostname entry (e.g., `linoderocks.com`). Keep only the necessary entries, such as `localhost` or any other relevant entries. Save the file and close the editor. - - ```command - mydestination = $myhostname, localhost.linoderocks.com, localhost - ``` - - - At the end of `main.cf`, add the following four lines to configure Postfix for virtual users, domains, and aliases. - - ```command - virtual_mailbox_base = /var/vmail - virtual_minimum_uid = 2000 - virtual_uid_maps = static:2000 - virtual_gid_maps = static:2000 - ``` - - - Save and close the `main.cf` file. - - -1. Create a user named `vmail` with user and group ID `2000`, as defined in the previous step. - - ```command - sudo adduser vmail --system --group --uid 2000 --disabled-login --no-create-home - ``` - -1. Create a base directory for virtual mail and assign ownership to the `vmail` user. - - ```command - sudo mkdir -p /var/vmail - sudo chown -R vmail:vmail /var/vmail - ``` - -1. Restart the Postfix service to apply the changes. - - ```command - sudo systemctl restart postfix - ``` - - -#### Step 9f: Dovecot-MariaDB Integration - -As you just did with Postfix, you need to configure Dovecot to work with the `postfixadmin` database. Start by installing the package that enables Dovecot-SQL integration. - -1. Install the package by running the following command: - - ```command - sudo apt install dovecot-mysql - ``` - -1. Reconfigure Dovecot to handle virtual users instead of users with system accounts. Open the `10-mail.conf` file. - - ```command - sudo vi /etc/dovecot/conf.d/10-mail.conf - ``` - - - Find the `mail_location` line and modify it as follows, adding a new `mail_home` parameter for virtual users. - - ```command - mail_location = maildir:~/Maildir - mail_home = /var/vmail/%d/%n/ - ``` - - - Save and close the file. Now open and edit Dovecot's authentication file. - - ```command - sudo vi /etc/dovecot/conf.d/10-auth.conf - ``` - - - Locate the `auth_username_format` parameter. If it is set to `%n`, change it to `%Lu` to convert usernames to lowercase characters. This is because, by default, postfix uses the entire email address (e.g., `SomeUser@example.com`) as the username. The `L` converts usernames to lowercase characters (e.g., `someuser@example.com`) before sending them to the database. - - ```command - auth_username_format = %Lu - ``` - - - Uncomment the following line to enable SQL queries of the MariaDB database. - - ```command - !include auth-sql.conf.ext - ``` - - - Add the following two lines at the bottom of the file for initial troubleshooting, and then save and close the file. These send login errors to `/var/log/mail.log`. Once you’ve verified that users can log in successfully, it’s OK to delete these lines. - - - ```command - auth_debug = yes - auth_debug_passwords = yes - ``` - - - Save and close the file. - -1. Now, open the `dovecot-sql.conf.ext` file. - - ```command - sudo vi /etc/dovecot/dovecot-sql.conf.ext - ``` - - - All lines in this file are commented out. You may want to keep the existing comments, which are useful as documentation. Add the following lines at the bottom of the file, making sure to replace the `password` in the `connect` line with the `postfixadmin` database password you created earlier. It’s OK to leave the word `password` as is in the `password_query` line. - - ```command - driver = mysql - - connect = host=localhost dbname=postfixadmin user=postfixadmin password=password - - default_pass_scheme = ARGON2I - - password_query = SELECT username AS user, password FROM mailbox WHERE username = '%u' AND active='1' - - user_query = SELECT maildir, 2000 AS uid, 2000 AS gid FROM mailbox WHERE username = '%u' AND active='1' - - iterate_query = SELECT username AS user FROM mailbox - ``` - - - Save and close the file. Then restart Dovecot to apply the changes. - - ```command - sudo systemctl restart dovecot - ``` - -#### Step 9g: Access Control Lists (ACLs) - -PostfixAdmin uses a `templates_c` directory, and the Nginx web server needs access to that directory. As in [step 6](/docs/guides/how-to-setup-an-email-server/#step-6-local-message-storage-lmtp), you can use ACLs to grant access. - - -1. Create the `templates_c` directory and set the appropriate permissions. - - ```command - sudo mkdir -p /var/www/postfixadmin/templates_c - sudo setfacl -R -m u:www-data:rwx /var/www/postfixadmin/templates_c/ - ``` - -1. Ensure that the Nginx web server can read the Letsencrypt certificate and key you previously created. - - ```command - sudo setfacl -R -m u:www-data:rx /etc/letsencrypt/live/ /etc/letsencrypt/archive/ - ``` - -#### Step 9h: PostfixAdmin Configuration - -By default, PostfixAdmin stores configuration data in the `/var/www/postfixadmin/config.inc.php` file. However, to avoid potential conflicts during upgrades, it is recommended to create and edit a separate `config.local.php` file for server-specific settings. - -1. Create and open the `config.local.php` file for editing: - - ```command - sudo vi /var/www/postfixadmin/config.local.php - ``` - -1. Add the following content to the `config.local.php` file, replacing `password` with the actual `postfixadmin` database password you previously created. - - ```file {title="/var/www/postfixadmin/config.local.php"} - - -1. After entering the password, you see a hashed version of it. Copy the entire hashed string, which is used in the PostfixAdmin `config.local.php` file. - - ```command - $CONF['setup_password'] = '$2y$10$vAuLxxX382702NfI/v8DYu7FQFGji/2nAqzEuLIdR3VTj2otP/Lsa'; - ``` - -1. Open the PostfixAdmin config file for editing. - - ```command - sudo vi /var/www/postfixadmin/config.local.php - ``` - -1. Paste the setup password string as the last line of the config file. - - <**Screenshot here**> - - -1. To allow the `www-data` user access to read the Letsencrypt certificate and Dovecot stats, run the following commands: - - ```command - sudo setfacl -R -m u:www-data:rx /etc/letsencrypt/live/ /etc/letsencrypt/archive/ - sudo setfacl -R -m u:www-data:rwx /var/run/dovecot/stats-reader /var/run/dovecot/stats-writer - ``` - - If you encounter an ARGON2I error later on during the PostfixAdmin account setup, rerun these two commands. - -1. Reload the setup page in your browser, and if requested, log in using the setup password you entered earlier. You may encounter some database warnings, but you can ignore them as they pertain to database types not used in this setup. - -1. Enter a super-admin password, along with a valid email address, and the new super-admin password. - - <**Screenshot here**> - -1. After entering the password, click the link at the bottom of the page to access the main login page. Alternatively, you can use the following login URL: - - ```command - https://postfixadmin.linoderocks.com/login.php - ``` - -#### Step 9l: Virtual Mail Setup in PostfixAdmin - -1. Open a web browser and navigate to `https://postfixadmin.linoderocks.com/login.php` (replace `linoderocks.com` with your domain name). Log in using the credentials you previously set up. - -1. In the top menu, click on **Domain List** and select **New Domain**. Enter the name of the domain you want to create. It is recommended to include your server's native domain since we are assuming all accounts on this system are virtual. For example, use `linoderocks.com` (replace with your server's domain). - - <**Screenshot here**> - -1. You can specify the maximum number of aliases and users per domain. The default is `10` for each, but you can set these values as desired. Use `0` to indicate an unlimited number. Regarding other settings on this page: - - - Since you are setting up a primary server, leave the option for this to be a backup mail exchanger (MX) unchecked. - - Choose whether to enable or disable the virtual domain. It is recommended to enable the domain unless there are specific reasons to disable it, such as scheduling it to operate within certain dates. - - Keep the **Default mail aliases** box checked to set up standard management aliases. These aliases are commonly used for administrative and troubleshooting purposes: - - - `abuse@linoderocks.com` - - `hostmaster@linoderocks.com` - - `postmaster@linoderocks.com` - - `webmaster@linoderocks.com` - - - The **Pass Expire** field sets a maximum age for users' passwords in that domain. The default setting of 365 days is recommended, but you can adjust it according to your preferences. - -1. Now, you can create your first user account. Click on the **Virtual Lists** menu at the top of the page and select **New Mailbox**. - - <**Screenshot here**> - -1. Enter a username and select the domain from the dropdown menu. Since you have only created one virtual domain so far, there is only one option in the menu. - -1. Choose a strong password and enter it twice, along with the user's full name. - -1. (Optional) Set a quota (maximum storage limit in megabytes) for the user. Leave the **active** and **welcome email** boxes checked unless you have a specific reason to disable them. It is a good practice to enter an alternative email address (preferably from a separate domain on a separate server) for password recovery purposes. - - -#### Step 9m: Client Setup and Server Validation - -1. To validate your email server, add a new account to an email client such as [Mozilla Thunderbird](https://www.thunderbird.net/en-US/), [GNOME Evolution](https://help.gnome.org/users/evolution/stable/), or [Microsoft Outlook](https://www.microsoft.com/en-us/microsoft-365/outlook/email-and-calendar-software-microsoft-outlook). While the specific configuration of each client is beyond the scope of this guide, there are a few common settings to check: - - - For sending and receiving emails, use the entire email address as the username (e.g., `someuser@example.com` instead of just `someuser`). - - For receiving email, specify IMAP on TCP port `993` using TLS/SSL. - - For sending email, specify either submission on TCP port `587` using STARTTLS or, for Microsoft Outlook clients, TCP port `465` using TLS/SSL. - -1. After configuring an account in your mail client, test your setup by sending and receiving emails to and from another address on a different server. You should be able to both receive and send emails using your new account. You now have a working email service. - -1. If you encounter any errors during the setup, don't worry. Instead of starting over, check the following log files for specific error messages: `/var/log/mail.log` and `/var/log/syslog`. These log entries should provide clues about the source of the problem. You can also search the web using the specific error message along with "dovecot postfix" to find relevant information and solutions. - -1. There are a few housekeeping tasks to complete: - - - In PostfixAdmin, edit the four standard aliases created when you configured a domain. By default, these aliases point to dummy addresses such as `abuse@change-this-to-your.domain.tld`. Now that you have a working email address, you should edit these (under Virtual List/Virtual List) to point to your actual email address. - - - In the `/etc/dovecot/conf.d/10-auth.conf` file, you added two lines for verbose debugging. Both lines begin with the string “auth_debug”. To avoid log bloat, you can comment out or delete both lines and then restart Dovecot. - - - Consider configuring valid Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) records in your DNS to combat spam. Optionally, you can also set up a Domain Message Authentication, Reporting & Conformance (DMARC) record to specify how your server handles failed SPF and/or DKIM validations, as well as request reports from other servers. Linode provides a [separate email server guide](https://www.linode.com/docs/guides/configure-spf-and-dkim-in-postfix-on-debian-8/) for SPF, DKIM, and DMARC configuration. - - - Stay vigilant about [security vulnerabilities](https://ubuntu.com/security/notices) by keeping your operating system and server software up to date. Regularly applying patches and updates is crucial for maintaining a secure server. - - - Make regular backups of your server. Consider using [Linode's Backups service](https://www.linode.com/docs/products/storage/backups/), which can automate your backups with a single click. - -## Conclusion - -You now know how to set up an email server. You know how to put key email protocols to work, and how to integrate them with DNS, databases, and graphical management tools. Properly configured, your new email server can run for years, making it a good pairing with Ubuntu’s LTS run on a Linode. Email represents one of the most useful services you can provide, and Linode’s cloud platform offers an ideal platform on which to provision your next server. \ No newline at end of file diff --git a/docs/guides/email/postfix/how-to-setup-an-email-server/PostFixAdmin-Add-Mailbox.png b/docs/guides/email/postfix/how-to-setup-an-email-server/PostFixAdmin-Add-Mailbox.png new file mode 100644 index 0000000000000000000000000000000000000000..d9e895433277b24773ffc17e84757af630cea09a GIT binary patch literal 52154 zcmeFZbzGEf+b#+|CW4J3ErOJEw}L1`2$Iqg0}c&CxB37k=tv0C-3W+uC;}n~N-B*s zNO!OE!so4TeS3eucki|Sd-dn-Fmum!UvcJf9w(1fZr&gxp(G(9A|k`cT~j3@`hyAn z@f|)0?-Ws$pNIcy-PLb9sv5b_+d0^p;jFOqj&62XdaNtXjEKm!%UY$IteT#5%lvWR zz`2jK0sLugWTM_=f~u;^jDgjH0rnzNvs!MXC*)t0;PN}FE?m0a>n9zneEoU-Y4v-2 z?oZB*Dn1YJe|-Ax6B;dXu1uQJ40oOu^Ghop9~i~H(j|C4ym4drr`$z_i^+0#D3{jG z^0!WJ_-+3w#;<9{jNZ{>-j_9L^dg;{?8x`OKYqge5VPz#)_EUH zob1y>b=$5kv-YdU1}3qx`J%?Y$=zmbC(rTz(73Slm~-ht-C=j88s5=sJV*NHoq~vT zXX7t7?DoVYD1Xr=IdS5l$z!9gk5nJ|UcYW=efh~Sp&( zpTF3X)>SIO_Vd06g;$y*I(6}MDaWrwl*soH9SW#&y_eVN)z{nG*Ij8IvAs=nr@p_YHbIiM?@qpCWrG)Wm0;K# zR}@~Ox49VT_ik~tlwi26q(U!a>wu-_=j7+)=8$#8IrB0|lF*Agn3{>IUc3I+5b%=( z!(B&5J5eq!7Z(>!7d}o~2XihS5fKqCZeA{4UJkf}1MgYBR+Vzun7-`iHHyn3?+=^fZ zd{_ZqegVF{q0l*qURA+JFz|A6|KlAMDuC#;Q3QpT;ZxOw?S zxdlae_|qt&nfzV?-pCnix;IZ4>-R?{ca3b!v0y&_lGnezkNa!ufi-PxUA^}3?6|IGda_!P!YJ+?4K zJ|!i-hD#Z_R=Ho2DJ{K|tkt~nmvn2xKew%5sJ=L=R!iWSS5>Z&Vcs4%arN5!126Eq zJF)m?kpTR$L*K4>O3($-4rZ`I3 ze)xSQ`V*#3^w*U>7`^^|C5qdRe)xSo43GyA(eLXO7BukhE0Ofx;J>f`-6QTV*6}M* zqA&b;DpJbd=)}#v?_O;`!VE9qYLJn0B_ei%jg75kaI2b4R6CJCI7JDM)_cBh-@Y?? ze78?JT|9H<%*P|&Ek1ESifnJGf5{y3@@2xqhldaB-*0CIW9t&m=f4>ZA`7=eJY>X8RRwZvHLWC)h*^(^OUs6yX{_^ zR{q`9GJBh@x6<9}P4=FbVz7RFCh9W+GgAx2v;IDn51KaYN#R5XT!s_uxJj!=cKg^# zJ3H4j&ZsBa36$H)6nBprX^%*nh30#ii8L%O(@J%fN^hF0+li^?E^7_r-%7eHx*V1a zA!VdpZNHpi-T1iB$<2DQhjz#2B`#uwwvK$~@-vc(y38KSp3V_`{}+dMUs8uF{s3V~ z-8VQy-S*J`ON`CEe8aoZy$3YkNNh_ac)jcH&irU@7#=&GaAIXy+m($X%5c}?&$B*H zG%MY+d)$@TO18~auf#lw?|%Eba@XY-wa=k(9%2wS&RD6QCZDR~)WWeeV$S1L_x@mG zWu2crUN%@)@-#1JQT^e@Wd_oIzkrK}qwFsjtLI55aZL%1^m}g<@9=d=jal;zdyNOV znN8XIWEoMATPTk)l(I#Q2$Ci=nroVE!lOAK<}Wo7f1Z2OYv7+2@P zDfYBFxbs7MYu@T?e~yI5N@{Fu6;`52HlV@dOP-&p-{Y7Cf2;LdPeaas7)?rLcX<^k zB~$kFvESJ+=LM6)uQvs~x0gFhR=O;g+tie`gO-2&P=is_9USr)CqlFgZZ$_s2$jKu?+;VCBTgSVZ@3{%m2XgymD4bTB8#e`J<4-ZO==mpNHg+~= z+w;wp$;#|wefq6^qFs&)C(q74s}r&UU=!%E~<}iIwjr8$X|L zso%bx`t_@d)A-k`adB~MmoK+T?XD|tZ_oO0wOXpi88>Rp|4KOFy)lupJn-N+8xvEF z$>1%63lq54;!*Ei+@jq4t#PibZyWPhwL`RHv~#_3tX@eB88^omw=Fp&_mxYK_D`|m z6~kL@(0L`!R_+=Q+7dCRe@r`99yN}sd(5V(7jvt1lW+E?XUzAx)!Ty2R$hG-H_W~I zD2WClk0u@&m9y1~_b#HRKT;9GQx8UkXBN+|ftq@6A zjmVxAP*Q6aUwj(vxqyMWWK4Q-5rfjJmtDD?YwY*Vrk4%lzTB?Wo`-GNrQyGKZ=;%S zCsygTAge%$A&cp*0-X}av=XPOn_9?;5*S zc3U8g*qL+ZQnK|+Exx}oA|WBk3ypg5B95zKP5QN#oFAUMc3Oj zczC+o;wY<-kQQNSA|=LR@PnWG&qvH{u~+{HPfn|Oa?TQFERVt5dUBSdElJ@V8I_>o z`}glTH*sD1M`xZsCH)d1pg<*Lvs7ebOTF0(ceLji8ZM50XRtD=X165hTLh1Ze<+t>_G{Y; zZCJB|c7LX}A&ZDxK!lL3L9*8+rHI5|zpRi!5bCjepxD|5^7GbVMBci;LVtO(T`fa1 z%MoO~)bqI1`ta$bloU%ihsnP3(&e@L2adiqsy^s6)uHs@AeqCu!Sx$AEWws_thSWv zE4Bt3@hxq4%nEpII3^`0r<;9=m~2f6>UxVCnqO?Jum3g{J^38(zhF3MfM3Gnr#J^S`u4x z)sG)N%I(Pa+H^)cU+O%qYGadaY+}-0XlvMOKSo1xl|$zGP32oVn5atMM!*S-JOnY z2&HX)RSD)auX{T0hn427O0zGN)BTnGY%A24ZbqiAFOKQ@HG}MiL`G(U4o(zw8mNKp zIn51Rl~@~iAnN?<6=Rz7bl2xEU)l*w3U6V_N->i9KYsksJjsTU+M0Xdy*7AAV&T(8 zY{$@HqWb#!t}?g$0@^eydJ)&TSX%e-3ouW4g0zfGLuRQ#xjXIa%Y1w?8Cp4-Iyw<~ zd3l+2tt~A}8&f&#!os(`HdjIzy%xU+Ap?=sIXpVbCLy5@C)@Jz(dqU~ZN38s4&Xoq zMPX=id6-sGdxlm6H>ti;y9UHS;Tpj?x`j87i_cZWD9UL8<-D&8f&%?tr*;Aa~KmBt}k2)rbE5>u-QA6eF)2BmTy-Ed(td8V8YuaOL zzAhv>+F&%_;O*TPmz1M3K|<0jJF_E1ozflfcnv+hOk{!i_*zMhuJ-%*gn#Isck>Vp zjP_d5uI#if>@IL$w!pM-Rc;xV_wh7;);2Yj$kNWg4nwrRF{(a8OKU^EWazz~L|XlI zZm>FQ7VWg2WJZk7j%gnF5Z19SALF`M02?~q}OCH7W zh_KnD9EH0%I>qun+f#=69a5GZmxE@z^UZ^<2hm#7&;?c%f@Wsj&Xu06*vy9gN_+a$ zumA)iOwh%1rMu8pYkOl^zsqBNVdV4Y&uzi1YD_X+d2Ualy*F@E>);1L18^Xd^78U6 z!}Tw-n$b~M^p+GbPK)F^efMz$aA zRAV?FGO*U&?{M$$@5dxb91Dzh1|`)gbIm<<>J)OEAZZqxE7O$RcYG_>N2z3GWif=E zmBPviuqn5OEQ}v--215477H(YDiN{L8^mM?abESEi^R9j%|;ZJ&KIvlXF}h%bkX{f#cI@}>w=t@!ssx47SIHB(`qVGKvwz?wl~^BssRJ%FltVWe{ER#y`DRr5 zgG0yV31&@^X-i9ve*XRz;AnKp-3uz#ejY8j`%M}|-+e5~#k8=S9EsW2sm`3vpEXaG zyDW3G?`_PK&aT`xU76}^9OX8|8|5O(l9v=S0O$xi|M#fn&)5>l1VgK?>uP!+0mX;(1Cd_KD zON_w Im1-52VanJ_V4f=bD_bp2B2jmq6kDG=hC$s>nJN!9P%!37vxy?PHEhMvFC zfrAG_ce*c^?+a$^1s6`+xj5_NGwQU@3Oob9O^>i;FAM@ol71_}pHbT{HYYFQ;jt-cjb<3eM`T-V*jW( zMGNc|^1r@;+@yhZ zPk_XPFw%%ReoE2@xw9yEvS{uw{OJV=oq2&}X9wI!PC=0xAz(QP0Yl-3tH#Fh@O>}@ zOc-U!^+cUQ8;)x3wl_vH61!WAghUSAcPwIJx`ehknM1u08+6!@9hT=Ro4dcf9Q{Cz__Dk!5_YPYPhgsXV?RG3rgx%Xi9+FE_wbU-vThH9TRWO6Ywew5HgV*xMJSauP|oxvWfW&_2AYI^B4_? zpuq4#a)G014jeMu-Pzt444`8SX{vt|7#IrM9B_)F#S6gfG>G=h4 zrzJlhv!6MA`eG};6DY?xIR58G6eXh(mYJPnV`B;g6x)?Ad}eo_DIPm>@}yBg+R)~& z?`DRld+5BDZcT~tgZNF^2VIzzF8Py>Nc}Wv|NXjsmpD0Z9y&(-rb*8O_V?t-*cdxK zeHGhB(rT5Lmz4BsD`vY26#R|GksdUWDkMo9Qk@8IdC9DdygdlqyN(>g9KWOIEcz=P zr+bPUOztjxyhXpRqkQYu3$Xb(j^^BE*nM@7ii*t{F%G>VmCe;zEb*$JGJH zb+uR)-`Rji4-ZcpAHO?AG1*_~Q*7S0xjdC};ON=Ay(Lb_OoPM9jKc?VuMGuB$rDOk zW@j8cJJK~2;Nw=Ie$NC$pY7$RUFG&ewVcyqnCsX56I<9{h;((tfg#r^c1Tj768=!+ zaRN`u+5lltu1Vdnu-?y~KlK8mAjYE+wz~pmAdhyDA5#ur=qmRp)Xcmc2m6GBY!!0D zn9o~%3r@1UW83!886T9+5c{g!XUl{<1e7A`oz;){pFfR*%p-Rpt(<~WRRtH86-NZF}Y?^s=_XZkS|C=={k?PaoUZLp2r?)jTR{8^dV1 zNj(^^TWAv@=8`RF^*t6z0ozw=!PlXj`srRE=BeeTmgND`v`3*0QiK+uXCW6}x%5q+E)+kV` zNy&85&RL(9Xo~Cjrb))sL#h$gR0oX4gNJb(GpgxrJ9XDb&>X5Ymdfp7aN!3^=neQfpO5znrB{#be2 zR-(^8L8Qa0Sz`4r7)MRweCuw(&Y#_xx9`nv+17=myRZC88;ka68u8NB*5*}erL1kM z@bdU!C76_yG|_Ea8G?(jXipC*(1(zxz+GO{aeP4M%6e|p&e?*#E-ais`7x%zefA(& z*l7IH34W{ZUz4hom6f^5yV`9xU&0jq#KsuhetvueJ6j-K4NBQw?%@Kys#Lmr+`f0A z9Mnb6-McLJhZQBS=|jn#HIu2*i}fWf;f(t36G`Yiq9r`^{CNO{m|Aq62?;h;>T|YR zA`M-~(ox(tyG`)8@(`!e_27AE=t`x5Z0j>xU#6eCUWiwL=OaYQMVuKlZxmdW{QT6J)@H{0AuB+ z2(gI9HB$&tA=jlndc5vkQO?*CzykV*%qHAt$`)_Joqd+Mzit;Up13^bZ#>WCmsf=zpjjOV#_*%OOJg3x_j!fD@aCGykpH{a)=hbycW`e#Ptj%r3G2SL~m)~ zR8pYNYh~5&3#?5CGE$sH>;`<_L5@5~#UmP83V_Shq>btXHCY{ZGGt;p)y0V|eZqC- zxWevbWD&SY!H;Xdzw;vxyRp)3%Y@n8=&a;-ox6i+0pY2ioQeN?o>`CtQn=}DBBW<`7j7!Q79uyDJ!=Yo-D6{C}*;p7l3&3U)d7e zU;oYIQb=E1pS>)%VL!&U#$)m9m#i4LRUz!kXput65Z;CQ34!0M%h7WE#?e3>>-K~j z$HU_LbZ^g*KaG;A2343cAG;9IH)CV?!pJ|ydn2vSb5Us@ zwS&|}zjf=v>8>s|OXWZukknXm`qU|e4?&(-JdgiNQpGw9HZ|IP3l0P@zy;yyJV7$Jy>{@Ay~^Q^xT;;@|+6E)79K> z@4VlKw1u4HQZjDx+YP#QGNGPWFyk2yZCaBHvWtF_U|KE)iN^!vz$zl54K~DA)M+vi z21P&}VF|!ZuvT*6;o+20-enMeAix0PdT^AtbSk~eA&(G%5VL%J^fh*@=T+Ymr!l8~ zpWSV2hlKmmU6}9$L{=S=A-Ee{+F9VYEIPBJoPMp&^mdQ1-G-E)wzA4ZmL-a2 zr@?T?SYOs+XKQ@}5CtT}Q`a4FI9!tX%(Iq#eYr{~{efI8bJ=mCrDn`s99$zeDM|^C z968caqSV?3whzf=(A6g0ZCi@#;SJArmUDdC^<8?ITKNl1>rb&ie@ZDJfARWLJGZRG zZRW^;yCTX}&XqU(3Qr8oj?L`!rNnr5k&?AoItlm)pmdlXNjT8?I-0@l)41j>BlH};o0?%~^ z_UGb|Kz5LU*J%ToCqvh^Ttjt2V^6(kCEV|he~shBv#_}<-4~lJQ&Se7{}Tdu(8mJ1 zL1~yg?D@M!%gxoPoK6D|C2-vUlYWC#5~(97yv1l^cn6u%Hc7of#2e5!l-^}}3^#(P zfDCoe?XKPEbsc&}ke_`&B%bog{zFxakyBGlR8GbeF;Npo^>E9@cHTR`x(k~}Nchb2 zNLS<8AwPi7TNRGC;kL(AP!ZjYy;2y&dMJruV@q#5Z&l|G&rXIgY|1PESeI-pEGhsV zW-5etO*_*_dFu&SwAs;o7_M^{&+VT6+|<-DKUAmCNu#67E0I&0cQZ!P`b+)Yud!E0 zLUms}Dl+HB6*5f!v?aEPNInK7m;3kk={wXjb&UPOQPHgCrs@`EPj+N^gnBQ!*&JG( zcF8Qg87105-oOUXE7ww=$4hcb%5*8OeB+{xwQ*rLoH|oAH)IlO&f7M}Xhaj?K7qSmuLxMSFKr4huD%j+ znhX{wybSty_3Bk90OfLCv#)0gTO*ey(py6l1vnM|!v@Ml{wfadj&?8N9XG$<92@H~ z92@fTj#-wd?%XVYW`5zW<_3N_|Bcktv}$`02NxVu5bT-{Wv*m}IB{xN73xNx7}0t_#k7UwcVfOw#}Q1 zQK^dDE9ZL}NvPRr-xYkQOOo20qW)=hkoW+RH*+J&pJURcyfry74LM)&A=+4xu=3?~ z_tv_V@T3DV&D%VmwR2*w4tgqYFIaxpVUns|nAueQHZ-3}Q<=P5*A(ub?GW%;eB<5DguozV88GyW~fxvRD3 z&+_>P#ebTUdh05oYwc>Q6*M%&eqzTv?8=Zi*Q-iD8@F=7O08H4DxI>vup;wA$*5oc~=?dT)YGN zhw9n$rp@1!kB|?C;Ev`rqz*9dPC7dgNa$XkYgviT>I>m3x?OXgqgh<6KmW189U>x? z?XPP8DD3~=DetR1JCCK~ReI^1=D!bjf0CV@9g^>_Cy0n*H->}zEvQ=g)9_IFom6a9 z*VCgWgW`O82!z66cK0Xm4eGX^F;s_=_iv(ruZn|xd>B;v)wPmwyg#B;?jId#fHn&i zn)CkekKEql6xey&{S4V-D@1B7J^$PH{;|maQay*U|AoC!<;VW~5|OWJT@alXl)nOL zCD=-PZ$2Pue+oE;t7{Qd8puzbl74`ONp-)+C?KFgM#-;I?!IiA|HCxm64@W>r~QpS z*%a#bFGJ9G{|K-ieAAg=(df2o*Z#bJ|Gp{3!Dsu_`I2#L2%~ALtEu_Mg6IM1fshli zyfey#xDP{5oSq9{P`b@EeMpdfYl+fNTq^m)*IVoXrvrfSpHpBjEavpFX`@=)0PtRb4(-vn{d1Sr_A^?ySAkLPTUYADgmY zxEW$5$zCuc8)iR*I1j7?Sn31?i>ahA1JR*X1-C_qc=@s&YQXTsyD%R>+{#yg z_8?%{QS@gtB=h?D=FJ@t{W68De7q(ri<@XkLI+e(0T~ORTWX+oEsztXqdF6%kWFNK zLIM*;YJ2Hr!-^La@==u)C>AUjRM61O)=PsblNXI)?zag1|pr7Ozr%)uJgv2 zmPipi6f0^Dkr7qNK8!v!u`6Q?u_ILqdIvqE;5oDC@zg70uvJxghVhN@&r^4vgs|sK?;s)$WX@(e*Qcb zr31`2BcC&pgKTiWS+eW}#zTQkuMPyI9lS$BL;Cw3JxFkoK}E-`7$`3~cIvxe2v94^ zg5YX$;5{|e3W^%G24bWE+_HHZ$@sI~m3Rti(F#OD%nT7fs6x1{ajj&@MVDA7lzF~Qj)OWJM zrjVVL6_ve`c{s0tq+9fri7;oUpZB*V))*nZX9VB>U_Ln8Z26(Ox_QzWkU`*b>_+~| zS!DD?KImsKJ#za0Ee&xXe%M?245#8@^~%|z2Sya0b;NL=xvDdN4b0G=EY7Is61=-j=sva)<{W#+wb;Vo1p zv8JZu1MeR|3KDnK*8(vR4;`mf2gDro8FwO^@!I_SJk*d?;ges^Vkle? ze60jDn8!guT5@uS$@YOt#abME2^9p&eMG+f=c^0Rs(!~izpp4T7<;f86;<5I_g8S> ztu-U0IDGIiQNPpw5C@@90{;AeW^wK#Iw#o5@3li!<+mMm5CuVO&D^9hy9e!zd{R(w z0)KwTo3R#05|0qYwt?!S2gmt+8cSOf(%FI>35e{3(L zIwz;9rq&L$BOovYaqm-?0SNQ|IpjLbbVY!S39L$oizFv!;B{hHn2Hm%gu6O$zDSN8 z3;j~-C>C1+uQYofmOz@D%;U@UXJr`?Jy1Y1AgnQGdTwX9KbGX2q~L3dgPm_j!;$H| zQtmJ)FTFfi+yQuvBed{|9ozR>U!T+dvC2#&5;{?2@oLkdyu3d*D!Okrtuv9KoH`KeN940!{%gM;mb6jpS0a^dtQIFIsu1XSZKeQ&lx4A8dO6LCyA_N38wj>XY(N z0RDVAfg$dr+F|_V&RnTz_h3)IQ-+JOWy@~?_;srk&pPyb15YYO9^D3T5rz+AE%MqP zV|nF8h9eB;(T=GMX3aUzuG`HRp)oCB0NX_!@#PP~TwL7TDgb_{T)E;)E>B&KY3iP> z$mx>~z>B$-bcLJvM0HO8vg$c=dhZczr>}`0IDO;&w1H#ks^=OBQ#6V7s>)ARb>V>H zs|>wv>(TD=ksfC}j}P*Wlub2V_#nda-AWLO*APeo^v4Fz0{sRNF2@88jEe8p77NvM zGliDxt5k`Q0?*_2lyhGI-s`+^qz^<{U-u{tc2qQ0_}o^Y z%FisJs_w{BhJ$tGDlV7%dA2?m$F820k38x#c0qkcf~lzifBbs1yK-dM*x^Hg1|(x{ zv`{54D!L8Gro)7iL%;G^>`&H2SBrCX6$fFC+}v*z;3o^5*B#7x9~K zm;uKb3ln~9znWp{7U45U>l-QaJfX9yds~sZ`)5zaPuhb$ImsiEJ(E5cVwVa6=j=fg z*%@6+t@1W2in#jA>*_@)z|QC3?;K`47k19j^VU#ZP$!VS1Yq@;ynT-nR{y-RXOVRr z=pJM9e`N0K-!`D1DL)zg;Ym(>eet;S%so4wrdAK}Ub>o2ZeE|TkqLSIrgCA(IItgr zHhH&;XCLC}?U$;A1DNVeW(JR*Gv@{ZWN0F9b@6W%Idp2ZVL&wC*ciKv$hp>;#ha1L z;U1KuBed?3)sOIp9gbs~rd(oteo9XCxy3}T)_C!jFFK1FjBV-Ey(>N5x^ULHXSGvJ zOt_iG-lxYcuOcPm(csUcmjYvuF$N7hX&4soM9S{X0kQA?9W&|WXHD3?&Vg3FIlW`k6@g&ZYf?A6v6l396R!>X?n=} zwA}q8@Ao5d;EeG7*(0NxaGmVD|KL2KDlqmZF0aHR=zhwHVe3y}g_|BltDeGK-Q`-< zYR4a@SkDReG;DJ&HeLAQ7E``_X&oPQ%JAh%)M~Xvk!$Hm#yz*u&hT7#XV!DfL0QY& zfsR4L*`a8HM;&Gx?Qc*lHM13&GA2>p)Gb-kFaAx<)jsCw4DN7Q-(( zF>I+c7|qd_Y%s) zYPAG|T}c$8rGpeUKLy9-bq`FbevV#g(9Jm_Q@FRHbNbx#XD)9QYrjsZ8pxVkEug8m zUlZPwQLV)?Z~miC`ccZh{tE9Mh=86Nc-ii zYQ25MW!p=xpPl18XMTR?ApEuoID~Xrig}GITFI}n$2Xgo7sn>c#~gHzFzy+zCzoDD zP800|jrn-}G;+*Hd)9ZbYu)-S#OglIrM)E~sh8ypptwbzW1>JK3@`Ux1nHMO-Z^jF9~Tyr6Me&*Dvcz{KK^uWr;_cBiJ ziU7bSz~9S;H~s$n^DF({T+O&2J$aIFfrw}=ipTRPn$hoQ7!EyB>skBvwst&TPFJsLSwYDM7>EV2X$_t2WS_tq2&2?;BpMZlRv zpn^u#t7Oa&Q9DZ{HGu4h2Fh8v^M5erk>^qhqL4ZV#oHP$AUY9m)TUx=b{e6reApvC>s1P&tnQ8 zow|VDDT-8vo6+KFWo6=Fb@v}U0A{oHME)9hv4+&g68j)=A|wKTng!T5SP%FLWLUGN zkg&J|rK91`hrqm$*jXE*gcAMvbCYA~RZ>)g@A;JwGz4h@aLH5wDLKseJA1SRXe^i! z(oU8O7p?*=ydNzjhKmpPT8vcu#DNRl(F`z81kijDMG<&REU@#C zeN_+$1a-ha1g&)}KR)zmPf@1Bv>?<2^0n#SQmt>_z9AAKtv$i@qpG>G9$icc>fXtQx za8epj^eB0ZKhBWWA{z~*!WvQhcg zLIWWY)uLVt*>(WD;rR385yaHn;Kdtwg5u%qvj~9R) zy-9#7SOBSta}y6Z#8jZz%yV4CZ^k9Cii?r5B4`Md+R06#9E4O)uZWRb#ZTD%4C3H} z*mRIE`fRkuv_TCOK`SP;Pj5ke5^AB_3afo$(ok#b*o0?TA9#W|=)b<_BC~*a6ByP0 z3NI!MLYj4Gg=?Qt?UXvANc9C!)V8f`l0C?anbnA9CZ#||toAVWta zK{*}G7|}8i5ghTzKrr1w?%M!H(Fd*=B0xVTXGf^$$&1%nE?$&D)K`Swg&d>8S9D@j zR8+!alp}?WB+k;&jd4iQgSxTH+u&3Hclv2V;j!yv5lE9XkCddMmnfXfl+($3ep3B6>9406bS7Pp!`^1 zKXed-pqMOchyAB8kDomYVT7Pqch&SqzWH%FNtmk$n(GHGu6q~X>_2dzo||;KuUuiO zBdZkv<(!@#Jxo&h31B5`48K%<3)~mPRPLDL0>US-vXRa~ty=?wc?7JBtcy1mV4G41 ziLlqKqM}`sZmeEkPFjiqwwMYI04mL;vlY5r7V zuh8zY49YkK%;HJOU5*# zYX5Y@$_fPJ&CS_ivKOT`R%df~Olsu_eLlNhS$f5)pt)^8bJF)WFAm6pjn_c*W3Ueb z*w1HB_F-gXMB2NLXn?`&mHNK+KwLyup=}Hdc-2H*#<^6#xVRY6Rv8!=#4DixNzTp9 z4O&Q4!J%3SzHXR*0o?l2%s2n4U!*Oq06Uol>Zt%Pcq^+mH#diUG0WcK zxgDk0fBgTwTQ-($oA>Pxprqpt4=~&*>@H?Lxrd1`i;L^QO8NKOo&40$z`k0Wh5Yqg z>62&AGyq5foGqKjr3Hv5!7(wj z3%Bpyy&FFf3}~Npe+JWsvJ7y8 z2JJ;)gErR3VqhWh*Pl_bCWcO#+rd_Z`5ZcMAPul`+DCgi(SzF zfw)KDq|xUfM=dWd-cVOpH{I^m2RC;!QW%Lbbl0?w6a%L=15gqG(y?7}Z{ECV?5&aD zphGLPJNfz3r?1Fij?M!iJq>&!kdE{Veso%6x)GnK97+qcG0JjsUm*rz!q}ECYbMFG zf+>G%^&^j$I2ob=)H`ZyY@BKA4e=!e;&?Y7pezZPemVgdfgGU#$nKw^YnflEJx%Qf zAirvRo&=Nug+jc1d`uXqLVlIFICD$!0Yw-#2NVrhlomaSxqa@79Ee3`(VF~Ba(4?4 z?Oz!#vwbBK$*({EYDEAwtPFb1Y}9~wmRSd;Ij(Yh+Ln+A+3+`}%USxRnm`Ru3da@~ z{;`(`F$j6C*$LS8>47#vvlHr+;0L}aq7aTeb(Rg_kNR>!#r#1|oC4}ifd-BoD%-O8 z%HXXE751d)YuNFu}vs)zxK=@jo zt3F=3KLm062p}gpD0-LmCD&D~_-;Mzy z)&Y^O%bt(i}#3@(wsk^2I>S>UKi+7Xjc(oO9Vd(Bq13>B2?n00JPVD81R@W z-PgwRe2Bt=fudZ}j__6xNg8?luLnOkn~_JO^j@_aq50hU#TwfL*~;GU1wi~QBudXH z1ysQ;pk9#zTLBi>`6L+|B(-rHg6cNZ zV+r02Mv_M-@i~MYHQqqd=1xOEJxD+wR|bTNhvycE3X1z6&*S%4u|l~BbesX9v;_cd z@)IXwp+sp3;s^wv*Q3obIqW%QEt6Sx=YY4rO%1LGyc}xw1KK7iXejFUvuI8DLK}VXXDFP3Fd6kIKmZSo0O-rks~rLt`clG;fv>~mLu*bn`F15iE7&%vy}i_X?> zy|>*F;|}(%mBytf4s6q1$SY_)fZ?GsFz9XmSi1nV1vl0_AL!mKUjTuY{ zYSJPnCr<@_4VK%?#0I;`AGBk6hj z-o1Mzzw#R1daT;?+EtSw|BYHTQSTEpi9pc>3>76X-l22M5jsauI?xfm2^(VxF-=#6 zS1A}~a|uC*VL50IM^P>aB_wBmGERJE&uN3&R+hE%S@0_;phx9w2-&kMHY_sgM$%HE z^Db?J*r`E-Lp$gT69y`Bl;W;$+?OXua+PTOc7XQCfC294Z3vyAa)}x-aIqWKs>Ow? z0nk14HBN6T7gz}_h(B`yi=|NkPY1ya%0!?J0Qse6kpJQe^v~j;0SC(ZYqsn!>aKi+ z1ArXt%VZ6RKmb7LC^O2b*!VnBfQqUJrhwX|9NRPwv`9bP+QIfvY3~fLdeb)p4eL*I zM3D+h!9>0%zB)6#Ts)OsdULN?X&WlHQ7h`tY!0l%eeFIklza1pl+uJ~t8RBsc7z$V%7*)uq zK}Yn>UTN6d=R#VR3E<0KSKK)+%{zBup?}U0XJ2GM&TNFe^w}HP) zbknAC+Zp7-&65)t8{iK8K?#vD)W?4jKy-=at>+hHpngk*dbU}2W6C{(g5pKjq;|r; zJllUNo0!0`kJ#i}{6mt*kI%KG`>GbW;tD!6rwY0>WfgoRy{y_dzH4R~XK5UTRO95e z6OT2n-eNeX6i2y#-`T?$dc9NoE|`w3-e?THQp9>!PI9*M$+`N*Uq622i~U%P!Z$U3 z@Vk8bjW2i=hpDVWhe5w{4$z*x2)$l2c{9*qKMERd47L2r+IfGfDNBR^cRLrD6=1T* zy9(IB&|39ZNOX+%&6B!&dWwU?%dK@)3X;*#Aiwg9N5GkyL8CK#jV4S(Q`f{>h>L5rGGHajP0a$X(*aFm+R<%w4F!qfB6 z=K>^r2wg;Y_UnqakeiC z;1q8l7R;*JLVMZCZ+C+i791cU+1APNg0gpkbRCe?-zdk(dSDpO%QIq1Ux~SJ!d;Ng zya*27f8w?68%P>~fO8eXuHvJCJxx}t0ABh7G&2dP`?>yBN>}6*6&Yb!NeW>d z5r5>G))TzEzrbfBV3wIEpVelwfy*{5&(_xk(#|S{+)6uZO5}$>kDP{l;G&pVX-5gG zTJi~hqb%B(-UD>0(P4|wEASNr>KFh#-`#!h@_&XzSdpJH39OJ)XnsD>&*$DBqT>b% z0ia6b9a-I+-Jq6F08Ow1vP8Si4jg=Kw%H|2mqdUqro|ha)E%IuqSXL17E0I;gM!Qf zg)4)-2o4T@13iS_pDlpi=v(UJaI6qTTv;ZgB!;%0dH~`u%F4_VrTENUOgXflQ&Xiu(E3%6* zw1i*6@x8=}9e@`j*xt(qWv`&b{PM+%+y)7$il?x!uVrp{#HZ@>TGa<&L_62`074em zJ1ci&!G>Bcf8T#qWvXE2d&bu^HD-nvhasmv1>PHek;{BxHU!)GiQkegNw{>TowPGO+%i9bwr=Up*4jK$zdq_)gq0=zlkU^+4>FU=K&%g3uO}fF zydDjuW?#3Z@CRzv3kaxR|0=T|x(<<*vH7fmf&x6Tt*uSRynXepjgR$@Jiq79gNK8? zx+=_CJRmi%oYV7bX;B3WWYK$Vp`pWEKmHpF7+5G|w@uQlGiW6M$&Js5qSieTew`Ex z7!z<2hU?~IPrUmgbs5@$D#nX`TR^T6%Zs>c7LoUc8zfim2yjzbR6Ds;r&&Fe^FJkn zsUC_vg}L9`r2O5`Ng)3CwPL3b7y5=?{U3%Y<@)EXY;%lUa_aE*1XGq5iS843qU^=K zj?gypJs=y*9GaPF>icStvS&{SjP)uEn7>^y{-@yeUsv8>Ie7j1N{G7#um8G|GNISM zuP{Em{(WVXc?7Tjx*}sm_@5r}`*HvEL6i6X7jEjRE8v#AqkmN(O_&Kgfe8xJniGs^Zxg{-nI9)_V=yzt-bfN z*7NjKxbOS=UDtUY=W!nAaluH1_O-P!dA(vKRTiV=5!KI9vo(s2@M<=q1OMc- zLVMZrltehE5id6Jj?*76uM;)VGcr1LPh&h_^|wvS1NNo}ZrWVwA8=9K*2q;M?bDW4O|~o<85yq6d%Oh2)I8$O^M`9(lIuG5>2dqWIEjX!mI!GD$el3Rj2La*T^q&a zJ2&#|)Q8SHZI@D>J&VNtMZL7w*!c6t@`l@G(%a^m)e2n)wa}}d<%T-wc z;FTan2F!XG@CjzqaVSG8u=>_L+}Qf8xWi7 z>Fbw)mrqMeYq9nYW|yS)v-h3-LV0Ljl8C%zoA07`@Zc-dhPRZw<#BFI0rU1JD%?UA z#_XG#l@-6#$+zD@RtYI9^Y~%J$l=og8OI9Nec0$V=;vtY==7xC)agWm{(8NnyuS+Roe)Q}p#h4i)plas&cjYwQL|8s>u(!H@=D~744G<0?8EkI2W zdE1p6hcgf6w1p z>6`gHo&%CdOGf$UxEa@NqkKnFODQUffA(w#@@+L<69VT=M~)mJI|JzLBZi!ej<(OX zP5x}j5kUJ5pknPAU_;#)uN5k;t~-@yK7T)#Qj-NP@bN-k9Ix$lX zU}ja83eFMoRk6}`>nK7A=h;xuq#|H|-wMYm2Ci##1v#kfa?Vq9cBpy69K_MaM zcKhGf6EB{^T7?O7vs-~V_?dQ>NeBu^UBaQpt2_t6_p2d&^@9Xg&h=*JSwS4#ot1e( z(`fhvRkSh&KEH#u2)*L(Tqk!;D9I}V9VwPTb%ydVfg7^^fK6xz)T6Z5JaAysu3d3( zV%eCMxX8AC{XQ02CN9}9FfrFLQ&>fPfQ5Dr4qXp`jU!`Xo+1*oIA5_OkpNx=-Pk`_ zPsOyfwW+LLvcelBN1lC`>o&aQ(`Ur?v0u#@{q*S*fwPpK&DrK>d?|EH>?$BrW6^gZ zBl20#d0pNarXO{!-TL4?x;{7Hq1RG~3IqpZ_3TT`{}XVKtSK=L(d@ltRP1agr z*KNMoW^+S}3*r>AfH*QFT6=n%f6hD0sDcxi(Esw_T|v!|7{hk`OOLHnrjZ?fn6%HV zgN0t`GPbnDr;qWOL4Z{NoKAI%`*OUH*~@;F#Cvp;!otH}AANyQhFGO(}`KvSM3!@f8+Hns+Ve}mmXbNq)@{(j{vcLn1UjJ}nsAI3b2(;LzJ z$5xd=My)6jH=$dDm?>k>BU#P0+rYpe%Uc%X|9*XZdYCiZhE8^t5=&PXhoZ+0J;m2P z7ZiC6O&yn!$W$`Zm|cJh#OSdF6^5Q)d@H_x;qLtr^F#D#spt0bGEie~Uk7UuW9G_% z$lHN#dD>GSlnRtsMbDiWd)OZ+`10s??eh4FxU8{p+<{ z*XtFJXW2Wpx%aYOApc8##Ke`5J}4jq)rj_P;_<;J~Pr)LHpAk z)`c~1-yTQzJ$R$yZG@AJ?mt-Z1FdCPzsj94g)5q=TgMeZgHcTC-vXiGi0@#dRZYm= zh2>1Sk&(#wlq@he#ifbru({#@8Uy#yd1uYfm8TvwnXav^Fi5l>^u&b_ z8}gEnv~uQK9NQ<)+eec1H&AXY#KT(Y3VRLhHEia`He*tR`2*Ile zN!wlrgnq1^0O#J*-!fbtUP#`%XU{UQwt|~Ce*`7!oyd4lis!fu=Cn~pfkt~?e}dFS za9?P?Em*t@jS6{`$z7i9vm3!=n><{ZXK-fI%L5+U^r(R0iJSs%3snG4Zw~I`u7vN` zYjDh}2yyVvp}qsI1->INgmMN)THG+}2%ioKv~_%DzqC8yn|;nET}MFu06og3@CF9_ zM0gLVAhkRU-u)h)3O`{N=ghi+{hEFHhgQc#O*0gVw#=TNkK)Ij`CaLgK-Kb&r~bBf z=kNY$R34B(K9aWdx^R*HJGL~2?V>=PIia47h>b1yA|HVA6{vtTqKf7xzMTL4RczI<8yF#WEfek@)r;1#w*yzA%Fvuiq+aQ;WtC)v!yFAs3F9|g=p{3VJ0 zBnp{lr$3zxWnMrtDx9EJ2u@H0mH}01pn{j{3=mj3)&CVI5J^DyzqJ|J&}VmHD!Rc<)~o-0&v4e&*Y@VpHCIP3F6_>AcC~-& z%dpC|<;(M8Mf;`5Zu^J1Tikdd`E#ri`|Qi?6TjVj*U{V|C1Cmonbdwyy$tc$m*Ot= zkHg5HNxSXz$nrG5zEmR0KU-wq%b)vOLp;4BXm84~1~rs5`tvuVqxYgcw3bhr8e0VH zz)@CG$MwZPmWQ;C?gLn^h85wQcQP`B5d@9ElCCeNdYF2tJWfc94Mm(9pa>uV=4xs! z_@z}q!vN9XfRM^ejg*&-;+E{FuhlRt8O5jh(eQ1DNkql(?4s^>8}99ntA0$1Ub+ni zg4`a}kE!-7m6wfie*Awc-T!Hg`?m}w?{(>E{r4L8|5K&Qe2D$3f&ULlG4iTAO$FWe zYoju?P4(wZ8!r(IJ^RnwU^e}aqV}@oPlr|MRLlMSco{UbwFLwOE`i?=A)i8jo>34~ z5MbvGGzE86?6&nQlL+SSM+bp!HF=qFZB^B|TfQzV%@kOUTJXr=kmq8F&y%`XD5s{~O!#Oj!vx}o5W7T(X z=IW<6ylt6yj9;eV?4e_u&X)@m>9 zh=wUQO^bBaoip$PKvRZ_S3n@8Nwy#3gJlw_XdhKnR(hxRwkC~yk^Zu)$0Q=PsydM^ zJsj(SV*#mH1;&(MNg!jJ#RCit)tVLBt>!cCu1s8>{Zx{{8l*aH(3ppV;0a``7tHj# zt_6y3FRI2|-psSSUB%o>$6g7Tkfs=?TVYrKDF&2HpF_eK%@Xg3SvP4M*3YEST4NVRuFIj-{ zJ7DAD9jiDfm+-n)>MeL^>^O-(Tr#NW}V0Wb75lHtt`Z~1VpMBC1 zK}BqWlE0Pt<+7ZBZ%^~$^_zwL8$lq6V`f`afzcXv3( zf$%4!Z*7mP9uiibpSpLOsHo^VS|8}Vo`MJXUh;Ai%8>hz;w)v4xsFwHu(a8%sF=XZ z0OQ|1Sx?9W=6&5H9YkXa=CShKfdhD)KoU=eSBSj1^1G}=10uFES z)(AmqwTVcLkgw=N)xH)=0;&I$L(WNXxV26w8mC4`jKU%Ck^$#B|(v~<4>^ab@ky=QzlaKErFN0M{ zb4$^4E`Z2P@SVtDD4yt5&{?q$Sc-EY2SIxjz#z^I$;MXH7kvmy0hnbD`SV*SkYz5a zy?St8CKdQ{n|X0O;7&~Dqrw$_AV6|l2aVB3Ug!CCp{*BT1?R8P+0*vNHOm@wu--wx z31gWM(d=K(r>44mQ8*1r_%6&DiND6an(Uvp^Vly23q7zTzQZlnp*dI(VG)sAvX1;D zvG^`b=lTZ=YT9ze{}hvE!;hs`RY5Ybe#s|IV7`IDI)c10(V74W04k?%RB-wHI;2Mn z7F*nBEUrB)I=Tw)Ar?Q7Kw&^1z=YQ_S~znpI?GFH65b!qMycWB<8!7n=b7?{)bqXn z(gGwUB$R9K;5>m~gR?-g?7YW7TcRD>so0!N*Cn=tPzJyL{0$eoCbKTS@|FLx7p8P( z*RCQqeL(Bovw>t}&7k!DRbGN@$pDMyKXW`+h=OFt`4e9QLQKEBbE~T6?BMnDk9|H^ zSn@7CXifTUTV#z7FD)i_gk?`ZXup+bH0rM-RznorRjBg#&KO^T>qC7v?TS!V#{QIEk$!&*&V~Zu2 z115%aKIlK(jEmba`+Re7!_?i26%qpEUFr)s!i1Y}2F7oY9$Z@=J@OmgQ(j$6yOJhw zi8W?6J&>Y|4GeB;;E4}x%L!M8{ic|A2Fd{d*zLz_!n}PF0nSE17rjS&l-PnH?*2k= z4kX_su-5&Ij3Dp?w_s{aY}bIv*ms;_5sG)923o~A_O*l^Bw=U>A%`9fbbV#9lGY?B z0}q&<|FGvzU*mNNCiK1;QBUxR+e-rcla?D3yF_W2fM$jv&WGmQg*FllVfhj`4+m#a z3gpQU>7_MUW6pJhNy&?_r%!=bpTaB%-g8=L#mGU!dbG$*60+Kzm+pn- z5<-9kCj%i9IjV#YLLltCyjq7)FkR@2b<31YGo$K)ZAvUEP}1?j4y1DX5x#F~;OU|S zJj2kUeuu>(WpdvJF}zK5Xi~XB)jVn%Lh1MwQX9{~qb<`JCY~==G@}csLPD^1^tKLE zUo;jVGX4yHiGf;zCvBtr1fc3;r~_K8F(PG!ut`J8!=w11@ZF}tnSyaGX*)sBTmjYr z)j$X4<&%+|az^oaYu$Sj_F>ZBzF_IWj=!s1Z~hiN){Ttoq?spQUJ0J(Sh+S(-RdIk z9n>Ruved(*IA1GbAOTIY-a7UyTa`aDudWy^v+ zc=S^{v@rCW7f-v=r%i4km`6Dgz0y$hxuCrhl0PpS3_76E zqd3grfy!Y|!E*<0p;o1Utma>53~Fr;f-{kSo-yf-(I8EU^9+FKhYbwaLiPr#XY4M; z$35LvG#w*+p;|@n$dO8{Yc)ouIW`nyUe>TTZ}u*NABCyVL2p1w1epunFa*YlE47h= zzwUU|8!wA^c0t;C`_j(U(ju@Pu$I32IiM?|_X!L*lQttIwk!@Hnr*vWE=3U}= z3>!@H&hX(Z^D>aCkEy&xAx!+Pm$ux9;|P%C%w{cl;{F;8KZ#v)&o1UXP>-0{4XUQN zp=;7r$juKL8?MFaKcc|F>-T*j%PfrA?kx z>ZNnK$>l2i|DzsLa)mG|j(-|UKy>*3|M%^s|J7LgUoZ6EUqYJJlHHiJoyZ?~d;9Y~ zW)loOt!W?O3j!38P>>=@@f<+JB0cbeo?5ZgI9jCEJa%j&LE|_wiASP1 z?*PM8d$_vhz51IP^!4;qAR;FmEp!SfxGr9ez~O0;Op1y+ac`+ZrHu2czV{>@BAq(F zPX0|!j42BmKRcreYq%)BMggBOEjH}wJvUP~)3K!|%Xsm#-WHTj&d8{(4I|B~5?NF2 z(byP*h)dl=DNF15CwKHAq$60H&(`)=6gif9f4}a0Ib>gXvF~+Dl7lr1(iGlKxO}W7 zFN6QL=#nv~Yv-~4!%Ca+%+Hpk?ty^>Di~IOKDkpJHjPU z_3!lDZNRYf8{PcSgyDMJo1T%;iEi++@3li_np#dlQR12rt{uao>ERsGwuiTcA!7SM zvvUI?@296fZ9a#VGN7kVX`&sd<2h)`dVnSGTG?G8-`ICtH?SeV3#^&~jO-~25KhJ8 zQjZ*$YVHeMs}%pRfS*|fx!3(Wcl-!74GGEi^FQ?{cxY9SP5o-l=7DsPk7+kFKSm8h5TR z5R`72%+dx;y$apz38dg1oZYYsT$Uk}M6X(k#{F4hs!u_rTzm}kJ}T+NGhfYOGr3y?wlAvZsbFej)za{f)vFVr~!{D@OD{c#b<*n5*{9VdHX_} z`!zUVO2K%q9Xptl4*(;i1}Ft2Gf@essU6To3(xq>3yiA|=!jOhvpZjLzsaK6}Vkba147 zc^`T=If)TKi&WsNZyHZ-*3{CX4q%@BJiWaXY!Mj4N8cw)78Q}`JCKVrrGnY@{{DPF z%vk8`-AhL)nf*3|$h}EMCT7p|g?Hk<)7p1D$~QZ%8Onk zt1s!x0asdkLip$Wq#E1?jVHOGPmDOPmd2O*OsrOWWP6hnC zlp@(oX~V7wrAYg&4+_#^q2FOaPJ<7%8x(vTJI}C>j5KnmvW@geW52|CpYC(gAO zCm>>efKm-Za2HxPbB5?2JP2!Yen1E0^(QE*aJz_(mezd1n_2v@pBQ*a$UdlFj*Nd4 zbTRr6PqwdAMH)?kKheZ}83|JKe>xhFu;BMV@PPwli`70ujhW42<{u#|N`Hg<;w4f6ETB>}9%cvH}pvu-_t#Nve^6Asy7eb~%4?Ifu zNMEsw8wvysO-(-3A7E1e`@8kT(l4ez?=;7c1V@BjW3rW$9DOztuWM_c@FPVB$$^qt zI?fS&8-{iwtP=X`mtX6M`XwQ5lKZ&Xiuh6+970cr+W#kiX1j*#h1k+}tTb|KagXzM z54LXJr1^Q5ec~2P6>!FcBK}()nlo z@sHLe1+$O`!1r30zp&k$gRJrOx$~`E7tUol-B6l21-Gv(y(Q7jpUU|2A2o}hA1CQD zO2m-78j6VnV28F9HC(>AT1WQcC!Jl)X~q7{z6)bKF!ZWNnNW|g=#4i(9_nBmXpc#5 zIgG;I+J0gMXy_i~1wy~MOn4zYLB{m@?b~3{T?3EHK^pu(_#b;xiq#V6jnrVvwZ9w- z>HzgY9qdReaRg*JuK*6^uQE`uG3;r+mSm#=!g)g3>2DdKd4Oy56xB|3ZH_>0RLLT#}9J zQudRNq*h^PqkR?A)}wMQLfAq?Z^fA}d}*{Uv=Oqrtf#0`*&)}$i_BP|VTLEZROf*r z_DO`uc2;z_ty#dJ5EPQCK>hXQfi$my}j?!597sUxb+ zO_7^^yDVVKe3l`p<(BjnJ2wblNG~6F7ijA#cDTo%pHzoerJ$|60SzlI(uPIs_5$zr z0}6(FkN|%@|LFjd4P_V|=3z|cIAS^ovRy8G%Nv>E5$3%&xNxrl9chL7^(EdyclkYf zTtqGW6yWsgDxNxctDORLvx#@4BVr)LQ*+0&w7EVjEn*&pN_^F_GAeDP3H{!{B->FP zX!_?m8^a|tt(M$&!C@L9&5uftAE?_NZ;KtFqdCl~O0O@*C}0Mb99Spg2C?65QVwt2&w&^ z*2``1dl#4Kc|6ZPn_sDTMpqB2XG$NFBE7Iv!*9{$eJ%WgcY^F)uIwzm)O^AE=)%t1 zR72U9g@nXyJW~}}Z+jKHY>T!W`b)0Q-hp5V#1)kTl4-SCH5yyD}YsH&nJa zj%o5b^!@W*dr=Ni@!~Kjqft^(T@4TpR_4{R^<<-OkZSuLp)JM-j}fR{oKc0o2c*Ry z4^i}NRABeR%nN0S$A^3b4Bcvx%*`6{DB?(2LAcS+`F5*H5v6K_Ii#jOB`v6%ozQu4bcc$@Q8B`U{SDcZYTo{P+>fbQztDBw7|491%$pi(*@ZKX6OML zXvV#{nxwUlTzmF!8NE0XoGbYX*P1Zs>8(Cq(5#;E;N?&u;3|Lyw?0)*|GMcp^RnI!pcQY$_G*Gz{;$F&|6^40 zCznBa(J)EtztEF;4yZHz-G-m8u?{>_khQ31F?x+pyc|73eB>G9)*!6v)6w~g1 zn&(C^u{q<;LQ5K@Kw*v`l@Fm-V-%GBQcsGadCY&*qsh(=2bhgX;vhuGS3v|k=$PdC zHFVxx)KfpnLv&%%cQJ;bIE>{2GZqY&F>;_G51G(x?c}BvXO=C@)N&a_<(~9R6*&?v zc6iT|fW1!w=*-eq$mb~5SnN7|hVk|xy{3o<$6i~fHW88&)4ZHNXFy#A~Kfd z1Do5Au4#nbPtE;z|nP_K_-(*P$Tx$$s_S zg4tdEeR7vY9sQDi9G3;if+Mu9A3t*SK6iH15vlWbXOA*etR84kWTWHbTdQ7{tKjA- z?;XmpJk84Nw8jpD+t`=exr*<3@X5%mCzCh0Rv-rBCKY6z0Y#u4KGX8}B68Nh02#uj z28ai_u3)JtNL^K+(uSPxI6BUxUrV&8MA(Uqu>>=~bJF~y#&$izbw7m#N)Q=VvQAWK2Lq-TJ25MkT)#+%bg_%F*Bx@prlMdBa=p%A0&34I5 zT)%#ua5-=xQldaKtw03QxcGx|CoL@iiBt-OGCInn41C^kbpupsf}9~vcqcRtttVne z-b(r6;@(*Fr9=64UmdPiUI<4g`F&28<=lXca&N5l4JwkoOBP%vXA7)rh@hO{FU*PW zWLz)y1GK3SEK_@6YTMb)vlu5S9-NHVWfUv$BZ6G`xnSS0LlHoL8!TyskXQ-6Lrob) zdS;-lhVd^+jlcl~+UzqKG+Jx*_E6I%t!kfDICpqRS1$Y%t08k=Sx&p3{jr$WFG{uu zatgBVBc)6l->z5AqOp}IP_{$&N!VguhML!}`Ot#ITmou@*YJxt-Sm(H zZ+V;XAA54mEkyEEr5KPcdZSc_2?BzMcj}(3et-B-Hj*{^cSLxL0I^)f!$ThON+6D_ zWP5+uvwj4_4YVNHME~mx06x{YK37~( zlV0s{+&xQnw!La)k5>e+v9K(carjiKW7?4I!9O>znoyyj zxg6Q1K`@8;T<7|D_nun-5v+a?{8C|7T1LWkzzE&R6{SQ6{`BO5hYzt#guh3oMw?8` zObeDQ+sNH6L2!K`D*Y|uO93Rpx<1yY)t8!#&~W%e7i4N=?3=glfR)}0N3T`n4Tl5 zSQMAX$yfsswVv;93R$K6FtJ?Hx#vqx$1!QZ`B`TOPbqnbw4%T0{-tPA&crczZ6D$wU1Y-p0t(lW`K z4{@=x*;`pBd!+hRR$kBwTPiA5^<}L4Xj#`>^n1dfnn%lUIV@`1q?fPn*RQ)>RaDj7 zlzCQd{2|thP54}9x~P6~R?(bjV1gxG)|CTqQkP{dTWZLof_eaaPw_(fI>y(IBteY8 zf+Yt&=Uyku0&=!3mxeIWQagNf5jdQx0OIH6v}HE!59(ue+>gq^7Vp?Fh8cV=xAQC% z9&@Z*>xHYZj$P!DBy^np7i@pEGyAvYNanOT;{mo}Y>)Ed!q7yXq|wsbjlXl>fYXuXv z8^4~HoEyx3e)(bO3!g^T^|9lu`;UgH);ueVJtaIo%mzETD{QBkh_O9ho&&=ldVZvpi@8mVT2ZhlpkZ0P zy6fBe;1!*d(<9SfYt~+AcRqjq&xh(ust-J{*<$A>ZIbe|e23S8W z|L($?c>o4Y>jn9{lrlY#Ft7dEWQH~{@K%Qg3&En7X(4@6R^|^kjfE#3}@)R zM>A_rv&tO|7dh6L8!{evIlOi@bB1XM?-0^PZ_jsch z24+bPAc|-tMo5CbuboG~|2}$EWZW3>=;p0knt+{1E&_6Lw@_PiJ6BDhKE{xMIbo#< zg1`fRIU+p%3l~jIIs?}hMMp#3?(qe81WWKL?CinJ)=Bh=$RHfyClH*dC7gTSawh*E z4K~C;OWdJ+S&a`4IJg*08vgosd>0qcVHm?am=yH*!|R)dCXLTv4nD*B>b1`ec_GM! z<;HLD-uun=o$Y_9RPLEN{+hiUmr;Q?J3;DGE;;?qE4K^%-~HEf~ zWskfoiyj>&TKl)J4D2}5Wh~L5z3h5GK+Wsqi@!hel5s$CT^*t6p)m$u!d*N+VS@bo z3i2BbAX0oxW$ZhCaLCvQl8~m6`Lsm$9*(#pQoX|6 zB}p3C}V~tUbV6RdMjR{AjlBiP8KM!>`xT z+X)v^84E9qs2xh4Ig0=ymt0brmwbeN^yN{zR=7H3?HRuHco3f_6|n=tt-~Cv_2=b~ z-DxkqT5WtGwY2WtyGr)mV4=2pilYZ;WEVOs4e%Kd7?{4jIQ0qQon_WNtfJ7_4P#?t zj%JgQ1J^LRwvtC_KX#m*>B%W|<<$?I^yXN3>8C17d}}Al3?e`6h}VC3-CDamL}2rZ z>)BSz*YD>z+qrW4q_W4y2ICv&5)01<2E^N99vzoLkI)xe1Z|0|Il5L$$Hr0ErdLUf zKIq~myA|#}zvU;^P35rf-@}yCWEJx2YMh3{nXRu6c+HL8Rt+As4)|2PS6w|>y;vq> zYq->X4W-q-({taS-t?_+-u2;xK<^G)li&N7%dTW$4j$N0U0PherTdi4!_Rqb``n@< zPVF!W3ZX~2La7wCB7`Us)5`s?rVLXhel&r4)BlU8G z#(UWX^MLBaV7R6tQmL!!SXStayRq=){;7xd5{3pLijcjyHF^Ec!TkblT){`;^0 z{PF)ue|_V+`3n_w!G}QpC}Th$JD3^nQcn$c>bt%E=4u%15tFc-bTr_fA*>bq~je^-y6|KnpMchVn*^eG@HNPi3K>C|LFb|$MV z+<9~z=hE&$z?R5>fE`@ez^QpUo7kB;WjW6YeKcBjNj2j3<{S)54Kjt(sr$O`QKvM! zEZ@5|EMUh>S+yg>-euC~_LJpHwbYLhW%X{}^Y3d}r_^LTNXzOyx%8(x6Fjd!O;=CM z7P)qx@J*Y%^N5SzMhJh2r}AUXVz@&1IG6p1dGlCCJCFO|5Sy^Def|nMJm4#Ata5vN z($@KPc_(}hTKpWHB_bIAa~^wxKk9TMTlh`5xcDKGVLTnlp^ zkpllCJL)>%$2o&NrY3ER@c4MIkLJ36w^aTBwotQSwU?KgG|jY4Q4fSVKzOUUuLg4M7Da>sPt8avU& z*o9U4#`h@11%&8FhS7o?g%`*u;p|aQ(D^|aBI($vPK5aOiexStVg%W<6$qf$~RgsM3x-5wQW* z8;6Qk(xQ}d4o-QH?SGYT|AL`hqJ<}eXprw)fY(P53nw%1*~JS%zZPTbQ0J3z*bCoW z)?ZY?hPx&2A`Ddc9rDjj$VssHaRRlB`Jx&WH$>A*WJ^fsGZaK5Ji?ku7_Dul5KkcS zFe5u09VpC$kX(p1h4h2E#-{sB>%rp}C1K!`$n()HqC?N0Op~!&6Il}u)=30t2@y2oPZ~)Ivqwc6JvraJJqJ1&oG<1~1+bR4oCUw4=!+bhhVF7yO_$axW`9Ziw;~ zlBeZ|as6ZG&783(CqsTY&x0f;JeG3Z0NI8cuG* zll{<`udZ_y-wV(MnzhZliv3|Oc(RX-%L%WHTh3|j5HJQ6*Ae5b#Fqpjb2nUbh?yse*#phQA%L3nhewF;$z=S5QYyp59yMYC_2H4_RU zT5up~waU#dFT0`Ke}_&Q9^#`5AS$Nzk*jU8H+&{F1Mx>dA4vfe2?0Z7I^vPrTtDZm z&bNFLc||wz3#kHIJZ{2p!QpNnYbHp#+Ul_exD_*7DgP)Gkcc6pIn@L5>ac?VOv!l^nO?ptEd|# zW^C>?vdpjfM21qh0bFupgmOaZ76Pe&6soaRnHduJN^@^MoH z%rCQ2@SF$^ynLBfe8-XLWgW^hBK-35g;f)D)EA9unh3auR!$pq7a5}5r#uthTquBe zhH&k)0wx6ha2mUfA%CKsBlkahDe(Z8jnU<`gR43c9r*0dVS{EtvK`2E*@TY36d;G+ zKY$*Suzk6S>ScOo`%#+aPL5%x1CS7<%ZWEJ;a~Y%H(2X~LG9N`yM6?FV`&&31CS4( zBLXO%Do_h7bo%EgT>$%0CGIoA_%GQXy2ENtPTR4^Roo=pj$63x-_O)!jEes`n4amz zY@Z|dwq$2XBth}T<26hL!eBF6Jn))89Nvd-1Xq(O)1Xd6x-yPmN~_ZTFd*8d|$XSXqdjX%rJURDSS=2qH0yaFQJ( z;sBXi0fF006obxxbM{2_jiX8G<86)qu# zcmvK9fq(rbO%KoG;1*yvPny8~Lh0XzGONO+OwP7jHoLg6sV$*{4x;Y^#UmZWu~v-V zW~cT35DWN@05{)tz3~^zM0}QyLS6J2=HhC}VTNx5G`esZX|i4b;t|@L8}&^d*j5MZ z;Jy99Or16$B=8=>5O7Tn{t92O7N{X$l~vh0Mg)S`*?Z6If9M*t^pk0rHs|CZZ$974 zm*T+hbn+Uj_q9EoN-phetm)T+ILPnFd;Ib2LsY){AG37?Z-jr+vN788&u{SY{(in$ zBfG|LyVcw6{{Hr5-PPY4g^cesPR^}9+B~_Hss8F+{VQYXvpSg@V#rGeP`_TKH=I;E zd31g{D!<>TKf^0}M%{eUDEm`O(A1&n=|kU_&`r2h#jh=2`$W_?^tFCl-TG+AIeNzE zP2=QLtI_4=$;3u|-la#tYy>kd_+VGNeB-=gf^H{f+k_4?Y_yj&#Xr4;a8;896B9KH z)HsDPw@|xpIHg>2PCw{H+%{NI(z0D1>;%O7(c9ZRW8~wbg#T}MH<|eTAUiMWZhLF7A;xmFR}GL1N3oZV;neL zGVzB>Zhuxi8Te{>?)>1wETp207?)dkwW4h`Gv$Fid*eirHFpg3ha<>q%`+{Sxqv*= zQ0M3Tp2RWWq~R&^jlJ(~*(d%Pc2M{-f~tBHS<)jPVY~w4a9f4N^kc+WPqWN@UdGSw zvc9pp&-J`;z1D@khCp0&`|8C!_-_fA!ayct((ft;AcNMydoY-XI9KTG^_v#Ea^bjl zwWmUHeM{75ViW>IyxO=#@+$V&O-%ITl1d$@p>%7NWIxOofwI8g!wG_idd=MY8MvfrePgHJ&XVk z+(QgqFiOY`VC9FtJIGRg*w8JfrAD_qfVBOsnLxdh)DK6~)eN+Re1b>w^2xSi%k*JI~i9YQf9_O2TcApsd-Ul2xUcV0uS{J81_~h*bf;_4vt?WCEXj1l7T8s+#ynDYr-#kr!9y^sLIBX3WZD#M*6H$yHkHtY&+5>3Vs6v?77lCcfN5ULdk z3JMyGg1zxPLqyKF;1XU)L~abNv(D+$>G@eNT)DqBLFy2TAK&b8e-7cB%#;DpJK@Z3 z2lG`t)ycTjZy+iZnB<{O`A%%B5EQH-7a(JHpgIVlPn0<5ue`-$Ae9c7XmrW~K$GEs z>38Lze+iq|QnXZxnq|-bWPvjReOZ@Z@l2l`EIH-yCrc(!2zi9jg(#kYWq4@OSTkV) z=}hY=GimqW0fCexem4YFz*B%&BoIV_+~`8r0HhV3kic9T8FL?37nH&uss?=$yidll zp1MpnD+*Cb!v;a3>iq+I9^w=9^d$4*RJAez7o-yiLXwbF7y_f}$PtOkM}Inxke`_4 zy@Z`Dg%yD&^&N;o3~Ik}F-!Cs)g%^)7{4okRZ=S;JyDJzr9rs9di82#KYqf8qmP%U z=t=DWYMxk5f*N`YNr~#=!)wU4L+jfb9T)fxvHBrQfh=T#Q+O>=m7_6EU_E*-GxvD; zg{}~`L#Gt4Phpom#k)02pSUBTh)F?T9vg`mC6LY>3b~$TSIN*AWPI@u?1ls4)%#3H z5%GLIHr8uI%s%gT0M4X@B34|`R8`}^WGJ*Dy^=p9cL3mB9qJyzLmSmy{G&@D{5x$7wqaXg3>oLTuO?21TpwltF z)9Z;>P$_hokkntiFaT3cGTDt7N-99q9ONCLtxe-s-`j=vIPO0RR7c=)CD?ZwGT20L zD6ytOaYLpjfZilwzHL8?OL1SLve}Q~)eWf?GuOTFcrORkDe?6sn*|{Qy<5+adVToo z7S-$9+GhAjE-^$ktN8TqOkmy<4S$kbA7ICl)*VI|h@Ddo%3;dMy7*tB7p8_SO`A_3 z69F7ZIsK>+?jJzjLz#FisyQQ@SLuTze>nfz;j(=Q4b3wwtp?Ui2ulTzw9(+_qaS>5aH5YY(Li@rVyEHFSLBs=Vm{c@vG zAmhPSBRgg)tZQw@g&xung7={2?}n|JC1NVx8X>lbv;;K=R_rbc-ebIhXWGF$w7!`9 zxi(v@@Fzd7R}W9x$G$bIxp#wL&fppNWqNZh|&hM_J-A7W1}J?)#m&L$8=G}51Y-?jIn=a zKMgtmXyhy`OqO^iJ;lb=2OR6SNyo5Bn~mmQ_ERtrgWlWT+T2ckY`V6d0Co&wY%a3b#HXuVPEE?v`_-(;Nau#)al+sp=)TZ<@EC1r0?&#whSv1~TeE#g7s+}xB7OofJm(Pi$KXJ_gs?7?;eM9kp63)<2P!m-H8Ms9pCv`f$i%Zs_ z)b7{rU?wRFWrKjGy6Ryv%!oRs(#0&B+;p_7irqNR_BCqC%rz}IC=@R^!!40KOn4Mv z6dtu%6YV5U{E|io*ZvgXUpIW!QKZ#tt9Uj`O6L4lF7#1;Wf6vR=^@G&UVpK^ckITV z?yg2eEX1XM`g`~|&(tw%g$cDPOzIWYJ3@6q$QaMeK`FgyS1qj-kNORse>U;(C~P(x zaZ|p;&)*(JS9rbVXgz6o@M8wV22Co`U4t3zFdQ02z`0Pn(Y$tcaw3Lzz>#pwbHBL( zAUqNQ3eYdRcvKkR%LbQf?2p?S0)_)o9adYC*uG>AoD7)}R0_N1n=?wT11$&dz0fzy zu^PyvL6)e_5U~y! z88JZCG$%>Zfp^skt7sfS0enoT2O=ST_cVKxA&yt#;i|TT3jpl56QGD8Jh6Lypuz$! zV-H7Rg8Gc;B^L{;R(PDUyTBu8~Z z#^@+uMy4>&s)G(S-f;Se(GM$1xC<_{x&(WAikq{yx)>u@9*ohB;4&WgY`_Bf0X zB_SqAxsM(vhGk$oFnVbPo}B1{upH53a+j#vKprzxI}&V;TI*ESE8&lQsd5LsAP}iNv&A{XGL8#HEN|K&`A*8 z{HgL#-#9rtFKxW0&vQV1au0|C&_%J^d?_4NGu3jypJz2Ee7cjv%gJ=^8Y(B#d;#5(A++%Z3x$@E)XOsvYv?rn?{X?@Nmw1w8J0%*I0 zDP!R^GTUvpvW7oBHm-c;mBsrF&Ie-APw(Jcp|_RIN@ zx5IoOvUl5vP*jo(%+Q*$b$dInUvmcTX~QnzG~95>A+vUpIk)=hf!ot&OP#{H$6?MH z(bIhGx`<9-Q8X@j^Hi_cX!8V8JR-Lwp5(_oer>YPn-Qrpcl>y7Sv4gfLP~+CTKeaoUkL|C{`uFh|2zKr|EJdsUu~V$ zsKdg_8osxZJtg6e9{@(G$cVEAI4o4*ZT`)Z^+N>*eriLWdB*w&4lU(L6X6zV+L0(P}3T?XYx2X~y- zpsLLIE^xU%+K?;#c6nQ4@jWz&(I&Q_30%K_zi8vRW$Ul$uRd;PAeLP+w*1$ZCtF<1 zwq30`MQ4(;^V>qlxeeP6-q<}JNAADvI zY{;RI)^-7F&Rrmt0(UBXaR$*REpH@aE@ty3fF26ceuLer5&V>QaNk#Lz6o>Yo$o#b@{Lk$4sv zM|q^2_$PRq>7j5VVXJ_$fS-LPWCiXd)JW%QnO(Q@;{4ur=f<&nx4v=n+~YH;FOmv> zap0b&&EM|!kKirdqD?Ht_iswdkGD~tM+aFB(H;0LMtE|5r@fN7^QOP{7iOK$Q~Y?e zhW%ayo#FYtC(q|sOP&tw5&3&MPY1lJh%a@{GVxV4d3oV|;KaI*qwU_)DHn4_sT*x7 z*DRf*aJnS@8;P1S>_hi+==u%BeeBjXjIV93J``p*z1qC3i9=E6cth9@gTfiI6?R;W z>|Dlb&EK_7r>Im~IyyaDEC1N46bH$38Ebm!81qKEoifemnmP{`CE5jFFrQN1eVlgh zkLkSVvvM;t6Q>L^?^R@bygufvuIX0d1lX44wv^M#TldSGR4sX>&*3L9V(pymqS^qT++Rw zg!jvaO)+#lO%@Ip{3tETrowc&*vuAZF9_Wh!j&q7%wxjKp_-u-Nryk!(L!kUru z@cOdm&Ij>356u1f9TuE4%GveAd#CzMm4F4aFKj&L9Uk`Qda;+H6RdX}hnP*Z5{yns<9J)nTvKDWC zhJ7FXd3LwkPjfmapEx7xoeKR0%}(DBpI;@#^7!7|`L~pX`52m)y?a*tshO#>PpWvS zJanMM`Ey6g+|SITyWel@P(H`~*7xi7fK2h9s?R)A@9rsQL)meg>rG0&S!v0)?O}<7 zaa}DeQPrmGs{>`ld`#+&2wZb$7x!4rBmXueCce64{w|Mde(dkTo6i@cm6(1t1^J0) zx`?Z{B}sNj%0=bhlvmRjr`-K*H0ph7|5EVi7B19k-Tr9t1H)aB6{G#tD~0Cm$0Ro& z{;*6~o%b;3ImH~7{&j4N>=JL2owhCEj54So|?hdkcs`*$^lgWn1ckyh|;M9`1P*!?n-o~`}5{QN9= z(XXqsMW2fiTWN9rI1`PBbmgkZXf@Rd)w#?6t+ng^hUdFL>{7_ujS6y62vC&e_j? z_I^%_lWGgv{LTibihVlkPYi{K?Sfb#*RNX@Hni=~PZl*ib>)odO6w4H$NAE-d=NAc z5=pW8^*(%Fe_Ji02|SqQVVUI@{Ayh`vj^7F0&;)07H21Fk^W#3zR4=d72Rb2#!a}* zf>aZaMLJ&|-1h7yoKQ_!+;z}rdUniur|5ze}kBl)OS zf5$rz#)8kHRAbXIguT}|AyjHn1u!d1FubcRGdYi8{_ALaK|Rq_lOtRO$yZ?2bofiE zT_%`P#OS5%Ny)fju!b3?KVLkLH^OwI<_Kuz9Bwo@PTTG=(TBFyz+SM;J^(l*PZ$JXe zLS<$03W6A9btyVRHu(5QEzqtUIo)&PZl_98Xe}0Slq4qiGJEi=YbB=3-o7^Ym8EJ~ zS@7m9;i?qkfXS6@y&3_UlJ?X0ljrMyS|q<;L|*|#Km6j} z&6rb=na-X=I(&fEV-6nOVK-kL61%RfA?l?A=NmEB!8;1@#7FCZh}(%Mv_MuNDNG!E zHbV}%M5M78CA}zRfm|Cag3G3PP4mtMX){_L38ClIoM*Ehg+X7MfVGa)VyYh2usVxj z6EI&hi={^FVDc_>f`jpKrG5R6l4iehSE?@k)GI#^krG693RFz!Z)oQCPr_9A-UOk( z@Q{zJk27;_@9ZKNGh``p{0^58Zuxl0SrKNIK3n(ulkKJ*I4B=r2JA}=oC@9I4eZ=n zpq0xnu3znhMF+_D2g3T_SLVntlF#;u=fdW$z4ML{s5DT(xALPsN$9iGiUXgWc}!O7 zyQQZg7U*-I%(!zg7S0>_nX9@xnj$KEzV}Kird9t2y+k3sxF!=eB8itp&0}I|@HoZD z@jor9g$y(ly-H3cW1Zgn;agL`EXWFlLKrDiQxQhw)Jsbk8CoVX7-?lXLd}O(_F7UF z$@RQiDNT)i%OcOnMp-5orMXGUEyo3zSqc2&Yo9JW0U%3o0Q4Haw*+j3a7S+>G38PRyXjgOC4Rj|D2ssx z$_$p^adH4MabK!xMjgr8*!-v|PVHJDdIa^q_LDf#8yQD?5#upyr{1v_9yY_&B|Tz>X4v;M%PP(0uGIV)+C17}s8>^eiSMswJ&ip_D&_4p*E#Q9 z(&eWLzJe{@lr?0WiMZcfUusp&?EEW9E$dJlxl}@Fy0_)3`;?i-kZ$*zg=RZV11?PI zH@$AyU6&t8iu}9rEzKIwsB%`NJ*EFysZeB)_P`$BN6Db;%(yfnD=YdPUssNdd2i_5 z2iTL+A&1{m<{F5%4$Q&z5nSS{zD?paDhiVpzfv?wO6a&0mI=#{YerAF7m9vF+l_Q5 z?BMT6Y>&lkg4}J~wUNa=Hc_HeC>8msCWr2XzW8_0K4zj&qv$arXGcW0*sg{mL;J}D zCbtr~I^Is@!2XHTwIj^WdbM0@;>Gh6V}k3{4nwfHm9Y*N(S!@^N)J9~P%B;E$_m`d zT!-vvRA}$$G^-+-5PP|FFsI4Lkiod?AoX6MtFV7Z_djGUwS1-rNXt;LN{Kf^Azs|* z&d;iO?mf{(J&;$Uul7DY+2{NLFW`;bK1!+H?Q{)(*b(fwznV^>Z zD(b)jEmHl-($mO|?u&ZYb^HF%3(*UYp)oE)|1>|_8a4}_z5x@9rpldjg2ps}4+IM9 z7UpmR`rUW}fwT&&f0%AcBl4)``%}JF)BfQx2YPHfQ@867zJP)syOp1$>cTt>j=94e z8{UQHhIn;8cB)9*_?1I`7eWRu)}f8%2H?a(@U8h2FR`APWA0o~r zrd!my8noejgBpT99fvH$1Xpr2x zlFwS%gvt(*%Q-V5X(hEZVGR9SnYo8B0VyBt`rO&N-9)#=98|i{>bqqL*zU@HF0ixy zn-&8$WUQQG?QT0SE0`y^*LATyMvtVK1*uFu4j03stH~6Z&`q|2ckrpws{evWY--`} zy#{`1RJ-JZI%L=b7Fm;6zqPrD>&@lsC6#HACng!d3qaX^qKUpWjJ826eF96%Q4@Xo?=4+Q7?5jN(hSsSsc?nK0F+tu}rg;WokbOSYOlmq(mZA|s^+wujq z^6F_y!G?N%!;JXf-?Afa?oK5cWp0lmI4ag-Y)g2&3_sKz{tb}Qfiy1owLE%ncctuJ z6s5i?9a0r2c4@NrJiAZzG;=lde!QY_-T;_RTW1Uipu<8IqclE@F2g^UJ5Ke|dU4`KAijG;l)MJc z5(cvytXi6lJuTo+r4~>69_(BJT53M|eFgi~KgEh5NK(w)KA@3ey>D*Mi{*oe_qzGR9(er~PLS%Xp|5fZYRnGd0B37o?g>XQXO|IuSTKYo_Xlz%q58Z}Bat`S zzoL=MrBVsVkA!DlXR?8fHuoNyIo7m{U$Ged89fv9+JTMPBSO(y&8POQcP|;no9y)0 znko27j~lz_mt^;`*@KU(S=3fiA%TtWmhn^TPWNAb*OH0fy57)$qquQA3>EOpMF_|N zV?ubWO8*i0+$ZT-&nhZ8e`0~Tu+NHS@KFFAFQ;9KIX(vxz&N7=QouX)PWXSC{za-7 zo|2J|lP0mFukw6dngUpaboJO#cy4}hPXpA*lN-}Y8TW## zE@g*)s$PxbG6LnDt2>!-_=Zyp;`EO$c|cq#m#HB27>A?J zfi_LV>2BEn3*p@wK0I-+_{{xZ*w0fQpt{&H_BQ#U@V$F%limlXrno6a4ant5!l&pc z_&iF0va94kQUI_4;rdP|SC`?&CFi%z1yr+~;*8&+g+Bb-E5t~l2UG+E4(kDmf&CH3 zxpr91YS>hOTm_Kp28hQ%#XO%Fz;r?Wp#jLg0*5$p%e)ie1?aDSR`c4|qdRkdPu)SJ zw%=qd3Lqm$H{3^iJY+8K^=pW0VD58o&12GH)L5jVxOviznT_2U4YM{rZ2Roe_Qj literal 0 HcmV?d00001 diff --git a/docs/guides/email/postfix/how-to-setup-an-email-server/PostFixAdmin-New-Domain.png b/docs/guides/email/postfix/how-to-setup-an-email-server/PostFixAdmin-New-Domain.png new file mode 100644 index 0000000000000000000000000000000000000000..b968a58f48399940ffc259a22edc2d33de1a66ee GIT binary patch literal 38744 zcmeFZ1yq&qyEeG7e=73B77-M|00pH%5EI?BG)SmOOLt=jAi4n&K|)Geq}v3g8>N*7 z0V$E5>+%0TbIv#OeP_;@nRV7T;aV;M*?Yh56Zd`9^WImGJ4e5kX)T39p{Jfdqe!7F z=ciDX^{rWjpXjD6JB5G#vOKS0L!qqONdD5*wzZmX!+YME-m$~ zKeG4Sma`i)zaK2!EFi-rTleEl)2TX{vPP4HjGLD=g7frOJD6tW>jzyl2p%v{HQ{7Y zbf6bFnt1-*0fwj-FFkLB-|%KObocn#HG41IGp>uncW$^hDJZAC$*!RH^<$^;<62t- z%X)AT6w1>_4Q(sQ7jM3@Rg-^@99~9G{;m6;>|1$>JXCf&QAvfXl^FPw`p%`e=!& z3Cor*x5Fn$hVq|U@l5hVkM-vs>$vpv^w)-%-p-Aer(W^;7e4-e(QL1>j*eW_dI}{w zJzM?f%hdnLhH)9adlrZElb5=RYhe>i_;R++EB{SzO(*ugQiQ#)w5@B>$pv+zG^tG}=ZS2(MJcks6if0^DTp1026-|AD zf`VrIBYpj!J&XVT{mRr}gLI^%Pke?Mm3n{cA@%TzU?J0{WNnkW7$3I1d+j>hrVk!D z@~YT{h0nnI_`;+T$Nv3XM~)~6b-1RnICj!;u(KQWlm;~C+9haam_#$~l{EU<`L@{U z!Gj0sj$>DnE@sJzh=|al5>g5^_ey#zr05i|Q*&~1oJR|$*{Lb{;|~&5O>ZU(V0#a! zW1p0@o$Y*QnWJSb`n>ehCx!FpKaC#Oxp3j}i^xb0>e6ge5gDJqHtjo4Q%%z3kdTmw z9LA+Y2I{)cq?cfq)WxeLFtuh1+Vqy!goxP0XGpluXR{AP+-0df%^MWeWSU)ca&*kj+pKk>JmRfJ zOS-WidmLUkSR3t?Yd2(Y>*)vC`;vK>Vc8(wvx+_2x}&87P2S(3cgFjgGN zO~)x3cdeXMymH-Eqn1oF@|jlo!!4O=iw<-4T^Xz%^EFQ`{Qdpesgl03W{V4>9@6pa z+0zUv6i=PHaeQgsM%#U+N1)jqpCKhL9~c%EW>6UtN550hXmNhVq@%FlA*)0(26d>u zLqFZ3L&wU>3X3a%Q4qr=aP7;HB=yu&x=Hg=5fKrzD1ZOW)BwMQgm>lLpZzl27o3x{ z^Hj6iRKH3GJbGkVJankREeS=k^45u)X_?o)@=|M`JG38UU|?`^a@ukF@sq>a2I(zX z7GX7~$LA-i$lBiObynQvSG_0Q^7vh3pt@{D1)RpO%7%(*=oNck@Y^SQHC4TPc=#|? z)b+PzL3_(yU$GaBNf%Kq%6?mOQ}M=FzR$#6GT8?PV#8DuRFk}!&OKy47-wy@BDf;v zqIu3)8up*&a1ri66btm%Xh#Z-w$W{AVVV|Yno^M2=*-EMWV)&2*S()XI( zeaIrt8OPfl;@a-_T+1WNye-~rs3!7UM&HcLOl+I#mRs>A>({R34Gj}BjCPvnE$%|` z-R|q=>dOAPUt{ft4NtPNvhX9abxo^6#igXB`A!+Tg$(@T&aqTBva(u;En-EOnoUeK z=?>MLV^uNM=y5yu!`{V5Fjj8f{CrFE=55=Ca{5B~-l+z1YujQd%j)Wsuv+a#bXh-s z{MZm07!aV6aP-h285F`NlOETv^i@7@&M*xmo9g=V)lBbe+!uP(c8NNkr+K%BG>5p3 zK2b`MwY2F;hdYXNF_Z$!WN^uL*vMSRj$OQe|Nb%x zMYv-PztOALuX){OdID)t?hCU6rCceAnG1bk9*qnV^WoXq!s0*QEMNOqvXgL zcXH+pRQkO5;g(0488cW?Sd*L>XSeyW5=ow_Cxeu>ZHXDsLFbnUd4t`0EWHfl-<&|O8CD|1MEZ4V59Fv4wmWpStR1ruY zy!u?!PSMEdc5Pi?$k#uB*KBiT(Jp)xdfJH_AQ> ztsSn5l}GJ9Hku!am5#3CMt+}c%=?@6GnMJ972M4Q$I}1P7P&Pemmvl;<7U#ZkL3+7BG``#)SHzCmn7&0FRul>S>H3 zO+t-gJLO`PzJC4sTK&-4zy697{5C(GF0KM_vw=nIfUd6Y%9SfWzkh!^Iy$-;{Rs71 z(=7D!sNIh*M|*mEIf25OT>~Z#^6h9~~l9157 ze*L;hdw$NLtzK)_t+V^tdGhwHTc0{QmhwZkQ9S*u^eT$)pQyX1wf;IG2CjRm`Q_G& zpx{$3X_Adcp~RdGN5lM|?%SS$k!77M=x(+Sf8p}pj7o+ZM`5H!M+i@>jGLUabqJ&g zUHY^G-~LyyLqhl{2A!6|{?DH$-MFz#;XOXY$jEq$>CKrn{1k<|s6Q)LuTDVIdj0j< z3Z~AD-PSo*vsyS*+AS7kYdu$W?&qV_za6kGHQ!rK2^39e;LNM26cc%K_4mMf%G8@9eBoA|X&at0kX1nO zG-fm+qxN*`fB#!6R$PdhmR92Y{JcpDdhEg7yWhxeQ3(tTj0JGXFsgZ%9k+`@IpM}= z%<)xnPA^l2Sxe*LJ}~26$#6QR z$ALP|pB+OUJqiaW=m*KDMNLW`O3sr5{{!x-t&Nt>Fm2+-Upa^3*0?=KPhZW@%rK~6 zIt*Tz)oShKzA&XmSjup7M%{<|n=;Ji1S^)V6k1zb^E>{$vUsj_5kQz-m z*y7?M;SdCWr5h^^e@Q)k%>IYM)vHk`7%|iBF7j=;c77EGN?KYW*ntAp-RH$Yxy*;D zsD0b^FQczMPf!^C3lRJXsW{|f@9+s8|eAva+Pmj!%qF{d~{BB_yOqrBcyX zX+=dvcv%3r8^DfqJae(Cy86qRiM|A-SUFNbd&`3&gZKeOIIQBk||(BXxdDvw4qsKuq>mP+-GM2$56r%zv^0iCDW|M+6X-7W|{;zRZ6 z<@{IhDq2);MKBi^mo%+=bQF})nMxzg?&nWSGW-OS{>odN9qQ@o+RMty+LaOCi9y># z1!ktPlPQx}{2i&Nq?F-0W1Xax^SUy3eqn)hGeBi+m*EU4D)p!dG$r93;`}G}+I4?o zjE;$sqMbT@T18WnlWI~MbsxpECfVd*4+vCO#y;6+^}?Z8>+B8cT9*iF1_lrSy$c8k zI4CNbTiFauXIO7(ZA6gR7V@TwT3Uw!%c4);-7tU^DX3F~%SEZ*LoKbSXaIrRvT@@J z%+P_uhh=H?Xltt&=71t3eaj8Q++tq6I`Xlk#1!1TuYVUE#k2U~iRJuk8M5(VVDY#W z4yr?&UEufc-}%j3h0mTlXNvVki#mC8)j@XlsJDH`oK#-h4K?DMGw5-F>|3@4hE!a{ zHhXyo?{i9J;_67@oH-eY;-Rh*-@v)}T37QwT!?x?|-a~U5u;m1dM^koi z5Xrtr#s~ch4GFcZXwDJR1p2ZP&|&50G4Ay4?yFP%HSf)YSXWwp6Mim-Z4Vw?+7{h; zC@MBK0d%1?EAer}-Bl;(u?YHPP4xgWQbqJ*ETn4tJcH)F*UKypDf?oLYG-^0l zP5?By2M^Yg;x6{`$yXi zd4s;8VM2KL2?%VsJ>e1}LoQpknTd%L+Y-YSPDfhW>bvhF($o1#S3B#q73gP#`>!`5 zz1BJ2RnBM5tcX~3gprKP9w5}WZ{HH=a!qjO^;Ov`u&&VFr~zR!&|R`~*eFv#CZ3|3 zH*Y?`e@GeqPL)fE;ktA{o4HzAZ-s4t^&W@7W#M$cKd-0QS&BY?-Li)7O?0J6MyYuk zpZta+JKRN=pAbJ%zTSxWcjEHi)Bhoq(|UK6Wh77*mhz6OBo@_`8S81-Fgp|Cl~H=% zy*u^KW@uJ|DG=V|Y(xYp0Yr$efuP#kXRK= z&kQD{fZehhgUuPbL6G&l6MlD9_8KiWJ42v8D)3-)zEhguwJ+h&M*8tCN@vd8x@bc1 zXsGkxL2av#Tc+9#Aq=B6)Pk%;+YdKCZ#aqzVY+c*xz>tR427qsTWx&VKU=+v7)$L6 zpwV7HEmKM}ta`$}OW5)RpFz2Tl+*)A$3z1VpR7JT{`04ThDOlw+5WvmWr0$Mep7dk zaWB8~q*2$%FD|v@`hV%ECJj;$B*Jj3wl99)3U&D<;^gc+NTjx%7WomFvi_K0^IDM4 z-4+%Wc0=tIMm9r9S%VTwGrr*4c3nO~gP-?@`C~hTx{gyhI5?;@s1h-wg>!N!XnYT? zK&Yi@q(Qr3m`G1VN4F&}gUlHTY?W@-A_(H+GT4|Dd`&PI1(D3j z^je3N^y#4Vp^EAdI*Y>BYC6oXqCAWmB$FwCz2X%GYd;H#Mq%xkEOiQvNF3Cv#cE_uR_fD zhtT_vo;_F}=NGc2(!>lKJ{-X2u==YLK(O^_^iYRQ@&o;R_fRipnKwYLF{*!zIz#y6 zY)_!>+TsHhKX_|P7jUYzyfhq^_r zrEy5dKNsTVRkZ1=Z1CbKbZl(}g5z_8qr z+#z;qR)>2YXnZV|+N)-#FqaV#yOCB6be-5Fv+D4Zv?%P09d!Hl?v1RR2AT%)I6%!E z&TL_)f;ZJAWwmos|8%uRz$OCS+RU3Wnsm70tUscwcq$$3UZ1_j?CWdH`R2{+d2Pur z*zU5&<>#LY4GmyzSzMTtreXEnq2C$v=+WP9ShQg5HzDQw1D2wP8AA}Kah^Wa;K~Hm zQNXzN3^l(-tH-)KP6;=n- z18Lf+Q>WrHFtf?2VGSk%s@LX#&pD_dv=Z|_3)tgupLU@;(V3Met0~*A8`s4cH>Vpn z=&WO4Xwr6Qjb&SC@d>tgXJjeq3UrOxcseN-!=~L9WC;GX45mpRBIxh|>W< zL6A!2WE$R4xKtCXArCcVS?CfQg*I6tv6%Wc<2b5XF6urF?92!oQ8YpOIB6> z{PundJLw>1p~GXT0LFrXSx1X`o-AhpS)5i^{1nP$)*NhmxBc zH9vB|D$a>FE?fhUn6?on zHf;2i4y+qcMgvLxvbLNFUi|a5l17s1jANJ+TTz3F3Ixy5WB@tO6U)Qp1cPN$Q&Wre@U7R%>#I&Y$L1>b z-qA(y62;`w31R&6@6r4Ex9Io-wz+xhDcd~j2D(F)JU{=uztU55#flXNBqTc8^eNdC z+{~80|0WoWpF-I5-%L!zyXoofe);0XI|61Hz$W}rknz*ockbloF;nQ@xEWExHyl5H z{K36@3ikGy0D(K)S83h&C+q4o>Il{oM87{{0$V*qA0QL<-upDRO_P<0;x? zR?&j&(W6Iafiqe!#19}PaLQL~{GOtsVthfNVHJzdP9Zsu-|ty%;hGKxsOi*z{kJJ| zKm<9%05t)QSEJ+ndj^REfY8JgGikqj8C@s0_nB!uG>LVZkzY~uREp-uy&6+=Q=qn+ zw8(`BM?gKHf~z&5{u~BKpYHI`wa6d4)9%MZ)2e_1lRtp!r zcnsQj_%s-~!AnqIv)=k~u?P6YnZSWu~K} zBVvk<>)6?qt5(J5=WBUw<7p&K21-rj@WOOQ3Nc_<-G4`runAOS^lf?CJx0&?mD}(xtrsAz#@HIW zou(-4FZt^(0s_0KCT+PHWD+qE9Q*bS7A-AUJilICQgY72V|cXLKbs2ezq<1IG1#xW zsn$7KYw6da2R*X3u@SiPVGSJd1VlTSL~UP!c4X*F_k8$$>lQuGeUkkT-0VRZ;lz&y zEKN76VI!drg2Ka3-mHAzU>T;=caX|^r!BP^BJb2WOnZ>*{b27Bc(U=CW^Zq-1ovv) zG3_AC%!Itc(W^-gqwQGjiq_Vz**}-GoI_5dPEFS>8uEzAP-E#gGlF%&XH=BCAF&4n zs%WJik!<&uH>G7B##y~nhJ`$9#ht5x*#$ zjfXvS_1eVLlnO2g)_=q~R=3IYlAq(_Gq+pY2CaA)oNc9T~Nc=jI6M4=TEbGkSi0^&Ik;cGbikWGCyI>oE?vG<0z#ywy=3e^#LmWG;IyAE*+6BQbpt{dZP1E_z ztS1)WH2m+ivO~$WpHQzm6ZuUWe|Wcui-{5LT4$aG>v-g?HF0*)%%0o187MYotN#wyrO{}sSm#_tr^NgE`i5X37}_Ovq*<6j zAYXHzV!07;EMz&UXz30y&!;E4dwPsZ{SS&d{tU-&kQD`2f5~ANAIx6V;9ldbu!M<_ z(jIGL5Ta+oRxe1wUzkeqP*GH@6%jA_iVrH98_8>in69yFsM`%eAt5mSS%-#9$1ygy zUtbN2hPG2I4~`+@M!BR)+(d+fNWug$GD3>CP0j$!kC=?GU7N~6>G*U3FBVf^94>3YJRQn#co^~ zB0{Kl=i8eCCiMs4mm8y#HdJQ8CTp{;lVyVS2C6gFc+mo?N4_Rm^@QMe6fTf9?mRuB zo#Mosaq!R~<@4vyXEYIf44-fnYl0vUv#Pt!lpgMU06d-+6%xXHSSwor(4+}L%I=|| zgsS6niH(<>A>Qh>Lo#}}l}9JBv-1+^DnOZk$TuJ=7lM;$+!-4;ZOQ;@F`0vFbODRv zG1wyppZIVD;aLPlkAEf1D_i&jhqH&;GWG^mUlgC9n^se}w?MFX zvvQmyCxPNK%w75;?$(q1L<&h)B6at`$0wk|z>giOnaRTJl)x{Z0|y?l6NTyV0dL=g0Tsv-mT-= ze)-IvykR?gR}f)dU1h6Tw=qeXo(f9yOJptf`VI9;bA z+}A%!eEn};aiD6*T2UuUkcDyq08kyuRC3{rDs8{Tm7M)<4Ig40-wv^sv}vv}$_ z$@}QQZheaJ2Bd`gqw32w<`E)i=+l=$uf1-~nrc8{kLIorS0ASD-Ju!r-|SEW?N&YW zdmjs_84DN|{Gm95^T+(Wz1Igkc`_L3dz@G27z#3>L|C9yMIei%QLXmlBo$KN%Rup= zBN{>HKu;X(ACr{l70h>(TrLeN>gaGY_zw1sO~x;TnR$JDf!mjhi;E*tHC7wesvQx$ zdxI^obqWY)v>T{BOCS!gN(M&Uq(pd1970II6J=I+l`Ws-LNC@KR|SkLB;1L`utQv0 z1ziH$(?GYo#$%Bfr>KL!Tkz3{4-7NO|$hz`!Qsn@1`9 zlElBd>6_&{lHK*N!z~25f8Em}tN7I{j^UD>B-I5`lq0ZA-}QRCUtw(H0v{h=hJM*r z*og_y6*+l$nu->uc!2PU=1N>kJzsHykjP9C9-yluTmOPnr+DGQ1)qR|cxT#(caGBW z_T#iDq!)mPkq!ti3_L}vf2}VKW4+8#M^iH%|J7#so?f6CG1xGxPhSD3OeTd%@bKI3 zBA4YNa>CrXb8WYfRT;1~fmmN`ilHPT8x{>a6--KCkp+`pTUTfIRX;E%T8EOo9jS%R zWji3Q8>^j4U`n=q4d>wkp}B;Yk(?!TE6qaJ8DrlfkUWeuG2TUy9S6Co$4J9rq6VD) z0&z1P8S<{e1N%GHPx{FpuX%b@521^UtDiSgYXzFL^nUPAvD*oyocio>yaqcHGyDR2 zsumQpN3n+Q-J`T%sN%D7z>piFrMD3w7%|X6P<5Y7B(HMG;&4f9zT*TytVr4|DpLan z2pdq~W#PnI2yhrW(s6E_zVXK$A)zkha_#U=T>JME@}h(w1!z-4jOzU-KfAVFgGzIuTi&6q(it|H=53l; z?am2}i5iha!z9k~)SKlDFJZF~9r+25ZZiC;GV?4`i0GPW20n#azoRdx!D1mCml{C# z4J<-X^?Ur4td^+{o8*nqM+n-EDqXn(AKMr{y^o5xRRa|AKix>ZU>IFl0gS{nJ>%=O zhF)6zxuwMgvg%0WkjA-xTnO#FvM50*WjKd~UX8%Goe}&KFeu*++FF63eXK?U84w;;THZ zfq=t9W|0>FV58|~D7`Am%IqE4ljZ#skfVHN38;RByM`lcl_I(o0p(P7tSb=ED}CShlx9-zG;KEbn(U z8T{w4{eOxG{MY=lSerHyN!Q7iLfN#3#IQ&r5E(2uW@QFxB(3zQtcTWS z9;iGMGzzsgm}{AW?jP^}KV|O z2y4S{kQM&^{d@WVkO6bz&E!~h6(58LP4q_CcF^n*VDvG=wnZyHfQWjI^{VQr!xl+9&FI*K*>VVC{|+r8$&Ma*eN8B`*A+W zJRa&1iFWOK4G92Oyt4}Xwxv^VMaJ4%5;VoxgK4cNcQmg-=OR#z7>fUmHVL*e3&$sd z>bH;FqcgnUR^@*Relk&TN0B~$%ntHApMHHGqBNWK$q>D<9_J zLhJ{5d0%VhK~pf9?5~kJe_jFDi6qpBo3&}boHDiu0)`-?lgLqrj=Ay_Owt~BNfSdH za?C*3(ma^OZjwcFn`%%iZVd$?GR0ew21|rn6i0Lu*=Hg)F~=8w>yf?>ZL3Mk#)k-Z zu*#D((j=ilVvE(42k{AjxKeB1-CidEIS4`+Y1pvg>M?8y2snr4c{yFTMLhidT?PX5 zO~^PuW=H3%bvz8Wj^-a2=x}-M3LH#35l$y_g;=D-I*tS50pjyxZ$l+(XeLgf$I@ah z*vcOX3@0$)+|i=Ey}g~oMoBX1#>#c%oDH@1nSiP7&+3y6cvly{U7?tsgcQ%#Nxsg3+g*#@af~b?}OI<)jhOZg?<$|I7+;b^q<;@gOOaoBm?A+XqEG(7q!teX|2xLCnuzvm3@(DG; zTHCz`w0UfP4|gpG|&oKAr#Mmqn+Y)SxZf!ad1Io|7|nx&PM#X$Dz3G8etB?f7aasK6+ z0$VRFH1r|PNC~Rtd^Wlz*)9L6riRhNVl-i-q^)h2gTu5}p@+cb&u`yGlsmi%Nk9|? zx83z%PRLK%=h^*x_dZ1%D^Z}gGcq1MypriZ_r+stVNua5XaCgkdU7zB|b!ZIn+~>}4-?UNLwwuj5a^mOD-Me>t!tZ(IvE(i*v1w+LwXN-k zx;j6^D3KqJ#~b9VU(3(Nwx#pix9dek9x8!*u-^Kr{rUcLH}&5cia36#<4|W+>~^rR zjqi^+v6s!79tXVqbRT(WSN`)BQomj+?n=PH+e{tK9j+7f3}Qc_?Fw80VL7Co>krZB`{<}{ zLr=g_V2=FNSDXOt{_$LZf`XLUF9^82MivKIBbUQvn;3KA4p!g0r*#{w3Tdr3s8+&m zvy%d&9uOuI)l-)xG)N)bJb*)2V>*{F?*SR^esa+~0_!#^D(dfDyJY3$HgI!uqmn-c zdF<-!JYjDyi1N7uDCx^JL3H;LoVh%OUFyAv_#qhqd;mYB*IrQ47$_Tk4gO(a@>jbJ z=Vym3loM2aaI)w*;#thh%-loG2xl2JCGT=*ciK;Z77qLw07X*Q??f6By}XfJFF>Oj~53G=Wen`9MS_b%XRaZQS_fwf;INjxx{q?*jln0wM7W2>1vy z@^fkF3-h+z$sb?+P_~yJm>D(2S+04U#KHozM$Yhpg5}zC=VV{~&3G_+Y43x3T6@&g z)F8vkLJ5U!&?7Lq1SQ@T;-IjwuqCj29V}wRNH68+W+8jFcN83Ag2wU#n1xdJCG-w@U{YXU8^>rqG{p!W3(!jQ++bEZ}^v;$2LYVd= z@@*7h*WX7VkdoZ$dM5sRnAeH15?0+KPgz85KdEO~qi&%8NkVnq!FzQL4wB0}7Y#sF zuSFhAGs|4|)Tw1IzkVFFxds>qQIzrF!-wc#*HNIM^1sKF`y?cAA=kc}tPFqyJpeMw zA&u9!a0&uK><75Y!j_#Btg5E&#e4VWHBekp$b!V2c=yYP=6AXPzQ*Dtj=s(uY+x%} z+pGU*C(Am2{E*SoYIQ2X$-`ynrCbnY{#w8OLqh{B%59iwT*-PCu`jh{=^1A7I>=fjMDTun^uQuq=0fU#5ed zT|wuKX^8kgaZFq*9VX61Sawd1c4H15c<$TN4B{(10|U3=(B5(Ab|2f?7HB0fIPTz( z!Ez3|{oLFSabnIJ(~Ofrs}Tk%#*)NU#95W=E{<> z`;3CZ-x%-@A3j)?9nN~?HfK)`c3_dwpXk(GHq*3oDfh?FX2uylB^0%T=U|OFvBsbk zNN1Qda3_R8X7q%Xyspq;gkyv`uhYt&IF z4vCC%>+W5@XU|G8e_!$(crYz}D?MR5?eMjL-O<|C_BG2xH|T^??s@lt+UR0aTpy|d zZUK9EOZFy@S6{F7i5FGZ3&_jMvp97>_WEV>OFWm^&^IwaF69`KhdI}KfBYOk>+teg z2Zv{MC4+GwEhy+SDq|3ihmJL4(BNEmLf)ewT>Q(|CdZ{33eDPS9yV(}1#+i%)4ce= zLG*R}!)hckY~CS-;Jky_Hpt(UGl; zIXg%h_J9Ar?dGFLj}k@<(Nl_NeQaQX{K$XPH9TAadmeqOcy+({fD5Lt=8SVmYV z%)*wQ*j|W0aXE8QUaFmS3*bLZsS=ngV?r_ne?C<$b>&?j zUpH=%J(_1+9Zml8h>6VNlefs%& zX5pVNjzt8>sfk{M#xMgYu90hd5N)a0B;&P7L%i27)@|GFMn>*M#3VXA+!NX#KpRTe zYN?o40!G!I2!MCFT&P^+t@b@Wdk-gYT3cJy3tdGhBwTDIcH+{d-Pn2}tP9h70qSMY zwZdG-|AI&I@$1a^qSVZg?ouf*^}YM|BQU?NID(3$iPMQ5IxS2BCOCP`pp~AoPIdzG z$U++IF^3V-bFt~ZzaC6jFDEC5;{F<0uR)=g^04T2yty0+dH~cl@A0JfU3iud?I^6+rAA`d|$FXw_%6R|lWcqMa^?9^NIOT7@ z6dYz}U!kkpG0~ixoBKpVT9FaQJg&85`XKc};aE3Ao;Na5HQ4Inau@;u4YisVqQbj( z@74gQ1D#-u-mQrOF(ZR<;82ywW+;poZuRPU=27$jkM0o?+6Mg1 zrNd)W;J@h2W6Oa288S?wqlTPp`q8nmUGQ#3mbiMV&h7Vku~B@1UeQ zro4Q)CZWMZ%mQWV;lsenj#&Ay-cOJBf@UhF=!j#DeFF5s8gq1ZR;@g%WvFH&3kDD( zY_-hmFMe5Pe33b$EJ@K5+b9c!vZqQ zcIeu6Jb{IM>FRMj-NMnuh0pP4r*+i~f_LN~YMM=-90jGd3g=kQ;i)o|FIg6>c;L?- z5s@IEy6OTK2l(I*{rol|V@e)mbL-BX*ElLv`1|`hIDO}(rJ*FTw1R0-%EKhW5VRsV z7Zj%$WAKJN)Cu8&w`N&w#fY5cpi0s`<<(yc15*FXtIMu%st6SS@bP0n+zengl6~Jt zM&tl}QZ(&Yi9<@{s1zir6jmNo-0N1BSuA{Ve4Gd5n9ffg}hprQtxcvFC zK!o@HfnZu4I!?TMcjsGo_lh?>Mf2|<2jTF~+bgNn2$`_p2-LcV;U7PIcm;~0rKRPF zGcxM0F45t#dcGQlkwhcN>LwPJ4R6qrzor{+(sdnMDegSE`{>cfP(>}l8yL54jrn^& zCUYCQrV2Nxc744v_!AuBW4|%5bSSuhEFX;mpFgj_toj`duN_cm}JI_Uze%1`~Z8>tPnP zy$56fjoSP85GWk7zNL^wa+Vh7aImBow(A}q9$(lKV*pG$SlbsC7Rs1Cz?UW*_FP9osS`*B$Q23V^`u9m{}x7wKLq5Bg86cqn+QK{rXVNB%gd{tZMla`IkH;%l@o{* z@Zqd2rML3A7qT8!J~#`-*BqcTNy%j(`q9+8ub)Xd9PQ;}e(YYA#8`%p+g$0<*^wVgHG(5XIEoZQQ=*n>;H;$4i* zl?t6p+ z(wEG`J3N2?merTMPeH!cOl-r34cvSMhlPco62S(JGhEzdZ(y*Ofrozj^oeq5?EA-g zoaN)QcPuL{<=nK2oJmAAQH~huZ%Eh%FJ~Sx_il-$83v#iFtk8$7p=*sfXqAdLU2N4 z zaCfX*#3{0~m~#==FV1Hpih=ck6<@)GD4gYdGTh?u=<(yX5QQ~ztU30}_b#{Wl{s2j z$>AY`Y!IELot?n!*z`0{odu)=QZx`6K8ys;asuF>XKptG4gq8;Mq;Xe;s-q=d4}A# zAF3xOWS|Wz zR<2Bi7D9m>2!UXEc(aBZ)EWA`wud)wzIWa zKLX2^ZqN9VVY&?!cy%W_>1FIYnXu!}>6WjmMpQ#@VeO?`&lRKBHKDChWo4nj-vzuz z5??#A0%u>J9(NPP?M7pyZHJo!0E%~v267kj$fFt}?0!UW)jeNdAxV2YUd+0tOVDDm za=R7bQ51J~Sr`S!pao%hre68D7SH=@;2p9AL zSdiWm0(%%bAjM-vKy6KY+PS>SU&t127kKjUk@hv&M;QOsR{m3ag;ub#hVcedFsfFl zU%X~g=Qi1ow7vyrDZ|lABk#%(@pl&(!6FZ7W&ce`kKSfVI4bP=9lW>Tc(%KYilZ7K z%EKlq%7mq;S5b8vsbMc%PAc@g@T<;&H*YS-<`J9w!B-wCeiyH0+_>=_EGvkRFYpAU z;#DgGBa!%XU7YEIdU`=iO9q7g)8~Uhx%MNUYQ92<*&*RB28Ir`Y5Reo+}`ism-*lF z!Skqqf`C<)EoK+NVaXpW-bth|bR@XeblXL&uLkkVCMv~lz;+{|4l$T6#yL?o<6frMq9xH5aqjyeKgXI9$WE1xj$1G&B&B<+24HG-y1h78k92n%hchq zJ8wHW!mulj;213OS;lR-SDO;BE}u7b+>SXBfJZ;zK_W75uB86W$oLi{6JVtaXYYtC z4HssgT*$qTSN3pnK7b$#p|2cV0eh(6Y6qC6APXK5^wm+!wtufTv&hDThEkki_>yC@ zAE#J4NgDkNy=dPv=3TqcbOe$6E)N#+Mf*#0o7;d63Tt>dxAQf!&1Gcx-<6{qQt?nR zJYVlHsQAiDt=U#M1YGuoKiqa!3zfnNxCT2&4`SVqwz*@t1@X~552@3wP#@O#-y$*F zG0?uQuCC>8aEkOVdU^rL;!2#76#}@qd@BfBjH%_K7gkb8#akWGl+%lo|Es~#m8V)> zY>;M!2V($fywuM7r812J3+2Sa_-a<4q|~%M`T&9vM85_T$`=qWZGC-X2(bjB^X2% zq>(wB#~ntd8Jm_|J1#stFcza7xX>m5XvGwfBVr5{(R@2pqP4vEiM2-hK~IeHf0UHj zi)?xjUS04PkA~tY6ceyOe`4Fy{e)0n3t1S2nBXRq zHb6+#^01|dKg7{L;-Dd$;s8zziP-ddkBJEi{>m4`BI|(&x#AMQ9H9FR(r8FAZ+Ep> zmYkg26nhC*ag-j`Pn<348Yn)!Cs3N!k!oQPk+CYF#lQSz)Lg#Z-u6_)W*-Gb`_G)E z{OhZf5ip=Ya-{qO;9CCo_U(>3Evu$>9zh$X=v|FL@E1^C$5#>C`@^lxMrWcF0frbn zU%os5)=eI#KQ`)_IYY?U2Dj-vJl=aUbp(^SN z(ydv$Ry3soTT_GRO^7UTVlQ+fiLy+}o*E3gHFZ!G>rUn@rZ?HE*4Pl?b2QDQau>tO z5cprq$YV*Xk$IuunPH`P{M!cqYn+d0H0xblTk%1G@h6j~0Zmbz6%&A632k_vywhZp++?PgAuhZ-qO*ykz@D?*Su_OJF zNZ$Y$<=q#&Nl>?O45Iy2Jeuy%#msU?oOp7Fat@`*C8;z&nRBDTR*B_FnyUGbi0*0a zgkP#yj4P$AS+j<63CciU2GmL2-w0Nngdc~_pbsAhN3_XvF8?fUoK1DagJ=n2B4h#t z64_nIfF(Fr`5qPm1tP52()@%Nq8UG0vKWFZ5RKUU{?6?hP;VXQ0S@Q~cF&U+OT`+t ziO!y!)Kk$WCUnI)EUESA3TGrGmvPj6pa@#DmqT&)5riDviH8_)fX?AUX>f;-EOJ5) z1jUC)qkU7sPo79BDsBXmu1~rch<107{)*UGMRLuAo0WeeofBG<*+2 zqsq(6hb&ifcPP1iyFJ3;yV_MfBLkz->W%IC0irnN1kf%Ja4c#I1(j#J8O}IT-T?Fg zn()Rv0pYeR+2wGAkU!*OLH9PmrZo++u^nop_as#8k-z_nKSTl@l@N09WdyDmckQY` z@u4eC{2V70T~{i_8h9sY!0J_3Q+ymCY_~y-cIBB53ZeyxXdQS0F?j;h-#d4f!Ty_> z>sWdSr5X>h+N-ef#J>^-C5TGaRW*ffpMUA9CIldf01C3=1T+RJ9;?}mDn!{Hc^Z+p z97#2&9;tJBQs=Hn#Xgnwy~)t1rmc<5F2skjLnmdwza>BC>T*v~zmah6D!^IOOp6XV z0^G{DG{$r)0N~xBccE~=LG*WFf$so&^TT*g*$mPiU(oe%n^+0N+oU`S47{6W^LZ&0 zLiZV5Bc4^-^g}a6IW~r4>7o1j!m z7aWOdJkl5=3Is`#%T&q5ETj@8}R|t;WUzCNH8do=pYU+=ZF-A_RMkk@NoVFiKgj? z1|}z9+4PZi*oo7F-FSe@C1l_TghkU;eHWlx_)5gXyV7VA1#&=qENqJ61M5!!(v{}p zMCG|It1DO7fb4qEkdaICg@&H$Fgi*UJ5c8Bo~Y1_%*^Xgz>kNtbZpcW8#fXgy?COQ zaSx0hJYVkwJSEVJ)vWI7wC$nL_8ZdEd47 zdcXaC`&(=OvG*Te>v`6CdT{#<*L7a!c^t=ioYQJW#l`->xsA0Ruz)Sk-S~ECA)H1w zCTud=D%6LS+BW$m5trER{>-~n0hj9dgG5U5=f9Eb|9208;N3snAfr5AEMrsin zhY&Lg%pH>Z=I(A)bhL?o`w7CN?dQ+dmX-tX5&0inDczuv=3*l z8?Y%|Y|nCej@2@FYU*RU8d4Axy82y!Bd?Au*(fCyinI7W(+4LPa={&^-(A1;3aWf* zsKEi|795n;iLY=XQUy}mL&ESi#pHO)4{=Lu9|8j-6{Dae1=}khA!|qPrl)5Fpfx50 z;%Pc?$g+MhfYJC%)Wx3>eEE+9S${S<6fZ~T4(n~BFrk|_bMnidAT}~(%K~rA?J_`z15zh|ZwY$(>1F+$C zULIBR5%7j1r1||zE8*h-k^X!=!vO`HIe#iP7${?dqgG3jI?dE;^ z*7?B%|NicAoV^5KqTmZeV?nqFi$ojHUqmHhn?I_DSfGR)0ae1jv2W%Osm?(hFcS|W z!W^`>JwzG9wtVHvBKYpV#l28~MYj=P8;2%WwEl9$iWoVG_v#*lVMtWaUC$Ztc7Bsd{1r7cT?^0hj{@ zm8fp9D7B5e-dpvw0rm$aprWC%8DIlSh~;b7miE>;S$%)K2>Y%TO+FxG{86B;E!iw2 z#A5&R)7sB^sL%WJ%TNi5h?I7s*1%a@0t0!ypTE%%Gf1$=tBVNz8^|lm=?AP55+fz3 zW?)At25`E>CX*T(dI)?fwlOMpESdQ+CBB+zUR<^u4h;Fc{b@#c`Cicby`vo+wh>Ef7Nk=0v|bOL`EU3T7m@Q@3e&T)St1&va(x%TmUY+ zL)BC^@*Ma#1+w*0aAtMS%-B#ja?71nnlyTGW)VeGVOk34|KUjVNyGuk${YRa8~6%D zQR^$FZ4uOjXfK6mw`xC-O32=AhyoF_DOZYBckOLj zQ{XESsi!yjTI$o$;46Fudg|)rY=6o7W98)s8a@Z)aj%r`=+Hze9*og35VwJ+Vgp|; zov4Hiwc^|F9#s6&L2Q8{DtG}U(2j!I$9_|`vFV;)aq_Nw)&;c%8{~afLb75J1T0Gy zgwfXF@N3uDS8mog<@DAPRLO5#5nxVsRo8R6Po~HLJQ8 zLRdfTXgYh5$gw@7H=vlf+2V#a0|lI@&1Y}klo?o zui)Y$L8BqZg%EZl-He_WY0r0r2E7jrdUr@cZ)l*)VerjlG7X0W66*Z|`e&TpuFrJ~ z(+CkoTSX~=kh4dN_jo$Des6klUt=~$C*q}Ud_~BX;aOki=^y!61{5P>kJff+^N4Db<#~5+>LVNK}w*u*G7`uimZ2D4B{lA0g7*Nn^s;V zUHJSy6J`|1(*A+Q8^#{PjSkt5pDLvaA?^gE({EZ#jZvT8fN_f@WEt%6LCC#~k)RHC(;ZNl75mMhBBK87Ua?BZ>7PO(s z%!t5gWk2$6%ETDcE^xyjI>$r1N-EOZR)UOs{Hq?xu6yOMUVH_xH8%SSxp4_dp%OKt zKLc{?tV$@GUwa>&f{}rNOMz+_JU>03KoFowwpAyNcp9PT^rPOrdUF>*82@_RLtTg2 zkU3kTi5wtu+fB3y^rW-AMw}&3JGOb^+md^31t=j&R*h)oHBxyRyqJISX%q(xSj_Is&ILYY8;v!# zar5Q??CxO16toy!4+?sZkb+#*0a(_KJ~ib-xX@wj7&&wGasE4MkA>6d7y>q8yXh1Tdbz54@dL`JonAe-nCuHKlxq?RYdt?sE zn#kR5Ay=Hj+zJq>38zRwcgp*GIJmub$X193Jqd`d^wXy^&4riVhd-*~`N;F zIBLf86#~VE8)WJ5i$ScA|4>ZWCl7U=ZP?I*hO?V98%WL=wA&ioTa<`dT;ik)A>!)&TDn!?)!je0#Q#?b!>r48YM2ZMtU6FP!{cSY+DF21^T?H7s1;Hd?5C8f;G!|S6-K% z8tKEXs$t{9m`pVf^c-2NAjV8wy=%4qO%-M5FR%6?`WkDwdVDezi4VK&P@ENCe`$R|HprL2##sptZ3aJ z0812_TSj?$9mBHj89j-|?jV730bMrBV(2Wn$ zmRZc(3O!hji={VhevA@cI|v_mtiZ>chzDsj8td&3(RUhbOUlbRgn#cGfJDBS>&6kK zIoYKEB>e&M91c!SMU`4=%amqPP*gwB&0UQ{Cb?VtP}`19J4-Z4pf3Mz#ASJCrWf3h zgOf}3p51?iR5pD^mqU!TQ3 zKr^_6vZ3=M<6LbJ5m^A7r{GW^YWK2{Iv71*%2rp8Cu!!8m6*?Sw+D&SEtFx{(&$IU znMhR0q>B{nIV~se-1{=-E!aY#M%7{@=p+k?pzT@! zpbq@X9MTxF`S!)$=OtbBnLYE*)%`oo68yLRA|;)5)m0?aP|tjXOoP1;W1t=&-a~~! z+U*G2N>D>&ks){v1bCY%^#Y-Zn%WYQ$)gW<_=A$%fniyso6~3J_gM(W#7`(f$c9ea zv*^A6R0a#>HPF=~>o2aX+*dY(w#VI&rID#@e;ML8&BHfL@f#cjEIQ@QdQIU!b{{BkjXG#A-kKXxClHsn99u2Wcu~Bj~P` zB=-(C`ixK6|GRoBaJ@nlhEeTw`gxQHh0x`JPT$!h>gw%4=}21z8bZ?1Wdhjt%+XtD z!W9w`xq-}qigpnI%tVE5QLmp70MCRMuzE&Dgj;1NbuBU;LXD${(r;Y$lZR%UD>Em{ z!M2D`NO%qr4nju&RA)r=fkHPvDPgB~y)$N+X+S)T;dg~#9U&vQ8xc`(}nMfcX=_ zz~|v3F*48;je3!K@1ASreiEXp5bhQ;makg%4%y5NBw3IOV9k*#7{rn8XJfj9I@UDk zl%EyR6-d-S0XYGbvS0(Iqr8?y&0{&%Ti4r=dmn*p5Sr?io}OD!V1P?r#l=OcUgUi^ zQD`64R-kM)6aI4Dh#eVKD^O(CLX@_Uov!WKNLpD*))t4CPJ}@=SHn@O$^UL!NosL! zQ?CPm_a{IZa}#cNh`OCMPgf$*5)>39(jmmcBFudFyaW>eImys-$yS0!pSpSvDr&Hp zx6L6~B|?vnBgaz>rGGed9ntdfnNdnFKyNWuni&j32*!gVnTkTp?%nH-Rx2JqI0#~itu*g8c?w75^3Ggr zirS8YWI@>fJYgnw`gCLCs5K-K$X$zTYqLJJ_W!R^AOs8ZkL#vTtpQk4gu>}WmMtI3 z`*|A#1g@am0o8Nr{Lu9mxj19IAd-J^{g`G3>r~(luB-C!-wCVI} zp4h*ho=y-D0JhhRqNE*;E>iN}qR^xPV?!5^y_M^0cS*RdT#zt93f&M1U$ptPH| zY~d9?G3A)HQ89pkY&cSs_4HPw{p^skGMX!t&^8ENtoc~)Zi?4L%Qd1+0m(+50#btO{j38l zlx#@%>fM)E?K;n)8YGK&tZ(lcIS(luI~leOH=*dUN9!^X&q0HCBF|kC);#-;4du(& z(SL77$`0*P1ZoWPEn89aE&z1pH~g6k+Z1;P&2aLs;`{$-7T&dY@9@uvzbJ%=0gWk% z7mXrY9^G?=u*W-|I9pXbje4cl#Pc?`xW4cgqvQo($55;6_W835Tj;O>oZ!%3Y%b2| z<0!$F#3?=m{AI1#Gi**APy7g3F=sB6L#BIsKbmk5_UD1)#BJ1nqnw6jZGY)V20EE_ z%jW|@`W~~c_iV-4I||bOLf$*BjwmO+T=otQvA9s~^T!PgKHzsjk3{t8rM(wt zu0K?~YIGprLSuTS!L2sgm%dH;<1te^3z}y7e6*%ltyouO?Q4>*-%$~*@9yp%Y%4z7 z?^ZzDPMndKjkScEUItJ-qfx^)tXt2X~Ih;<9zEZt< zWKVr?PR<@O@$#yXN8{3>V=gY4sNZ0C;>l3(>)*K)xeQ+wp6s;oVvkrbhSaAG6JzFA z7rf@gvCxz?#^xsze6PV%ewQ(2l_^*a+5d0qXMF| z{KlElc-sEeJUsPg5e%EYv5WI5G27v2()o&vQ$?tb6esR3_S;}Y<$RKWk`C&5Uw=G(WRWK{4`VyUNS$Q{@9NVg85zB%smAfPQ4igdCuz_clKEZ8 zE6B9ll&@(80>rZgh*}JiRg)_>9rA(hzlN6x-h&tM2?O#5qnN4ORg_L?Rt}0YrbXx@ zdJ3vQ=S}7<5bs7*9EMP6kd>XBoIC?A}|2ujf8#ZW2DYx z68mIbg-;?vk2R=zyznYavLo|XSa7jdQ<-QB}1G?qx90w1OiL`B4-kKI6Gfzk^iZ=mFM`hAh_xkTr3J!Vbd^JcdzX zK2Tps&cewca2P4ul#R2u@1;;y*Q*>lpmT2k*x)@xW-| zw?@2KNWez-^JCCEWO6owb2S+sgeR*)CGIHDDcXQiBqNN;4S~eNRC^uRK-Pee0NdyK zG&}qEi|9+}qtOLRl6Zl*=VJ;6V2-_Vs6^UQkd|RYhEdv4jX3BD#@V5tsXYqXSK*NNZvKt>fjDhfXFf5W^U7 zPba4O-S9>I#V|!oT0h;X?19`9Z!s|-V1YO4_F7a0#BW><;}iM%J;7$cW(}0DVCI5w zqzCOC9aEpf1aI@mB^OBYHr*-=pa}83J)x3chFCi5Kw=GW2;qq6G0#q`>MSTbmq%$Y$>oeJ?cC@c#yTmU&M#=?7R^C-8T4OjEv*pk$Te51Nw9X1u;%- z%pWlY1i%2nO`N%~>s3-WCaS}peqaFS2h~t{Nlv%EP5zN(3$3P251l#{vyM|a>DKxT z^;D{1(HGP+UMyD7n8K>P zkuv!0NlHF%c;4H|Pi`OaY0jh>Uiw&?8BmbrLnBMhT)Z0MN#;NAnzQ?#J=KvFrJy<= zqeb{ILgysLcRwjCEOceAfj9ra0PKe`h+EJ4gmrF(S_Cofgwh|o1J23F6$^fs+j;fz z2Y0-PbD=bE4}?iC7asb3vo$;tr~LNu2Sf050w@p}K?Lq=sNtpK?hA1n@et_>vfu5m zfX?w^X+I6sR+u0V6IGCTWPjsHli~7Ml_1kIbMH(~DqYZ=%w+b-?cv0HnuZD#6m+2= zbZD!~LE#8;A)zlch+vzZ|+J$sk zD18}5k-`%T_#fl@_Y_{+*9Q5#h-20I=S-5$}k{v4uqfgcY7HMhR&Z`f6&oAd!p*gb3`}8n?@Xi6h_~y_guh z$pH5+l&O&p7{3}t#&)LZ$qCp8AA^A;`rErsVlWHpD26zN)vrMEAd*v^T*x>3_%%upV=S0A%phCK4AhDlo)U%z(a3*-L5lL24tzNG45Dcp1(>pelnlHv_+ zxAoC#Z*QkFo+CRJU#n%c6Z;QShlG)Ck*Oq@l9f!Oky{nmW!$A+U|jdy{2FR)GPVq3 zv68BvLT@rvUk2wHscH8&2B<55j>&#t))z(9ag`^JV>NIL;7cNo^h}=c$L~Sqa*BZ-X!1 z6*M@w)QQANNEV18EpEH-t&*mT3mr|qe7gGj=a3>8LeUH-LWJL5UbDM~(Q!KPKt+)< z{VNy_v`wmxkq_Z9h^0m*Q{ylt)~`4k1iw&Tr%8~<3>s0#*fKxx-c&O4T%&#g(<#cjCarX>rfQx6g$PFQjV`uZSKD6|5mc(2+-4qn4l&7TOv? zlke-@J>t56Pjnnrdz3&0W#Bpi=Hy7{RLPvKJW;^cAT~6b5WoE%m0H#R*taq7BC%*g zE`%qLgnR%u4_~_1KREM&Pk5k@VFVNJbg&C+kaxCu4#3ZfoK|&xW1P(RuUcWyClOO} zl=Q=lyCEUfwl`}5_u)AuK|`zt=cjvuWEKD>)6ZCp3keH_M_Of2qt8*8dV2%Qgd^&#=x5=c2D&Ew#5`pnb1Y_>+P`DkPIdvuf%zzk(rs< zU7Ow{#NDZ`u5M#xggKWPwJQ(HB7QV=z^cnV@=A{%i+M+>ril^Bu#c;epH4)}zXLakly1ClAX=l2v^@sPm2in21r*lHs#8 znLBTS1(g#1{JRn4|M`IOe|%NXuV4v2z+V_4<*2VmKeeLw=g2^KhGY+d` z7s$O2g^%W!r1PKtypaC%jcv}oYjxE3N=}%P?qwp#jK^&u5XL?NJzc{V$r8*U4i$tw^& z7w-JWNd11gW)R2ymQm4yys;O34tEdmtl~5*t)Qs1Up+(b zFR|z)G%Zh1EY`KL8k$JujNt&LM2TVNe-QOV+AUD~R>_wUUr)_|T4q;|Y|10yYYoZF zT5tEdu@XDADn9EgVZUlVtJVL!eTxx1ppoA;?s9vZM}K5oz0aU?`dEuRyHznQrY`L zR?w~LnGlWgwcJ}G7>^bG#q+&m4ry-Xp*0s$vQO@t9G9gZ)BC)8K70Mh)POqU!-V~b zZ7351W?mHNRGe2xelWOy+aoE1DUB$7GmA+1$AB@np|Rw9MMuNm2K(FpdDb2bBjq7CeLQO zrwDc_=xbsvDpNXmiDpdonku_t!5Bof4`>Yo^GNi3bXUp#io@n~aNK5)DTw^xiuq{kl zof`ian_}j9!^bwf5t;VW*D%p^psjm)R!-SXoj+xEqD-sF^Q&!ry0^cE{~p$n%7VsZ zCk98(z^u2ZifZ7Z>em~A+rM^k>zVh0x%GuFqyN_{JG*#jqVO8u4 z(0{7B5kQS@VrW(h0$|!;EfHuPf`WDmaUIEKRy-y-ZE@=kJLUHBY!TJoMTNX#cLIH z9O)*z6Br(?X_7BaY@^q%-?}S3Fy2Zo-|LadREoj425<6JmW|!5S~5A3LWXZH$<(o> zgzxk6+sx6k9dE9h=_sf&H6-R@?ie`pBkEWEi`*mQNBL6B*os^_X(E>Se{rvkkH2K5 z%D3X_K$DC%Rm$ts1G`M=W{(4ZKc4S3?u^`%8M8YoOzM1Mbb>3?DwqA--1S_cx7s%~ z{PFrmNmXi1+pj0T9zQ)bo7eu#WMW3AK~nMnR>hrKvEAnyZg!tik|?rL-y@r_v_{?Z z_8lo1Pv@cYw`WSq*uCSnYvwr`6c~raGOHJKjb*?v`_E44$s`3ns^G;y@fFodJP2I9 z?*55FC7p~+tlGNl4k>e;6d&gfE4kMWZdtFY8EndzXvM9gL)JZFNZ-J;XldPTZT0XO z-bkS|Es&i_S199`Z|3b2*u3wU8E5Wdu^w?I|2nJc!3PrUQFMFV?SI(L>)pP-NY~7w zL1=tvq{i>qwFQTFg}S934rpOueXyofWiRQc>GUOppZk2SB1b6SXBJk;VHnOFQSQn` zdpjC57d2=pj}uk6Ot;azc5|rnd!KL}O|s2&U)mm-nk~xQW7_fccg`&5_KtG}*&Eo5 z7V)PnLI^F)m|F+`rO{@Sp~wtcCB16br)Q0Rr^vla!m&6af?T29x@%&sU|JSWY(mhzN~4Ff23MB+61&K)RMKT|de)E2VtYF#l9a0qxSFzt3vFb0Q-2Xqo9B zTah1VPc0E;v`T^$iC%r`rOn4dt5lOavGEf=Gve%<=eCTuhPIc&bVqW;AL9jnG(VBE zxQqYN<@k6GtJio;LV$x$AORAkj304 zkMpT81xfwig%dtdkj4am@ZK@?wZ zzjL&{_3lgscbo-wS6*!>8dYy9`bRo_`ZCtl|Lg+Ocxg8_E;i5L=VpWth4y7GD Hb@_h)6dh8L literal 0 HcmV?d00001 diff --git a/docs/guides/email/postfix/how-to-setup-an-email-server/PostFixAdmin-Setup-Page.png b/docs/guides/email/postfix/how-to-setup-an-email-server/PostFixAdmin-Setup-Page.png new file mode 100644 index 0000000000000000000000000000000000000000..acbdbfcd22e25ae4a5e104334d5ac086a1f2b99f GIT binary patch literal 103620 zcmeGEbyQYu)IAE{3epIIAR%BPogyJ1f(jCfbax}&jWmLSN`s`JbT^XHNOy;Hcf(ox zdEejn#~I`M`;0Tjag66NfPL?MUF%wFt~ux0fzoe8@o^|{P$(4sYq1wHC=}Wx3U&1X z76$yw67lXd{Dy5Qrfh>k;SwSLUFn^0KSQDJpkBXtF6S7xHsK(5({K!PnkMV!hvK@c zEObiw*KkSKxPIj-CDReEiRT?sliavZx<>L4{yl=O=|rc&bJ*)+z#TEx3Yl9Zp}w00 zli%|?-d|CEm~d!!eKC)-kh81*`)NAGL-=*ahfo;nF8nV*#mIdf{eS<0b@wvi-L%wy zUx5Gpx^Zpt|Mz_q|KAt>za{xULG%AV7zU0;v463Mi;Hia?3?=d`aXX^G_yWdO2@z; z+~9|=ZEk)&Ng4|m7q>rMcG2{ad^UXN9nzq8YHGnTT&BXJqL?UY_;XekQ?&l-U^cFl zR9od;5?N_!&#Ef^1%-++C#6;BFc>d?k&U`YmvR}S_y(%Ceupsz^n_F~u;qUV3 zInKwAA49)=OWE0>prGg;9Q6C};RA*2{^q?eV(?i>>FL<;1O30=op5R>DPiR+bucLo z9Ln2;hll&l&gv`_e)w=@w^E);&%hx0#}A+5tjtVYH@EZLsC#f^G=pBf9?|r%=r1-M zvfP?}{-?Q_QQdy_PvFsZGtIkP4T1efYq;?F^+_WBgk)qbF^5x^7q{R($k?E4Xkp%17cGtrVNhg5=&( zkN4Fr)}?_=MN518oUKD2;k)n6%(f>Srjj&k+^5v0Wn^T$Djhawhcw-8+}IX2h%YYY zaz9W({m%}7VCvGHp5SgscMd{`-+N+ zW##2=jW=%yV;!qhFB5Hs&^*%_D>377*obSJ;&nY@yG|pB$IZ^%o}D=YRz_l3p9Oity0lso0e9`D}0!^xf5(b3h-*Q&ev*ti${sl&$ETB4@> z_VzXw7FKBV6Z^H{O9yf%d1fvylEu#N4dphA$dWp`xTHAkE@(bg4kx;OJGeQ7hBLv= z&ThN!?KAqbPFVLm>v{1`Cs-@%8bu`~rScaSLGP5W-t`GxS&7B3A|@ir(`zOA)6}G} zaw;e&NJmFko26Ws!K1G^d9uG+V^4&YUi9O~1IgGY*)mg~K7DHZ`Y%$T33uoDTP z7Lfk=hU(wHe|PTQz4GX7ydLwd8{1b``G>UO%W~^yntB5n@_EI@FX68>_A>n|`>R7) z#;$@iQy!NBEB)!-u%Yh0a^h3!^vc{Sm0rCo#OXzMgOJm!i|@ z<;$0jrw7bAYUN&Trw92934(4a#$4+jm0@8w2aE72pCn2|vT*c4tXpl2^G0V3YGzu{M)R#G?0qrwxBlb#t%Dita9Ae`H_}( z@46H~6eEd(jVZ!?oZ{He9 ztq$kkH>C(^7J*Dx^Wv-6H7sK zHhKS^X|mcaXtdb0VSM~HKE-3tFJEpfRzU7SSvpiV%xy;hG6}*+@>l z2ifXAA0LI2latY86>p3xSETV<#tG6PcamGT3Ny-g9r=A(N85UpWn``fzNmL)sSH83 zXnXb=9OEyMk(hAH<>WU;Mn(bx1D{Ju;uRGaYwPKuGcqz3M{qR4#RUYYqNAf*+S
3yX*w$og=ITT-r5Q)n44Y z0b3aw9o>qT@{kZq%g6`|7Gr5yK8wb8d|VB7V-Ak!(bf#w%3yX-(|40*=R`01dapc~}mfq(wI(9_dPRLEBOrCB4$#Kd&- z;I^jwm|AllgU1;5T^~8kDY=wAx2-Pq{Um^-)zPl`;ty`Xi+i1M z>rn61Dr~Va38-I~m@q8z9lHubj`SZXG;DXf;d*h#OZz5{j&psc!QXLr0UtiDaRh@3 zrKYCFW;OdF`c_}f#R)DH-EWm4Z{ED=xa>7a)X67=6E@01dIAdA0PC=ZkbYxDFd(HkV*23(;HXN-et!*03vCG8dq3ro{--_M!F#Ycy(_M4Mb zP}%&-%Xt^iJ~GhJ2?+_IIuo9S{Q5;#-VSM*hmWtmuI>Y;5=+h0Z|D8`!EDv-rJnm) zD#afQ571Cd$_426Uj=)Xl$6xl!U?0Krlz*`-=W}l+`6?K%tlX-t)QTQ6KOnA!Ig>O zUv-WtxLGw-W`zc+D!g)|;4oI`PHi}&A_@gXq%mH=MK8i_Z|TeUzUBU!`$|83w9J`Q z?2}fxLdeDZO(8TPR8Q@vXB&g!R!OkX$+%2z(n`hb$%|S+)$oKWp4rqpR%*eEh7@Bc z?;ee?HS-$ZU{7JeEv>BH#iS!RqR_C*dN7Kivf65{NgD!+LnPj8q9VM|;|hu}s1a&{ zzM#bBRD(Z3X3-e{EiDU+5Pt$1os+#~j`sLx9@J2#kT5jFn63B4oxi?WV!y6(28oHI z??+eLj`>veCr?il`n79TITCGv96o>kEH1H7SXh{^-%h%qLHG6!q1I%T6T`WE`{_C! zKE7{c|x#WKC{H+E}h z=c`ltSB9|?6$WNz{Ju1)Z=;K&Epm0*%H7V6ZopRShj&`v2z)X8+l3n{NVKB{4|Q!Car$oe6$Fg zfJX37np7;0MDxzhPM*`Q0i3nhGtNl8V^qx1+WFTie)v)zQn!}WSb;t+*%=tESF;TevmaL;5dbK5$Djo!_5YIym_I`d%}QhNFI)&o-d&6YtPTiTT9G+FGHt z@$zr2sLZ82jceDgk*H{lJlWgZn_gZHl+RRXm7IcGg3_xjm3kEoP5C)@LRWM0%OIsy zLC38-uCA_f;&bV;KP``U^w*|pG|d-aDGu{=8gYDw3dJ7OcRjldhO9z2K|6GQxR~Hk z-_Rhk;Q)9&AIdATn~?aLf4u&7(|qnvAhF}Y8a?1u!c{lnk-S*>FLDBODqyhq`HGy$~+zyRpRY$qd8vA z5EO>(&F@HHK`drwW{N*YNuS(1C~jRhRxPzWKe6j{0zfJ5y-|RG>+nc+wPFnO=E=aNUOftp8V~?t4W>q=KIGIvoWu( z#kt0yTV>As43NWU3p*<8R=YD5SyLZM^xj$k0HysW;06?M5d{U(&s0yFGOjxTMC*v- zB?f^0s?gx?^v1?@6u^WJ2?+@u1${r?8fq9oeb3zy^f=iIEX4mE9!>%f_%mc*5hl|6 z_wFUvvlguU;fkn~rh5UkL%PsF3gwxb%gQK}UsB@t?He&vxlm})rl+;yc&vmCqM;p1 z5%Isy#>JIwSpj#{NNxnkprNS=BU`0d`1NaSh`D^5#W&Hb>vi6kEuEbT<@f;6bbE?T z6#>TGg-i}LN&oi|m4Ne2G|cN^(WE3KjiZJrqlpR<41x;+l~VIh_4UFpUcG9glA5;J zTN@z;I2Ok`_5AsBN#;lv^@>E7!;PixBs55=Y1Yh<89bZJswHyA?wK8SGV*{yyK^<4 zJvQn_!L~u`aOLd$Tt5P`29MK@UTU+{eG#1`ro0Ry zCF6HwgG*HQ?q9!VRReKdR^~+|lbL-$BVp*1q zGPIIWp4h~+EpmNO?+mWpnQIPd4kqW+8}$WDm<+KKCE!xhQSj(ZoU}@Er!V8u!S=TH zZxpxL=*{)fV%<+tG}P3e;q)*}bmpj6c0<@L*g#9)UG3(ww>hP0P!5Ph>;Vz25i>n~ z9iTtu)zyhg?!jD50xBvhgP2dB@SP9V0^uwxWcY|v0|NdV%MA-kjw4~dIaR}I!w+z% zJ4KWLxftztefa^W(!4ya3^v92bA@nHCM6V|nj z-vDVlIz}2Ah^$jfXz8N(>=<^HN3ZB+Dr76k=L5X+CS_Jh1OzC#9$ZxPIC?q|x?vNp4w-1?7?cMK$BMHaVbds%$TMePnI#KVQ1}+ z*9B6q;oKun2`m3?1Rs+m`}0kQA)sn#G6_UK-)@5S4qwZ6h5M<8 zMq7WdoqO6Q;^67ir@D1s*E-I7ii~A#*M@JTh=xQsZNQ;Xff>`fZ-tm=cRA!OoE~9sYopwO*1esV3_brNlB6HW|ptCH|s1J);IkOpg*tI z$k-U0m6f$qYY@&U^J3Mzlvg~!&Ola3+i?Kw^BGQsZg=8yAZ~6OhEM0(P1Y1$LBp7C zrt$dqzUG-$ElOe0UubzZJp+MwOVG70YC?BB14K?Ky~xPtWkJ`o+6?>l#oc_f(Rkc4ICL@=#P$ z>uCG5F_;}&fA_N^Keb_?SHaikj~+cL7udGmr#PJvnIEfQ_!b%2%wT0}Z?C{}Q$APY zcgA0`pMd7cp1dbBbp{G6Q+&<`n>Z0R*Fjz1`${_8r6P}%hK5F&+v$_tpTC^l^)uD2 z*9&hB4etSd*SlDB9RvMxNxgVX z&D|;wO_gL(t0>%m-NDhuJImiX%oCaD4Ya<;~o>$NqiY-6%>4Zszx@%S&&S% zY?c0|W*vzCj81OZfw;^+_u1L=+e#bc>r?56l+*^7VeGL7T!3HlSC1sK6&~<=&uYmcyB$0RL;^N8& zzA>1BOMJr(L2C+>YXwMvC4P^M4T2Q+BQ^Cd@Nr+he8IxgEB(fr>pHMc<9_sfnb5D- zewU?IgJHE9n`Vz25z)kkn{$dyz9!_-FoXjgNU386q^x#2W zTKW#&th3-FT3QZrBA^Aa2nZrwHpB7jQkOR`AvCPeeLxp4zY^2c+N$mLHatxW7-jRtk00qW0_EeAr<7lEX$gwjotQoH zA(XMJj;Hsmedo`)e z^4`ET#bP((km-*tnQsnLTX8YU#RVBtI7HaO!@{(ts@>%I&J^Ssriwhf7Bg=e{Tl6a zmY>~rMEFYtGPQntG&Bk?n zCK(1;uw}1TJt8fQc5iS0rUBvWaGG+!(3$-%0zNvCvNAIN48+7Is@-C3-fw=Kt#~VUe2yBfiG`ymW+yL@9M9_6 zJeLHJGi$PeRii2Zu!)?Jx|-QQ%o8&l&q`-=d;1dc^27N|@tEjnc{+7XV#QV&1%-%S zqDS)0gbLg_*QZgI2jk<=%#u+s)rjR=xF3j89_Uh z+Vtb{_Pi(zuJ)QvHf3II>_`yuR^Fl0gF8iCHA5LeZ_QSwaovv0Vxs5B3fXB`kkl3X}+d?WW+wo-`@SEa+|0 z28Bi>`Emrw<;)nRsDcpjq7*3#D1_}|+!BPs7#9~OXPy}z7uUh77qNGWPmwp)k@n*U z9hGTuUS6nteRft+65ouo6>#^m6zBp@GTRw_Y6AEYfi{^XCaj9`NAvB9bZbnx4FBfm z>xPCDk<#X0S@{&uSt|~0^{YibHF6Ph$#Vi0AUs=aek;-dQvK z?x6oMC}=)HMj_2sfPq1LhA*}4SuAjI;~g1rmiyAVEhg#AI_u>N16Fyjhbg?<=t;rs zJK$wyCAe|phU3{0`mc_lugR`tBG_tRaI3t4P0Nnd^uD50WFHllyvcI zr|S_a>Y0b&t6;J^Wf9>UkW&;sJ0sI*%pHKiB|(z9!n7j~TeW7Vnc@I#~8H823{Kq*h(NX+E~Q z0{zsI)HiB%J5UV6+&6dT+p~;&O&Oul0BMiILqB!^U?n0JAY}sK`Zgvi3kMtRSUt?H zT)C3PURchz#|M$HxWBzUCpswY1*p*%sMPU9Rb{EjouPg}oZHKNk9?<&xq~T$K+O?z zll{OQ(%f)%yvA+}N26_}IHDbBJsz}w1+1z-tY>Ze00IaGI=Xz7nSo(8OXkdiVSBKr z=Q$`j`e`p;RB8Ple@$}pCf#jniI15$$;k(<^QMnoSHndXZJa=Xm`1W@l$7 zfMKTHX0C(6_2M+zApa$^((-JPqE3X%A^?9+~aK9zt_xadw*X(>bd>y zf|SB*^JDhtOtc&dGN38td2*~lO=Z-TyFi!iP!b(*9X#?E#$3=!!=9Zle4Im-675cHXGq>0Tzf4 zwaRX> zCOecX$S5ejo^t@V)juBfPp;FMclb3&|YWueCjjNUWTb>7yT zk!4qVcOI6jaVapUswO4l;NotBWL%h*t6F*;XknnPwe)WXHR?DzIkl=ez%{e%e0+Q? z&3DgF592<#AFuw^E`4`GM?i`tg(K9=V7#@v z>kW)520n$4A3kOBuU}ZKn$=;a!aYA;6H7*O_;Q_BZdNxyr)4!$f6X99iKz(~79?Pl zR8>Vl&d<-!FSDM(vEhEuuis@@dH5>$=nCj^!uIx0fOu%lu@b-1B!yVQLJ(JohCk2f}6b9Z;= z=tJ73urR%|#b+W~`ue_LK!8)=Q#`)d3p{+}5C#xK_5I=f@UaM|*0$i6;ndRNvR8;Sv zqkBM0I}2UEwQ0n!Hjp%-9jS*6Miv&L8NgBgD+`n-kbDYbl6CC5O|<|W7RYyjb_u3= zM*ZxJ?dsoH)g-{vP$7U&daxRYz%&p)I}CGHh9EBn1OE*5}bOlkJXZPE2o10+2_!v`kDsLW?M8a2U>KIgMI9Oar_}#$$QMvv=VZqr1kH z)4K;8?NIR1Zn0|o$JH`k z(k$qW@=R`kyr#R{o0^cIMPg)PqSKT7GOKqYAmEm`=7sa&2EL);B928NbeDuUzFCqV z?~8u^6<0?{MC1iP!_m=Et0nX<$s2Em;7^~}!Gkf#CXsPFHUm`PeBkjFmWysG_7SoG ze)^APNK2oqiX^D_>Ku6SbkwS^b*1`FVI)X>Ia1 zrI4}NBRllT!_BE?z)i}1z(O+gHI$_X(z_qe-%@Bjf{^PeF;j(u4PX)38;^_QpB)^% z_FEaD28ocY!pPs4uMOvySX0MMDh;^>$ZzNY6ss+{^dVj#bgUH?S%bP38vqogzKKB;k{xMffaP+=v4~XXj_mbpSLvF?mo?eh4=!g?Bu=fB$}*fD7sOrw$6n-=Cdrp)ocDgBL12 zr+TE8l8*T=*diLM-A;L)nlR+P{zi+aLj3&vJek1}ilyf2kckn829BmQ#3&s8naxes zJ`rc-Howz!CVBsNvQJ3Om7SfPl}gR2Kv>BGzYHG5;{fcBSy@@r3k!b4k0dmM%STO2 zcZN?ZK$z<+36z1St*)*%nyMB+6y2(w0XN11R(&oIyZx_Id4c3nf2V77G-jDoXke~A z6{4KS?WCwz(jUTX4$l2>o|SjKt-O7WJa}6EokmB7CE8e95{RX`&K*uUi0wswyJ}qj{!FocO}1o_Bxlz z7V<5yr5f7KCkN|6aKK#cyZ?q$+u=z-bHRBVSa)Q5>(7aBe37(xurZOjRbgdqT@MK$ z48y6H;tEK^ufP<-6WP<cy}$`%7*MME8G;e=a&kUk zKZ3x#2Umk_N6bJ7>tBo!p;k~>c!P!}ZE@wab9Wn_qC z_s7BR0o8{P3!UTidqM)DYgak%#6j?x{&SUd& zGHArJw}z_|3eTb0n1)_d3@)gm!mzW8i?}q1i2(^+RZ>w=IEj**ck1fwG~h@u8O#b) zDK=^S{rQ>endecNBi!{YsK`j=i+OA;lO)p&yg`c`0cfBkpKsHfT_8@hp;J{xQ6(D?Z4AX#?-D>fN=dc)TkzVQpiBAWq<3W&qYe21lf*^OOCg?Cifx zkG_Zz-n!)vGzTK2z)1m7M()E|9HW0{LS#-$oM0 zXD7Z<0N)Fb+tBjmzC1ODKcS3MZ+vMggk<~YNB^0Dce0Z;{syW*GXwShE+;23Y;E_@ zkfERL$yX6I#7_nv(K00bf%|_yi!k|Be^c!Lx<#?x-T&Y9LcWhHx%U6TFJx>N6K_5I zx3F-JmG$k0E2tqiZy_}f4baGp8kh>Wr+1ILA?Yb{46raVO3Vl{fNOMX;V&f_C1uL1 zPZqNU$Nxd@jftnx#>FNBUI4UIN*Vu)I7~=Si1o(V87`r#N)iJ(>Xbl)Botp1eEs$fF{LI+AC0V@#GNXVEH5wrlCLD)Gf_A@ z0>p%%?){YkS&_E>N6f4DO;$}s-l`rKtCG{;e7w`i>h;=8y*TS~YDG5*y_`m{?#Fei zTd*ZlpDmLAoB~_~b~|dkMz{I1Hkd4jD;;vj?GWS#$l=5*J;%B2;N2JK?eHj{-~m{d zkIV4z2keLR8jhD2zf}flZry6GU^xW^36!W=03GrLpMcPw%dNT45d?)vx7PEDB_wT+ z%TrCTZq9WliIAu)LW|B0{z)*Pg5v}f{u^XuN=as7@&f`bc3G(&@=hUL-=E%sW~CN7 zK*s&^oyAp~4NZBTr%&h1yC=lm4xyzO20tXp&tEIYlL5~qE256qsu;HMp5zyDyM~VjA)URHmo*kg^k>&&xIfC zk^ubSrf?FLzTzV7oYkI@uDJcxkp&t&@GLfgwXM5Azg;{# z36Y;~zIWGnc)-fV@jDR#{A&68_a$fn?52ZE-9>nRzlZ5~DhL2-qC z(Q1E19(F1jR6&FWLP*iXqMQA#t=Is*(4`WqIt^$Yj4Cg8~k@5lP_SEWrV`r_%-v1?fdQM?zOu7kH}a@p2nSu-3hQ{~qk< z`5-Z-J?IDNnbV*{D}$zetOnYbI~*KDC_<2rK_Z-m?*|iC6qgMtsER&tD?ltabadc> z59$TzO325c%7C&1fJAGfmaATg0bz^WEc9cd!0P}YiFRvkX{kL}A48mOsMOR6{lAa` zAPyP;2;2adHKaaWu-^g1Bf5I^>K1TeJUl#FpzxyfHtT?l(E8W%1u^1WoUF0}Yk_oA zK%0cSyeFYr-2ojZAKGFhWB>yqu0Jrg5r9YqHbrE?L0YH-@jWRu^%?;I!9pdR3d5Wr z09~^nN&1LAxEk^^5MVQBJD63jLOmA+3N7DZQzI%imh&(%C+9j5@wcemVwbne`-&r{ zhtM=T9&I5e!2sw%bRhqb@mfDvbnk*kf+`BoEQ~j8XM;dWYUHCV;=zI@nhjJ>D0Vo2 zK=ShQ>#Ce~weY@($*nN+rYwVri``gRHr16@l?`4W zAd8ug*OiI9c+=Dx`r<{}e6owINRi2%F{V2k*<>y`zw1-VB*}()>k>=$*^?A?w;WSX zcNmy&x#Wu8XSz%2IzeH%)Qg&Pe&UywhGB4dK=@{YxqG6G3>CUtO=uG$*fiQR*gb2k zbKLsKa&_vasF%i^eg@fZRU9@$OWd`xGot6LFMk;(esc28?#@gN>~(uec!Yz&#}yiT zi5*!lv;A7ei>8w6&(WmRH1QFR2ft)fWz|*5aR-8+b=71$Z@w~$2(PJ)swUGO7c%mt z+9Vq^$&Dd&Op8Bx5v)gY!MYA}-9L-dd*_I59%Fo%Szek{^PIZ;C@Qmnxo4&y+$f^@ z{Ow|_qc0Twoy$Mm?*`Q5ArFg!oppR-0vzWAAQKYDoZ%%D1_|1PR$_Zvf=T?9Zi1CKX4kjB~lf*BP#@RKuO z^+TF4@R`kkeF*{>M4)7nELIsNhJNfdP4kqRX9 zmAM?UKv!|+i`dPLDJcBfKm`CRq`j1vWHeU742i0CahKh8Ng7W6Js{no0$^ZZkUe%J zgm!fc5^quh*dN_q<}YGMGYc)94veHA8Tw#z zir|abA0}eBS)e29>g%s=Y;1^0O8x;10nTYJpbr{4JFf#*E+Qv)6E)((#?OBnj0Rrm z>GWU@#s=VqbZ^joG0=kNzVeax(xdboYQEGd3=ek4bpu(K+567#IlTX9H`^nHTJ3eW!V1 z$8m2DOZK|-$SL>Jr<7nv1xE?4G|c?a&Sg|VCaQ01!vVVzB%hBPAv@OA)?3qcXltXz zxZqEYdg{Oe?4ch76lYg)0fUR?)zs$~klB06Z47~KO3ce61W`gihnQZ#jM~qh4Gm@c zUM&PW>q_n6fvFPq@$gbVsUOBDAyGTLi{oVOLLywy|-JHZ#@js{OZpaSpSt!IL+F9h|ON(u`n;JjKfAX2W=z6Bb{? z&3kM)N#*60tdn)ShvI;$BX9MDF%DY_9p&?AQRr+YVNOw6E_kt(m+nk1SU3>9>zhs9 z**{r46IGgBOz!5?N5*7JcDP?>b+V{OFbwQWbm}&>LvKdXO_Ua`g$z4$;jk||DQzW? zE@|ugd>_)h%fX9jMmhN0rJawhJN-ivRflw!5GL!_!u%acp7#_34F^_KY{@C)2UEdy zLI2)&&hPHvZa=0MO`W@UafBV2kXE;7fY-EN^e0U4lO;P7$(4|=yj^IJWMtIe*;|oA zxB)u#kBA@zs^lY5rvcR(^(6atShKUUBa|lMo|BT2LfpaMxvmI7bmcqmn*c?a3@HH8 zgfEy55xyI$6apHN!LBPP;L(xt$HBpws3=PSlri{f4aHkvyMuw7MbR;1??B1{a*3Gi z3CuddnSNz!`xsP$oE^cK*jPrjTZ*p-ij4cBdRw4ZMl9NhI|qKDP>7IoVQXi{n<=ge zq&eNqdmw`Xy7Yf>?>Si4Nm(_5VORi3U7!w7H+`nUMJ)E(Xec~9Jg_@mfq^gpV4d?G=ljSXptHFTaup!fyuw0nn33CR?aykpDmr2w>N^2X)qFy|$u=x9RVq1z~tR=G$ib z?*48e0W`Dmpua)~r&s^fxaC?-p=w)%Fg2c)c$2;*p2!Ney0F60s3Fl6!?bx|=>9@3 zhAgEb%;3*&$=13W3yz2N>w8&^X=V$W@a!NkB#j-&sj5=i+uJ)H?>t0?aUf}DfvxZ2;$ms?_fs%b z){*lYo0z~{$raGI>wq8Knr*~IqIqrP+sI|XSWjj;CYTTvj0+j~>{ie}2zkO}%YUYt z;^Icwb1gV1l@1b5!x_e$!1L~<#AF~Y%$Nb4xMVjz3cUQ+q*W^DS+_2Zw(s|$c_1AY zaHx2c8qQ{56Z+7#$oZUGnt}-j{VGs&IzU!gALb@M2JaF$@)3Iva(L`k!X!zKp=%Jj zLpa?Q&WIA12z+_(#(&=j7vDcdZo~P&RgNI*@-@}BX@8S4kT%4 z{eJt?G)TZG278Y%H*;kbmHOUZA}gz0$h3y)U&B6W^o3G9CiLdUUPo zjG*e^xnaU_#pT!{QPqj&qxUX3FWGme78dU3CSs*W(?s7PL_KJH7~p=tX*m8;@5IOm zbv_!!_QAo{gvGg-kge_^%C?jU)M)?=h25ZNfCf7a{TCua z_CRl3{`(|iGf$lFwjzu>0lvTh6ArRZU|p|=mT7u^{@QfH9pTCL-)_?K&;E}WphzVf z41gVkB0y}zfRmH&K|aSS!!y?~D0g72N=!=n0HJah(lpTG4bhy2dC*-lsaM>DdSsBj z2-;jT^tLx(G7gX?5+%TPbzDT!R7)x<-U4S&oG}B-j5|BJI2tz0&md!+;LK@+ekk_wo@=>P(9er_|QaGp%OB(>InZX6jS%2eL``2*6G|M>=p7B16t!t))p3kJyl+B*>bW^xYX5T>SGkD3Gm}-9aL@Q z52Swjtwf6-Cclhw`^V1rBqJ#2Z!nvSmQBZ{fMn_>1B6CmW@`M*Bru<$tbtcIaZX^$ z3aQ$_;noifkmTg#AnpMB^-w#^nLkKB$ZZOE%?7;P+G<@?03}s4=VZJ zV5L2NcK7awbeZ=C3Zn)vDPD(&K%TvcGmzh4P%)?5UEV+)+=v_x{Q%Fr1Y#Fa6rkt; zm4cYZ5G0C>;DNu|5@Qm?1yQiKSc1J2VTVBYGFY#9Oh*qBbr3UAE0+L#ICP61J!-W$ zgfaGyFoq8UDP(|lo6e4Rw;KqaO+$D{{p64_H%Um?>pmAzxr|(IVWk0TDnejp)qLyUh!sccOg4)%d0fWk6 zR+X6vT@0KCxrK4@O=V6_PFj&e;i-REbDS zIAmZTzXM$_%#Rt4KDe4{rV82%GAU~|Chj8A+0o(yOA8s@_Y)=eEO2T80RgpOf{EIM z^O^*c6Hr>wl9Q7|q1gnQZ3dbvYZroupB$^BC1#Xh!w5jAW6(a}6%P%ecSVqd1X61q z*c+frh0d!MKA0q82^cs$%0HgBRufd>+UM6yJ7&wdPck+U3AUrI*L4b^12i>#x z4*i|!tFyDSgiyWVYOND~Fkl9BDZ&MUC2t0>GD_TqV6!(B7oZ$?;zDC$J|dJa#J<>@ zH-50bXD$AgFH2s(#^vwg6xdUSfq`FlKaViNcTP@g`-d<%?cQ-V=gJd?P+uUJ(P zQKa{kf*_{B^WV_WfCi)Va2dHW4yuy6%e}Xl$&heOEo_2D4KVb7LReZF$7ws) zzwyQK$llMCm%!2?JvsEbUO#{S98bFqv=3o)jQ5Y=L-E6rl5!OMecJAVSBCT1^gbnf zRj243-rf7M*D9GJHzIi4S#J!*|F|a-7m}$>zg3g)r=zr#T|}n|bFJcpD0%#<&m#lv zzD6-y3ll6G5jVUd(t9VL$V4~)%u2lxG#7l^yjh1$)?58pwoxY0-&2%6z=iRZWCht6 zOO0Fwfqb#Wyz#bYN0smk+Qn&+=QltJ+$==k`bP7^Bv&4~L74iGiKDhB|VZ2goal#1J7NAqqGe@Eec=0S)C4-mvk? z-Tg{oHZT&%kTEnhSENTVY{3T?m#PY4Nl!%^4Q67|$0JaXqq{(Keh#aQ1Uj5B9f&w2 ziamQvT43OHdR!1?yE^%a_ldsdKNyL+4ugAXx~zf;A&_=C*W-Rl#rnZZFE}19_s+G3 zPlE0CE8Cqm)E~Egb4+N&;(PQ9eQjC^Y-^IKHLbR+*V&+xC|b``%1du z)-QE8|2AYWoitw#@%mF;rwbxeVfkegqd)sK{3Grw29p)KM zx|+A)7Y=yxAcp)b$Q3cq;aGdZyBZyX8o z&mBg_AOKHSM}PkVeW=?d{7!A&;>7TY4F~({5m)x(YxjLIOmVNp(%Kr<#Y-IJ^iQ&| z<$YtkT%Jl%tD>AFho^)B*$D%G7#_37P^Yv0W=Y z{uVaJ-_ds^!~aU#e!RSxEPtt+)j<+GvBkJLwe#=qWOh{XoP&nCJCP^1OY!u)eP`Cu zgxEP}Wb4|D<#Eo6%zmIR+An zPkvB2$#360JvrF{;(-&mKk)Ow+d$rBlO*@{$^gVmb%c}KEoYKfP&5li0kL#}(L#@d z9MU07q$NOzD^@oB0x}+c5`+D{WMlZ3FLl5!0%1V_DO)sEW(J0^B`{2iW1!qaSB3A4 z)*lS**>`6GZBQ^$e*OA2dNB~Q46ktbHCSyUGB2AhH#|C`qiZJ1SOuD>ukgE{0)H67 zao`WD*AIczjRJTAX;>HrxIvWvn)zNtT2AhTzJBUt<(yRbX6~z086d@uyIl${uOlPb zB_-}gb0mo{`~r6XG$(aB6GZ`Qw}1M9)!HyS@E5!u7yN)p0bf(tisrU86iF1Tz&ud= zWVRsw^LNJAaLTJj>kR#*Gr9heM$Q?T8h0CYFfuia%DgipDEr(d-onVxP}h_^cxoc` zu-rHGaY6CpGLOpY{-5ugy2HonMsIWa-Y!o2>NRV9`~B*qeQ@i`|MtU!@6u4QiiWgY zEoTVp@j=zy!{(S*uLsb6*&YtOfg>L+*#!0{Ffz=PFUE6HG&e{ml);!BUPS@J&5tVn zasw|?dJuBg3LL}W8P6J88cfw~IZBt{lg|g9ROyz`Z#+F&VjQ90dp~l>+EdbZ&IkHm zz6xQKf1B!|q{pHB9k1Je{@q*a{-18c!^8c@$8a!kd}qIqPk0s)RIt$9w2oT~Zl8)` zXZZH~KH3aUIo>1vbrD<|zmu@PWL)jpq3tXBw%%6dz#DxK+IlNWHW?BHyq7??-5Wk& zr2tlFfi(}szuUnH67gkrra$Z#*gGjH$NZF~J^|`zZA~8y7rL|sKa26!Kf4dp9^?>S z--aS!pyvZb?U|-XSq$#~{P}-A1?$Go|NB4qmHrps|NQ_KdI+Jmr(iNd-UL!@(SVUl_yM_o}ZiFNg2!X6Gm5;V-W0!HcbCZO*x6w-kg?1|6%Xc6LHb3EHnHjO$`O% zll9eqi<2p@3!m_m3kFK2O_2+y%DjVDasiJByEahYZ^8x0YItNs8|qt8M+jpD2lBor z&O*P0NN_DRPu5XWn#N*;sBYDWz{%u@#>2$)SJ4g;_lK9&Ak56bK=JcAH!?8wfJ&JN zJtU$51O0e2!Z`1l$-0<)x=R5sW1zeAV)OUL{yiyeZ+-md%$+=k-U0!LM zzaA2F-*eW#y+EqayZNr!-fE@x=RkaMQAzXW#9K?Z0<-L@A3uNYHc?tkZ*F!$W1ivb zb~xbxTm`spk;1>CaMTR%ZNLL7$w;LGD>#j^NUGtb7>MJovhozI5ujKu@$K6kiO;>M zIeuQ^Q7dR%Dvp#{-3Qvn$IovN$3>10I4o?z^F3K`-}NVM3(~Il?h<0aP;VNbc`tHZet13l(6uG1dCBLjU^7XgLV)zHHOqB}$*>5cg ziww6E*kBTM@crWQEZjp%`EKL#a1mF^qg*6S&U&f!nm5|4Ow-ED>XMyK(*Co))?9NQ z7WDI=*Wr&OpB-gDc(#Btc`46+1F601nZ+dDXa_O#sA9V*C}vSGyAA+21>i8?DH2bB z7(}F`el<0h&jy!raKWzx^p85(SGyN25?hHd4e$vtGbrmK@7~=2ICUiI*b7mHP+IYh zvw@;9pI>FW|JYVc-Lt1Cf7JQTo)xpy;Z;)JX`lDX#o;sUu~w?pC(P6g_yf6-Eywf} zo@tlV{}*d-9?f;zzKwpHxGSZ(kR+Kykz|Ne6fzHGR>%}8B(qYKAu=S%lqqu=lDSf3 zC^CjJWG0#CX&=}9Jioo)wchuSz1Q0JTF-M2@%?^=>pHLVJdWc$&b#q#vEc@01KATb z%aT%Wy~{itPt`7Z4%I0!a2z?}{Ok`9w7Z?wXZEMh?8BDua_MIK0oJeX!$wNHN7ht$ zNDhzJZBJ%Zjyo=`^pU3D59I0GjSu08$lqc#pzZUHj_GrbkA&RK=i%B{I^J#E`Z)c# zOQi=d-xkA9ZXe%;($|DcmRDSm@0pFVAFm6ju$`oTkQ1>EJEA{U&XZG(!kP)4``dIJ{pccMe!k-tB!_S@@8Y@x~M*A~Ei47NbE5Ze~>QX{1$ z&xRdr%-q}@%+;hNCGSc)(4{Q?`EwmAhB=rU#NQ&^0>sm?6Ai~qzU?PKKVUF&sgT5U zBOOtBr-Q ziLMxWnA)ZcUcv~G?v-gb>L&0U>_?6emztw63^|Iw&C#1t<{hwbBX-TMKJz4U!rzs=4n+^x&pzRoEnDK+&| zS8xB5<{wwp97WgJNsgaQywd%BZRnGAUzU$i>;ZBFv#g|rshE+fys78Fz7rM@uv9X%jrrR~1Y7{R1RYTbP zls;>LGV?d;raSEE20V9~AJSz}7$~-Y6>~bDFsh*t-nn!aSN0)}YlJAcr!?E`sWg zjC=*dFkK1f5l<*h))J!!y*phSD5&8-u}3-I11ktw%C0?o_^(y(tE;P{X*zrE+ z+HZaf0#4|5&Vyc`?+H>Q?jcxaohTM_BB3xafGth7)yOvplEx<|4IzShA#6kC4%JsC zjy&Uyfj`8Wy5ntiREBC4`OEt zLGMi)8|V=k16Nk?G(lM0n$Nr~dLHs=yeZt=bCj9_<_#Pu9RAt3@d|KiA|vPjX=7tE z566OyG&G;Se}96HBm460^_Gu>Gy^vZ%qMh0N1t&m5s-jvfML}eXwdO7m%+I%5JiHY6JqH&rKc`n_ zCO>TO!cIAz0LjV5!SN8A70ZKI*a`j`Y)lD_W8b}d_p3(pc87jOGz5P_x^QPCrx^mj zr&Aa9=H^#&y_Ajro!j9maGBb3YTr<^qI=Un-hO`ZadDqag{PIH-kKdM6|taW0H_hS$5O`NGyeY$GjZw4PuxH_9k zeNC3Z=vH2^g7TS7e$++ocH!(6y^_Ci_Q9VveF>mP=iQCF2rGl9>EXSJ zcUn4}QSuEM7Jrqbo^F4MvN{#fm@C(=m0=55#E*7%zJIu#k!5q0d+iL#412me1QWLG0Ye)?PdIX{X{*tDh$U?+W&u zbuF+lx(NgxH85HY7g|N>V#S2_WvZZ@rY4F8-5RMtd{RxI##{>jO7v{r< z{~)5k!^1Gg#Lm+R9dB`NaI}DqUqwmjJ*el)Z?0|tRJ(x?Yj_bsPo5~t>Dl#0*td5f z@>4|v_Js7;7eCS{qI#N%h!MIzKKRmmE9o)mQRL1jJOhRb{6n9gP&?&)Wu-UH&7hD7 z)-*jQ2M40;7m;YAL$VGufIL+SbThC}cno?07EmOf;G=tS?${32Z8(4a{GmgKl(<4t zbqn^0ijKs10d7SyO&SJITl{pL>+&Mc3dK0AElLp=;~nwH_kwLWp`~zEWC~I4r4k2W zFt7!w2=nl#Etj^I{)zna<6ZHg`X9?$JrS*JkUW@6C&#?i*c~GK8SL6K0h6uBfvDb> zmZFdR!Ovp5aDCVL&vE-H2!RARqyV&VUYYMldU@>Xr+?srTD6(4@HEJT6o)4`Q787zqk{Ae`Cz$ zcfyAC-y^2d7RP_kZwd*~iOTfNbZU7fD)h3aj4^WMns6WQVXwr5MXh^24A_Kv{faqaz%5{m77CG~w-c|T@rUG;CdE`{`T z+MS$oJrEWmoUCtXc4B$UErk~>E>-qFPW4MFJ8z^smhk7T8vSf7u$}RuT2o|?^=-TzBS*311`eAD-^}W%Eo_450)rNhae3cr* zEAKb1C&5*L-8!Y@K(c_^v42Vn){tNTaZTt-hmvRRnV8eOLb2IDUJqY3yD9!wmObcZ zNa&sz+Z!KR)5qObdCNW~&kTO~{Ge4`#-c!)s(WH`l7*i?5E&lZ#fGhiaWX1%g#>=z z(z+%O7F04aGPFi_xI<(swozbVKnIlv0y27p-L=x#;OM%EkCT&`msdfHZthQ3P26kH zP53|=WV9f!AqJE2Fsr3MWyh$Lm|#wum!ieSV8H_+ID>YX}F<+yIo5fFo~@mP!@=Lh+YMSB3rLg{n+2OTt0X`_7E2y95Qu7 zIpUB9DIn<}Nj^b0KkwD=i4WByR(bqipl$qucH!ir*`w=I0MIGOqJb;BQk952!{hv3epbFo`%=bB0S zYzX2giMqr?``}V`+m^_c1(sL$-!az@t9xph9yj_ccFs$e>B_IS8)l1zWxvJL|Cqhw ziCq`y(fpmuS;UWeYJEWE&w<{4v!AOa3rQL_Nvnr9WwgKln>XXBlDyMW$QhN=wV!%# zA_@ie9xi2=s@nEGM)8uCr$WM#-kzJ{^>_Gh{9LC#6(u z;y#rRY^f>^_0BKcm6%XQdxWop5_pX6!C`_uF;-J;0HuM~Y2nfgq9VetTb#LyEI zvf_tC4Je&VdaimYR4V77K0|y4_<7aJN{{E;b2oU$^7tc!vW&{PP=Gd-VyB2Q6c^^)uyv+D(q4&WE7t_D& zEjX-rNeC?)Siq==%E7*vHYV>LEnZBYdI4k#8;Yns5zx0EIPeX5KCAu2C4H9=l(1N? zNZ0n(oSNN_cmc5(Jgr#hqOp;3hA!EUL@MZEC94$Mil}8(d)j_dyCWsF0iVl@`~~!B zZJM?ajQrwnC@LxvlQ5WA68|!^T^agz>{H`Plgq@x69l`>*!fpJ`+bY7X(FnVuMTNk zwA(V(BHy$~`|cOWabGX~W*%HwU^m^3%E7{-d?>;7;%<5oQ4)>M)vubVj9! z<;g$m7x#*K=xn`q?T6Se@4Bhhzd!9*S94Q-%nrl})_vXe$vbrE^T_VD`BHnTn;wa=-}ug`&W$;JPt$rQGq1F) zB}CV1_r3Cc;iH{>yndX%8LsIcOKZ0+zy23Jr2ph?zfPrbTIA@_*OJ|?#WfcmyJZFT zr1YCM#^fKHuA<#e5&M-B^`_KY7&vxq+O_F{GLVNh z>ymgtR7Btvc2VQ&wq(E~n;`4DQvK{$;oNT@{LKR`5wFpqK+O6~FDct`KgQ}oe|9*` zZ3p}^c_Jjqo6_2qZ?Qh7L}R$`5kf*`KMZraSkf(QelfeF_63e6eEDcFNc z!IBSq12Oa{I%SB13n=(O__Og9j;#fsUxr2=thyHw5u|_u1c+!Zlae74p_0<55?24t$aOkvwqaANr=HDN0&Td)-JaQ8%R@@G} z^*o`I=fCoCJqj1K3|reslE>Ap+EG7(eO+DLeslVd(~`~Q@QqTe%Sxsm8>~x7HW94( z=am-q*XL%Jj%*nmFP+&r9YfaiEpEAn`5f8~{;V8n-Ld}B=f8LC@>}`YaU?hWSl7fh z>fA745v5z*kEiUV^rjn^GpCNo2CBZfVfQiF&azbLnibV?K$x1A$9JRs0 zhjKI5KUf>~;P%>cx|dZ(;_TcD7-kM-o#-Fb?fQ~-WXUa#`JuH{~{A}2Q>;Awjry=c!O$) z>=~-R>Xc^{d0uV)5>mu)ZG16l^h-ry>91h!KdV=_H}f4x?2o1p0KI?nWY)Wzte$b) z-#>lc-&>_V8sI#?>r~;YUs@5%rU!KEq^WQ62}bH#nB3qV-;t*|s3Y#?J5sgk_wi?- zo<~`eXcXU+oOfWfUzxm7Wre7-a6|tpp1;+4bai0mEdY;H$WyG(Mq4yP{ccmmX zc&RI2zI*{e^5*T^2_T-4^xs5x8fq6JDd})sOzT2D%@zi%V@OS$hWF0G-%vyOvwo{YSC;#*92xpTm(#lrhvLf zKl1Nd00Kq9fjR*MaE{lmVmw=ds}r()adZ=DS4051f*wHfyXbX9qo2e0=e^VE;(7V` zb%}~h$j2V}`LVLFc;HdWrvId^1beBRq;^h9idfemf8>P!4=Nn^1>6TF0C11kVnyrn zq|o9Zfo)g>3>j^3w^l#jeSrGhwC>Xb0`+TeosL2I#StP4&hjJLp@^L6co$&CxDjgP zTXK%lBJh!dP1pwm=Y**_$%RMM@nnN-b&2X)oYS5*$S#o+26U zg;8$hF(&=zRj7I=N0cLq&fWYikNQ7|Y5IK5*wUn1z?{{|S=tv3i^abt54`%ex`y7; z&2+Huo^ciXms1XrmFQb|e7=5e_sA8$r}7c6P5VAByOe(q4!)};fAi&SIj@9lnv_2I zC)(P9i&esv0v1fiH3fJWh1&Jc{x0YWY;#nf_@;AORY$fxX>+4StKSo+3Hy;4`@PxP z0jbj$Pl|Ea4SM|-57a1RQZa8w0!M`jLWlIWj93Nj<<3n?xP~((- zqpp!3D(%9^dNtC@;Kq%D3TqKU1Sge8LD!cP^R(}TkorNG5 z{=%P8#jhC=uLnFm)}X3&X#p=i6CNV~gx8GpJp8uJ0&+WOCAwq%#jhgErWDS!T3~f4 zTI*2=34|{N@&rvv2;>o&peood*8aVDi7Vs?sG-&av-t;uDo7UsXl`}DV=KlZJo zqA>uTQYWbmdj=!;yWkY$OhcZ&?x^*O7;-`R8#j((ck+O1uDfd--MBlV9Y2Ehf%j;n zJugZ-5?O&0<24X-v(Ze26JTi$iizoHnV~tL$F}5JGob*2XQm(2h;+Uk&ki)_ zM!j0lcB#^gdYj~bZFI>exK{qt)))8kreZT6Vd3%Ri_Hmh<$$rZSrVH2Df_KY55|7Mq0vhcaERdFf+G#(fQ_V?Dv2m2L^5n;~e$B zUNP@3NJ;*6*{>UQCdTyH{4WC(|xe8M)n?q89)Hm;FrSM z&59{Iqv|4*nVA_P=K_Qpj`a~35+a2*5%ZDHJb=$(p;a*2l2lE4Vx+63sH==pwOt6!{B@j_rhSdIaxV58~}k^Z>4N5n|jB* z@F-uY`K{(teJ4Q;@7UK5E9-7m?@uX-<>ZRVEL{7*BjT&YzX^t@_4FDx&2_b@UAewiDAcNNaCNVOl+}T2 zevIaHKNsGK^Z2sGQX4c+n;G#7-&$wYx2G~+-}2hSg{e}4zs?PB=Wbs;-E&J=A-#-N zC55l)#LVS3v8B#9u6&oq1tpGM)3>b!J3lERvdM^-ueviTeOuV(N? z3DWM&0{k&&<#LQo(FHzW49E3`<-Xpvmp5$x_AR~jQ8%qel34SltqB2Dz3Zu{NXG!k z6=@iGAy@7Vxuln*k+3jeq}y)x(Dfy6L!M>j(RX{buUM>e{B!cGwEkI}X+MKM`gfkb zoHMH4AN(WRa(?W|^RO#@rgyHYX58cn6@2(zms^2l{^wSN^2VhtO6?v+#Mo@r|{JKb;FOB5}HEc@?I z-NjFV;{X1t@grq5k$GL-nY$l9>g@YPe#&kA|E6b|{r@a*nY|-HwQF~eib}Bc(Vumd zd$boNM(w_Sm1SA(6HL7xeB83@ZiwCV;vMz8Fty;23vO*3jBheeIDb`e(A+qfn-LV{ zL^UwZ^$h)H`*1=YOyLwE1A|mSLum1rLE1-(o%P1 z*4uj%@U7WUm(8o`Z%SkLvm~i;;jbG=7*X&lZFuv0dEbqhvC!+96Zs$9*k`TR9u(q^ zkdHBZ_z&aP4}5)-Urhuq3-#}Q{8!UMYq{Sgy~8?8e`MLthUyL1D+vjvxfc^$RKlkl z-sq+}SW^nb!!GvBYEzHz;}MTw7c9;@=RE3TBd zU$UL=pBm_m>!0?ytxI|RI#Vjd#-GQhytXH4>s;|PbGqW&_`=lt!#7QY^SOP0E+#Em zRBqx_C{IYEJLRweTBcoldjfBBN2*c_J=wuj`eXJ4b13)8m61dpv7FFimTPrMZKqSO zj{qI}oW%6@b$7Sh9yrpl%olg;7uS95>V?t@@7-Hes9YL?o4Y@DKj*va3b)QGXi0w*yNE*IJy(#$GRH?aDoV+Vg$>+tDJ8-} zt3q%VGQe*pFfCD&F(Yuovbgc_uiK;Zg0~SV_HN^D_g|yYbekwqAV}e0d_hqXIVo47 zso8eR)MOw3gL}=1Xm0n`^bxIo75q5jw+i=cx)nPB+mavOL8OoR2gpr@#uxh=xednGlqYW=cbF1sa z^&tpB{`MToc~uxjf)>ZK0`_ohFhT~0XciO=L@xnZ5}aDGh-636c@lvfQ`QY$u+Vh8 z2kC4c4-*VdP{$`7r#QeNl|lnjTdM>KSRAkw;Zo3Ys3>8!@vha|7BS??l`8;3i0ldk zPOa&271;2Gl2aFU?9lG-WMoXst;S#t2r?+dX$(m-m8mXm$_avQ z7P+gp_cN3$bI`fOy@smA29{?Su;30E1`?1%TwI&nk-Vah;w$=kK$%CsdPl4&0s+Ak zxe>L+UvvsK{w{_SCi2}6m~8~z4L;yB1S=nIJxfkZepVNSth;-7*e5ZO9Y0)G?F2u1 zoURAi*~^XQB}FA)V{i_qA^&;Bqmn zs!pITrI+X6L3cPPgkNk6=50KerjZ3@-qO+%6i8PQO!reoj(#a~x<$RHQ0(3E&<1uX1Nl z+jeor5)l2flQ*xXskh)|M4?u@0k2XBmXdN6K<$`JELvPNq1R%=m-K<3CYmJ`T_Abu z+(80^R>cH8X525NVaT0m|%OwkNkIxhN6&v<-`Y0JbRy zgezAGGQR(RFZDUHMZxy(80ylV{?)w1B9swODw})QFmi=>gUc6RU9v&1{CRK~Fr*Bo ziX#UZUOIte5O&D3K6+)Xu&^*Hmup|2OQD^IKmtIc$jgW8!;aeYBYtpN1&e~Vi1zk& z^iis1h(RSzx(Y~3ZtsJ=dK5Cu#Cf8E9m)pqz=SKuw=nbY$Xkm+NW;v=<_UukK-5wg zl!Qi%Cza@~YBaCGyo4u!>7eK%jOHBND)q zC!e7$hQJtb^OG_#IEYn^6iL8tNDYF0eCA<%G!Y?SjTiMERab<9LjtvXKg18$Fy+U2 zVK5QrrY8=vz=#MxaH%IwJPi!o5!8DrrLl1Gn|KhQ{KP`G8F zsu^yZ@Jz|rv&!VQbXPWhEfF^Tp9Dy++Y8lMPo0Xu&jY_ZkB=u<2AHq9P0%i&s+&hg?wS#!df25ve!vvx%!oc$tcaNJroJ^sw)GA*g$BL75fFha*JwPsDFyZgNfA#ujdb+v@UTdNd^~6;a z9SBfG!Aa$VQEP&25*yqtOwgBvOpzd+@OyyMG0vMWaaQ{*G6YfQqIsvxfYE)N#4;2# zghc_w2$NLrpr9a`76?Oq@Tf9v2UXBKcGK4OFfZ?81Zb^nQ?k&}40;vwdSG|@luST? zxDB-#0-jbHKizQK#X&oW8F4+;5u%}hP>G`#R2$Ub$ie&(NC!fcVi(1}Xkoi31V+si0qwV%+JK!38c5UpJMk;dWR{D=5r6R{wfmIa!v2gfI7oXL7wKsA&J zMV+48vK{I2BE*8*(y^ycwa!)`E(64FmhHggOaP^?v3lT*auxy^AmIeZ)f@r<&~Zz8_#+O&bhDDVRmK#U%Ucwt9MFhGF-dMI=t`9Uz+Yu5NR;5s>B zp&*0~Qz}Mj4C+8QuU4RBiyxtY&mfcbC}QKEcKR|1Jw_#kMO}$6CR2$&jcw1F$O0Y@ z50Dx(RIa%L5FZP!3t9_c5cROwz`Fd5D6sK8u%mZ2{g2yk5mOcE;iNuh*Rt9z$DyAk zV{s#*MtorbhMj*|v+*{qpxO$)2{jt56N$cmeRe*XVOTUs9~c@l7xCf+X)6To8NhZ3 z7fyG|@%YA#8=-(o*IELFMvQ#n{0CSHyiVOv#G4ajHcjlb=|cjWA|UtN%8MH&M>@eh z>KBo4mBB=!Hh<2`(~}=VR&noM5Rf7~U@`}iB^lI%$a-!6m>i>V{U0sBkME|!TONeL zF3sr6Hgu&DKQv4q`~b}tbRiI2V#gBG3$0`PO%j4;FGprU?|%Zl0|bVIE);zbLj5~3 z18gh%i4#q)XrA)vD1wtfaTL*@R%R$Iiv|wcD5`avcf@Co8$mHbYJQ(CPcK}Y^fwq;D+Smt> z65t7#LVlZe>WljDIjD=bZ8JcccEQBQ!T|sfx zg}Cs!rbM5FvaMx3D7DIP%UEwu_K1)ZrDSEAuW0<)kgBcNm$~tz#K_-}WFWg&HTS{T z1VX3P^)McEc&+wz64izoJk$7!mUf(IIzdh)oSM-ZDXW2{f7bg8eH^nojjV-r%Z^KF zT8#$(w@&MF2?N(@BGjsE&3Yxs$;WeMu=8GyZujbnuI~f&ksvmo%{h!IIT2k!+OQ#e z=<9n}R5X0!PIgKF3@25Rf<-K9Z{G(lk0)^|pes#{D`iV6j3lIy9ieDICW1>~4OMbS za)FL-bO2JadEG?#1q2{hV&~!UgQFleG&|id3P$(VS=<>uYfsT`-L z;)wU%FT4X{NNhQaQ`WDRKrMo$Rbx0R@ug*h=kMmhZz!&Wv8{9Lr|8CL0Lh44i z!uUFWP^G_zhb=O<4EQE35Fn;!LW1!nq7okC@soFzL!jikAT4yz!Hb;XAb;xME8@B| zejbV5H-y3DB8yiq5m!ic%5vmnz`~QkNiP`Vq{<|iT4y19PZY0XqbJilG$Ww>+ ze3}N~Cd~|JTOWM`=^B2#(5_#f0vppnl+=MQoYyfhSh~^-I;q?0(W?*dAp;bh$39Ru z7V_B!9h$aOL^V;kJky3gsd~&00w4wb^x2}i^v#I(8?rsxl5e#X>keNV>gu|pCKSE0 z91A6R)MgOkCDHTdXUEYSI@@NIIvl})13VOx;On`IBGya>wRZVv));@ zpurH2bcLaXWx+TBY{V^GJKYgc<;JzNw0`&XY4qPFnguaz0UlRu;WDi8lJ>MpIL|50~Ax)_vx5d==X z=ut8pX>LuO8hyJE)xP}$!!sHn@70IL&;czE@2SJNFIti ztNT5qt@hwCaO3Dx>qIXD<`B_gnjT;}s_yzcZ~A0*RkcPY*aQ8J-rk2m_rcu< zN|f~38+*_8HVZuy(x5uK&s+b}HFowy^X45J)~~O{;iOdqPuT+yyb#78$>=;b^Z-PP zsH@h{y3or+TiCoNM(*!3-?cN zLK^)?3jtjl@i763Au_9|@U2zm;;)%!&(|g7-?^e@X_9}^+ec1`BYWa#+^G62(@?9M zeArN3^I%eVc=+M|g|~^=M^wmk0mI5e#0`Cc7~+VXLP0tbnRT9R_c?zZok?c~qL4I` zsO=(P8*ij*9Gk(@T&=2GB3!ocHXrIwhk;me5u+i|)KaBih+m}N-^@-7K?c>o{%Dr^ za9nzazN$!l0KY@PXwqX8<)onmN;U^nV-C36`GHvf0H|zs-+9gi@$4I3AAMICTIu|P3 zpuoUGTh3t6K{Df^5J&CRM%@I=d`SenfDXYB;5%|9m~|S3LQ6KQ5%Kb=ty>S024M_5 zK`x(w9yG`>5VqqU>-FDL+iRP`hSFB0M_HM&2*sTG*N#&uQ!EJlcNBY zM23LN(XqY^Bou>eQOE7bzXNVdNxy?Hu zyMnX{!2N@65!|#;jHsn$Wq+d=AfRv!ITT9UFpdCQ0jG6xT5;Lu&oOFT@#5(akGix4 z>F}E1>kw4W-5OTo*oDU*WY#PdYCAxc`yY9kmo(&Mfk@|?qOHU@Jcr(^Eh7Ko7s*p; zc06YEPU0Wz6~MnuG8x0NF1BA9?BDSMXd$=-{KbIK7f6o2O14w!7#%HD>A0=VWJ{g0 zfr?5ty$_0})XBw#;!AJ>qFqW8YE*n)_nA80JYs0Y4H&4oNxs@=wWzB!s*V;`R^N~e zp;UM>Gz&>#D(3izyd!q7ur=MZ)YCYO+J{{{P}Lj*}4$Z-&Y?`^d{S1D0cQf(7syM)V}?}N8dHE9;AOXJxAbO z$el+&Q*C*pB+6!bS4k6dhNR(eM9p5uB6pP}BjtfZ@XnQiQwOZVkg+F~nn4#!z4Z^f zuy7dK7(@zg50}CY1IO3Rg()J`P=tyc>OZ`@2XHfwR^uXpg?PdWS^Wf!^8&gwGksHN zAc?uDM)^g%CfVNAn)V1Ub@dT{CbxBm?j1P1`&e9EYWAaa;eefvYvs==pDpDLSypnR zw-q?H+vfCsN%_JByU4na?A4WB6LuHA3ZE_-=(>5DwPBZ3pXB=K&QV%d6aB3(Hs1f! z+CMEOzSb$Ks9Db`EoaswBd1xJ%$9OpUA9N61?cuSwj*(zfToOecVXfL9H#@mTj~@! zhG2*o)V-vE3!E8ZG56l*D2{IeTm?$~^5T(ot9g&=O^?f37jr`K^`F?V4_kqdW7q?G zXzh`?u^`VR6X6FP+>q=OeHtY7%s`l+`iI)>&f-XJNMsi(HPTUuV66zzJx*FQt(R2Z zd?uJF78VAC;YmQiX=UXn6ORpg4VqrS%loBD5{5>ffJ6b~Pt+V1an~)GqxESpC7XZJwMn8n1f|dcliCT_0Arg!RhBpKU1d`Lzq6yhsU}WSs^y=N6 zpmTr}-1k6YR#sMpnES+)VuC#V{YeMsLedF^ay|hOLh#3+&4fRo(tLcfr2@qd7`?J-Ox9}W2iyGFxg4( zKuFTtG`8N>;Gw6?HkJXx5RWI+wL_d;`?98CYC&67FzM26z!(1L8bPl{^z4namsraI zaFqi$^5`*dNqdjcB^Rk={$KM^cs;1-NVlVOKg*l@c@su|MYJOg7R0Q7+Y zeFp3lChqe5`}Efw&c0_{x%n~OFswonY=hT$JpiCB3{6YK-44Hl zUk!Tt6yljD6OQ`GToHPR$34!0=HJfS755B|uLNZ#^DiYGU`cS6`zbW}V|Cf>-dXJe z&#A4?K6T`8nX55LOXaMr>hubUsT7fqa*e#p!s1Y|EHQevs40(j#*aR0xJ~#I??&a7 zzpV?_G&Il6Y<~+b+YVCS+&Z(B;M-vWEWxvKz(}j$0|~{?b_!7ID`0dhjrI{Ix0R)N zs*XYa6FnDZXOZ^?MMR|0$XrJp!R4w(Dr6vNBbnnKy*Gn|eB(h>ndRV6!T_~mSdAO& zHw=ZV0yJhiwagDcRs!0=^ok&tD0Z;|1D>!{b=Ywvnu`WO?o!^HmG*Vu2Y!or$i7tiPN;Ld!UYLUC#xWU0!o57CpyS5vKD5Ar$vQeRO~5u~~Cw;XNo<7UCcbVs|rBZaG@^qxk)l@ayaqx;90- znyOg-#+9)jY`$4g-NS=CO% zw)zkTL@v0AzK6u|JC+ys#;dYwo4#NYY2DX4*=fN zEgiUxD=41(y}5VgC|DG;`UK8d4hl2#2cpp?U?ws`V9r)YEq_;-OuuI1JBr5jJn}o*Io8Ln>i}0UOuYIsuX?bpNuwd!@r-EsY7IG`I zx=%NVcm+;`hGV+X_(6h5L7{2!;wkV7WgVT=+2ZJ9INZcAB6To{8%FXUK1k-hhO`du zUxr6J%(>XvsYw~tas63rqd5?Cg%IX1=##-uD0QS4Ppr6saeyB^n{}{!L}KNlpt>tj zuyJriUy1dsTuEWU&{;oe54=;-KCbcp-xSO0BE^KNdbC4(^w;Sy zz8Zjpgxp7GrxI%hKp$e-2W0mkJksIV6Mr7Wn`otz9a%3#DS*2qJ=8eLFx*O??y075 z1P(N81llwWImAT%^=%C|pI3Pd9c>h+dnq@os(8vcljc(Uc{8)5?=i2QKDFnNxUE~P z*{YzKzl@6j7j~*w-)_b-`3PMs_t}t+y(cc6IFbY7Qz+Rm7%{HJ#=vY@Ac3vFSNWMm zTe5cg*CYkHGzA8=@MN3iv@MMlK|>roJiWL|*)|Ool`}1+ndZ8sP;mo|NXf|#<5Ki@ zjDTNSsxMkd>o83blSRBSD-ACJ$F{n|W#zCpCqD1!tF(kM2boU#eBD2lC9_~8cbz|9 zZtkWbmUnn;&zXm^_(+mFjL*)RbiTja)6;Vlh7=;U1JM^vXX5HMw0n9w|832Yn~(fm z2}>QE3bLI%E22dB0|qw}t@SuOXT3J?*(F`=E+gn z)V_cJ3IBJFG4Q?izaydWf3ME&xU>0xe$4K|+W+NOWN;Jz9TC;Qys_}XfB*TR$l<&H zI_Q!=RQ4i|?!O;46tKSifByOZ-!EASylap2is*9i*s=d4{`NF@W62X^NR1Si)IknT z&MsJP`3r7Iz#pTF`pS(KoDF`wDLh(fO+5~kU%#^Q@nw{?3E4USE(uTn1IO}c>8KKn zW%+EsCD*>MvNtH<_qfKlW>CCnsGNMJ%7Ghv$o^HIYYb4{2|(;0A>VRa>SkJsTAg$o zo0>9$2hi%Y&YIcQ!Nk%9h=E6y!i$r4Gcv3r{^B@d!vA>n zi)l{Zy2an&G8>WU4BJDDNcj1CM15rm70gF;pXyi)roqkQ2%nu5PQ#v%{oLKSoLZGaOdM91J62t)Id|bjdRe7-goWI8pu9a`dZ{|e zlKqvRQ`Y9xP}3X&>HzTS^e11AdFyNl=Sjxz)0C#e8)fU3)4iK~VfSq4#zN3}vK~}h z$N(Y`Odnuyh+t1FxRFTz0NxJ(fZ{yUVuBXK0K{vE1L^pU9%j-+V4Tt6U#`%(8s$5{&J8kz{jJuO%Z__c!J8rE##7p<)&77c{bb8p)%IR z^c~1A)D2ZgYW)%fQJUZbDVVWLtV3~57|)IQLvM}N$bB@2>+9;sP4Vz-;b1BgfsChk zWx>KYf}}fp_LN}}w}8Ncumg|J6Vv=Ka((xIj6qV{k0mvl<9YqaHVgVNMZYLUME_p? z{{A0qnM7~?K@0X`VLE(V9=qGtRduL<(ihgj)6*^6AP^fcCH7rGxFH_mhs@FYz9U zH-JFNG>x76_FVu0(^5!*?uZQ>59Nqf_CuVNTvf!R$Rx@|8bYh-)*SEN9S512C6j~z za$o=XPC0`yC9SZzw;t{<>a_dLd3{fjI~OHFZsPyj_4# zT;<&V2D9cB{=2g!tIO8lC>4>gr5qWqjaf%QHF$b{>=$40+&$==$n(MpQwb=7xWeGr zfjd3MbyY(kM>NVnKfA)Mi<2^cLDF$+ZtMz(#JHsq0Iwu_0tB0^o-)@ju_^;A>3?Wx z$>~ct06cK6L5?Fw)Wo$RahHxgM&}FCmmkKC#QFx>B|J4MGMb9eeZKeoip%`tjCaISd?BaaXkg1vv<^ORTMj;A5R7PtcvTACdS6cz(k^! z-bhQE2*Lo(FTP;qD7|ZjF!_ayP9QEGzwA3$ahM28+f;px@Ih*gR^7)1iwvYf09i|_ z``AIABS#LSC)}Ns_P>8$Mt2x$#qD@!M70JXgU0*|sA%9=i2-yS6aoT(@?4qDaN`_C z`0)aV@v_nUyXo=Z;NUTMvDFv5IKkl(2}(4A!)XUfOjQ**w1okMJ+aQwpAhIB83^(2j5SkuS%xxWx|2t=NJ6c2Ev-)+Tfuil-z;MgH-*dOFD ziq<+S#GWiy)1sR*r6GC{8aQU)u%tg{YBg zBEM=|7fBHp;1egX2RLc9@ZaQ7LE*wgKNj>oqLb#7!%JC7k|9e@jSrO$cs8*t8+y|}%2pMbw_M^8SS{+n%v^eLF zh3};xm7&>pl)_=%mTx=w@`yGv0AMMsTwJmlx+#}=eZ0LPY#1K2S9w`&>+cG$y1Uu(s7r7ud6E~xYgPfR=gZ#@FM3~s@PaDVo z?3MBJuV&xv96MhtA6buK10GdKz{o5jTx?|r**-`~DWqSVv_1mbK%wA+_l^}p413>W ziZ9ZbNyv7FH_QOBdzYV2whAe2vbA_1t2Fp{egPQ3~YgJK;+OxG)d%*Pv}D zf(o34YshdRY=jNL)UF9n*;!e`#P;H3AVv^_53sn|QFS>M-RyI=yb=BSf3yJ8jhD!C ztX!el@c!-Fx5SDSq$y+}!WcM%D`6HC48bDBUl>`dPmGd67J&BhBJFzsMLichybxfgvIqnL z?3_Z7f2`jLh|l=ps{+N{GcgB#ph>44tOtN9{1Z&=1`Z$*bl=GzqG0;Vz?=r(F8z^- zzw@Ik#w&&uR3b(yfr>@^^8%BPtN@r{`S1MnM)Uc<1*2p@6aWS&4~Qr-B7#v#ZzeW2 z_G{l+L?$}4AYm5}LRYqEL-)vY*?5(v@2BpMV*>1oplR)Cne&!?E|3hO(Eaj@5eaG%&t)4PAj>aOWWg)bGLIk@FI| zI?^YOqYJS;4##fgwlRb=?qSg%qP3W{#dXS~aU8rEmqf1V_cMdXMqzwFJcWql42e|T za1q?GJ|h2v5R2H8#rGE=qE`m|MPvp0S~4(FrPJvG{1p&ZNVImYygUAwC>H?{?oc~B zFaPFoUT?y;&md!Y*%yBVEY*0@N)h zMMVXmL2;b~Jk6WHvz0ur8+1*%RSfO_<#iy>x03 z-P5paugIzq_mPf`!F3#FW1B!4%T=_{H?#o2%LfDJl=R-BThg+~AQz8m&xZDdeHP7J zXsV0F9TFo#=!b}Z1jq{ofNy?Qxd{$#D@zXK;ZCHBD(H6V{+fA<^Aa- zU@U|&?_~Y+A^Aj>2`1n%lf+{T$im@JISxKjZS)Mn(&L}i3Dt)jB>DrQ^KY~DvKBP)#YoX}j$ z4N(fH#5-trpKt3}DZ@2ZV$EO|qbaxPcRt*5Yr(D@{1 zuE6eD9v>@=aa=g&jj-SmE{_M#ZW>E~@vOV{ z(5m>JcbgO3zVe*s`B74n#GY=u%FU1Y$Zx(weoCw!!MdCTDTHLN2g)~OTnxIH)JO|8 z4sN|46b82QZX7Ro#YEhJ@B#Tbk}FAxqs@&Gc;L`&ht#ZYC-np#Cx$TZ!wWP7#7=xZ zNwmfO_J~R{YbVBbIHAe(3_v+b;ok?PlS&$ioPY}g}M0< z%N7AN1ha^W`ryqYfgqI_PDhLU$a0)nS=bl&k0A$Yv2oEqL#(Rs6+aQAAf5(jEwRtV zM9&0c8c44tX(zz8Kt_x_IT3pW-9_KwqlqL5JDm+uI23%DP;T{3_B{<3B{s8YbmIsL z89|DV2T$K0BaAc*Qf-o`qckB>Jv28EgP%%=45V+4c!iiU^nl)FTEk8vBb;LxaR3w| zDX3BT(roShR$YAj+q-A? zq6MkpD+!IZVnX2Qy_)G&>*Pb5MUysn~{n`fjlU1dQh;ynzsuqXq`4Y@+Ukyy05e_ zy2F(mS&==)2*es07S7(y&?J!ChP7Z2i;ns8+5B!D2ojNC;z13`%U;G|gAxynI`{Op zPH_4MA?rs~skOAN{25j=nt?KWKfZF_S{<>Iq$*2x%f^m{me;Re&M_B6ZfJ}cTG@e_ zGhk6ZwY9bVIRTXPb#AT+q6)5uCY0o%M_;Sz=IG8`TZ2F18F&4$?5 ztTuWL>7&Ae5Xg5q+g~UW)x7M2Zb>}!Nw`g}>pk_D5N3{hxQF2W257O;NJlBM1ZKh4 zCfhOo33LXMy-!$)#Eb}BMRmB4KlbQ%%v&S4HW1^f$HY9bvd10dmjUV#Y5$^3n6FI2 zwTPoc5f09X4`^mVvyQrSILaKZUQ?vCz@h}8P%mo#84zHg=Q?j3R2A*~QW98Qq|1z^ z@k2M{saPOB?au4_h8&FnG#cVHkZ;G>hIPH8?yGa%{<5xs(3E7nm~p*?G(?axX7I$c z?7`k~o0?PQAkJ_atK3`0lHr>E67all89bgO0t@8OooG=?Ks<#io?}ExzO@aROC~^h zJ*N>tO7ALeVVE&1ChDt3eoGU$>K1W2bMFkF71`@Or_Ed}g& zZOfM%R29{S*%oCIs)D?CZlYJ!(vn51;uZ$MPaoQ2DsRaRuL*XO5630)cfBAS6Wr~I z@(uKeGLleZ({Y%N`YD)GkDXq0UnyQDdlVKiC`4=VFu7=%F;~L@qpd-R$ZDZN3vQnW zI0$+MZ5pX{;pXO=cF&TBJpon*04+slx=#EG2zyRKCyh4ZkwTnMM{sRasJyh zB$wS~TW~1LJ%NtReADx&{XS7jbVM z*K_{%eSc%b*vE{mRAUT74cXEt$ujm`o3$cYqCzSaWyaVkOH^nfm5Qwet#AM;x<`hGv3_i`Ms?U;%(fP4~5)QjA!s{WlXvG>Ni zd9m}o7oGNErp$QlduY1P{#LfNYKNbVYxc_JhLYq7TMJnU6eW~42A}t@^L(h~7#3i; z)@5Ai-Ek$wU2@aEM^13y{LUkhEjxE_Q=}Qe*X$pc&ePf*rO~6usrm&xs^I8R#_pEJ z!~5@1(TSKH_3K8`LN0&p4482;|T{Dq&; zzIdz8a!9{%;3+Cv=8OIXl6~fJU`9rU_;;or9lEc}0Iv`2D?L~O(FOxz_I>2ADCWQe{<8kzW7&x~fgUcedqH-;ACEN*K`rXHDPaW0F{#{ru%4)ErTNL>X zmkv~In|F5cmbFH6ySfDB+7M1?NX2xHJ z@$F4kIV;E)1H(`h(R8#Zdb{r$=8vYH<+WNarT)&aBHx@y8Wg(NrQY5dBOt`myGsXp z{C$Nfep!0b-LJ4C7X(T_4<0;QJD=xjl=T*{wv)Pgd*1;L zlrPpi8+3}TDX{)Q&zQ%HvI_UDJWyghf&0&4+Ouvz=GX7#%9wdbweaeQbr%jy3fy(_ zwBbv(c4%q^>4dF_i6lrhza~{vy;Nt%2DUx4B{6YCZ;`N*x*S!|v55N!I+&kg;(5dP zu|mj)oP~UjVRla@(heUSijaZo^V|0A`>@AX`9G9!UHA|lm9;+oJ8fRF=>wV51zeq0 zc{9!3)m4wgteE}UolPz_Hb1KGJbkX&X;Ud*_?QzXPi7qU_W9kLx;HatmJ{oY)SaQ1 znkEeQ&|^>jh$sV-+N`miyFXc067PZL775lBCJ?e%uxKZzx$lly6dKia>tnS| zAX{ru(O^?bVVeV+JpTe=7MLJ;}cWk8vo?g0=RHjAqJzw1Q zpKsmw1Mg5h&Ng~d++e4qh>2#~@CZiM+Y-vRTf@-2wgF2Wz&#FW^m3h0aSVG@;2U31 zHfMHh#=@73t*?oVBZJ@i`nF>ZCVo*-Wl^I!2xdRlGJ5R_s>r5s9a{kg(_P2rhmeqv z$u2_=wKsaWz{qyPjgpu(URG}ke&u^pq=09LpZ11xiPEl)9=$uQZ<@3q!D$a{AOk+e zg2s!-M=0$sT{K@3<&Z@j{$!Nty00+`Db#vF7iB~}Ls{RWL@4`e5Mct8@}WG!r}QuU+p8st*7geJSMrY8L$vx-_0 zccvIc8XKAIyUf)UOoOb(^LFp}xHh5F{U=l5`|%NZPb_^ZbeX#=$b>}3vc@O--G4;m z2&{n(5#iZp085-K_!ABgrt%#IXd1;w4U#V{K*Xf^6kpP~1J&Q3;>^`Z`ziA%@Lg}) zw(ZeiXG%IbaY)0EX%*ZRk~`R@>wv!HRF7Yh@zLyZNQlRc^Z70#D8|4A5(K|xtreA= ztE8J3HZ?la-eq$5_%ScTyp|66zY%NC{ws-fYIb|BFQI&(`A{h|SrVEm7u#e-^OCV` z97~Q>o%NkO9~nhua??njh7gG&YXb<7V0XQvD3v&4msd^s=70*Gl1JCIMH_A zhTBD0&I|TAhtAY(`J;0okIq>zuHD;zLWa-Ii1|&G*yf;pr~zp%#l+9^lXQ3Cg?LC- z6TJH6F~H?#{4I3DcL#K_Qb< zz*rWuHPSwZJ|1ZFu+7-l?Y#}(-pQQTOJJ zeaG*+^BYM z7wD|W`rSSsun9bB0^o^AH<1>}fDz)_~|eZao}6E(OC9A0Q88NQ%9}spfUW(Fuq=A`6PAryN+q(@(2&LMj1` z5;iYz#9cY^AWd%Jl_*BtJ3#TnNc8|nc$2o;#b#ZJp3 zGwvRW8}?g5-ET5B@T2Y%VjzxDsiT%Q9_~pL3ueG}DWFh7YJme>hb;*UaFx*oFKc#- zd>;*?LI$-6&(ZLy_p$T+hrZ;5xMo?<1bhrNB(ns$vlL(&LgfQQ9ta4S&gEOq zhzF#!pj2m@}XhJ4hDtXP02Av^>vyMBE&ONj}4x2YKCTv~nX z+-u4wp|nFT>}de|=UcNN4tV)vTu9|HF$YUZN`zcs zbkM02aU7bimDxvZuC2SWsV6cfOnb`v6TC0TR_mA7OEC9ETG`-jE?Z0Tm=xvF|*)+cJ z!)xn5tto)<5)v74p|^SG{I?crNZtiT3kfq0nSK9iNQ;^3CySA_~?j(x!} zj6QgZqB>o7!e$9F#pWew&%ov7>5FeaeoUnrwY)d?-PR|F7`YD?+b$frdaQHy$G1<% zTKfydX$XAHz4qBS?r&4w3_U_RsJegyHC>vO=x&|ac%pz}mseGsm+2#kkr2T{>Wif^ z==NlWwRi-o9FSKj1Q=nX{HCw}@?g(}Z%;{4OrFKTOwM6XR41fDg`X1LH9(53lZWIk za1sfb!*1-Tp)rFuwkIF~X;fDZyItuE`2UdSEz;}@C{Su#-&g>7m6U>mKyyp7z)bfj z$8||Mur$wEruXwokt&=$caEuw{dAWoU{ml+C!`JPwx2265YK;3Q4mgDGQJ?^tnZXO z{;Z1_P=Zv`wmmYtK)awY2dkITsig8|MPkq0f3~{)Pb~na(Gr9XXb~0YEWR1UCo`(Z zr2@YTi`>+7`OZasul?FL=geygbbB*=X{KMs?eBk)Kn-AXZjCJRB!Utju7H%saoh$q zuPAV+BkngmcwawUPtWv`DP@s&;C$R9L|aUpQkSu$$bkZ-x0;?XgkuLd*!o7Dj(zXC zXu4x{Cc1^;GiIt^!fDh`Y2}TTfl*J&{7Y%A_rtmDvl<%yWr5ecJZm$DbmPELF1- zns5w7WKCmedM2)1P)LHMTGBPVpiLKy9ay)DB3mVK*2Q(nTen7mDKdroj>0?S>m(vLx zs!U#Cgj&fvxh45#XeeOt+a9u?Le3(|iBqGjUd_1^@|rzEN$})(tchl4@fISASOjsM zw)rP3$B~+v5oyELT`6KoibY;D-@SS@M?0RBWB``!+F{7AE1cDPTkJl2p^;g0VsJ&+ zHkm>K9b1t3!u8}4tZ{S{r~|ior-PG2K5n|5weGOK2aQD+wQKnaCT>%;vT}E%rLJ7I zO!VJ3Z09&u=lNE=uqcTSZ?kIM74sV_3jsgdK1hYLt7x$;=27hYd0*-)<#{s;JY_fu zH|IORxoW~mc*!@>?38f}AKW(k#T?f+yZu$ChP}FPS3ohB+kOlPTQ#aq8Hg)P@u@#3oGJoR8Y~8M1uBwgs!uTWKiEFDY zf8v6s2G>1VCS+sr0|jB}MioOjAydK$lk&!Q@{}5T?b>sLUv)?;JZ2JZJbqhy74X|B zY$m#u%>^B!Il!`ssL*_wnwn~4Ybd({D8F6R%pqGt^3F?n!royJXM~9c(E+qVwyoPa5~) zZs4&Lee$}>U9?deB920!S=r}fuv;q^@!A+qpdS-%f;nFg@&-CY9PuEo@F~(o6ZeNP z+u~d9=^VW=-szR;&Hf=R2ZJhs1(vm#?-gvT>zEYLV|{Zx0=$S!wwEvAg;7ya7}{h+ z4#16#F-kipJNW85u?cAXu;NuLOc-FEc=F@UX(e^uJB6$X+Hhgd0L#l?xqc8ABN2E& zJ`IN{WPs|@XV-U(e|Xxry~D!=R^NAfa9v~J!@oMt=;F8FbeEd)>}`}o=jjn`It<<((+sFvfZPa}yanrDM1l=Qk6rQ5rkT&{ydQ~K0by8JLr?k2Sln=}oKZ8)^k)AI$YRbZL3)P=}H+PY`1 zcFbCJcau`{OJpI!oAqL-BboV}Su=ou(UBC>Ufc;VIKqb%lxk6a{4XCMuIX=m>jUPE zjdyxYsPket6&~Yil2DT>Kjm{;(sN!e$S?aF7LWFJUfaQ=KTK|fDlJ#ye& zDmOTFHYfObdT>^ao$$oS@+5Z&$P*04)b)eJW`Q3W*1v7eAs2Pu-DY+ykNckv%c|U! zH(!jqC%q2>i?2R-(V)S;;zQJWIl@NOG~X#quNL1|Dtqeo-McU7-I;4L+r=>U+<=7% zbhN(R2OU6^vX z7g2FBuVU=NCjID}(x#?@(2*=Z zZFsa;!P0i8{F@<_D`%Hyc3N6%fFm(JqI-~RH+_AkKu?7mg@pt(Lv~=+`!wN+h)cH7 zmC+^%E3DCjW2~RyM|d;(iSnA`#tZBwPD?);_gdxqE?q*OxA9J1#wkA)MTq@6i}>V( z_;|zzcOegPv#mS0=?cX%z61fs_(r@<$(7;2pS$kY(5weEO#oJDhE26I=xqO_6lLnt zjw^#-m6hEBIu;

fVhx{<^<^Y+M~Sy<~JOBh@&uXmk5rI~i%zK|{wvGs3Q+5@RG> zz|5)(P_rV^2UKFM?m;&qCRvm{@aRd-#r^Xy_AbrbEBeQe1#TVs8vX*kGU#vBIm0#N zbD&^7IO&a4uSvsuOpRG|=$q`$dHyVuBU9U0u4x=yt6#ujYTU>5J$)hL76xC6+Pu+4 zf0)D4zp5Vp&TS^6OW+4*U+z@NU41JB;p5gdfD5o@Rr7$380-ET>h16DO>p6#-KHUov! zejlH02M%QS>M#XWMld>Xz#6Kqhy|-y$FRex_wS!I-I}uEi~FyCMGHx?=TB|jqw>tM zsjTa<-CswGL)BMBS>v&}V{XZUoB~B=MN{y$Pa>ukYQ`RFYW?4|8;AwzfAa2eO@y8~ zGqd|M8yYUpD{E)@*d*NXgS<}TSh;iAZGn;SaO}X0r3En%5Otwv)fQ2T=jcGBv$P)LvMa+UqlZ{FHORa zA<6c5E;z|d!ERHkGhx4gUIqe9q6=L^>2s+Ef4-WgE;u@n=|YufFT9S~m=s~lD26zv zi$OsORn;RCTwjA2cH@5;)-POU^zg~!4-;~AfTqT}CN@3i`iz*WGTR6O+Vy)y_j%?A zR7YF!i@#p}5rj8)d0Aj@*)I3@EpdJTsl#{Cc055g3JaeCi zkrS+M#|?V;X5Qf2VZ*&5yMFXqwX$*hKU$Lh0TbB?sYL8<+v;(-V0-*CHYqZC`iNej z$|GvLzvsXhzinOXcV;n^6DaHECa!;{@xk&qt6xWDSp70%|N56X;Rmin=XG){UgK>G z7k+5pvH$ex&CU3~blvT;k!Xx$E-n96`apUdI(m;j1TI{tmVk7ZY7b!k;pfp8B?Uy$_r;{LqS5izeAJ*5O)S-Vu(wcO3O*FVB+&-3D@K&7O}* zE3*5r$<2y0znT#jO-@SnSG-G2ht$uFFcDahDrjDP9K>}N$0T8D3%7-zzk>`NY~&aP zl$U-#k4wMQ{O!?DW2R`YF??$C1Z9u1%Z1GPMW4}hZ{rs+_x9xWxc9%8;Ug6KW4<_z zZUGxANn|jd6(MJ^;q52?NC9#kdP;-Yt~NFi=T1Y8e21Bn6sdo4U%$~*p)+n##J4F8 zvo%y&%{T%;doRSezx_7nk@L7hkK`?68sQP2hGpyh)(-)M9P!MWuVy{sqOX0Is)0LA zSU=nsw8J5%{ugd65Jt~B&NNb<1EAAARI;SQU&ZyW#N^^W82ZF12EX$ze=*EIU|(7z z3}8)cm=WXKA)jEGvg_&qRk!chp;YwWDbrDrxy@EHBNOJiW@G|oAW;_WQ&Xw%znJyJ0{Nw?WehZJ$_ACHeptZOKRni3u5^kX!_;o=Po?P0;LEc;KkhczNmj%2|IC6Pm>`e(Y z6NW-sFclS%5aS*l4c|u87^fZtd=XXgZURebukr3&;S`p{M%a)iu*-ZaWOTkGH|hbl zON+&KFZ!=s3=C9D&Mewgzu^vjP;d1bI@Ftw*?Xf*@}jtukRP`uuO$5rkr9tI3>&xh z`mwBM=QSxky;~dgnwGuxS;X%>oB3JIbJ4cxvRw1GT>rtdSIfJjpV}0Tj4mzzHuI6&>zD`TZl7MoJQ#W7 z2A$!_D}BqFKc;VN4p}t~9+NJ1F|m&#c!jG(qL&+YQ~Wx3SS%UpEoFY7N24EVRMTnp zkO=}V19|wPIDPu;*;SfV9vo@uyAa9ULzlZ@!^SgbV;9jrGY>p~B+0>e<%Hs5@oDCq z2X;W6xtIm56xo|xB2vW3wkxMuU_&11LJ zz#n8FB_dD1H!Sa|Q}bo1{F&FH!hJWX81Sm7Ht6Z>9P#_QABF9>hs^@Hn($ylmfo4E zF%y-ok(y`V;lpWw_>-B^1KKVQOCIby!eN{H=0Erd)A+Uzh$@v!tAddgJ*O2Cj z#rfRhf!Mmgullj7s)|Cz3h7$7Ns)$epEEbJ56ne?1URRmTNPYk>Q{bn=Y3&p$pHoTlwXJ z9<%A20v#Koi7HlCu;6{w*83bfL^wnW;99i%Qd`>${;<+U`ynaJ4F5AEq&MFI&+|Gx zf4x^df}jSu;UxUD%dZPk!ViRrXdYOFR>(w8w+`f^vgC(aq?X-A>f#k0PjA`Y2X5}TaN1$z& zy!Ah8InhsbBX=U$>UKa0T5!%|$?p<*vT}Y<2jkI&M{GUe8C2TED~a!{&lxay4ZSyS)02X#mc$owv$o7 zIj^+RYj+>CpD`n|b+1;tSuRTNJNW)Uf3m8eNBb0bd{&mty>_A}V2;YY@^zf0-Fj## zsGKE&h5A@^gFB;^iKGcr&R2*QVw1|PBYFSW!;0=UjWcI%{e}-}7I$>4Rm0o))=?|? z94jD?J{QtE3wDmq_68r1E2V6m9xJkKv!sO1UAl-gcJl=ZE*`nzH^l_69yc;F_7D<~ zm^C!5gTC3Ec`C!S_l&>xI&X`Oi;l{kD<4am`*VvjB62k>{S;_RV)Vy^!th)aU1+ z$-sB-#Z#1Pl4^z=f)d6qSaX3?tYu+ZL#V?u2Y?%hLw5VqULaG09@*_am@r-K+Omy& zDrSJ4Nvrzfa%%UJXYAihPw!^kM4!@qL)5E>2_81&^(1Fqi1^oID}NU?i;_%vEHxnZ zyWrqnctLCwC$q~%y#bn?0=K+LPo?3FSmaoFtgUWsJqm~z$T+N1j9`oWU6C~FY$A4G zSxBD8tFx(M`DX-119tdBKv)Wa19%L_-NU|FQ)1CK5&8y{{$@S*rzfNU$@Y@tPdU$%5|Ue84OtJ*+P%BC<)%%LvHZqyuj_(x^P^n!wy_Zt!$&lyMrn_)7vgY`ngQ&`| z59QeAJ$gKdN=HPuY>?IK)-B<_MRS?YuP3rbZ{3JCX)2!)dd$=nNOh4WrxvnF0k{3r4cSL7m;#@wR57lT(Gdu7r; znZ%$`P5QZ%*RhAUA==4Ka&x9vefQzR3)qk5@0IM(bilVP;y7c9(m=E$HCvV{{`f;_ z1PJJyIdhC3+wGPHg9RkUH3j-MQJ#^=)M66}*#~QQwBOy3OqT@*0?Pz+O;mJ zHZynGLg`XdVk60NgYke1&wMK+8JaRL6HOJ6iN+5eGzANi?#}K%J?w7+~vc8SFetloIW|Xsv88` z?~GlVcRDu9`UhFz7|&4u-z)nFl0-SG(yjn;A`a%xTl<+!n06@tXvwZ!yV#v#l}Zdh13Bg^?eS zm#6yLPdggR3#W&=%k%GoQ>R+n+Vc374fB5aTCsmqaQx=M4v8A$LFZ*Z(JkV5uzef4 zs^^-slfyC44s@|3=# zFP@wQNm7xi_yS|JI`*I8PF-%#|2IxF??2O-cKwH)z-Hfnq%-yZ&j_e-$Wp)MQsUHP z>_U457ZUxCVbKDE5hxbpknX&lu&{hxyvh_A2Fj5^iT+0aG^>J>LaU+i&BlKOMSZG1 zkWx28g2ld0%~Qw-pF+k{H@|C=AtxP5m5=oUdy=_BpV!PICzs-CT9k;{J=G0t*2d8W z$q<~12dCX;)M`~iJafMt&#E*sGNRj(=$3>^+a22i<7{VsS&H>>xC+!SQO|t`PBVJ+ zm5pI0)c>#?<7oz`4XA?#T!V=9KstuA17fshuEG=N#=rVzJ{czYPCWA`KfiUK$hW5f zB)s%E_lU@k;HwHw)ksXqAQE{#e|XKzpS_Rs-1w;Cx@(^xv%-Lzr3I<@%wg5%r=PC= zn8B8kBnM{DTq$j;FEz}yMo}tR(B=5c$>#1{L1uce3dgZ{MH`2)MR&P+2>J7y(;8%ua100UT z??5Svs1Fm7$)V_TRY--^C>=L1dWGv$(t8vVu!3%l!}lho7W3Q|b4x=fMW!=TP9|_5 z$PhxEYXmt%voj1X5j`m1KuTFkIpx~HF%8T)7bj{=03yOT*P4jF>Y6vedJ)e%d_Mi&5&=vMM9Hl zoIIZ-9BSdAx6q}YA&3g?rU@nd@M7<^Xr{?b`BwM2ok z_ituEgMk#&pG!q^>C&ZvNZ?UGM=XGt-p#q$ja(IBDu|iuHGX#ycb!~$;4P73a}X;{ zAkoOR*n%SrmdR`6=aZukqci5zI!7N=BO_U1O~-OE%T57)0fQaL`7H`aDpIt>E#Ci8 zhreXW-WNjEwGVVcglg|mr;6~h!KMCeDse>CSN|Ht6HX<7=r*19X=TIE7j`e#=>c|# zkRB3A+?w>C-r~wiRd?G>4MG6z4jLqsr^hHeK7IOZX=Q6QG)bUVVj;K*G&eYt(90V- zd*+M;e2QOy_j8t;e3Zs3j;Id07sKXKa6zK?Auwp6A?GqMr%1ku1?A=@G3ZRzITMor zru*_)+E$=d+9pWU=boPcX}Gs{azYPUk@Yjb%Ox$gE@%@_imQ0Q1Z(3apu4Y%_GoDH zB@mssb#AtaG#$jF?i*b&)z*V^_|`r#}FoNJ3b0q21QM{-WHKcwaxh zr3lOU$q^U67TenmTXxrm+C!lerE8IeN~!Q8y%XWIUWRN|$X7BX~gL`{y70^R8$ zUhF$=JV`t~pEZ5Tl;%Rvi=gOYSpIS{(J4y6wO2ESQDU`%d|Gy2n9LPR@xWtW{=SY5 z@$YozbJ zDZnR$WuM(x=Y+%)(LHd*J+eCppI{h>abD>3uwu&b>&#Og^Z3Q9Z9pDF;CvMV>+r=s zp>RRB-kbV>b&Lv8Y5ntk6GW57{06~J0XoDrE$-~G;(EgotpRR=g$szV9AzxgoJM9n zZF^_X3KKCjnjnMd#H!XbXIz6>VKX#z%9OdeTLx8jPqF|j9T%A!FL zQC!!^k#k%Ar0CM63kgaV?Gm*uE>A^Wk`tu*zGlwcqJ<_dZ`7}v3np;V1E`~z&?G+g zne*8f|ES7V;yvBU$SC26-ZauO$tOrPg$soK<(Was5r9RR8#BIXVPT#J2{hn#>p41d zOSI`1IqY&hk_i(TzuE4jt089t5S!)RSVnu$nkv8VH4W{o%DU!&sXUuwo&g+y0arc< zUdzqXcff#Qk*^qzw)-(eEuC}Li0LP%(+JU6-qIs(q=buS;Z8>P1P^!?>+AM^_} z1>Oc{P%bQNsI2Sfb#_rLve|8kBqV%zJ;pIvhm4wrXiil?bCh*$MsbR3WgH2A?F`CK zVKT_Qe!YZOAnok6)k|!FbOWrwWoK+zid#EqL`4-Mub6z%DA#?a=f1QL;4(@?ewH~; zK9b}X*ms5BVddkO>gI%}u_hk@px~mA(uHRzQ1AJNUB5nO*({88?8p@s3bo$Ze1K`^ zk{dQ$7Jvr>fz#OMQ==Y|b*2yjn7b+LJV%dA4pfM4{k?%3Qm#}Waj^IRkmt1kzdEA^ zEhRxik}h#Yd;x(n07~8#HZ?x{@yzThffN~q@lOQk_LGVrsu)PLHN9%Q;?Dc|`N1Ta zX?@aX1Rs@{=#;o;*l>KoqLMiWIYUZl=wHygN38Q>g&e?LipO7?Xqb%aSFbj^*K!$X zMdv@Cama^zTx9jo$9Es$-8We~(n!5`igweOK~_mcB^JvMfj6LLLLm~wqS|yhRfqbE z3NJA!Dcmet9YWw6&5=d@GIKsS<7&f4Bt?!4pajYkpc@N|y4$Nk%(y&mr^~-8aNMhx z5wQz%-8op{6z&&Uuh#Q#PZ^2c76%Qd>bQ;FHBz`Oy=d_9DdV`gZ5jB7y9SAoyyI<* zsnH8meQz|L)<8{u|;G_sp;R!NS!t0g{7RLXQPt;sSvjM4KkZQuEIR_VmmY*||T~aV+*3JXq#N z>8#fcWvv35Nv@Fj0NoCcp=}Vz(c?*62*kJ*=8pHT9vz@4h*-h+*Ue(}BzUN1+}xXe zN1HH<0IF+5VX+HjZRNH^;i^6XQ_CF^nVZEOGGwKZp|Kv!5(yu4S~c_ z$=HLkeTJYjEH<;|v#n@n6&p9PP;N68W*oOKe>t7AOan$PCed&F0w(G}Kn}+Sx-KMD zckl>LX8r`%CE2s}0cqK{MmL>1&uwRS;!DH`AIWs06&drAXo7&0ucBO5+8!InrhnweDLd>Gn+UEQPqUC@8wK{8>?T`R0JUMbbzvYGC%t2 z@;}miA9nzvvEtShODjL)>NQKalE{1ojl4j^v~w>P_Z@nW=T{FlA{?CDPqi5ktgumD}8 z`_LJ9#9-Ml)CgLXW~&MkcE9808=3F_Y`~n%V8n%Kr8(PeEYX%|5{{uC5UdOHn*b1FPZ~ z|3$`$wqFCLM>}d__mZKvmIB4A=(N7q;pNAFV{A}yz5>pZS6KEjV~TdtiN>k(0lUN$ zDhQRTZiUDG3aA%RkSmuA3>)DT>m(d71o=6r8_Gc`fME>>Pb_Atx+P_wf?HgYuVW_E z@o7sW{Qo7Im;>xklesNh8|8Iq)yfj=kB-B5A@gxJVRr1q?3ymx=6B$fL?AZrbQikZ z^BU%Uk2_F<{|qV#Wvck>^DXD>oQ*^3cqX}PaY&07X8U)&6b+3K3$rYuln0_dbnKQ0 z{z@3eOs`}vK(Y;&u4_6Nw!y<$bpbRPC;*ZZ)q9n}(0OV0x4x)L>Tl2W?w3FA*&kY( znm;i#2zt(P#fnKF_aW9He?L<32sd^?10$&)ges|IWYc(3HhqC@K5t}74>j=k(t9tS zKM!IC?d8Ob1t3O*73Z5tToBmO%xHIm^A+bPV&VMNH@=^BASnsMrJzo>R;NQZ(!QhX z4N^9Pf&)pyqquzNkLb^exobyM-RiZprpnYL0Nn@YU5@3v@6^=fU6T<4Vz!C1vvqo3 zeg~K<_wbQbHg!9(fTP951gAUiB1eHuU37bgk7K!sLy}Sjw|exbdxqJ+Ff6mbClEK! zu2{5enez-s)46j29V^2Je1Su*Uz^a(eo+pDtLSvG&{H&lOMYzW-+PTlTFZardv9;* zUq1P}@eBV0p!(RP1a4(=x$pF^AmJ>x6RH1B86THb{O>UFpZ+6E{QnHD`d4Ck%zq}9 zclpo6^8Yt~$jQ5#@1`_OMt+7OYJ74eeGr{{Q*jT29$ZWcY3mLhYN{(82x(M4yyOHb$8TlO#$u-z{iZF<=4qO>8yy}-io-EJId|eqwrZBj%Pf$kl>~CZuR;vU!)rPVhSVLsPm#$zy6`K zWadgHBn_JRhIiwz=Usv51DUvQ5Mq{XaMQz7XJPc1R_}hSFKJdOA`P0m;6h1+L{2B= zpbrBz(axs<+U#Luc#Df|e1|!z@XntSb=#80N~S+?3zd zD!L=#@rX&%a7Wnl)llkN0Vs}W{8YTD@!KlSP!KnnkcN*OiPb2+m>&V{GdPEuWENP4(}bOol}-=<{hj?J3m=o!EtvedT^=G%kv zDWw3_h|^M3V_(Q1tZg7p+aTp4%dux3l!4SJOX=DlVSb|416PoqN53-hS}(5=i`ROX znD|I^+>IMbZ|_gg5ZK@?oZa{2h@3v%AM4Brg<<2TUM#_0=-#9wr(ObZ71=)5iOhK) z(eOT-y>_0?oLoQ2192gsdhbrj0H$k& z>Px1s%S2D%b{Gfmn9QJ(T};AN>WJ(N!2%b5Tj7O(VW}4mkf#dC4WA^BohtnujGbby zxA*VRKq4yOZ;YI&!R6cwuQM=@NMfPSL3S-cZ!w{nKJv_X)Pb8uI(!PmcR&zXaKA`S z#vEnRel-2;LPEb51afYx@x#Dl8|P+DN_V zYZ|3RKusdTV{!dP-3#L@hFR<*^7WZVa(iR=z*vidjUN|s2MR+jk(eAn&SwFj0n#?1LTmbzYWO$(E7#x#R5vUaGyROJ(hWwb`7B2fJ_dR0eM>=ec5TUI zUTNfr=z|w=oeEBbnljfskJ4Ns1OWl@9LC-r+_$bT=>?KOz{%RO6~8WfgSuOT+D2+q zHjS{)*y&Es3eLJp%E25N%<nx80i1FvwN!SQA$g|aK63iyscGKcx|g9b8YDH ztyw|JO(Qpa8VJowT#iM4G%sOxwx|{O7i4?@GU|QgPACn8A4lju35tOz%urf3laU){ z@}oy>Y*kWGkw#n8wrW*`+L7}b5MBb@Qh)R9!TMx(F%?0FGH$$AX2j!r;H2$hL%fHe z)kHnm{hrrWM(K*E0IC8qdG4`SxdtyPiOp!nyBSX~hlJUPIW~uNVL$H*p5o zI)^q+#8xRJ35;bOi-ec2yskX!#&ee>q~zl>ugH%SeqOb2VL-;BRmqzgk3C^^=B{Jl z65(4VY-FLyIv=v2Bam;X5L1d*byeQU>4%*ItEZ_s>-pbZK76YG!?cy`llXQ(6mXE~ ztR6Hd#duc+MYc^FsbcWiD`n>GYH-5c<_WuBZ$^Hxng|626iJS_vzT+Q<0t!=MKpAt z8O5SyW~unTU{=Zcu0C(3|-+t`{Ssx;huO z`L^fvrZkJCo)>>&b-`RjHuW<&#HW(1H{Qxw7$?fR%?Szml&q*DyPv>fJf7D80~@v1 z9dJOdAvDsgsc_xBTm}a(KWP_)EJl<(kXNnleH_r`haW^a&L%Ent}k!l1@aKQNDRYZ zLfCGVZkh%YO6*(F#@*uZ{xZG3rXqJpq$i!^Bjkl(=w^nb3_Jq>GHYshyfRwOTds5A zHF>o*nSE2x((r70>gsj{?E{CnDU<7PPb)r^|B_uje_C$ISHrNXg5%}|bnofCH;G_Y zPLUBDA1v{}3l7JQSaIeRXS*=7j}z7)EIi=SgCa)JvO|T2UEi9@($Z}qTS8nN$ZWRZ zP39aq1@?ev!)kCt1noC(E% zzRCv?W`XwJT<&#+Us7tg764SGGiRo+O=?N^ybg?zG`2r3Q(h>i!bg4+@Ak%}w)kCj zrTIU#0Ouoy<%kc)_5))*6h⩔7_yL1uy_6(d#c(;lY?;) zAIhFTKQX=CXIQItp0i5Uk7TzgD7!Yq+LpQ%5>^+n z_Xc;{Rmt_}sC$gu(2ZjS{7npYyc<)Wu z47QX0o|lP2FY8Zfb8f7|i_rhLA2*60wnD+n=DUzY>t!sxkMh(4@qjMVfYrA+7zEJ4S&dY$k?#qa_ zf&z7x7ZV+B$ns)ODm6G3EHF`P+DXTSHFOu5P(gvQGXv;WWH<$t&TnL7a{Y~*X!Q4^ z$9^W!B_^eETQ*Jch)W?HU#OZI!``cBZ=H_ZgCt5LTfbyiE?8$MC zn89E_0Ovq3e_Y9KN^>2paIL8rhg71SYwtF#ThoVsBYA)l*d?CEq*_DgH%DC$c>DTJ zBvJ@qqGD!@M69*D4A7qu6^sF=xTt6oLAo>u3YJ3llkm95D~A$(09;P}>MYZ6wfvWn zPV_Ubn(stUB&UBjsd6cVr4b--#Pd#zxv$vgS;>PQf9le{1mREIyD>c6`ZJ=SvR<4tb zQx_f^h6lRu_4VCO?zIE}0lYoW*fS<9JN)%~;k1J^79P8x*4y@EqMDXwUI)O&Sw7&E zi72C9d6JR``NQF0#S~}Hjx+Bb4E3ywNLv+QpqXmF zVMAiP0l=@g@qt2k+TsMLsF-)U`ZITw{Cy&9@>*y;pRx>p z*Y+O4^#3Uur6Dj0t&`Fxt8@O9GgxTmyAkI3L$!?jt1TQeS8_pMb859or~_f092_8D zgJFhrOqK6F%w$onU`=eXXgkw$A#fsG=}rni07fy%SW(mErcJPZIML|Na5K{zM_10P zZ3tfQy~sMn5zJlxzSprXcT)ML>|5l!IYos>Uq&2{D7Lr{WhaZ%yNNnqxv=ijC(y7R z{{H^13rv6c6g|~33X0@i@_U~)i8K*k+^IE&A=}Dm3^%!dIy0uW?#)vRSc8*88-%Yx z5Qw<+E?_Kjn!#EYX_#eSYxk0UtdN%0`^bb*8cS*W+RfIM#WM^x7>Z27AO_7Zs{sPjRz%+ zEGl?8dsbtgtAD$jd>CHVyhDj{yq@-9Q0air7n<@m778}Oa;EV*hG}sVr0l?nNA4ig$65T`Wc<>tzKh_~ERPhq;*HFE5$=|4Di zq@c=Lt7+>p|2JN*{cKWqrhV8v+l-5~;xm8#I^kqg`B^_2mUv~ltr%Nd`#G^7F4*W| z$(uJaA^Uz{Q+%P5N~ca&F>6i$SCE2_|Dv_;q^4%;l+@j7`VmbF^^j?PL!NXV`02KK zNn*%18vk0O9TFs}6DkTL+^pvM))%g_b+?ZX4u9aXu=`K*8-MF(Vfe8w+kUd@01r>? zK<$zZ$7Y6(q{xgYJqHb1H~IYF+~G|orHP?4w`zMZTY($?2Ze@3ppDPy;Tk3n#z(r& zidfs$J2^C$UY@75*xK6U^af+6JwtCCb+9(M6BpXgkx7=hD@i>+MsY!a5137gYIO2w zPz3ZW*O-9WZg*rbYmJ;}g>gaX?vO=qYQr>h$tQ>=8|*oDeT zO+m?P_Uy@Rda^yPIuQZrCt}{>_PJgw`#3ps^War3z`}xSfTSyZ4p>&=Jk35oKIFst z3ruiHS~Pj;RAc*3-*@VCC(S3$+qSR4NG`4y^|gjuKWjjBz*R^VkRVXpH!Wlmpwt6C zT1`R6N6?_?t-JSeHdcK#|LLh{bK1o&nyw!;xz^GZU`@U^I0V;2$cF&UG>yRA6=T!( z)L3~LD3^VV+;0Xz!|z$ID`;rwQ4J=&>hCk7H$Iv}E%y0E8F!FLWP!I;ke+P?YLiVP zCz`qb>Fu;Kjh~V`YSg4;c=bMBZbsI_a@C29$MZm$ihMBzMmp?6H_g&fA|x(KX5mUH_l?W_oOG4x*R z>tLR6geU;SvZBl<*IDtT?$VKk%DqQTnLb^4x7P@z-Ra=6Fn=yffZILL`_VM|Nrv-wL`^n0}5X2xF&%_W2^I zM((|FOJI4#t54DGt=H|_KjCD&)wKmL7HE6xO`kR`sq*!=J^zYpT&rysxf=)_@Q+;A zPWLQQ5T7e@Tr6MAwCl*a^7Qvtqs28!j=Z~f_&B5nb7E{dL&_%By-ASqQV6Guyy7O8 z*r#xG5=Fx>9=nPux!#MGe@y50OIo3+sX6%4cZ?M|cx759>{i=?TMZO8_o0*#*C_S< zb!fv@ONWZtx5uI?X0Z-g|7ZKpab=WrVl$(Ncc5>+8<-r_cnUzlk+Cj{PpA)9Jh-rU zCS`KhnvkVIfzcg4_uRy_y_kI`;|fXoaEf08^hX$ zLffiWZ+h%WTMuN4k_xCicF&QaE5^`_1|{!1LUTeC*U~KkA-Vr&irr zk!nIGc8sqHUPm-{u}fpEI$}>$V~cXDHtuZPI2L8!aaS08P@Vo zD5Q(C331W(Ufb9HDFtd&dG+D%pj#@Q6q9#$GW)=tew(ZQj1}9VukW0vNgZFT2Oq{w z{}ba|B>@BE@}#XuqnT|G{orM%sexKltT{gW`)ODFnwg_Bt$Qq-iyeRLcji`oA{t52 zu>3dcC1mamCI{gsef{~Tw^aojh&)qdqKG{8YhP#Xm1U+9KH| zWYO;758H%znlbYny0y~n$e31(#0A|X%oMz};LRW~*trmJ-NGdKS7hYMkZaDBANaWl ziX?B00)AMlZ_+=iAC3gX#p|Gg@(Z}@cUnd@y$j34t+$|nW+zfNfX<@jK;I!wA7^YZ zzWMip8&!cZ;HQAVToROUFu=a(unCyh30(>aOOK#>@1rKdagj)kYC51tF<7xT7Vd1F z-ok^`y)wen;rRKtg@glE@0{iK?nc+#5g=Y`XutKG-_Yf()KqH>J+bJ`lWBy!#XQUt zB|+aj3En{5$^ZGsfCON)oZ-Nm;@mOV1rn*l3hq^Co}(YbCx2TZ9Cr z`cbDAz(b(Q8cee<3ZUBRt~nRWS}H4_to~-tpxmu*?9Lv{kUhCt57OyrZ=wwz?$Owcg~reFGqHEpXr8;mh`>lX$(B%vF}89wX3y!Rj?Oi zQOtbYO|C_aQdnGSNq*f8z%1C)EHqJq^RRW;sd7+M^mvpo4TuIU1fC6(guPN=|L?jURvbT25Tn4-Qc)I0qOYW8M>y9*QiYHZoZk<)9E8 z3*LG)y;x)XO~3oMwp^9wyFV-;v&})Zrki(f96Xp#!iBg4aUYY-KKI;`9ePzo?!NKn zz6W%f1<41tNvpiq; zCQ70Q(AqAAk`eMkxez@SSxi?aXqp zkYE4e1&LzfBXgA`OO>w9^wtEjiILlo%F$X^3rn}$j|_b1irrS=x4Rn|HWoeF>uN)6 zF(4Z%x16pGev7B8#wTR_=|0k$?}f_9a%4%8U9jd?!gviTV3nb(Hu>A$7#b0wYn3|6 z+LomM85_@L1K~ug2d8bg1NSt!@R9{JK9;96S+=4@#zZu6%9LQvj?Rx`!ix)xS%#?< z@jlg`!Tm@x(H$OmdGJC1Ba~%1fxktbS^zW7xdW>p8V{n@nse+uqU`*!%%BM&kr zRlE1S7LcydCiL#godCM-jkU{SQtJS5$7fzMId}}CLQYPON?g>7(o&ArF7x|LP z&iUaqM-wNz!KFt}a>^lc#r!{8S=m>zQaAJVa{ibIvX*V z6Yjwrw}CZpV}`vvr&pR5;p;F>qEz00I`!(W`Xf_<@8?v^tgJBCW*GUfNnRH_ z_K~O!8ctQU{W7r@if;56it^$U8Qm1hssE@kamTRz@=Rk?zHxJc!CIFw!6)U z{Ku=>p9SN>*pypKs(!&1)dmoL-7kyeh-D9MxV2t(emzn4xsx(gjD z>IE^qrEE4dHzWz4n6BARD-XZFt6zBru0>_W#bJ449GUhO*<;7>wKHBGimt9RFe~3V z<>#UtzP&Rh}kmTv&V zKzw0IAxcHj&~oLcSxctr7YMpJ8oOiqtKs=9|C1STN^=6%szd9 zCx|Y={aHz9Xeb)6_}TXr*E~w=^nf$L@B`P!HRa6tWHH*JS;jcKKeztXuFz+(Z9tEU zUG018>wP$zem@}T_X_QvGlIs?(C83#W8a0BK8vdj%7%(dYi19yHXQP0!rDz0Z*P z)^qon-8Z}yGchyHW!tG;rd@Q}w7wUR@O#C+nQQF|_Vq3we14+7)1mig5`!q{?6y>~T`j1y9eej6cH4i3Ue*q6%jmWf?yYTxg_|DHIZ zy(@MxFlmORWl%;Ph}<4p$81ypnAp-eO7Fj{QP82`b(t#W8Kzu{;^L-C%LbM@V?n-z z+EP|a$_iI--qBI^r0MjZKP>$&2*Dn}euc;v=;@a8?{ao7L5|U_?Rdv6)5Bz(b=w}l z?Zv)u4qA}Ch^e?ezh6bQARa+Jr8ObOsCuqe3}L9E zjM1a>=&rN&2RPo@^QnPE$3R)r$KZP*2}IZm>18cW1tOJDDGSNYolwSY%{{U|rbfz+ z+Xu$2+)WNbI)Y329nlv;q)a}4F-c)pka$~)Mt&J>_7ZfP`@<{#AM)NZs_M0U7sW)u zmJ(5xL3aoSVGz158|eB!>Z`wD2PNeLY=3&0)nGYYTr+^QGgMT3C>YA;ttDvL!lBxx<# zAXt%@9W=iJP=Ue9=@^0y;6@zO*9Q6kZ1mPV?Xdt?fLP`b%^iePm^EC>bSd*HLO=Zw zJMk-FX817kHE?>v@E+uC;(rMakUWxTaEB2?&-b&yl4F+ME)1xZkD*2+h9qFL)=#5D zFv6m!x91gWLMn3X8%%1>g6|)HuxL9g26EpEo%0&A!1g4ezQi!4wl>FU2}vD(;G9tK zBei*Ev`u?>vb3ilt!&yz?K|TKocfr#je}<^?|`o43x;elJwU5qD2mdp2X`@O0<`Qd zVZU!2C)q4GGh@dlp{X_;^LbKgfX_RDR{3+-v2zQlVaE)dGuHe8{p75LC1YmXD)ncM z-_C1#Zj(3tcO*d}7z>0fOoT273ntHIQo=`ib5_UuEj%2QDL&DwBEqW+?&!;z^TNXR zjvMOb{n)1cQe|nDIqh>ayE&cn%mW{hahhry-gP6nXhu-DcNIJ~=3H0{b-fnQ2 zXvk7YR$k?y8TG%TM0HzqL^k5$Ny{bi(bO*O&y8hv(;to zIqehIV~16tVE(Y(PLHTN9{Epo@EJak+A-;pe)wbD%C6Gb&WL9&!%UwZDcdglOTXgp z9Jm|o7Vda7z^RJ~g4k3qy|cr;wC$P&o?K&!EPP+*QY-itpKDXUeU?7cC3R!Ttxe(W z+E=wT1HWY>{L}lpboP#K2-0J=YA)5OiroECd0Fx&z3T^edgRztjr^Hy=bN5$uzadr z+L5+h-nHf8ilE-C*<l#d7)h6(?bBZ#v>Q!c@Xpg`zLU$}_c~^x`{KJ!z(+3Hu=TeXgKsfK3MaTxNtB99G(R^Y}i@w*jwK-C2Sw ziec+yDeM7#NVXd3?o}cH%sCT?tjpC(XFdY6N%X{o*o3oyaL}>SVr{qYJN^-a7l*Ne z0}!}dqou|`+jv?J<-!30wL-z0K)mqc=xPiB)qG1C`hbEQ=G1?Ig!~f_ECtBg!Kei$ z5Ew29TM`TvUx+zml!=3rL7a1lS$hl)7xh-GQ+pWKBi4Zqm`S}IPQX71q*IMk+yk22 z8T4Lz5VHf?5nZ3CS<_QYnvuRtUIHKvp~0d)LDjvLq=KR;C3!N~-0Pm6CW_o(XdH1R zM&aPX^B|sAdPsC6bZ%(VPXe5TWy~D_K(8B3@tYT8()!`6Ow6EwbFc@>V}pTZz@_HY zQREsy06NGCaG?Bxi6_vZ=MOB9$%Xw9<481F7~b&ei@2y_(<3q`2G_30(B^<#FHViu zf91h?nWRUNISGIw(7_=gwT2yrW+BLyn0~G4vDbcog9B~Gbtrg=e>%=tc~2I14$CF< zyWaS$b;!`g4@Us=Pcn5D5ZLL4OJ2~ZipI1#m9UU;@I@gi7^AEmAmQM{f$^7;_3Cnx z>wcpp91Y+v0B!N@T*c({E4WuUfc~luMJt5^M1Wxnl>QCyV*q``WO7jzBVx1Zm&g(V zt{8$YPGY`yH^>yj`&~`5LjVI%)Pbe-yE#dJcv50?QA2m=jdoV(t1ShD6eH0;(h(VcpC?lMdH(msWs-KDdh|7Vsynv zc|lb?mv|wi3P1n#r8frwE3k+*tB3A}9WFWx6ZAkNDw70xfP6 zPucU*^wO@wVM{09-j{q{@HdFB2foB}hKrIrw`|Oawp4xQCsUqaE!U&|;@-C{g37Y5 z8m`F=OdR3pWi_t!_C6A4Bwl#)p>n9S^6$qct5~i}XqLehv0S?AUuWMg96rJNJpaMsYb}wtNqV)m5n@zFB%FOV z4qdOm+@rW_#ftvDV$bcrL{FXhGHtJ65n72z>k}>?&AJulxWiA51m6{29$!^`&a>|L zzVYg}JC-b; zYW*b1oU(f*u9RzE?8F*VWk&e|TL0G)*PaE$U-g-3U!C3QIllSXzI|pl6{&^?f;~(} zVPKE(u_ksS1>_@3!cyVngfiKKfXY+*9snZ#Fqs;E9qS_*K0yp=BY8=2W@UUgYy7M zn}Z$?KN_rF1VjPPk9XH3`fKpn{)U;xx|rR_+lo9xiLJi*B#I~G%#lr`?u>G>1bYzw z*;^yxU)vK3GQ-4tokaBDR{)=WIE*tep2V(I_BD1hYlUO5ABV*>MH}>IXKmx4?1JSLEKKsY^<|j zu^WD^iDO9x&L&+Rf$L%)q`wK_^|Snxb`t*n$DXkF|OW1G~eHQ-efKNIaWBM!?~B7ncd6 z=yR0`Pe*-^yfLg6OkM}j4`?K)Zy<_rGX4jp+hEpCeAjXDuVXb*3AP_P(hmG$Tlwg; z!d_L>zTYkX1mjhS5HGV7Qyu1M7O(B8#nL0vRebTeDB-+mt0S#7uCmvC9n9On9u~I$ z9cN3B<&IhRuTq3Peq<| zI__r{O{a=KSg*1qm;FjKVdm?QbQ9NrjFo0bluut#pUk*jntF8pz8f5PML32wkQNP}sS#DvJUMw%`ARDi* z{BmCRg*1_i8X7H`LR~2mz-YKBLEc7^cL+IH>o~MFaO((lenT#T=+{C||et1z_Yh$Lm*FE}> ziBOZOQ&WZgEt7S{UYix_Ofs#_G=e@(JH5`i>i2E-ZIw{=8*Tsh-LIZCmb`mUPj#Km z+PWD3vdz_}CO%sQ&*f=tvg)fFH%qehw&pEV>FJm<6e+#S8U5K*`RJ*TFP`%L+eHs! z_DS*;Xj8?mbJ#rl_4+_}cfZH|(4;pM1#8?h54{uJ{Yq)KDyNOco`Fleou(6h>T=7= z+;99Z)=dR9_Of=y-wA3mlrH=E_02K)?FOB;`<8K>21qY6aRsdVYs@8as_oK&4S}75 z%B6|Az3uNklWyP43vW(Pci@~EQd}6f3mCHuoBbu2@u|T7aGy61(9BX_sQtB>oSFY^N*F@9^$R=(o}fG z|ARmdL74;7!xLIKQcki}I@Xm3#I0wEH@sVRRkK_g?c4!|loW!`sIYG9ud*)XU( zM5uQI@l`-1LFDGzJVChYI7#TH`NVwrJWBm55d0O@$f)!NsxJ~9fQ_7C>+k2sUBzD! zbA@W#w&yR$VD^Q%o_|!s?ZLW|)33O>mmKWvadz`{|Cx2Y1Y`9L&w?#O2!i@62jfkI ziTri^xK{mKt0^BC6ThI~3jrxi;j}1&yFI^YB+fT)7#PEN4QCjdaAHeA3}Ml^;flf( zC`aAwke#0E^34RVVPY6^bXlAjt)5D`pxq(x>h(C{zcy61wWU1Wiy!sOWF3ad2bUq8 z1oue6@gjy)u~|PCDw^!y9&u6dn}xRS#%Q~y>2Cg+*=VXx=&dP;JtnMFy1z!$c3!s+ zn{Cv{`MFTf2Udgc4%+7%Qp=Y#v}dpF93*SH_{VpHVY@ z^^9XWo2WJfQ7RrhvA}8++LUuajN)Pbof{Xpsc}mA6^GxJJ#*hn2)d>(uV1ROb5Cf0 zxOy<5!S_$2CF7XxJ%togQaly0^2OhoeakR0@#JL&)tI{hdsjhawPHD(j_qmfJEE=$h4k+?_}%Q|YY!DYyzC=6e&$8QL3)=ZQI_!#H5BD`FjuqTjZu-f^HfX7ePsDUq`}$=WvR(_Pwnn;%^&W)ZnZCVa!sHNM^B zb<4%%wmz+Nle<}OM?vj!L4|e7#dSFkWy}h*qOT`>&lI<;ows&cx%T_>5`(*^ke<~{ zcllhI)D5avrAhl<3uf^d{cc=OxuH?gA?UjtS8m=kCFj)dvw^3?ZIZj?f{&X{jCHc% z`N{|GCCKF7pvMYcoQ8UjOWrJf7|W|KNdBB6wbyaaOOenig8`e_$+7}D=c#MYsaV%Y z@^O?|mh3G~kY~xd9v##3dGcZ|ov_OBR3Wxav;E}`W(!{@duasutg?EjX?VXFhP`vU zp3{_j=tvfTnaP-1dmZMUN+?rUe_;~m0%6~3! z1|mc*0=IB`RqmQ+2rx)WN|NrxZq=e?cRN@Un3<9BTIXFxV-^4j$O=B7HX1}TiJcpF zwag>qQ&#qSF)Awed&G4DzLA95h^j*q$}NofpR*G8*Z|g93K)NXdwpe<^ZJi6_fj(S zgl(wY;#$>MdD^`7V*dJ3{=xkp4jTuv<~IE{(JRb&kaVwq9`-Zn)&oADwaC7BWp^V~ zO4MHO6Gr1~5hHP)c*vm3B1IeuUi3}(@gcBt5gl^Xclu74h+zCxmZ4VHNvGiS#)1Ct zLMu%B`Xc_q{OeN;J@;b6l7kXWv*g?KSxt|sP;j#aEIqW^IktiJL%BEwF%{=|Vc|NfYzWksFzH?p_Ar1!+Ns>~AD0b8n4DXp-F&9rtC}hzz z&&V;i!zud#LDuAuM%_#ha|nsFYP7#CPC)8L>!9B-$3IpCb_RhD@*=96n=gtyFDNJ& zDQrsdwYk?nqobSUf8lIgvwUFa;qHL(1UcmcLdrffwI8~AWEy`T1LW*UlYeBmhE--xN5zu{leBtD`Jt- zTg}MYimF~PH*bUz_05w5X%sI-_AYm^j)&`Nll#%u^5eNe?Y*2+&Zl@^M@32hJ{&Mbud`i zXDL>4t@^E=@!TLQo58D7hPp{PuxjtnN{;jc@k(vglL&7TQcww}f%?xCM^&`&7Ky z3M~G>udYY$CPr_B?ALmtP{V1c`-Fw>)R}CbMSoh_>iaLWk6uiAQ2J@7^AC5mm)jl* zZZC>mpnOLYW9neNEOLZx`vzH-7qUN^_O7bjw&soe9-!}bzxoWzsduS7R4X;A?Dty-xj5}Cx_Jw#xjeA*zC2V!PW!R zHrkn|(8yVSz7|tApwe=v4`QC2{c%!;wL!`3Te7A<=<+S^u#5cy0!WVOX4qrna`Kx= zc-^g0_M^A=@a_dDmCl~!Pklior9d&p;mXi}=8FI-$jA)4}`? z_1wr33Gyw&mW>39e@VS{Yv9_)w6lunSpfOK;wJ6v0H0p|W3+j~&HcNV*-G#hUhA*^ z_&5gIJ?T$>H+pe}y=_ghW+t{UI7(n9EqqInZeyG+@mNBMl%SEYi$G)QvGRVKleJQK zFDNV@ZmU$A=l4-hkc$3V`P&7V32=%t*R}MIDv$WoC63x;7t^$(I9kR`e$AXmKNsSK z(JO8Pe2BM7<7(CnK!35aPYLX{f1Jb1(XT=Hr;s4o)svrgK8dj?m}Nx4slpmq6>&%f zns^20AmBIf-H3n)LksTlpISc_LR{d1MQbwh=k=Y{fFV7znkO7 zHR;pNz14KC-xg6GZD41u`fAGhjK1*!rHEj!`VOTFvIC|Qt84+IMo&FyHm+l*8D##h z_gJVxYj1x!i?!VXV|d&A2BSNsz7q{{qn693s?@REzeXH8d@qUFS^2}rq_x?gMW)#9 z)a=G~NqT8Hho*(~FTL+Q6_KgD)@!b`F&5n2RWdrJ(Hj zxj^}V2g5@-)(N`Vb5BJoRpePuaMJ1C+7>eA^QyM$z(AV)w-24gk;z;S?>+L^>8|V( zt+^_>YvVdi`qUqSH5r}nrxaEH3Lc@B|01+oCxyK=+v*X5w7v`<0}*j2V&s5Ks3m9+ zJv9}rm&9oziW)7*L*bl(eC5!-0&FY9`liE9gEab(wnEDinx)Ujz$OhI4_KiO0a=5X z#B4GY0j%3@?#~qf7P&|lGdDZve!2v={P%1#di+^XUBO_H#$oXqn~X4}z!1i3gK}7j z-8T=;GRtlmI|Nr@gm%l~(-h)ichS+61F%L;C)j@c0Cn@&K8+R3?g#0t7p5@8<_vSF zOb|prt-jA97Rnej^`Qg?;Bg;d63(mhQ8T{*i-WUlh=vBI7m;_7K_mz|hfBb>V?{1A zP^dGQ!cmYQ0Agteak?N14xDcU4i;MG9uX1Td=SIJLm+SgX3^Z5ZnRz6tBBmwpqY_a zXDO-mvtwPvF%+MPaP9-=^k$}1k_qWzl<}27;u*98?SReeHT1NNJ)Ap z`q%-;=>D8-%PSpYQ&I`0H=+L2fU6aqBbl6Js? zj(pZbS(aJO>y|Th=az`k4LVo(Ci&vU;v_bY&K(nQ3g<<0|zGQ!EUnezAQ}%eGJb zZnnaqcN0KU)c)MP*u$uE42FZqwdCi z?}^6s=*3K{gAp#AOw0Fm>Qx>pgxqqr+@E?R@uzCJd)DsjUL~cWa92{ZmETo?Uehb!GZ4P903p7Vo*IdQD0gU~#<E8#`B${PwZ~;O^mkYFx#{|y!rIBcIr)PS#2>hXTNy4Lm7+K zmagy0M$OE9Z6;I_Hx?@Qj0M%rEwb3V3V8Ict2mX$w%qH$VXsrj>i+qUahMrn%5L>- zFHc6iT(@yuuy6UMR^>phZk?1}KpfQOMN49}SSEIj_KXftQ*B5TQ96t6qIFWOx2&sY zWu+%zsJ%2w*(mhLtEK9Zr@nQoGC}?dXkf;x3nSY-Q;aMHML76hDKz+Dq}MAhn=qwy zk>k^|v@;Pe4=o2%E@T?Vr+WrC7Z!d~_PWJ;c=p=CcR9Ok5_Fyndp3KW;<|Y}i~g#0 z;)?Zw&Q}f9qef$MU%ZMu)%zZrDJhgJRyj4i`_}xv@p-XCxSUtcykR|hWT1@m0p}hhJ~5#gj_%<@!*8EWO|B-LYrxXgN9_a09uH|kgP2y zt>)xeDj~^yk_`jmD97NgV)!ps;zy#~H@8wsz;a7qmD^opOw;*b+@T0uBFHdGjE#bsqa%QTrG{3taylVXaU~clA%w$=WQR^BdQmbMV-!jnk6s zO+p67Hf6*ZN5-2;^Qr>fq=-4h%K!yLpxuuGBbUWdztQvvF>-+94E%#C;i@M4_StE* z#rkl8VMM_M1<_}lHu|+&AHOwRiBuKtwMD_~mSGzyDKm|~9)wvc?g7G*MdzfIz2l9@ zTTjkBesb8tkD`Y-OkV!eT|%Ib-wma4KgtUDq&sq8CQ6n7`6>xhlLV)ny}NmJGYV;z z{1H{`u-_>mSCcXXEpF`T(vsR9g1M0rc5$~>g-e%Qs95AGb-@17Z`wkE-#>BX7Id2x z8$Tb)96qPYnUH7C^yb{f$QBbFh7`KFjc9-~{%~A8dQARi;0a$x ze<8uP=S$+tr6X64rB0i6w|ruVcr|fC{K?Bg4?u|4DcZVpTezmJ*`Ju*?oqFJ&60e? z=5@d=r;=u17keo$((9ON#LX~8$9ih(_Dt^|iHJ8p6#X#6+@Pl@u}P_Jc*%=eS90U4 zs=7`QXL05WI!_#XPo}y|&3BDl@8J2kcCW>yI6Wn?yzKs;NzpL^{t|%e*T+PsdHOx$-1XYZ>>-N~wwaT~7j|UI!ewNi!Rk7ujQDrULe778< z`JK5AzP98w$1Ox!nt$3`_lSs=^PWl&G_~TIalUIi61wi$lHDdz$weykU-6u@ulI>5 z3WnaE;PhFXoMzeWOnI>CAs%U3V*{LL9CwNvZ`8BebAL*2 z&(RG*#~az3Klzw4Pv;EH`)y}pn=iI$*OrhiIC9RYb>*q#!N-GBb@cCl%Py-@Zq1rs zRcsx%uDa04I3KIa7t(uj$3K{ zb*r(ciqbje64frpb?;GBaXrs;i7e)&d01g1bB78Mn&p@I&tCI(C)T1TPPADzh~Friz*@zJftYR{MuS2W`XdWLveUhVFpZv$J zudgqVJy%r@q`;DfhDqNC1_gR5cqwFru!wLtYrvQec;u_o?o=0sbo^%IRaD}!ctz-i zJYbKvFJmM!S&h*m06$4RA!}iOK)}y(eHb=iI}3L8RYYc0WF7-#2+H19V0ROfWZZHU zHiD%70iRoPd~sQ{D9xueXtmcVwRvbB{ChBN4*-~uid02)MDmTvY@Dt&oaXpTWk(TN zSy@PE!6^ygy6!xo-oB{LgrCJ8ShcH+kA1U)mctGKsvAqcR`=JqXs@H9WIAs&Qh%#! zaptcL9D82h-}tKbi?rrw(YG64FTeWh$Ub+^O!s*Xh8+2GM>$eL!nCEWxNF~p<@I*y z(STg`Bs9ktFx=TwTF1Tnsy}UzE4X{_29I|iPlboX2})<>ZQiupU9!3|tn4)G=UEoZ zhw8InBP(xcnq2#(ei4IiW38+&si_w)&)IQ_6S2 z&kok&-g8E62}SP*-FfZh7e8+Eb3H1f^T#n{Sf6#iB8cwc(jBV$tfS|rvMwodC2sZP z782dAs~6sTan+bssPe6JK%_?N$nlB8UyY0mD!KS&Xmac#zte%-mbxYQ)P1iA&8%}6 zI7fAcvA1PM9X=Xlts|Kt=Fd15#Xn!6`Jt>VR?2^m`{^roYfU9gTmm*<__0Wn&G1Tt z)50=h1B+{_pL+Y-OVU?bHx5U9#FLJDCmxVoV6K!pLMZt-gx?r{jXF3PD6?1mi@k7s z?)bp)@KPo9?k4t;adTz3OakX6v17z5lSEXwEIS6%&B{%5Ex}Vpf5m?cNf-CCil%Xy zsj}06<*^4sCU{+~d>o6{;54#G)Zp}7;-#4_q>)uyeI&k<=8}}B$Q7kJ_P0mb*aG@i z_SntIo{nU1W z*O?S@|1$7iIhAU7<+AtnS&?tLbG4yYxT@cm?DjLE<^3WO-Lm(Fsq>%L`sXDB z4xau)_utFow_efgyqEJoe&YJr$2;=>e(V4KSa#|EKHEQk>i;iqp~v<8+EpHi{xKvv z4J9na`9uwJfJ^Fd{f}>GDQ)sIbtkm1#2FO4LM*F zleP6WKuQv{b4Fd$Wmb>joFXh@{B1Ls84EX{dUb2`S;6@ ztq|g{hnfbIB%ofIiy_rP(F{n5N5hK#DxSt{)|^CFW3C_D14vms^Ii^;Oi>y>^M=vO z&Hu5=RMymnb-#>=P=UuUn%97rRzP>5CyoWP3-oXjT8SR;BYb0w<^c|up_Ww&=E|9f3^y9NS)m$3iy%Dqk;Bue;na-X;e9S>yfA2F&Ydd%2KXxe}{qR;Crqgw&XYyRJBpnK|f_v39VsybNf8?`@iWB(-~u|HdD`QxEFXa>m|!P|izSL3znU0ak1?8V^;HTCKZuK~E> zw^g#dW2IpR13IckidG;ME$5Q#ZzAr-EP;X`W8U5@iy9CI`G$nZgBt-01dZfNzIdfb z4bGAGD>e)IY0U~J4nyv%UUj?-VmgLugP~rq^8P z>;x_cp* zL13&OhsNt6Ts}aQOMhI1Cjl=oafk*)&8bL$F!2Wlb;%6`b?q1@2L~7cYEKQ#hSY3u zulTi!j_(Z;+JH&1Idf4pfF+IhMQ*rQJB)C9;PsLr!oR)S9^WPW;STJ}fzbNNZZ@p| zNr-+^^$Mt9D^HDYpcHlM^8sui!VCg>T~!_@9~*_?G>N*vcGe8AkQl{dH|}_U1PrSm zU^zekl7>*l1>Q2iaqs~4EL2Tuyz{4o@|LsHzZc2hG=LMr!Wy^4;2fDJd%rKjCOW91cVp){w9iw3WpA9gyJqZlHk~Ph77k&Z;OX z2E4@No^UuXq~#%=2T&M@@au>@01B$Y%HzS&4ZkkITNfIroM1LsK*2eZm;t6=Eu+%l z4CL;(%%6_6q3I?(xd3gr-OrCU2#!+30kGz*yu9CZ!MxoXjWoS|{HEuq2fREzGc~(V zrJc1fN)=E(d-hosZ0w-4eRm<}TZ6GMA~YU@DDeiCW@v?tCtX+|<&~Y`Mj_J=N6L(l z=5MzErd0#sxy{;TmNcwJ!;7+}+79Np^EwhAPJg`dB!|HZ~RJQDKH z3rSZAFbODLfozuH^w8a1b5kewUdFBW_~?XkZ!#t%Bt)_cVhk_}46aLouCwsYG1yDx zXo*550bUb9{ZVov*+=SD!F(>h!TosXEMj8qrVhBA4DiV>GyvHnaU};19FTq+^zS*- z@KGpJAX_gjXNQzNY#Z{@z+MvoDCxiQIXe-uK+@sU&EmN9c6TFbTVTlP_b!8h%f7h- z%3N@iD-PCT8AH0vk?m-l-Fnb{6cDR6?fZiKeB<`->SlBZ+tJetubJ=w(0dQ8HciEE zHHSXK@K|E$&lwD7b)zP*qf8Inz-}UD0iO9#Ykz)uqWR|%h^7VyZX}@?E)@w;&;SmLp80ZfF{%KnQdSXC3e~Rj|uEg*|5gJHe3LPx2<-5I#vz z2OB4+e4IPCm!q57{TbL}Mkrhz_tDIbTe3PhjCp1e9FL9;cy0#a=86ngJnb~d`HjR z%Ev(gx%n1`WiL3iRO5h-or0$1+4JYD^UootRbe%UzEc3N4!?r?rz8Ku$q&JlLjN2N z2qODHbtC|hJH+qAfE`elU)5l98Z+kZ8`*uW=A-M8qKsN6K|Pjg3Ca>g~d!ays^5R`yE4doTvbS-Xc z21%Fv!|CB*kb|B7X>7q}L6VnO`C9lG(vlGvaQD$8%F9^?NoX!qaY@6Dxcd;LjRm5< z7Y76qf;gOsI2SRYxzZ#LS?=wip=C(dTMO-9v$#`u9`tUYrmKTLBVrN=T_3Wf4CyT5 z=`%IjLE^wXokE4+Kt%*;#kqCk&=FJ<@+sNeot>TFURtlNIFq-GU496-VDL=R0Fbn|Zarm4Qe@Hjh&vyI; z5TtnSS#bo)hmK6e5VRGMzJBxBrz4Bo+Cri0ty~Zm6s%9&I3q_ww)7nOXn#3$w6~MA zzTo3G6S=!WjwHo)LBaDp7QSkAxKcHX3s634&Xsn-%V=Tw=&~zx+%4I7F7+oURU=Pt zK$XLl_cqlri-Y@ zs<%8ny-F0DD3yNA>8~yXNn49(3!615#Tw>MK3KV zczot}V|8L&9nzby;)RfT`l}sG-OpHZBZ&qkg7}T3G5GjW;x0451g!oYv>3rM({ew0 zdJdTc*Zhm52ek9?>U;YMe*ir#(5tMpunmC|6CO;SJ`Jn={jIo-J|N2$gL$>gYf2QH z7gNm}T=P-kWpvQ3EKRB;IK!4EW|Hu^qbi{6Lm|yhLxro$kZ~5Fj+zVmn3?%9-QX{F z-+VltAD|iuS->tvMrcsbb-RoAurf8dFVpF5T2EqaK==+T%f^f!7FxiOl*oS%2;2>QBl_g=rXXnzR}CsNiZ$Dq#4b1AWEqzo#dHvRH_+SQ>ea&y zKcTrHR!u;8lrcNxKByH+S&Z^xxFd(&%vh+`rMRDW$0`R_vXM{<0D8faw)Ubqxp52w zT7?sCgRc!@I1$YqhY(jBR(NQep7AUZBUpqO;Y7~`^#{8;Ow6I)^wsIze?RV@6eu1I zfymeMt|j);@YVovzO9r*2`yyk?k36-U{DlCoo12)0N!^V;^d@49x3h`G$s%tY8e-` z<&6EcEYe&~f6Iu!0?vw%`(+@a{g=+wt5J<9>&|lq_U=+=n0%wA!L-#ZkMmy?Lo7v1 z=w8nJN+Y9Jd7KDpB?(B=m2dHKaL9=W@F`yLH{f4TX;pw_V&ml7w@I8;Id6r3U$Lmy zeL+GJA$kebej?7heZSZ*vC(VS~puU=<}vlzQk3IvVyVBA~~?M zbcgsx;zRA{plI)zDuS;d(Zt-}E|LCzlR>LA#nWqpD6KMbx1cDMoF+C}cj-jeI^*S5{`rZ`A|gPg0i~X3Lsh5tl6)^}nrj zqhZb1K>6QF48C4o(FT<9;M%wEekDA?JeusjmM--9#+l}JBQ|pOf4aY>EwlZ;Qe)oy z5e_@Dh*vxxsT~V(_E;_Q&L=8wt~IbuaP@#9>lp^l=tA5Mx=&+Uk()@t=~-x=0Ehv@ z!?J}la#w0grLKhczTi=`S=0NO{w0*~6g>=(#$JO|?1H;xwia=m@@Pz#FkQWG^Y!xT z$}(h+4RIWz3`c&UtjvDQ--&Ce1(_T%<_BtGOhiX~x5`Lby;NpvlS#%zJ>!;e*WSWh z5fS>hnl#ZXJdE#;c;xA;@k;)8>+Qy^xA*B9e=4(~Tf^V4PCJ{fQ-1g(o^gpL*KZP!E>Fsf=wF}-9tn7Uj9ZW;Vsgx)Ak$PDeAG2 z!onEeA#}6VD0YZb3*o|{QaA)NJ;>#Cl)6u2)`xEF&yN~;68 zt~b9WX1{`WljQ?Bi8CDD#<{#(7P!9%s56fi7=4acKy8ff5m8@ddHD=RhV4%oKbG!H zQKF`qxw^lj{dutE6^mqXTp!h+Bd85hrQcp`(^N+zUyezt@i_(4!m-Rxj34q{(3C&h zoWh!snPT>vIcF6X$3}$JU0{f@o6YT~T($O7F+b@^FiUEc~bQ@2#+Sz=>$sKYT*R*X+W)Z zKJyU>ls7s**n|cILUhv>bfX}(_~}{|7VKfz&`(r-x4wv_p8j#tkkL!#f_}pZ%tMUE z*@)5IuiH2Uc(^q_Zx}p*AtV5! z3j8F03xSR0gEjq5;P3P|0F1jq{{1)v#^7x4OT^d(<)dd zAPM>g%Ozz8^L#Bq$Mt!%T zSAR8k*(%jY53Qy9=9@Ay58b=)o6Ye3)1&?o9#;$w zxo_jQj3GU-#1E!x(-Jmtf~DW((g!M=H`(V_jKO8?``eMdgm%2V$mnU24cHO1q}fAV zlajjI?IKBp(h`nXz(X5h}ymX{b8Be=F6FMyZoAF;Ej)k?$~R+*K%!C5#Z3 zlB-EEr6CnSj=lm3g&3M5dix*vAUuIp2Y60!ywkj-^psgr@0#f-@YTud&Bns{pe^B| zCZ3ce8S3vAU~&W<9tYNbDOwKn_2RbQP-*%!KsteZ06FC^>yorfwlYh!UwzXnCxrKn zPyc6ThE+tQDaz_RCvDo)ox!HM#PepFx`@?9(&%<%0{^x^alQ2`{MkcbozB$$&{ zLywrT4&`7o;*)!7rNp5oj){xY+WCI3X6~Wfyu1d8*F5t9Y6tBLUA!NfPWvqdc5B0} z*$Rn87m|#Sl8eU!W8@F$vU$p{;aWDQnv;ghXff7nOv?A-*K(4MQ|t)!So7e?yT7;G zz3cwhm3y|z)YM~|=J`~@{0j>B`Qgl3^EjgXMir=YOF5~LxWrPgk%?7*gBctUUxf=c zC+6aRf5j&B6n8`n0x_fl+V=bb%j94k%&}qECx7i5Bqh&HDyasz%soz^gZaCc41e%o zJ@k!N54^}m{2n@smcA~FtJtv@oWGqpefoQmYms~15m0eFi|+tYr7KAxJXOc3*Y1~h z@7Pg{j>^oY2#ciSXV`_LK$Ai;*`SW(VP%!MCex10_)wSrCiW#>92=d9b>eVSptk$P zCU?bbtC!4~OP5|qcR4yZyn*7gy-G|cok7_6Sy^T$xc3n5RX?yab8x}6knmJ?#1)#G zB4B%x0x!K7a+_`)r*1e18{ z6lJY}?-Q9tH^0c8%WSWzO7`aI52^50XjR*NZp&?VDViOcQWrF@^}8Be^;@rFdwOy? zzlXp1rt^TEuFyoccvs)g8qqF8(24?G;#%KYRO6jE!0wN$UBdL+YpVD&I`%wd#E@Yq z7wc)b6%97@z&jb{6t?p6p63gng&K+2OJB_80n9}P=xFG48_FnLu{GA@&vrWXt(|ix zridh{4<~Px_!tb0U^y^|BGSDgxaJzMCxE8-+^<3Ju7wq{>Os)-J8|pwYAs)e-i)Uqpn@ zSL4I*2Te~;=PKNHJ{Z~0FyBAsvUC)JWq{^8nV9aBdD1RlD3aZWTq1HQ!afSZXb6r8 zu-kX~j;U#)f&GmZkFP~528D>h!qf;@6o0VddA-GZrE8U0U-se}cu{kW%o4Y4D`YK! z(2Ilvz|{$f+Z9OZb9Hsae@rvJaT4aIn0diIp&ME1m>9w$Cy4ecHyt%@w-3g`SNR$E zLu+Wie2~07%0%LhfCLkd8hliFtLYn&gM)*%b~&UzDPGynByr~ju5+Y)n6zg7qMZ)Y ze}c2(IrSpAb~aP5QFB`V{J0q;7?QFHg4+A!Nw}CD!fXg3H*jR!v~3&fUw;+bjBwML zQ5EI>#|5Cq8)TAn31d8Bx?|@~o3HcBO|z1~E;0Bca$kgyW3omDU2yG>cd@Zy;axI+ zzV%p9J?#wNMP#z#uan1!uyee^RNm@-8q9+eEU7vVibhu5o9)YJF%QF-HBr9{X94`> z-_&>W0HHoOAsh9^`JinXzMnlvJvz@^1W}RMB`;j#k1MB@O0=a?Ujzj;OM4FK{u(EL z;h-q>2CJR#uA&sertcBW_6-QQ;gyJ=wsYsZLJoV+_6Nsr40h+ToR{`|ySyKtc(5fi zzGr~=)GF-z`xU;#l{I4NkY8bgaRoj(YY1%IT^fU5Qn-MIo#FNN%*Zb#g{W%%o}wdkk6iobUvWL z#NQkjB0s~HMqR(hk2OlJWvZ#FVy?}IdDQv2=R^1I;r*Yb1!elG4+kfgVm= zTAn)I>Ef%?{PKFnDFixTSC=XzPU~?fsG!{qzU_EHl`2qDMj@pthG&SU52wukw z=s(aMUlh-O&>_Ohw-y;~UCzgwaIB||?lXN7yM5H3&P5M|Ksl2dsNp>re7;3_6<$(P>T zgBl)lSK=XB)b=yM*FkrS zBrIM0FdBM#;>U%T8lRY0dl_&caeKvHW^w~!NPYsSs7TEt_UAaV{lmk_6WJ~?N6ZCq z`ea~YiZ@#U?*Iy7BZI2E40{wJnYDj#827+ig3xbK-jFwiF(j+F_{$(Y$IWh{*YfYi zKVl;pIKXhg1qerHR_}V!b>lXM$6t*NajTQ`ar7H-v(p1+TZ^L}{q7ZfPnd%cArkBW zemu?5CC~SEJWd4Bls3yeFH|@r($jTil9@!7gWxe=t-tbfQz!Zd>j(Xi4xprY{N%}+ zVjP}=!Mvukn4Lf}F+L!<+A^-wA^>YfSfU?)GPe<7J?$W9>E77~lYLU=ohu!8|EF@Rz3HMBwB z63=_0mI?*XPr;Ac4Cj8!`PudxcYFAt#gCma2GwjEI13A!J5c_No=1F;^5>&+{n(D_;>@6&|}aUS>=zHTe=oRmAR= zUHw5^e2|UfZGcl29mTr88RWp6NCX_1OE2(|cF{1AussU0*D%tKg^MgaSbhu*DIj`^ z0;5VUn1`>i)=7$%_0Awn4h*~pH}zf1Y*Fjt$!R~01$SBhRG}igMz@Rop};A_#=)`K z4PWffk&&(4o0k5*4v&-TkOM283<^6Phj@NBrxADYc~o`##9Q4A3WeNCE*F=TZ9qki zukW#kM^si;R#kKQC2k6&(rV;(eE9HT{Ch*gZa3VPoNf8mqYf>JLtxI3Vj9tI4=_Eo z#({{vcy2UzajYl;C>jCWK3@~U5!{CavVPQ{AFCTYi8UWOIP`U=u3kNeZTACEL@z+B zcH3$mH|PC}I3XzPe<#FKFxi!_Tf3Icn{#V+UHZ9YSiLF z!OI)6l?9*Fbqk6K+jD}UHSj18fU+*#sG6=~64$AzPzMcY;R94U+pcmLlL-X+wGw+qg#Pc|4NG8(L(9qCB zm1!`F!u+)2pf#8d>xTV3L}C)pwje zBqrKe%U944dWZie8Yu`i;d)G-G$blN3hW`^3AAK72K6Oe}Mr?Wnk@?_7q89dOBZ zaDmnif9S2gH=l-{eXAQR6ej?WeubqDq8K|k)7(jY=5<;eE1)4n(8$B!$QYTbW8{Wp zn_n%NY_Pw;5_iAyVLwT%!htyn#hM+AC&^KW%n8bqn8RV|uf2?Z1c>uExOHegwiKgX zL;k2+H0Athz=S;*>3Y|RgFArlk#vFfd%Q47b_iS#}z1I?VWJJ5MLa#H{x$yN7CT zTmK>H<9%(`61>5&(8#R{QUD8AaC z&^{smQOKkeb@AW7c9RTMtBY5Pj2GlOG6dCUiA;%-)+)P8_vJm0P=rq z4&s6Q^NUUWfB*OYFMiWDVRS7iYi{G>Azi$`|NTbO6jHUvP{~B^#GMYt9o(%*Ay2{o z-CRWbCOuZZZ2>1cdpE}XxMV27GupE8%*~*~cz)?E=2)p9)5rjtrY-Dy|B7^+>h35m zfrljM=853DC6BuKSZIw55<+m<$D+OX^XJcRUO6eOKPjn1yo)oc);mB=VDQpnltvfO zJvyqK(wYr*OVX&i6a`NzylvE3k{UhoLQm)5jQVIS{ByKF_2#kO_mM>h@qu_xeW;d} zvJ_kB;A!6dfAg^Go%5x8MX^#y`XY#ryFu~7F>|vmc1Q|V+7t*YDlrs1pIeJ65YDXe zm}4oscEK$d)njRG?e^QZXE|p(U~BE}?%sa0S$9DUYq@f(ifhf|%JWXE%Vkr)8$FRJ zO2_XjW)*(}Bqfsb<|C0{9-s21X^0xEU?vNF3Dt>n0j7w1S5F~{7_{9A`s67YJH3gX~ z22E@3!ZLmrZu0uwV;z#(N`XzpAZE{x?~Z&xK)UOmy?p5v5y4Edrjf#V03J-B5{I5hnt?Q(Rc2 zq{E2celYS8`gHon1@ukGUzWlUXCB=p0iO09zi}BBB}i!5PP%&X*$|_Fp-3#Mm@UjJ z*U<^BA(s(=I^3?CQQz(W6&?3uf@UTw3f|A*;-MHYuTd>>VfT@g2m$+N0{A^XQVqG? zK|e=x)E(_3agd$;F=^h2ARA`^0|F&6&?94I(gEVZ04v8tl(-jvM0J6Nj>Lx(h8b{u zq9{b$L&8EygFvJ*s2b5l>-8<(MhS=%29Fl=I8?L5xRO-R576qY!(Ar_0xxj+HNypU zSfc}I$cPmc3g>hXgN6U{&Eb#m2rEi~i0{{Ama7dT_)- zvA|wd?04FNV}k;%8L*`t6zF;|8GL{bP69ZP2CkD@ka4UMaikE12T*IFHO0S>T=#!{ z|5;i4qi*50!N)Cl-Gt{t8Z^{bfYm7odVmUwL@D6xKqJ4CHM{xhCRwB4EO}fC=xI#Cd_4LMYP2dO3Oq zMQ8{RNEjtkkQ7DYSM4J{!$1KS3nFqugW=}9I3obYD9WMgmy#!O>7uVCml%bxMe8>; zDb)?iEy0Lh##0 zwT}nUM<`k7>~XylHX%?Orm^Vw_yOsGHGklnOU$_6-}prY_e7G%#>Pdi$;z!tJl3U z3`J3lWZVVNrhii~R#}B<_J#MZa81K_YXc@rBx(kPL=nq&@Q$gF?cI(d3H8iP?{>cC_TpoPnEoodlxn$(9B~7B&3(?!jN9I9JfWkzh;`fefY!K8Lzx1oi!XEX)?f zQeWP_1h%^Mmeu`8T1R-s29h&{YK)XIc&33TA`mPzNeJ1Pm&p$5Vd@2>QvlLn$H3-M ztO;VnNuTcegNRJ9PAe4n3VL(n{%NA$pv0#@dq$=Vmlm^^8THt)_7MV4==CcL%|(Jx zh)`fZT{7Z<#Q-n9wP>6N-a~6q=50do+y83s%EO`T!}Ul}DTJtqzDPxulzodV2`Mf1 zZOFcFW6Nk&pDiT&Qj%0cvM*ze?7J9aXKZ6PV|Sjnvt8FY-*x^u*LD6n^A|7k&O7h> z`#sBj-_P^7M%5t!iQxjoFXNv9S_Ca^D`+KRL>?Yal=5)3ht+fn2o8&dL0uH=V~91G zy`Vh!^wyiTLgP%hsS+=)QD(a7vT1RU65kA)hS(DvFZfi|daWBbQecB=B+0}=moy~P z+}$RQK$tBZYS%t6Sb_z{ANs-k0<<6uEG&cUDkBQ2R`w6qvYC7U2|qG+9JC~`s3#6a zLe>kZNH{oRC=x%6q}m%Jfm|rxl)OIs(15`bj1vk%&j|?}v;}r0UV*uyr^M`UfU?7M zVaEw-wow>@hfY+l5ET7nXL-?+CA*QV3_vtc>4rdGWl1t}qFxXTit|Pu64DYdc`1%<(DBQh3mA-|xP~O5k_X62w$GX)o8ihWm6gfLBxGJK3?-_9=EV|^Hm^eF zbFl#1_nC;K=S2UqsXh=sAypa(mIh-w-iz^dKp)e(Qa^|;UGajYf8uL#5d@9k0~8EN z(jh^X+@}qT4_c&B&sB<@J-aWP643%15)cIhG(#)}7@5XA9oDIaDhs_ZFEg{hXz2}Q z?s4F4S=fP3T%lha)hIdh_C z9CSgG%x7a^k$6#p19x?xx)d zX)&bJHF8!2S?DnF-6CNmFoJ;~Jg%!U1^m(qf}DUyg3BOtkp~!a?1ZhczWz-|M?uis zSi;}HA16UxFVPRstsFA42XFx0ORR8xBUA67PK4H9&+o__-A5Q((hjn;y7#th^nLyS zdc{h4@Bs%k^6GrjFt`(_(s>OF7)sg3W0?KlLG}#fq`JNRC0N}&K=8Ug+irOCe66dC zWjMMW1*Ij>(6P})vvM$(P~c=zcXRfk>^fWVV%fkC8)gWxkhbxt1YCnbEzGmp*9LU# z7b#=pcKW#z`ILeS{;J-x*tplqw zSwu{tHiZj<_$(Hph-Hu;8(wAEQiSIR^;QvZ2LL}%1;L>CZ>%x^JX8=doKaR*hP_Rb z+lS1zi-9J2MP?h&%NOa|g|vu3oF2Fv#A`r6iP{o&2luN=0GI>e;z3SIpWUj7OYn7x zJ}N1+RWPR>{oQ*O$*INpo@z!;DUFL~>t_P80=nQp98MnYOQ|&%WL99eEpv;iIBfui zaB<1u4yLxSv;@i%H0%Ne3t-BSVUBRo5THjwd=3?T02^5%vlIc)ha2ODcPIdTjl#8S z0npa9&l{mpXJ&3fXv1%x4$Lf&q0pcI6Fjz}F$Xbr5O%^eTJ0~M0;Mwi48NjbjC2HS zbC8NQHWSLcjm|!*ll+6`g7>5C@QP3R#8B79B z@&X^#+d` zo!4{b>{*=_+dR+=&#s@<{UC*8C)>Q>Re>C?JKS{~^w#$s#bY%>Yg-!LG#|&k;ZNMN z6N%;E_cp1wzAEKta{nYeg*rx(2>_&^B`)b`^G^#_F@Nr1+z@3L1|)knY;`0E1u=!Q zhezfr0t&wb%^vtQWOck@*u(H1Kz~M(2X%P@P(B_ySw7cE6X|HR{t724t)1yCl=dKoYe~<@C^X= zY@mz@imKK%W${svyqH03q2uR-frKo4HXH~y;4Kx9gxXO9IE!B9o#O~(1+P)1KUfFy z1IeV9bjgh7NJ(Qrl`7_mp^Q0ojtp%e+Y!~9q#I38tu|o-zU(o7cqXiOqI60gF?%JRK`;QB}hcGYye69cZ1^zD%j%yPR{0aX;d6OUZH0XMAs;73L z5&UE~+fYMAO6*&8&0_}}ChZc0doHp(0#U&Of->@!EO?8mpuj~Gig{8^N#Wkai1_Z) z?ryrsAof43b3Ipd^NX|}C(PBTlI48EstR6in_0s`1_;YCGdM5MQ3vzf@tD<>6T(Hs z<{oS4o`&Bu-&B;w*1ZGqEeA_nXbGpGe z#ZuT>_Q0`?>wn&Y;8FhzV9Mov{cSGZRmY}6$^LjwWHdd?=LVJY^_E7$%gIg%n28A zQ~5#6SINuTm@Sw6PHpZhS~N)lly>UR*Z-DthKoV&6#fu3jj=&avY^mTH2vM)D^>)v zQdz?dFMHyQV2&cGdZ#dNB#*&7nu+!H)5*W&_Q!PJ#3tYb7N?4#OE>wRv@-Jao+kb2;4TcGFxILyn~rA4Zg6 zy!)NQ`quX{8LWxA{R8%=mi~1msnQ)1^}+3?73iGr%Yk<_OgvtPB^5vYSUGs&C{2FZ zKu|$1*JR{rwWxfPaBptMu^tuwm|&Wlmma*uCfDG~<&IqYl*Q&0Rv1#8C!3?|z#$Ra z97FM3(n$U&)0R`dvtB2?xYO>g-NNeXglC-h@kmW29pJ`~-K`D@9PIyjSC-rBliPK4 zm{rH+Dz4P_Yo7j>TLlT%2Y$KTFBi{L^wSkC=9V7ooMs#eD+zi9EXyE)r8Q#joD?~B zDLsF^XSKpKpbAabiR-T`F6`VNL-4{hk@okJ_oZYPzL_>55#_h|hVrM|PKxc6(Z-Y0 zmq*#QsMgVFHb1+<&Yiu!)}>1NcN(PylH8M|VQYOsED0Y>Rq%Xt#P0L3i5J4h!3g$Mf9?-y!G_~dpkx|_^aLZ0S(@-V(eQHEh0Yc zg76b6WG1FhB=5W^X!LZy`h6!!1;t{e@?>Bco=0ul7LQqxQ*Vu*n$w)q z()0VVcHXr$+7(;386#^5i|B6pu)scJE zGI{(;_M=C;V%g7k+{`@F)pM^EU!~&_*pf+dCh1=oK~ zLy?!Ak_PK)yq0#3xOBS?Ksk2B{-PDXP23oVdUKj`nZC@xPe;X$&V079}Bl@BGf89a7-E_ z8qD^NuBqbR;;q_WczM=XwaL^3W}ze2vHYa6*deY))BZNGBera#zbQ_Q{ub4bucE~E z%4m=7v)#9NBl-o;!||1LjOTCsw%Fsf)*)s0te^Iq-g`}@=uKSCfiK-ZRka2yEARHn zc!K(djnaW1Ig0E_=uP%;KhnH@wnUQ%P zu57mHM|&i)IfYsc{`5lSbIMh(2I58Xb2%wZp0!86-KUz)4Y3^ym*+#M33&Rpxg!&I{A;IHl*y)Ok&_u?V+zg= zT2i89+7#6Po$W8b&q62VfxOmrS|3*m97KP*BKu?%V&uS?9|crViJ2zDXVv(k;(9x8ZTU zy0Py<%(gyLTDOiB6-^hUK+G!o)<9R$*+D3nh8m2&tXkiZn4IGQ`0AY)>5g*O!t^h) z32ZFU5t#BWm+ii7Ci?TlwyVF{+4B#ZRPPWC6r%LMCNv9O#MqC8u^!9Y{4?Aqu&-7&!}Qs%-h~&>d%q zmM=f+t(inXQRcSfdqlr>3_mI&MW5{bavA*6F4>#I6qndvHzws~5_lUOmYk*;BNX{|j(3fy zJW?#qFy8*nj6*t7OLlL$vZM=LYb`uHf_Cj%Ad+q=xNM|&wF-D_w3c_Gx+p7EwH7>* zS8yG6p6?u+_vz)GuU&G>&SH~%er^CSbx=s0+3A~PeVud!$_wL8tGbx9VQoO>XdV4U zAyu!bs)&wf7;Ac`T)&`@C(BPDXXOP-dM$G_E0!*~i!R;QU~)PCy$EOiXp?YCv7v9@ z-|Cqx(fSao4QS)GXOSzq_e?= zqUYyU*Rk>0{r2nK&Y1lR#+ft1h33>h{nx3l^qj7o8)^7#RnjhJNcqHeEaPuh9cCm> z+07#hA5cz{>B#$Q&!_O{=~El7R=FrSXt)|$RAstwuBAoD(mm`Tr?p8K>Zh!2K1-I%LC&QV~7X>X;<;dsXEn1Yh2CQTllSrdUQM0M&w zKQTD^4KVZ}GQafaZ}?X5H@+?oY(oUjl2S>h>$Hf9w5_!8Gj(I}fKRL*-rrUChrg4%bfTMzL5JDSGr4NftT0YQM~St2zQPf2|B@^9!>XU6iR+7xxj$0m_g&yvTe4u!3R<{R<1xulfWb9grCK_azWV;W$KCMI7Ss?YE2Y=;YnW&`NZ0=jTo2IT}KzO zY>FQido>XszkhMzkP&Kq{`M)OxNb9T+~l^e71K~nT1TexXXu>F3%|uY`ixPYyKj{5yo!2En(gHI z9e9k+Q)D%i#@+VRjr5O?Sy&BjwD47QX8NtSG|9H^9nEQFFX*>#+FQ6&XS);~;rZ?L z9Rl}>Zi4YFMYYp=3%67l8ysBBpHRa6v`|{)AcO&wx{jh$HPnhq9?>cJr--kTFZ2r= zv!1Q^WiJ;b`K!Gv;bsBV*S`3Mp#|LY_e}h;-pZ(i7D1kx-k`98WM__*fplLziO;fS z`2C$Fn!>21j3Sw`tNB%K8}>vs$3vO5vJQ%{_ES>{#d$IrQ`{DL_m_({`&13EqZxym zdh0bL6wgOuIQWsRgIHFFTc&k)w$|3|(K;x|!HhTUO`;r(XGE2icBcRs@Mi{C=-$V* z^)MGvlO19G)b@(gA%4FEFHKx?ohXBj;e}>o=f5uI4*zXZ-CTRa>zXG0PU-9W_qS~e znWsoC;Xe!^Gw~NCxLj7$ztt{kC*Rc?*)>;n7=L7W30!X8fTC%X&6LSgbWr!@(&DBd zN}ff9!@B`;!5-uI*yDoqFWk=TM``rCzxcf@4-9&R;asQ)O5Ul*sESyh7_QwN=Kw%V zWNoKZ_~a3e)_P2rD=$D2$wcMAO`kiBjZrnh`yjh`Bc1=*K?gC3GAT55SC%gd<{7(U zQ!B5nm^v|aEOT66&3c<2|4M~QRIRE0Jnj>VI2-rcqq3KK-f@rN_{)m8@kAjH!&JLW z9`Q&n;t{u-c<>S8YY12*5#DWUZs0e0jv^gz;-_c!<7{nOPvhZQRP2Vb#pE8-%SIpL z#O~d!sOF_|j%em7?bbx0Udw>KkXWp(&h&0prp&Ncf^Ye=!pP&;lgqP0*Zhqde|_C| z>w(O2NrQvV`!00Z9H(D4g->T~q9y9WrTjN`UkbZs4iX;XDT&2mS?A8WUiss#!r5;& z^eKMl+o(Dtkp42MQ~bV0;+uD|T1w*#inw+_-#@qIxSYO}rh~yc94nG~+kpm{ z=`Ki^UK(EcR}oW;M7F@sh<%sNDbH-Mx`@ReRaZL(zw^@D8xXpYe=A0+FY3>6Xv#Hy zjmnvmd8?99s}Dfkwpme3u)Dos;45l;2hRsjk7(|*uFV(zQ*-qPRYb1#e~@4Oocna&ci(YcpX>8}zhCR)=@kX39a|Z;l1QW-(wD@QNF;Jz z5{Zm|GX?&Sq@}(q{@7x6NzIZ(+P0hchpeu{d4)teM3NRif7Ld0w8PF(-lk`LQpM!b zQEQqT;&p*{o(FE-r)(@MTgvI_op5 z=-s>lXEOX)U+xS#^y5&wgNsYw>uGC?7pfsyN;h%p}_ei&ulB>(=cP~ZmdC&Z5}`zD6JFPc={%KP^2ic(KEYIY32*Orlb=f@FU zyM;g9ye91nITcn5e{>2~rev=tYe+jg7gWwQCEeh;Sww36Wcb#s*MQb~eT8BFnY%af zt))|sw$Q{WzpL4C>Y`dxvS#Jd?1;C%sj2BN$7%VM)zuEw6U2J%-+AX_TAJF2n{I|3 z_^_eo6s9+C-q6m8h_24i+{iTH3*^+wv(==IX1g5D8#efqEj(*Ltk+6laiP~YnCG@a z_Hs;g^mBjz3wnA-O$!zc+_k8)&-}fPGM|Gy0o{G&FV0Ftnx8vR^@{u9=;+=0C71Q( zPOGujM){bW^q*t*ufJFQ?7nR;=}yas!(*-KmX`5YsrI*Z%imW}tiXWaNM5=8~(9w43GHObopB6*-+`+>yiQ zv^>Yc&b~djL*f4YGnGM{Y~0*GTG*JGAD-=Wd?EdUwd41ZO8KbkN$TQ~k_?q+a~{XB z8#gDPvR}D>HMHWe(~}4Y`4GP!kyT_dOJ}i<;{`be*4b`0&x;-l2yW1}fz1y;N>*=JnLKheJ zfPR@!1-73*e~xzK20eH%l1p(vH|+g;c4xdwd)6sb)Fm8iUWu!KGUobm6TTf5# zd3bnDcZo;JqC?`h<#$ec!%ri^8AaSAe-v4 zi$8=jUDlmX^YEl3Zl_H;T_}YOylxP1{UZLpEa6(BSO2$fmvXFzE~u)$;_msGV?AQK z*dG+H_*OD|u%fzJf4Ct&c2^|n{q>Xi_Om@h?;;8kPSeuSO?};~&E>M@7^GO1bAPPj zgHB2Euuwn${n1y3cJt#MLJM6FW5$hBRe!gppG0+WHHC>dwc3V-hE`#Bd-qTFmeof| zcq(;THpD5GT67jT4K*h2B?WP4M!Br7m1a1vF8zp+-TTX7LO8>u!zhQUySv-!_jkA3 z;dTSh(#45-ogHpG%EA)dWHa3Gl#?S| z&yuF|uf)jE#>xd3fA!oO%x}s1`mE_0&DT$!Y}Rs|{JJ%MmHp@Cfj1tEN0^yQ=zlYd zibjmJWolpZn86=udgZ(CkG6DAX=WJKKR*AEV)Aw8N^I4x^{rdCz7n+IC@*ijbh-0h zt3kTD9rl;q%nzw8+qbi)ZGU$;Vj!(ngqelK-OFoxeTG4G$W+%u>Z!gLtCO>{*8Fo* z%aQ7Q+OhJ>-}a0@V_{_tG16LJYA&pMug25W?BZMh?(*&FfocvNN7T${Yx*`+4UV^C%~& z^F4U@a3A+A@!$yKt|B*f)eo+Cpt`H*=yJ`2RYN?Ik;m;gSJ310mdA5re$gz?jr9_n z(EIGKL#(W^RkhYEsORXIn0=L+x%a;srPpO!-md@VJ~=trPr;DeQ8W58ZL#mg<%)JT ze*WOTK0W)H-=8s%KB!g&lu=S0xY?d%9^2i?859vw`^m8W)tP%CmDZ=`#xgrkJFhG# zO>AJ6#s-BIB4UQxvDB`v(VkZhhJOnCf7~RDWf8Rn?bnvz3JT1-`&j zHw<#9SVTql2)~*iZmhg|W1~d(9gH>(9oA#VzQqh_I64Y3OL`s4RBLva$X6MdzmM6i zRN~cW#AhAKc}BltPhEYz{K$#nwc|rmTr`Y~;~!V6&vx><2Y>kRL5az+(`9`%(Ye-t zZDmk&KlSJH=g-GD`_iz=9m_o49^i=m7~Ai`0%1Yo6?4));q>j64)H!HNyX z7UB4@!LQ>)tM>vUv2tzKWFq;^x?JO>FJXSfT}z}R&5ks`Q%j32&A{fI8}GO=Y-dpQ zs(Xrb`d%xqzrX(zPtV@hrUg3RBhRa_*EVar$jit)Gwe8-l2<%X{rah=Co?~PcCqB% zk-8Y!cx&+!^_Go>=wUcM=wuotH z9C&@^UeAQfdaj{^k!q%#WY;;n3F6c~d#xnPY7n zc}J-_T-YHbBVhKTn1MlTr7s-~o5E3iJKoduUaiEFv*1pvh;b9Ua^Wj~vUe9fsNQR2 z`{OUsWJ=LjlHMsRY!!%C(0 z+65&gf7$7BDMq_T(a}fo1Z;8JrkAqu_)O>mcHfa%``DIr<7~Z!FJo$Kzx7B{b||s& zzkK}~+*BPQ8i8+RsD8DwvSPcoIGD0M zEov?K^78Y8&)j367M{5hyo?J?b6m72^<}!8Y0^Q=*OcYY)AlnHoe_S_QVgqlc(q|$ zMpEU*xCrN^viL#`dc7_i|xcoYI86$4! z$6Jp|XH*H-1ED?c9YANnbNpx{eEIYJ7+kk<)_}*h9~5Z#RQu+lNAgJf@#Dv1xmprc zIP1CUSd5PZv8z3(AF|@VTpkj8?LEUSv$X8vg*@TNV%7)YQ?@@z3Ps8<_x^2u?L|@xEB4Znpu9Uyg%M z+cHf})t$TCDCH`*(Xn^6XIsWvOZgn&J|!h3Wr^new|K!SFIWBcclL@>tiDys53u z&dwZVnRk9X&?$MmkNB5j`t0|8-yQ-5zcFe|;27Mzd9#_}fUO-{79ezAj%lDzfsYL{k1zYFF1y^-Pm{Mid#=BiEHZRw7*1ep<9WT?-7q* zR!h1Lu&F+r@p#961^@vzHigixKiwq+{KaFL8~s@VK32JM0A%XrK#kypm6{3)?&LW6 z%Ox&nVTQ9N8pBJK#*dPNsttJfXg{eZamWwn<>mcGF~ncD1Otq{d0S9t{5K;l?X`iO z1M(rfI>nE+aE!<{aRtoVynRo0l!Lke1Ew9bL_hp3;A3pR|Gb4nV%3Bqw&HcgZnxOJ z_S4!wN&%FG>Eo3x_xD2XXQrqR)< zb1dXxOxBtAeH-KZtErU(D?NlLWbU1~9`3(tKO^k<{CBbG6qnTz6~;n0H*!yb zJKDea_i_om3yRUBd3%e+CAhH8PKIjU{uC;jvi^<^ImPy4Y0_Kv2`+ z_A%v>oHnTL#9#9=VP9lL#OPe8S(YE>t*`ps>GBP=WCN#g@soWN@NWKIkinThCF}1vp(bFfZ~IwiIu5c>qd>q z?u8MeHXYVMh95j0Ja}-L&8fP&n(xBZ#)NBIsHjStn}fc8zw&my*^QjC;*`tz^KS8H zKI9b^#_V`NGFvNNwCKDDW#Ghh_e~5QCEcg1MzYL%E5bf-2@8h})xX_d@o}84l(9Pt-hkmPRbFyZPLXVoN z>Lpa2oQ@v4{MC3RcZc!pvdz5U>7d^)1zdJ^Suj2FSnpg8I-oXM70eTJMxXs>g95Q& zD(>mVGP1Hf-VbQ^?D+zvLk1sFxibBQ=JKl=owT2X@Z?&_K8q=HEX~rc{E#)jwzjsi zRF9XJ*J&oL7cXAOhB;0f1>B7&H0=~Is14T~=VoDxzuTM~w#!w9;_*5fV@!Cj`bE|9 z?qJU_e#^%ao^-)Yw4w`*DW>BNJV0qm9=i9>9gqt>=U3pg%;1uo-jvuU_dBL~a>Gl( zXcLJJ(M*2=(Z`rJ&|DT$9PjJ~Fr=TZ-*b{N35eDxw(EI#L2kpuC;+76(o?(S;GXUz z*{0_}MsW>K4QY1o)}UZMZla}TvD4LVdLTeO*P^?4QxHSplPBx@_oe9B9=})QT3mb~ z$obLP3p(AiXSdMq+BIoKOGhB3<==08wNmqQ3JVJ>R}Lm#PulRzxzPn|RKAVi-c(E? zciG#jx?S-A<}DI?w3Z?2ZLMnkk!Y#KTii4yRdw19-R{NfAON^`2InFh}HA1c}9Cuj^@+_ zMfoD*lzanqn?(^?yY==HGIK7TUS4?#J}WF9OIlfGZ@6`S17OLuN%}J0WBB#cB$J?y zuR`9sKYq->$Ab>WBOem{^5vIk=@(vygWtqucX{pOk(;nw6yo<4o_iJlvp0m#*mfd+ zUheQAPEOw-E&KABhmu$@xpaFL@@fD~`F;_XH6gr0D;pF?ro6Qc#4o6j&}%cFZ8fyG zKR2pI+`D>nw&h@=z}$S{dj76kk#QN_{XyEXn4ScPtQB2vZwU+tkf;q8e){A|q*lJY zK9!4x5*Vmq)BEE?L+kU0_#79^&_SMfc^y4U+KJ3FCBly!DSpqe#pvTs+t`ut$iwmS`RyEbjw6w@TPI&|6P z^r`hpUzfg0&O+V`wSaFwv&@;3Ze*5LRwgzm7FQVEx*G1!r-=fNwj8Xn8mimm;^Kng zKBnYJEyW`=*)Ys^;7Y9#0`n^*5W$WZKtYN=Q~Z+YieuRAZN^twbj45NLl~9 zWpQzFJ3W`{hYwuf;){!e5%PSwS9li=uh$2FZ8q1Z3DRqm#t@cU0sT6 zl7AB^8^obKwUSY8DECA2(7^ggn;pSl?gJQCaB;cG{tD z(E&jd<)&F&MN~xk%PYLZ4GsTN`6t8+WA10+F~^E2v-9yavQ*(-z$SX? z+LP>OhdKBZu2^ZCbmTN{-ka|*fB)yZ(?WACx*Q{bB-fO&|9fB@Gfv)fGE{rCyg58uJD7af;#K>=X0@(e^vx}iJzniYU@2p8^<&&HJ0sPo9 zkkteE-{^~rZ%i|&K4IwqJ)GcKYQuR)zd{==^=FaQaLz6a%;pPsoRVIfT3=H#-~ui= zdGh-EtXoVm&$3*Sc^mj#ZD^d&*OcE^G+V%Fd^Fp?U~yo7y#>f>iXoSW zKTQzp(WCUtK8?wmua7Io{=pYzS52frHy{vEOz_QApkj#q-MhUw&faa|3gpm~2@|l^ z$WUXav!5TYMsKeamIA^B&yTOnzcKnlim4x7$cfp`=U6Co2YsXQ>np#$o|tktAY{u0 zZP`jKh5s%AReSr{jYogHeh!JBK+pyTO8NHIfRk48CHwbU3WOaHbq)m?-2z$P*7h72 zW8zCnvfK`zY6E6AHjmKI0~}g;Pf}7it%n=lpx>wn`@wrUI%rE3EUNDx5pfxB0%y(Z zapc>}sm1HPwGnde+S+^}x!KZ;;o5Y>y4gV0KF}v=EOld|O5t$rfZ4fo&MW6&^Mnf8 z_~7AQxOg#TMDV!m!v zv&_C*c`e2&w*A993s(^BMgPUmf5tLPyfE;_?{(1ETZdU$OJ6Zu#`D#dX4m zViTGOetctCZ~w2h;S#cPN%%~3>;uB~FZ1$*4p4dIdZOI=Kd7>A+_-V)?%fYC$#Xp) z27%G%2RCbUXX{{geNcJz0H``AEPx^p61m232-Clfu>e!_6rZ<43k!QC0o+l!lE^6%@h* z#yNbzhOHGNclpU!;^NolG7D49dnN0ad=3guL02_vyO*gsc|gjSQ6FW2URjrE+F5a8 z_|#C58#yta0LfuC4vqKVRy6kFw*6#ybW69NF=@Y)W*~0|MbZuu(3Wl6n7O(AfR(iy z`SH=EP!)?&(I>M%;c4|ey-HlL0dOY?Vs9Xj@^(&6PUq>@ogbW6?Xi=+RtaSi8pqFk zhqLoAfI-coVXWQ#l^1MSA4>)o=`;3y?KeMWwbWaiAWZhS@70P_OEYL0yD#ZQPgc}s zT38J}rdsGM942VP3eg#;+pJc2o{O+YGwzKj)xi78o0>XFpl1;H(>CK8TeoeqgTi9l z?Y{TV{5<6$D0b+X01{ioU}tjX{n>!#+THWjvnrJT#kIuiK+8nUf!hM9FnNA0rWRc( z0`P&zNKH~yRNT%a5?WLw#wz!UR0J3WU7`zDO(@{72kUcfOko28By8+jrT$fx62gQ# z)c^X7mN2=X0@N{QQ2Krmd4Q@C5ebLrO0$1I1V)!yIJd#vx)g41ZgRn=-GQml+QeZm zo#-{*i*fx1CUUDNWaD#LoiL7HZxDn%l%oZ!i8U>kppp5 zwWb>f3s|4vGivCvDO^5?R=%;zPm1xgL7LyISC@>8P5>96i{DE7xiDGAWY}3CjK;?T zNgIl79hUL_SgVAL%vP-U!t!DoEOL>BE^?wTT#}V##_hDf$llH<)H1W^shMR4T1<&g z`k$%?SQjXV}#G*YZ8Diljq4<)%)zlD{Q}55)5&gK9ZpiE;F2*VXCSn5w zpVr?>!u)&-Kp^>KGd1;KudnC;5PiY$JoSzp`rxo%%F62V9c)ODt(C^Pd&_)p!*U>$ zYSP`GAKigSfH*Ef4yETY*p5xWYb1x=K=gfK;e*Gvn!lCwzBScXPC#Hti)MY_cJ;1Y z7M|Thqy-*Q>^O4f4AHdzc!;i$xi&Ohg{50wQ*$P8TMg}>4x3K0@9IfX3FcX>3-)5H%q35CN=* z4!NS>xZ#Fs*>>AunOviGa+!6B5#Lu)vEe3=h8F|hGnB~&39{eV`-Q`+y0>n{K{bXL zFf;m-#+AusCAD2Q>g`)H!qW$Qrsx9QC4>VAco;;4MNcne`@!4`jTKczf-wD~z{#Ot zp=TRpEjcSI-otMWLun=Z{_ZjpuCNT-^7qd)wsfP$C=eggQC3!XZz7~#^|8*(2ne)f z-(%(XGmiqGy>+a9eU=Rl{xJr{WL2#8Z&EFWu=#?Aw@d^dnNVe=M8TuD7cnhkZkSj6k&csDgWINPXn~lgPzu3;L%}18Ht~U zF+6r2t>wi)6b(P5N3Rv}CV zo-(QncQKV&xay4_veQM>WuP{q7HISiI1W%l)$6mqB2G(Y$a}z+rP?z~BXj8zsS7ND zl543CYxCoS&PB8@@7jU>e*L^cfEN<*{n;jW50CvRo+ z6BG5G#xr(!04Z9+k#T_|kSRzg;EK4P*)Z(9Pir!&j%W2!k=9lxOuY`-#|Q*xEqbx}Yjjco;-B0@Mun)P8Q% zu;D!zB6B|>x>%WK0~`9{K$PGj_0tS99L(X#S|^G zdy15m@DRx0q*uekxznD-O~CzmbxdsA4UONQT#6xB0e6myg~e&(ruTKikdKZR@Vc#bD91lb1w29&>D&r>!`zfDBA=u2rS z10Q1$9ttz!GiQpcP~b!8>e>1}PoH+bxGbVGSQGZh-F*^mv}bIr8r6sA{9Y?RWUsd4 zkA~2(g~?todhQ3CMQ#jn^&|G0mH#z>aO!a`1)&L8DzHcBZ`78bKE*^ z0K4^8W*brmUn?uOd6b-2P@uvfE*0Yb3g1zg_=m8GpC7*X;pbf#2_+4p0~UC`{ivvo zH{mYYIyfj_xgrLAMYF=J=gU*2&gm)3{{DV*Ag^8Y^uMR}T@Dv|S~3)QKdJR9cx{#O zeLm2UZ-nlM<`^82bo5>QQ!o`St`7|ppARCsBYpMi9y(8FU7B5!N2xp>Vj9%@T8u{$ z<7|ikQw#wg@vSs}tqAae5MtaPK6sfhl)DBULkUP^INxU=>{kS!8?%KF;1Y=Z?u4fK1`xDa3hnA z{6{JV`mF@Q#yK86dD7mB+{ronnPX@xM$W89EMBDjThj3MU$TYavhp>5ulvjYk=)>a znq+)`Vw?ksj7#UwlL4BuaB@;Z@+R)?5a&UJonWjvi zKYvC8?8P1%Kk^jsK%NVHsjsgOw5)sX%HNwb3GnlCi-=%?ZVB8Xg(zho>!6hY1k1jL zcx8gK0^MZ>N)hYuC24AEYV(#IpPQTadP-;tN{9=&Vczf=H63DOE9;Q>5eewkqebOG zuFd4W4^8+MnC0wb{_!Q@VHfIMyUYdoc(7H4&Q=z7{Byy~X|SU9Ltkm0FD@)x!7x8L z9uXF{L(I&Ki`c6xgzM7>x3nQybHBEBr?H3@E|wZze|&y9`jY0LSy^Cqo)gNU*0Os}(qYUzR5d zYk|?^y&3qBl_)7I^FZ|LG3t&RF|N6Z&RSFF>HUz7FXG0KEzn0m3v*J*EZJ2>%h{bU znt_9$_nb#25q(5=v?Ucx?bmmrK9v-S%RccFimED*_?3q3?;$}VOlCgX!i}Cv`Ii|% zxpj^D&I9AIo*%p9lC<<;7M4w<#6}rsXOZ=Z^;OaODX=Gypg|(x0~+!2dW^wI9vehCzC8HJB^CkunYbTcjMr8ct0F`@TLS+PnFOoa z&;^f?CnJDQZn}S2m0hAx`dX5D<0nU!bmL}voan-*^o!%9js`FD4wCvImFv4H9 zy*rS=EC2TGCJcG(o?GeamBNKVLCx2KVm=MrX|~A2HCI$nA^tAF&8 zagK@|X_kWuxP{~#>gOoA0|%%m5z{F>#PcuP-4Bd2D|a*YKcj@G$A3{4`cE6#zl~(~ zT&MHgM0B#ht=!_=fwNx^+#2U}!&laA*s$SSb+xq(H@FBx|G>bnJv8V4svFdBL8zqz|) z+#NgwDYOb;OAwUo+)Kne-qlNESfKDw16jfie{b@JzMfv!;Gh%$8*+INfp%q=W1T=7 z_^pTc0HHAp3AHEnD-!Eqo(M7R!i9@}0Ca9CHY=cwca4n5dWY~q5HPn<x6iZSXAPt7eF}H8uBR{ z=DR#g4mWX~z+oaHA{a?!9bfUNvN;I53c>PoHkzf5r>6lF&+R_Fl&8WZq!-PZf^C zy@Hy_ubYiF3UBp~=CBQ%TGvO9HqvouTrx0VB_RQl_osLpuVLLIl@L zAruBf_*qC(XMa{v6&H{0A&xz~?7_+s2#ExmN$6}a&Pj-gP@+}c?Z^p0zBoo-EumCmaG$dr*zU4W!n6RrTv}efAJPu1px}N& zY5{ooHxkREU_xR6nf-%kHKC0VDoccjlU&3QgtvYor;Ue>OMpd5%w)i|zj-XJysWyE zL|{1mx)0Syj;x;q5yQ43STUwB*bZ!yE14#mIW`kD$e`mc^QLPA2_frT&5#uXIpzPL zP7)b6u<7P{!Rp=CPg`8^ZS*>2$m=4vNP@JWfI}!G(e;%y#bja?k%=P~1u;3&@1~^J z-1couYkxeR6+S`hKl{oEP-9Jn(0%&@M9FvV+*x$crrj+w^DGJF);HU%O&N)7;}--= zBqbdXqmENaVI*SNEg$u_Vb>gmZsRa-g8f>uvN){?D2h-vUXhl|W10K)bA&#$o0lCVtt@wT-pp(xBjik%Sw46N=4V%h*p67x;)W>1 z{=HDp0`iF=ehBIu6vMi-+n3*V%0Y_;yV6G_OiXdmQB+j4w?%LwkLH*WBkW)S5}>FD zo&k{>@Rm1E`-EBj2cd?Kh-*EjW>S!o+pg`h%10vpzUz3rZkZ1$`rY0}dOnl(SAbX7 zs))vF&P-SxiCk8{uMo*I07v5S0A2899E5qci&@ePbQr4tH)tkqQCvJrF+Uo%C6~c9 z{R|Pbl87E0m`Ch=zmq;kL|z&qAYzIU!98Ni?d&^lf)^8nbno6Wz#_LOzh-0*cHA_2 zcAXvmJRC4&zHOmO6$642dL6{xq~{|rb$U3o6yU^-U%)ecfL=@RbTrY)`FT$3h_u_a z{y6plD_rvC%}B%7F#m8I<6J0}QFDSkggF;$JB4r|X%JVKA=wGKph0L>kmr?M7;IXz zE!iL+tFjwyI(4K+`X6{FmZ`t}JRj^Ym3V+j0E?HoM7$J?FRrW4U{xK3pk zsfDAv{UyY|yd84k-nDp5NlEF6w>RJF;_8IUWne($^GgV)^hrQ5hD^l#m!~u_<7qY% zT7)Qv)?#|;jxChNr{3QE@YwQu3P23J4hjZhxXW+`5z`EG&2K9YG(?IW4C20w!ryRS z2BZ%>^jF7Mi`QVldt8zG`t^JsPSC%yX_fX&P+bya_w^!^OqKgT0KraphlD=8F;3^r2>{UO1a8AKOC9Q-BP%@lHi#PKiq#t6sKkm%2v9Dq7R z7VlOD$6XlG#ruD2eu znJ`!phQJWsj{|r}wWT87g0M7fEUWSMV2E40>FK}W=+I9LCLq$%!8^#6U_!BL7lZ;C z5w;0L$vfX8$?&&0s51$$g1~y^v;2KnYLlIWDPRWm5bH)tP)VslhH|L0P?Q7_8`t^~ z--dHWl^9Rw?52+XH7zl_Zo}aN3L$)OEr&5a;wULbkPQ4YVts(ZZ$W+~JTF-BfG`vU znkLo=0}jGDDQ~7u7D={1pdJzf?;SDVGnb|M2-4@GK4$_wb|I7MPk z<%+gHg`Eybn*lP@5wEGhepu5apzn<^V1YX!ZXX~C+s_<=KM1qwBTfin4avZ-;mLx~wp7+spB#wwAgmE_evf7$y)Gj(GLKi0wgmz8j~s*f=Mld`Wda@W^AUz%uW*Rx9JCFYYY$hH$i6|swx;XZ3<>cz}CHETHOjsMx z;B4V)88#-+o>KpG6Tw6<7!^y(zGGvw8s~S8c z#ZSmVAliS{gqN{c+qQetc;UKp$eDW;aCfqCW`VF-FN+G3URN6&Xr2j=CBb#^g|?=J z5V}!way5#JN(}xW35jRzA!ORnj6UHg2%b_qV76iLapC;xqsS8L;559<);uSn2 z$#YBSchq8#;D}S4u8N6Q?_#U+-fek~fXxQPnQNfX?I=RGygHta4o3M*QtV-r$VnJL zC5TEQ>&}G^r`y@HQ&oclCpT7BSG+A~_k&o#kz|4AjL-#fbj_lYbTeI@$an#vwnL_h z{n!|GcsD=Q2_yLPUR%$R&M$ucoY?;nlNX{(6@Y zUQRR%A||l9G>ankLm(NR8R5C7s1#e~PSe$Av2Xw6cCPwBe49eqkh|guqYV-r*UOCzr^SeLfNT8RCO~FJS9J8<2M@}l z-2m!Akwoe$Rh2!qb^o#9i5H=HJBoM(TKe5^Y;Gf=&FR*Jf%^tIoFa_G$hi1@Maa^U zY=PW~bb`~;4EI=PoFX#`pDGD)rOd)76|14^fN1&;kK0I(=D~?99W2m-6h-;Wh&Z?| z6abDCT}Rt|9fk3lIO^_*vpSMvf0GrMivZVzZ|8M@-yis%p$t?$g0pbN9~~Q#7Od?4 zs^EGo!iV+FU-=YL*9Pnktj`Wvu^k<1Z+-sgDE$QwMYlT-4?mz+6Qieme@>8YB&lWh zM*RX_9bSwrC7;LpzxR=LsQcreYJ{j-?F;e_iEXmPfthQ=azdyLc$(zNo!;d^bHKc zX~Tzyhi5Q)6SJ~ZLCLP+u8@S8#j*KeASN%-ly_-q$~cmy$VKm!;;8uym}ms9=T#Gv zWT2Opku=7;L=>dB+w6idiKHP^X5R4q`_6Up8&TgaC~jU+4WuoUH`9h@)tjV#d&*X* zqNZk?XS=41Fx!OKeQpke!gBmRgsV4hBw}{s(qu#;QfenS_iT-S^X9y@wRLNrT^iMa zC+P{^j82{q{F4{*8X6j=laJ0eLmTImR{wC5?ED7OP2LSVNE(OVT)9*$GXGw{$L5=L zhizhWHUvO9)3wUi_7mEj^?;|m@L~c20t|65F(`d^eGtwIoYKs>it6ojjo43e{VZO& zk96qG9e#2WkLIaUw^!!yn^H(O+41T4(cN{2_=Db4j2wRyscvK-iCs_&WGOS>tw}-Z zI>PT`d9D3B%Oov{lx)0j-#(*z_vEeikz73+T3cIFDCM;c|Gon!G~(jprI8VMd9Up$ z2PMgj4AC{{WZ196({4W=J{|l{BJEDb!sF}=ER17gw@GFJY3#E2OvD_o;B`@zhw&N` ziEHnv+r*z<5|L#1gV8Bm1|Lo?kh6miJ4s7iTb+WsIHB)RKSyf>OH0 z#fwpiWUgfAac@Vjt|kYzRBWg4K3kr$qQYH&!iTV=UI7uoQB0!ziYY=`@u?EQdqda994^?;PF9GNm6W7? z8cyBXp++Y(VW;J|a6QTX{RL6m(K+YF#Z{>idpoW5f$*VR>OkY!m1nX7bfjcTY!cVh z@SJyY$tSauKiQVXozIRHEmvCf{`v8q6!T+>J#rJBC#qxYdrO?`^Gzmb^C?KLMpul7 zQGQ=zy~>+^1?mouo9|)tW3HU~X5PNAAiDZBDS<)ws&k4;S#DJ8`nB6By-eZfG%o+* zk-4}cJ#2oUaYDfHvvE!0iGcpe--08VLrhFtN8%kWEO}_3DJ>&EE|NdDu+f`7gthXc zRb-O#apx3`v)7w*BxtOo+OA6`T#m6DvN)hJk}-NsAw;{AUM2cyrP2*4aZ8nT1#QNm zIyDpdgZ9S7&Dr=;YPBrg@!4Fg_r5F zlV|283cve^W*AS&U*xpyFjY9FWGp3KxE4WoP=MjbrzxHMQkM+ds0*9OoTltvJI_u! zZz3lAw2Qm~+g;}SqIkk}quQ%QHkIpF!OMVb~c<}va zbIp$R+8b8yPbQ3h>R6iXlxxiLKaiBt>2jQjnMCi48SHAl;kbx*6?I%$pjNQT8_O9%m{C~Fp!lj(mH)@WhAd^&q1M9T52ButGTnD(^@u@Ri~xv zTDsNj^|d5~R;nTx{Ev2Mg{;1t4&A!9S}Lc(J}fJ@Fw`0hf*-bPzWT}x$*I{%o1Y<{VJDZ$w-65>?t}%BiVP1>&rXp z3>Ukm7D{jJiox`mq-RH*KF*)qQFvIsl8HVMEk=E%4^DQDIyuiV6}4Q$S~XqK_B@qF+LGBn_*l(V?WM_LnU4J&4f)*{ zvQ6$@V--AgzwE>8>@r`*Ia%$(q$|dIzc6Mj>Mw8UzrDlHQc^|5q$s8MW#R<~jy<^Cy~)42IV}GyLOO<9217jc;^21gzdK7t@fD zg4~7wiCIXD(cLG?jirTl-!scL8MUNzH71Ex<9DiEQwwCv^%zXw&YJt~Mu5KEe=w!^ z8g{TVwwn^Ocx582ohqhX()u f1ZMb;-nzzA{He5iu1->pxB+Pi1@YtyHy`{vIB_oo literal 0 HcmV?d00001 diff --git a/docs/guides/email/postfix/how-to-setup-an-email-server/index.md b/docs/guides/email/postfix/how-to-setup-an-email-server/index.md new file mode 100644 index 00000000000..f4566621d29 --- /dev/null +++ b/docs/guides/email/postfix/how-to-setup-an-email-server/index.md @@ -0,0 +1,1603 @@ +--- +slug: how-to-setup-an-email-server +title: "How to Set up an Email Server using Postfix and Dovecot" +description: "How to set up a mail server using Dovecot and Postfix. Understand what it takes, the benefits and challenges, of running an email server." +authors: ["David Robert Newman"] +contributors: ["David Robert Newman"] +published: 2023-06-12 +keywords: ['Set up an email server', 'Dovecot and Postfix', 'MTA mail transfer agent', 'MDA Mail delivery Agent', 'IMAP/POP3 server'] +license: '[CC BY-ND 4.0](https://creativecommons.org/licenses/by-nd/4.0)' +tags: ['mariadb', 'email', 'postfix'] +external_resources: +- '[Dovecot](https://dovecot.org/)' +- '[PostfixAdmin](https://postfixadmin.github.io/postfixadmin/)' +- '[GitHub page for PostfixAdmin](https://github.com/postfixadmin/postfixadmin/releases)' +- '[Simple Mail Transfer Protocol (SMTP)](https://www.rfc-editor.org/rfc/rfc5321)' +- '[Post Office Protocol (POP)](https://www.rfc-editor.org/rfc/rfc1939)' +--- + +Email may be the one true universal app, but no provider’s offering is really "free". Large-scale service providers mine user data for sale to advertisers. Others charge usage fees by the message, user, domain, and/or megabyte. To truly get control over your messaging, the best bet is to run your own email server. + +While email server configuration is not trivial, it provides you with much greater privacy and flexibility. You have complete control over which domains and users you host, and how much storage you allot to each. You also gain a deeper knowledge of the key email protocols and how they work together. + +This guide walks through how to build an email server at Akamai using [Postfix](https://www.postfix.org/) and [Dovecot](https://dovecot.org/), two popular open source email server packages. You also learn how to set up virtual domains, users, and aliases using [PostfixAdmin](https://postfixadmin.github.io/postfixadmin/), a web-based front end for managing Postfix and Dovecot. + +Before delving into the details, first, consider why you wouldn’t want to run your own email server. Setup isn’t difficult, but it is time-consuming. You need to set aside a significant chunk of time (several hours, at minimum) to ensure your server functions properly. You also need to commit to ongoing maintenance of your server, both to keep it regularly patched and to troubleshoot any delivery issues. If you don’t have time for system administration tasks or don’t mind the privacy tradeoffs, consider using a commercial email service instead. + +## A Quick Introduction to Email Systems + +The email server built in this guide uses just four main protocols: + +- [Simple Mail Transfer Protocol (SMTP)](https://www.rfc-editor.org/rfc/rfc5321) +- [message submission](https://www.rfc-editor.org/rfc/rfc6409) +- [Internet Message Access Protocol (IMAP)](https://www.rfc-editor.org/rfc/rfc9051) +- [Post Office Protocol (POP)](https://www.rfc-editor.org/rfc/rfc1939). + +SMTP works for message delivery, optionally from client to server, and always between servers. Clients often use a separate protocol called submission to move messages from mail clients, called *mail user agents* (MUAs), to mail servers, called *mail transfer agents* (MTAs). MTAs always communicate over **SMTP**. + +IMAP and POP are *message retrieval* protocols. They operate exclusively between a local mail server and an MUA. + +None of the mail protocols encrypt data in transit by themselves. In this guide, learn how to use Transport Layer Security (TLS) mechanisms to build encrypted tunnels between MUAs and your mail server. While your server is capable of TLS-encrypting traffic with other servers, that's only if the remote servers also support TLS. The free [Let's Encrypt](https://letsencrypt.org/) service provides certificates and private keys on which TLS relies. + +Postfix is a widely used open source SMTP server, and it’s included in most Linux distributions, including Ubuntu. Similarly, Dovecot is a common IMAP and POP server, and it too is available as an Ubuntu package. + +## Before You Begin + +Before you begin, it’s important to understand five key assumptions this guide makes: + +1. If you do not already have a virtual machine to use, create a Compute Instance. See our [Getting Started with Linode](/docs/products/platform/get-started/) and [Creating a Compute Instance](/docs/products/compute/compute-instances/guides/create/) guides. + + Use **Ubuntu 24.04 LTS** to create the Linode instance. Ubuntu LTS distributions are a good choice for servers because [they are fully supported with security patches for five years following the release date](https://ubuntu.com/about/release-cycle). + + Select the **Dedicated 8 GB** plan with 4 CPUs, 160 GB storage, and a 5 TB transfer. This is a sane starting point for an email server for a small to medium enterprise. + +1. Follow our [Setting Up and Securing a Compute Instance](/docs/products/compute/compute-instances/guides/set-up-and-secure/) guide to update your system. Also set the timezone, configure your hostname, create a limited user account, and harden SSH access. + + This guide sets up a mail server called `mail.{{< placeholder "example.tld" >}}`, but you should substitute your own domain name and configure the `/etc/hosts` file as shown: + + ```file {title="/etc/hosts"} + 127.0.0.1 localhost + {{< placeholder "IPv4_ADDRESS" >}} mail.{{< placeholder "example.tld" >}} + {{< placeholder "IPv6_ADDRESS" >}} mail.{{< placeholder "example.tld" >}} + ``` + +1. The commands, file contents, and other instructions provided throughout this guide may include example values. These are typically domain names, IP addresses, usernames, passwords, and other values that are unique to you. The table below identifies these example values and explains what to replace them with: + + | Example Values: | Replace With: | + | -- | -- | + | `{{< placeholder "example.tld" >}}`| Your custom domain name. | + | `{{< placeholder "IPv4_ADDRESS" >}}` | Your system's public IPv4 address. | + | `{{< placeholder "IPv4_ADDRESS" >}}` | Your system's public IPv6 address. | + | `{{< placeholder "EXAMPLE_USER" >}}` | The username of the limited sudo user. | + | `{{< placeholder "external@email.tld" >}}` | A working external email address. | + | `{{< placeholder "POSTFIXADMIN_PASSWORD" >}}` | Your PostfixAdmin database user password. | + +1. As a developer, you should already be familiar with the Linux command line, the nano text editor (or any other editor capable of editing plain text files), and basic networking concepts. Akamai has quick guides on [SMTP](/docs/guides/what-is-smtp/) and [IMAP/POP](/docs/guides/what-are-pop-and-imap/) to bring you up to speed on the way these protocols work. + +1. Although Postfix and Dovecot servers can operate in the *system* or *virtual* mode, only virtual mode is used here. In system mode, only users with local logins can send and receive emails. They do so with lookups against the operating system’s `/etc/passwd` file, and all system mode users reside in a single domain. In contrast, virtual mode allows an unlimited number of domains, users, and aliases, all unrelated to the underlying operating system. + +With those caveats in mind, you can move on to building your email server. + +{{< note >}} +This guide is written for a non-root user. Commands that require elevated privileges are prefixed with `sudo`. If you’re not familiar with the `sudo` command, see the [Users and Groups](/docs/guides/linux-users-and-groups/) guide. +{{< /note >}} + +## Step 1: Configure DNS + +1. Configure the Domain Name System (DNS). Although this may seem unrelated to email, working DNS is the *single most important requirement in this guide*. DNS misconfiguration is a very common source of delivery problems. + +1. Email servers require at least two DNS records: + + - An **A** record to bind a hostname like `mail.{{< placeholder "example.tld" >}}` to an IPv4 address. + - An **MX** (Mail eXchanger) record indicates this server handles email for this domain. + - **Optional**: An **AAAA** record to bind `mail.{{< placeholder "example.tld" >}}` to an IPv6 address. + +1. Follow these steps to use Akamai's free DNS service: + + - Click the **Domains** menu at the left of the main dashboard. + - Create a domain with your domain name (e.g., {{< placeholder "example.tld" >}}). + - Add **A**, **MX**, and any other records as needed. + - Update your domain at your registrar to point to the **NS** records that Akamai provides. + + {{< note >}} + Linode does not actually block SMTP ports in the us-west data center, so it’s safe to ignore this warning. If your data center does block inbound traffic on TCP ports `25`, `465`, or `587`, go ahead and open a support ticket asking that inbound and outbound access to these ports be opened for your server. + {{< /note >}} + +1. **Optional**: Update the reverse DNS (RDNS) information so that at least one of your server’s IP addresses points back to the hostname `mail.{{< placeholder "example.tld" >}}`. + +1. Follow these steps to edit RDNS: + + - Click on the **Linodes** tab of the main dashboard. + - Select the **Network** tab. + - In the **IP addresses** section, you can set RDNS for each IP address. Each RDNS setting creates a pointer (PTR) record that associates an IP address with a hostname. + +1. Before proceeding further, it's crucial to verify that the DNS records for your server are working correctly. You can use the `dig` tool to validate each record. Here are example commands to verify that the **A**, **AAAA**, **MX**, and **PTR** records exist for the server: + + - Validate the **A** record for `mail.{{< placeholder "example.tld" >}}`: + + ```command + dig +short -t a mail.{{< placeholder "example.tld" >}} + ``` + + ```output + {{< placeholder "IPv4_ADDRESS" >}} + ``` + + - Validate the **AAAA** record for `mail.{{< placeholder "example.tld" >}}`: + + ```command + dig +short -t aaaa mail.{{< placeholder "example.tld" >}} + ``` + + ```output + {{< placeholder "IPv6_ADDRESS" >}} + ``` + + - Validate the **MX** record for {{< placeholder "example.tld" >}}: + + ```command + dig +short -t mx {{< placeholder "example.tld" >}} + ``` + + ```output + 10 mail.{{< placeholder "example.tld" >}}. + ``` + + - Validate the **PTR** record for you compute instance's IPv4 address: + + ```command + dig +short -x {{< placeholder "IPv4_ADDRESS" >}} + ``` + + ```output + mail.{{< placeholder "example.tld" >}}. + ``` + + - Validate the PTR record for your compute instance's IPv6 address: + + ```command + dig +short -x {{< placeholder "IPv6_ADDRESS" >}} + ``` + + ```output + mail.{{< placeholder "example.tld" >}}. + ``` + +## Step 2: Install Postfix + +1. Install the Postfix SMTP server package using the command below: + + ```command + sudo apt install postfix + ``` + + The installer prompts you to pick a server type, the default option is **Internet Site**. Enter a hostname, such as `mail.{{< placeholder "example.tld" >}}` and optionally choose whether to restart services. + + {{< note >}} + You may encounter the same setup screen again when upgrading Postfix in the future. If so, choose **No configuration** to retain your current settings. + {{< /note >}} + +1. After the installation completes, verify that you have the correct version of Postfix: + + ```command + sudo postconf mail_version + ``` + + The version displayed (`3.8.6`) is standard on Ubuntu 24.04 LTS: + + ```output + mail_version = 3.8.6 + ``` + +1. Verify that Postfix is listening for incoming connection attempts: + + ```command + sudo ss -lnpt | grep master + ``` + + The following output is displayed: + + ```output + LISTEN 0 100 0.0.0.0:25 0.0.0.0:* users:(("master",pid=2157,fd=13)) + LISTEN 0 100 [::]:25 [::]:* users:(("master",pid=2157,fd=14)) + ``` + + The output above indicates that the Postfix server is listening for incoming connections on TCP port `25` for both IPv4 and IPv6 on any IP address. + +1. Verify that your server can make outbound SMTP connections: + + ```command + sudo nc gmail-smtp-in.l.google.com 25 + ``` + + You should see the following output: + + ```output + 220 mx.google.com ESMTP 00721157ae682-62ccae740b7si23680997b3.287 - gsmtp + ``` + + If not, check internal and/or firewall rules to ensure outbound TCP port `25` is allowed. You can exit this session and return to the terminal prompt by pressing CTRL+C. + +1. To set the hostname in Postfix, open the main Postfix configuration file: + + ```command + sudo nano /etc/postfix/main.cf + ``` + + Find the `myhostname` parameter and set it to the desired hostname. + + ```file {title="/etc/postfix/main.cf" linenostart="37"} + myhostname = {{< placeholder "mail.example.tld" >}} + ``` + + When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. + +1. Reload Postfix: + + ```command + sudo systemctl reload postfix + ``` + +1. Update the `/etc/aliases` file to receive messages from the system itself. + + ```command + sudo nano /etc/aliases + ``` + + Edit the file to set `root` to a real email address where you can reliably receive mail. + + ```file {title="/etc/aliases" hl_lines="3"} + # See man 5 aliases for format + postmaster: root + root: {{< placeholder "external@email.tld" >}} + ``` + + When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. + +1. Rebuild the alias database: + + ```command + sudo newaliases + ``` + +1. Verify that the system can send an outgoing message to the external address where you can receive email: + + ```command + echo "test email" | sudo sendmail {{< placeholder "external@email.tld" >}} + ``` + + Verify that you received the message on the remote end. You should receive an email from `root` with no subject and `test email` as the body content. If not, you may need to check `/var/log/mail.log` for troubleshooting. + +## Step 3: Let's Encrypt and Nginx + +As configured so far, Postfix does not encrypt traffic in transit. To avoid having traffic intercepted, enable Transport Layer Security (TLS) to set up encrypted tunnels between mail clients and your server. TLS relies on certificates, which in turn require a working Web server and access to the free [Let's Encrypt](https://letsencrypt.org/) service. + +1. Install `certbot`, a tool that automates Let's Encrypt certificate creation and maintenance. + + ```command + sudo apt install certbot + ``` + +1. Install the [Nginx](https://nginx.org/) web server, which is required for Let's Encrypt setup and later for PostfixAdmin: + + + ```command + sudo apt install nginx + ``` + +1. Install the Python3 Nginx `certbot` plugin: + + ```command + sudo apt install python3-certbot-nginx + ``` + +1. Define a virtual host for Nginx by creating a file `/etc/nginx/conf.d/mail.{{< placeholder "example.tld" >}}`: + + ```command + sudo nano /etc/nginx/conf.d/mail.{{< placeholder "example.tld" >}}.conf + ``` + + Add the following contents to the file, replacing {{< placeholder "example.tld" >}} with your domain name: + + ```file {title="/etc/nginx/conf.d/mail.{{< placeholder "example.tld" >}}.conf" lang="conf"} + server { + listen 80; + listen [::]:80; + server_name mail.{{< placeholder "example.tld" >}}; + + root /usr/share/nginx/html/; + + location ~ /.well-known/acme-challenge { + allow all; + } + } + ``` + + When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. + +1. Ensure that the `/usr/share/nginx/html` directory exists by creating it: + + ```command + sudo mkdir -p /usr/share/nginx/html + ``` + +1. Restart Nginx to load the new virtual host configuration: + + ```command + sudo systemctl restart nginx + ``` + +1. Verify that Nginx is running: + + ```command + sudo systemctl status nginx + ``` + + ```output + ● nginx.service - A high performance web server and a reverse proxy server + Loaded: loaded (/usr/lib/systemd/system/nginx.service; enabled; preset: enabled) + Active: active (running) since Mon 2024-06-10 11:12:29 EDT; 4s ago + ``` + + You can exit this session and return to the terminal prompt by pressing CTRL+C. + +1. Before generating a Let's Encrypt certificate, test your setup by including the `--dry-run` parameter in the certificate request. Replace {{< placeholder "external@email.tld" >}} with a real email address where you can reliably receive mail and {{< placeholder "example.tld" >}} with your actual domain name: + + ```command + sudo certbot certonly --dry-run -a nginx --agree-tos --no-eff-email --staple-ocsp --email {{< placeholder "external@email.tld" >}} -d mail.{{< placeholder "example.tld" >}} + ``` + + ```output + Saving debug log to /var/log/letsencrypt/letsencrypt.log + Account registered. + Simulating a certificate request for mail.{{< placeholder "example.tld" >}} + The dry run was successful. + ``` + +1. If the response indicates that the dry run was successful, proceed to obtain the certificate for real by running the same command without the `--dry-run` switch: + + ```command + sudo certbot certonly -a nginx --agree-tos --no-eff-email --staple-ocsp --email {{< placeholder "external@email.tld" >}} -d mail.{{< placeholder "example.tld" >}} + ``` + + You should get a response indicating success: + + ```output + Saving debug log to /var/log/letsencrypt/letsencrypt.log + Account registered. + Requesting a certificate for mail.{{< placeholder "example.tld" >}} + + Successfully received certificate. + Certificate is saved at: /etc/letsencrypt/live/mail.{{< placeholder "example.tld" >}}/fullchain.pem + Key is saved at: /etc/letsencrypt/live/mail.{{< placeholder "example.tld" >}}/privkey.pem + This certificate expires on 2024-09-08. + These files will be updated when the certificate renews. + Certbot has set up a scheduled task to automatically renew this certificate in the background. + ``` + + Note the locations of the certificate and key files indicated in the success response. + +1. Open the Postfix configuration file to configure Postfix to use the newly created certificate and key: + + ```command + sudo nano /etc/postfix/main.cf + ``` + + Scroll down to the `# TLS parameters` section. First, locate the `smtpd_tls_cert_file` and `smtpd_tls_key_file` parameters, and replace their values with the file locations from `certbot`. If not present, add the remaining highlighted lines to enable TLS transport and enforce TLSv1.2 or TLSv1.3: + + ```file {title="/etc/postfix/main.cf" linenostart="26" hl_lines="2-3,5-6,10-15"} + # TLS parameters + smtpd_tls_cert_file=/etc/letsencrypt/live/mail.{{< placeholder "example.tld" >}}/fullchain.pem + smtpd_tls_key_file=/etc/letsencrypt/live/mail.{{< placeholder "example.tld" >}}/privkey.pem + smtpd_tls_security_level=may + smtpd_tls_loglevel = 1 + smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache + smtp_tls_CApath=/etc/ssl/certs + smtp_tls_security_level=may + smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache + smtp_tls_loglevel = 1 + # Enforce TLSv1.2 or TLSv1.3 + smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 + smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 + smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 + smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 + ``` + + {{< note >}} + TLS prior to version 1.2 and all versions of Secure Sockets Layer (SSL) are insecure, and you should disallow them. + {{< /note >}} + + When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. + +1. Restart Postfix to apply the changes: + + ```command + sudo systemctl restart postfix + ``` + +## Step 4: Submission + +The steps below enable mail clients to submit outgoing mail to your server using the submission protocol instead of SMTP. This is necessary because many ISPs block SMTP (TCP port `25`) but allow outgoing submission connections (TCP ports `465` and/or `587`). Separating SMTP and submission functions can also help with troubleshooting. + +1. Open the `/etc/postfix/master.cf` file for editing. + + ```command + sudo nano /etc/postfix/master.cf + ``` + + Add the following lines to the end of the file to enable the submission protocol: + + ```file {title="/etc/postfix/master.cf" linenostart="141"} + submission inet n - y - - smtpd + -o syslog_name=postfix/submission + -o smtpd_tls_security_level=encrypt + -o smtpd_tls_wrappermode=no + -o smtpd_sasl_auth_enable=yes + -o smtpd_relay_restrictions=permit_sasl_authenticated,reject + -o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject + -o smtpd_sasl_type=dovecot + -o smtpd_sasl_path=private/auth + ``` + + If you or your users run Outlook and need to use the Secure SMTP (SMTPS) protocol on TCP port `465`, add the following lines as well: + + ```file {title="/etc/postfix/master.cf" linenostart="150"} + smtps inet n - y - - smtpd + -o syslog_name=postfix/smtps + -o smtpd_tls_wrappermode=yes + -o smtpd_sasl_auth_enable=yes + -o smtpd_relay_restrictions=permit_sasl_authenticated,reject + -o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject + -o smtpd_sasl_type=dovecot + -o smtpd_sasl_path=private/auth + ``` + + When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. + +1. Restart Postfix to apply the changes. + + ```command + sudo systemctl restart postfix + ``` + +1. Verify that Postfix is now listening on port `587` (submission) and optionally on port `465` (SMTPS) on all IPv4 and IPv6 addresses. + + ```command + sudo ss -lnpt | grep master + ``` + + The output should include lines similar to the following: + + ```output + LISTEN 0 100 0.0.0.0:465 0.0.0.0:* users:(("master",pid=25871,fd=99)) + LISTEN 0 100 0.0.0.0:25 0.0.0.0:* users:(("master",pid=25871,fd=13)) + LISTEN 0 100 0.0.0.0:587 0.0.0.0:* users:(("master",pid=25871,fd=95)) + LISTEN 0 100 [::]:465 [::]:* users:(("master",pid=25871,fd=100)) + LISTEN 0 100 [::]:25 [::]:* users:(("master",pid=25871,fd=14)) + LISTEN 0 100 [::]:587 [::]:* users:(("master",pid=25871,fd=96)) + ``` + +## Step 5: Dovecot + +The Postfix server allows your server to send outgoing messages and receive emails from others. However, you need a different server, *Dovecot*, for your clients to retrieve mail from the server. + +1. First, install Dovecot using the following command: + + ```command + sudo apt install dovecot-core dovecot-imapd + ``` + + {{< note >}} + POP3 support is optional. However, unless you have users who specifically require the older POP3 protocol, it's recommended to use IMAP. Should POP3 support be required, use the command below: + + ```command + sudo apt install dovecot-pop3d + ``` + {{< /note >}} + +1. You can verify the Dovecot installation by running the following command: + + ```command + dovecot --version + ``` + + For Ubuntu 24.04 LTS, the Dovecot version is `2.3.21`: + + ```output + 2.3.21 (47349e2482) + ``` + +1. Open the `/etc/dovecot/dovecot.conf` file to configure IMAP and/or POP protocols: + + ```command + sudo nano /etc/dovecot/dovecot.conf + ``` + + Add the following line directly under `# Enable installed protocols`: + + ```file {title="/etc/dovecot/dovecot.conf" lang="conf" linenostart="23" hl_Lines="2"} + # Enable installed protocols + protocols = imap lmtp + !include_try /usr/share/dovecot/protocols.d/*.protocol + ``` + + LMTP is explained in the [next section](/docs/guides/how-to-setup-an-email-server/#step-6-local-message-storage-lmtp). + + {{< note >}} + If using POP3, change the line to include `pop3`: + + ```file {title="/etc/dovecot/dovecot.conf" lang="conf" linenostart="23" hl_Lines="2"} + # Enable installed protocols + protocols = imap lmtp pop3 + !include_try /usr/share/dovecot/protocols.d/*.protocol + ``` + {{< /note >}} + + When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. + +1. Set the mail folder location and storage type by editing the file `/etc/dovecot/conf.d/10-mail.conf`. + + ```command + sudo nano /etc/dovecot/conf.d/10-mail.conf + ``` + + Find the `mail_location = mbox:~/mail:INBOX=/var/mail/%u` line and change it to: + + ```file {title="/etc/dovecot/conf.d/10-mail.conf" lang="conf" linenostart="30"} + mail_location = maildir:~/Maildir + ``` + + When done press CTRL+X, followed by Y then Enter to save the file and exit `nano`. + +1. Add the Dovecot user to the `mail` group to ensure proper permissions. + + ```command + sudo adduser dovecot mail + ``` + + It should display output similar to the following: + + ```output + info: Adding user `dovecot' to group `mail' ... + ``` + +1. Verify that the `dovecot` user is added to the `mail` group: + + ```command + groups dovecot + ``` + + ```output + dovecot : dovecot mail + ``` + +## Step 6: Local Message Storage (LMTP) + +Because Postfix also uses `mbox` by default rather than `Maildir`, some additional configuration is necessary to ensure messages enter Dovecot in `Maildir` format. Instead of using Postfix’s built-in local delivery agent (LDA), which defaults to `mbox`, configure LMTP (a local version of SMTP) to deliver messages to Dovecot in `Maildir` format. + +1. First, install LMTP: + + ```command + sudo apt install dovecot-lmtpd + ``` + +1. Now open the Dovecot `10-master.conf` file: + + ```command + sudo nano /etc/dovecot/conf.d/10-master.conf + ``` + + - Search for the following section: + + ```file {title="/etc/dovecot/conf.d/10-master.conf" lang="conf" linenostart="57"} + service lmtp { + unix_listener lmtp { + #mode = 0666 + } + + # Create inet listener only if you can't use the above UNIX socket + #inet_listener lmtp { + # Avoid making LMTP visible for the entire internet + #address = + #port = + #} + } + ``` + + Replace it with the following code, ensuring the opening and closing braces match: + + ```file {title="/etc/dovecot/conf.d/10-master.conf" lang="conf" linenostart="57"} + service lmtp { + unix_listener /var/spool/postfix/private/dovecot-lmtp { + mode = 0600 + user = postfix + group = postfix + } + } + ``` + + - At the end of the file, add the following section to allow PostfixAdmin to read statistics from Dovecot. + + ```file {title="/etc/dovecot/conf.d/10-master.conf" lang="conf" linenostart="129"} + service stats { + unix_listener stats-reader { + user = www-data + group = www-data + mode = 0660 + } + unix_listener stats-writer { + user = www-data + group = www-data + mode = 0660 + } + } + ``` + + - Enable Simple Authentication and Security Layer (SASL) communications between Postfix and Dovecot. Locate the `unix_listener auth-userdb {` line in the `service auth {` section: + + ```file {title="/etc/dovecot/conf.d/10-master.conf" lang="conf" linenostart="84"} + unix_listener auth-userdb { + #mode = 0666 + #user = + #group = + } + + # Postfix smtp-auth + #unix_listener /var/spool/postfix/private/auth { + # mode = 0666 + #} + ``` + + Make the following adjustments:: + + ```file {title="/etc/dovecot/conf.d/10-master.conf" lang="conf" linenostart="84"} + #unix_listener auth-userdb { + #mode = 0666 + #user = + #group = + #} + + # Postfix smtp-auth + unix_listener /var/spool/postfix/private/auth { + mode = 0660 + user = postfix + group = postifx + } + ``` + + {{< note type="warning" >}} + Ensure the file maintains matching sets of opening and closing curly braces. If there is a mismatched set, dovecot does not start or restart. If you get an error when starting or restarting Dovecot, check `/var/log/syslog` to find the offending line in the `10-master.conf` configuration file. + {{< /note >}} + + When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. + +1. Add the Nginx user, `www-data`, to the dovecot group and grant permissions using ACLs: + + ```command + sudo gpasswd -a www-data dovecot + sudo apt install acl + sudo setfacl -R -m u:www-data:rwx /var/run/dovecot/stats-reader /var/run/dovecot/stats-writer + ``` + +1. Restart the Dovecot service: + + ```command + sudo systemctl restart dovecot + ``` + +1. Open the main Postfix configuration file: + + ```command + sudo nano /etc/postfix/main.cf + ``` + + Add the following two lines to the end of the file: + + ```file {title="/etc/postfix/main.cf" linenostart="54"} + mailbox_transport = lmtp:unix:private/dovecot-lmtp + smtputf8_enable = no + ``` + + The first line tells Postfix to use a Unix socket to communicate over LMTP to the Dovecot service you just created. The second line disables [an extension for internationalized mail](https://www.rfc-editor.org/rfc/rfc6531) that Dovecot doesn’t support as of version 2.3.21, the version included with Ubuntu 24.04 LTS. + + When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. + +## Step 7: Dovecot Authentication and Encryption + +Just as you configured Postfix to use TLS to encrypt Postfix data in transit, you need to do the same for Dovecot traffic. + +1. Open the `/etc/dovecot/conf.d/10-auth.conf` file: + + ```command + sudo nano /etc/dovecot/conf.d/10-auth.conf + ``` + + Uncomment the following line to disable plaintext authentication when TLS encryption is not used: + + ```file {title="/etc/dovecot/conf.d/10-auth.conf" lang="conf" linenostart="10"} + disable_plaintext_auth = yes + ``` + + To add the `login` authentication method, find the line starting with `auth_mechanisms` and add a `login` to the list: + + ```file {title="/etc/dovecot/conf.d/10-auth.conf" lang="conf" linenostart="100"} + auth_mechanisms = plain login + ``` + + When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. + +1. Open the `/etc/dovecot/conf.d/10-ssl.conf` file: + + ```command + sudo nano /etc/dovecot/conf.d/10-ssl.conf + ``` + + To enable the TLS encryption change the line `ssl = yes` into `ssl =required`: + + ```file {title="/etc/dovecot/conf.d/10-ssl.conf" lang="conf" linenostart="6"} + ssl = required + ``` + + Point to the Let's Encrypt certificate and key files generated during Postfix configuration. Replace `mail.{{< placeholder "example.tld" >}}` with your hostname and domain name. Preserve the `<` character before each filename as Dovecot uses it to read each file. + + ```file {title="/etc/dovecot/conf.d/10-ssl.conf" lang="conf" linenostart="12"} + ssl_cert = }}/fullchain.pem + ssl_key = }}/privkey.pem + ``` + + Uncomment the following line to set the minimum TLS protocol version to `TLSv1.2`: + + ```file {title="/etc/dovecot/conf.d/10-ssl.conf" lang="conf" linenostart="62"} + ssl_min_protocol = TLSv1.2 + ``` + + Set the server to prefer its own ciphers to protect email. This ensures the server determines the order in which to attempt different ciphers. This means it's not at the mercy of a client that starts with a weak cipher. Uncomment the `ssl_prefer_server_ciphers` parameter and change it from `no` to `yes`. + + ```file {title="/etc/dovecot/conf.d/10-ssl.conf" lanf="conf" linenostart="75"} + ssl_prefer_server_ciphers = yes + ``` + + When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. + +1. Open the `/etc/ssl/openssl.cnf` file: + + ```command + sudo nano /etc/ssl/openssl.cnf + ``` + + Find and comment out the line beginning with `providers` to disable support for Federal Information Processing Standards (FIPS), a set of US government security standards: + + ```file {title="/etc/ssl/openssl.cnf" linenostart="54"} + #providers = provider_sect + ``` + + When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. + + {{< note >}} + Version 3.0.2 of OpenSSL included with Ubuntu 22.04 LTS supports FIPS by default, but Dovecot doesn’t. If you leave FIPS enabled, you’re likely to see errors like the following in your log files: + + ```output + imap-login: Error: Failed to initialize SSL server context: Can't load SSL certificate: error:25066067:DSO support routines:dlfcn_load:could not load the shared library: filename(libproviders.so) + ``` + {{< /note >}} + +1. Restart Postfix and Dovecot using the following commands: + + ```command + sudo systemctl restart postfix + sudo systemctl restart dovecot + ``` + +## Step 8: MariaDB + +Since the server is running in virtual mode, with domains, users, and aliases existing independent of the underlying operating system, you need a place to store account data. This guide uses [MariaDB](https://mariadb.com/), an open source fork of the [MySQL](https://www.mysql.com/) database, for storing mail accounts and related info. MariaDB is also a requirement for PostfixAdmin, the graphical management tool installed in the next step. + +1. To begin, install the MariaDB server and client packages: + + ```command + sudo apt install mariadb-server mariadb-client + ``` + +1. The installation routine should conclude by starting MariaDB. Verify this with a `status` command: + + ```command + sudo systemctl status mariadb + ``` + + You should see output similar to the following: + + ```output + ● mariadb.service - MariaDB 10.11.7 database server + Loaded: loaded (/usr/lib/systemd/system/mariadb.service; enabled; preset: enable> + Active: active (running) since Wed 2024-06-12 12:14:09 EDT; 6s ago + ... + ``` + + Press the Q key to exit the status output and return to the terminal prompt. + + {{< note >}} + If MariaDB isn't running, use the following command to launch it: + + ```command + sudo systemctl start mariadb + ``` + {{< /note >}} + +1. Enable MariaDB to start every time the system reboots: + + ```command + sudo systemctl enable mariadb + ``` + + ```output + Synchronizing state of mariadb.service with SysV service script with /usr/lib/systemd/systemd-sysv-install. + Executing: /usr/lib/systemd/systemd-sysv-install enable mariadb + ``` + +1. It's important to secure the database, and the MariaDB server includes a script for this: + + ```command + sudo mysql_secure_installation + ``` + + Answer the questions presented in the following manner. When prompted, set a strong and memorable root password for database access. + + - **Enter current password for root (enter for none):** Enter + - **Switch to unix_socket authentication [Y/n]** N + - **Change the root password? [Y/n]** Y + - **Remove anonymous users? [Y/n]** Y + - **Disallow root login remotely? [Y/n]** Y + - **Remove test database and access to it? [Y/n]** Y + - **Reload privilege tables now? [Y/n]** Y + + ```output + Cleaning up... + + All done! If you've completed all of the above steps, your MariaDB + installation should now be secure. + + Thanks for using MariaDB! + ``` + + Your database server is now secured against the most common attacks. + +## Step 9: PostfixAdmin + +PostfixAdmin is a simple management tool for Postfix/Dovecot that simplifies email administration tasks. After installing PostfixAdmin, you can manage your domains, users, and alias accounts from any web browser. + +While PostfixAdmin makes email server management easy, installation takes multiple steps, though none are difficult. This guide breaks down the instructions into several subsections explained below. The configuration steps may seem daunting, but most of them are required for virtual email support, even without a graphical management interface. + +### Step 9a: DNS Configuration + +Even though PostfixAdmin runs on the same host, use a different hostname such as `postfixadmin.{{< placeholder "example.tld" >}}` for email management. To do so, you need to add DNS **A** and/or **AAAA** records for this new hostname. If you’re using Akamai as your DNS provider, access the **Domains** menu at the left of the Cloud dashboard, the same as in [Step 1](/docs/guides/how-to-setup-an-email-server/#step-1-linode-server-creation). You can point `postfixadmin.{{< placeholder "example.tld" >}}` to the same IP address(es) you are using for `mail.{{< placeholder "example.tld" >}}`. + +### Step 9b: Download the Latest PostfixAdmin + +To ensure the best experience with PostfixAdmin and avoid potential issues, it is recommended to install it from GitHub instead of the Ubuntu package. Here's why: + +- **Upgrades and Compatibility**: The included PostfixAdmin version in Ubuntu packages may not always be up-to-date with the latest features and bug fixes. Additionally, upgrades to the underlying Ubuntu operating system can potentially break the included version. + +- **Avoiding Login Errors**: The Ubuntu package version of PostfixAdmin may sometimes result in "Invalid token!" errors when attempting to log in. Installing from the GitHub repository can help mitigate these issues and provide a smoother experience. + +- **Consistency with Nginx**: Since Nginx is your web server, the Ubuntu package version of PostfixAdmin may attempt to install and use Apache. This can lead to conflicts and configuration issues. Installing from the GitHub repository ensures consistency and compatibility with Nginx. + +To ensure the latest version of PostfixAdmin is installed, follow the steps below to download it from the GitHub repository: + +1. Change to the `/tmp` directory: + + ```command + cd /tmp + ``` + +1. Install the `wget` package if it's not already installed: + + ```command + sudo apt install wget + ``` + +1. Visit the [GitHub page for PostfixAdmin](https://github.com/postfixadmin/postfixadmin/releases) and note the latest release version. As of writing this guide, the current release is version **3.3.13**. If there is a newer release available, substitute `3.3.13` in the command below with the appropriate version for the latest release: + + ```command + wget https://github.com/postfixadmin/postfixadmin/archive/refs/tags/postfixadmin-3.3.13.tar.gz + ``` + +1. Once the download is complete, use the following commands to extract the archive and move it to the `/var/www` directory: + + ```command + sudo mkdir -p /var/www + sudo tar xvf postfixadmin-3.3.13.tar.gz -C /var/www + sudo mv /var/www/postfixadmin-postfixadmin-3.3.13 /var/www/postfixadmin + ``` + +1. Remove the downloaded archive file to clean up the `/tmp` directory. + + ```command + sudo rm postfixadmin-3.3.13.tar.gz + ``` + +You now have the latest version of PostfixAdmin downloaded and extracted to the `/var/www/postfixadmin` directory. This ensures you have the most up-to-date features and fixes for managing your email server. + +### Step 9c: Install Required PHP Modules for PostfixAdmin + +PostfixAdmin is a PHP-based application, and it requires several PHP modules to function properly. You can install all the necessary modules with a single command: + +```command +sudo apt install php8.3-fpm php8.3-imap php8.3-mbstring php8.3-mysql php8.3-curl php8.3-zip php8.3-xml php8.3-bz2 php8.3-intl php8.3-gmp php8.3-redis +``` + +These modules provide essential functionality for PostfixAdmin to work properly. + +### Step 9d: Database Initialization + +To store email settings, you need to create a MariaDB database for PostfixAdmin and a corresponding user. + +1. First, log in to MariaDB as the root user: + + ```command + sudo mysql -u root + ``` + + ```output + Welcome to the MariaDB monitor. Commands end with ; or \g. + Your MariaDB connection id is 41 + Server version: 10.11.7-MariaDB-2ubuntu2 Ubuntu 24.04 + + Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others. + + Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. + + MariaDB [(none)]> + ``` + +1. Next, create a PostfixAdmin database and name it `postfixadmin`: + + ```command + create database postfixadmin; + ``` + + ```output + Query OK, 1 row affected (0.000 sec) + ``` + +1. Now create a PostfixAdmin user and also name it `postfixadmin`. Remember to replace {{< placeholder "POSTFIXADMIN_PASSWORD" >}} with a strong password of your choice: + + ```command + create user 'postfixadmin'@'localhost' identified by '{{< placeholder "POSTFIXADMIN_PASSWORD" >}}'; + ``` + + ```output + Query OK, 0 rows affected (0.001 sec) + ``` + + {{< note >}} + While you can name the database and user anything, for consistency this guide use `postfixadmin` for both. + {{< /note >}} + +1. Grant all privileges on the `postfixadmin` database to the user you just created: + + ```command + grant all privileges on postfixadmin.* to 'postfixadmin'@'localhost'; + ``` + + ```output + Query OK, 0 rows affected (0.001 sec) + ``` + +1. Flush the MariaDB privileges to ensure the changes take effect: + + ```command + flush privileges; + ``` + + ```output + Query OK, 0 rows affected (0.001 sec) + ``` + +1. Exit the MariaDB prompt: + + ```command + exit; + ``` + + ```output + Bye + ``` + +### Step 9e: Postfix-MariaDB Integration + +Configure Postfix to send and receive mail on behalf of virtual users and domains, not just those with accounts on the local operating system. This requires installing a package that adds MySQL/MariaDB mapping support to Postfix. + +1. First, install the `postfix-mysql` package: + + ```command + sudo apt install postfix-mysql + ``` + +1. Now edit the main Postfix configuration file: + + ```command + sudo nano /etc/postfix/main.cf + ``` + + To allow Dovecot to deliver messages to virtual users, add the following lines to the end of the file: + + ```file {title="/etc/postfix/main.cf" linenostart="56"} + virtual_mailbox_domains = proxy:mysql:/etc/postfix/sql/mysql_virtual_domains_maps.cf + virtual_mailbox_maps = + proxy:mysql:/etc/postfix/sql/mysql_virtual_mailbox_maps.cf, + proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_domain_mailbox_maps.cf + virtual_alias_maps = + proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_maps.cf, + proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_domain_maps.cf, + proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_domain_catchall_maps.cf + virtual_transport = lmtp:unix:private/dovecot-lmtp + ``` + + When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. + +1. Create a directory for the virtual domains, users, and aliases you just pointed to: + + ```command + sudo mkdir -p /etc/postfix/sql + ``` + +1. Create the following six files in the `/etc/postfix/sql` directory, substituting the {{< placeholder "POSTFIXADMIN_PASSWORD" >}} you used in the previous step when setting up the `postfixadmin` database. + + - Create the `mysql_virtual_domains_maps.cf` file: + + ```command + sudo nano /etc/postfix/sql/mysql_virtual_domains_maps.cf + ``` + + The `mysql_virtual_domains_maps.cf` file contents are as follows: + + ```file {title="/etc/postfix/sql/mysql_virtual_domains_maps.cf"} + user = postfixadmin + password = {{< placeholder "POSTFIXADMIN_PASSWORD" >}} + hosts = localhost + dbname = postfixadmin + query = SELECT domain FROM domain WHERE domain='%s' AND active = '1' + ``` + + When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. + + - Create the `mysql_virtual_mailbox_maps.cf` file: + + ```command + sudo nano /etc/postfix/sql/mysql_virtual_mailbox_maps.cf + ``` + + The `mysql_virtual_mailbox_maps.cf` file contents are as follows: + + ```file {title="/etc/postfix/sql/mysql_virtual_mailbox_maps.cf"} + user = postfixadmin + password = {{< placeholder "POSTFIXADMIN_PASSWORD" >}} + hosts = localhost + dbname = postfixadmin + query = SELECT domain FROM domain WHERE domain='%s' AND active = '1' + #query = SELECT domain FROM domain WHERE domain='%s' + #optional query to use when relaying for backup MX + #query = SELECT domain FROM domain WHERE domain='%s' AND backupmx = '0' AND active = '1' + #expansion_limit = 100 + ``` + + When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. + + - Create the `mysql_virtual_alias_domain_mailbox_maps.cf` file: + + ```command + sudo nano /etc/postfix/sql/mysql_virtual_alias_domain_mailbox_maps.cf + ``` + + The `mysql_virtual_alias_domain_mailbox_maps.cf` file contents are as follows: + + ```file {title="/etc/postfix/sql/mysql_virtual_alias_domain_mailbox_maps.cf"} + user = postfixadmin + password = {{< placeholder "POSTFIXADMIN_PASSWORD" >}} + hosts = localhost + dbname = postfixadmin + query = SELECT maildir FROM mailbox,alias_domain WHERE alias_domain.alias_domain = '%d' and mailbox.username = CONCAT('%u', '@', alias_domain.target_domain) AND mailbox.active = 1 AND alias_domain.active='1' + ``` + + When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. + + - Create the `mysql_virtual_alias_maps.cf` file: + + ```command + sudo nano /etc/postfix/sql/mysql_virtual_alias_maps.cf + ``` + + The `mysql_virtual_alias_maps.cf` file contents are as follows: + + ```file {title="/etc/postfix/sql/mysql_virtual_alias_maps.cf"} + user = postfixadmin + password = {{< placeholder "POSTFIXADMIN_PASSWORD" >}} + hosts = localhost + dbname = postfixadmin + query = SELECT goto FROM alias WHERE address='%s' AND active = '1' + #expansion_limit = 100 + ``` + + When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. + + - Create the `mysql_virtual_alias_domain_maps.cf` file: + + ```command + sudo nano /etc/postfix/sql/mysql_virtual_alias_domain_maps.cf + ``` + + The `mysql_virtual_alias_domain_maps.cf` file contents are as follows: + + ```file {title="/etc/postfix/sql/mysql_virtual_alias_domain_maps.cf"} + user = postfixadmin + password = {{< placeholder "POSTFIXADMIN_PASSWORD" >}} + hosts = localhost + dbname = postfixadmin + query = SELECT goto FROM alias,alias_domain WHERE alias_domain.alias_domain = '%d' and alias.address = CONCAT('%u', '@', alias_domain.target_domain) AND alias.active = 1 AND alias_domain.active='1' + ``` + + When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. + + - Create the `mysql_virtual_alias_domain_catchall_maps.cf` file: + + ```command + sudo nano /etc/postfix/sql/mysql_virtual_alias_domain_catchall_maps.cf + ``` + + The `mysql_virtual_alias_domain_catchall_maps.cf` file contents are as follows: + + ```file {title="/etc/postfix/sql/mysql_virtual_alias_domain_catchall_maps.cf"} + user = postfixadmin + password = {{< placeholder "POSTFIXADMIN_PASSWORD" >}} + hosts = localhost + dbname = postfixadmin + query = SELECT goto FROM alias,alias_domain WHERE alias_domain.alias_domain = '%d' and alias.address = CONCAT('@', alias_domain.target_domain) AND alias.active = 1 AND alias_domain.active='1' + ``` + + When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. + +1. Lock down the ownership and permissions of the files in the `/etc/postfix/sql` directory so that they are only readable by `postfix` and `root`: + + ```command + sudo chmod 0640 /etc/postfix/sql/* + sudo setfacl -R -m u:postfix:rx /etc/postfix/sql/ + ``` + +1. During [Postfix installation in step 2](/docs/guides/how-to-setup-an-email-server/#step-2-install-postfix), the `mydestination` parameter may have been set to include the canonical hostname (e.g., `mail.{{< placeholder "example.tld" >}}`). However, since you've enabled virtual users and domains, the canonical hostname is no longer needed. Open the main Postfix configuration file: + + ```command + sudo nano /etc/postfix/main.cf + ``` + + Locate the `mydestination` parameter and modify it to remove the canonical hostname entry (e.g., {{< placeholder "example.tld" >}}). Keep only the necessary entries, such as `localhost` or any other relevant entries. + + ```file {title="/etc/postfix/main.cf" linenostart="47"} + mydestination = $myhostname, localhost.{{< placeholder "example.tld" >}}, localhost + ``` + + At the end of the file, add the following four lines to configure Postfix for virtual users, domains, and aliases: + + ```file {title="/etc/postfix/main.cf" linenostart="65"} + virtual_mailbox_base = /var/vmail + virtual_minimum_uid = 2000 + virtual_uid_maps = static:2000 + virtual_gid_maps = static:2000 + ``` + + When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. + +1. Create a user named `vmail` with user and group ID `2000`, as defined in the previous step: + + ```command + sudo adduser vmail --system --group --uid 2000 --disabled-login --no-create-home + ``` + + ```output + info: Adding system user `vmail' (UID 2000) ... + info: Adding new group `vmail' (GID 2000) ... + info: Adding new user `vmail' (UID 2000) with group `vmail' ... + useradd warning: vmail's uid 2000 is greater than SYS_UID_MAX 999 + info: Not creating `/nonexistent'. + ``` + +1. Create a base directory for virtual mail and assign ownership to the `vmail` user: + + ```command + sudo mkdir -p /var/vmail + sudo chown -R vmail:vmail /var/vmail + ``` + +1. Restart the Postfix service to apply the changes: + + ```command + sudo systemctl restart postfix + ``` + +### Step 9f: Dovecot-MariaDB Integration + +As as with Postfix, you also need to configure Dovecot to work with the `postfixadmin` database. + +1. Start by installing the package that enables Dovecot-SQL integration: + + ```command + sudo apt install dovecot-mysql + ``` + +1. Open the `10-mail.conf` file to reconfigure Dovecot to handle virtual users instead of users with system accounts: + + ```command + sudo nano /etc/dovecot/conf.d/10-mail.conf + ``` + + Find the `mail_location` line and add a new `mail_home` parameter for virtual users below it: + + ```file {title="/etc/dovecot/conf.d/10-mail.conf" lang="conf" linenostart="30" hl_lines="2"} + mail_location = maildir:~/Maildir + mail_home = /var/vmail/%d/%n/ + ``` + + When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. + +1. Now open Dovecot's authentication file: + + ```command + sudo nano /etc/dovecot/conf.d/10-auth.conf + ``` + + - Uncomment the `auth_username_format` line: + + ```file {title="/etc/dovecot/conf.d/10-auth.conf" lang="conf" linenostart="51"} + auth_username_format = %Lu + ``` + + By default, postfix uses the entire email address (e.g. `UserName@example.tld`) as the username. The `L` converts usernames to lowercase characters (e.g. `username@example.tld`) before sending them to the database. + + - Uncomment the following line to enable SQL queries of the MariaDB database: + + ```file {title="/etc/dovecot/conf.d/10-auth.conf" lang="conf" linenostart="123"} + !include auth-sql.conf.ext + ``` + + - Add the following two lines at the bottom of the file for initial troubleshooting: + + ```file {title="/etc/dovecot/conf.d/10-auth.conf" lang="conf" linenostart="128"} + auth_debug = yes + auth_debug_passwords = yes + ``` + + These send login errors to `/var/log/mail.log`. Once you’ve verified that users can log in successfully, it’s OK to delete these lines. + + When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. + +1. Now, open the `dovecot-sql.conf.ext` file. + + ```command + sudo nano /etc/dovecot/dovecot-sql.conf.ext + ``` + + All lines in this file are commented out. You may want to keep the existing comments, which are useful as documentation. Add the following lines at the bottom of the file, making sure to replace the {{< placeholder "POSTFIXADMIN_PASSWORD" >}} in the `connect` line with the `postfixadmin` user's database password you created earlier. However, leave the word `password` as-is in the `password_query` line. + + ```file {title="/etc/dovecot/dovecot-sql.conf.ext" linenostart="145"} + driver = mysql + connect = host=localhost dbname=postfixadmin user=postfixadmin password={{< placeholder "POSTFIXADMIN_PASSWORD" >}} + default_pass_scheme = ARGON2I + password_query = SELECT username AS user, password FROM mailbox WHERE username = '%u' AND active='1' + user_query = SELECT maildir, 2000 AS uid, 2000 AS gid FROM mailbox WHERE username = '%u' AND active='1' + iterate_query = SELECT username AS user FROM mailbox + ``` + + When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. + +1. Restart Dovecot to apply the changes. + + ```command + sudo systemctl restart dovecot + ``` + +### Step 9g: Access Control Lists (ACLs) + +PostfixAdmin uses a `templates_c` directory, and the Nginx web server needs access to that directory. As in [step 6](/docs/guides/how-to-setup-an-email-server/#step-6-local-message-storage-lmtp), you can use ACLs to grant access. + +1. Create the `templates_c` directory and set the appropriate permissions: + + ```command + sudo mkdir -p /var/www/postfixadmin/templates_c + sudo setfacl -R -m u:www-data:rwx /var/www/postfixadmin/templates_c/ + ``` + +1. Ensure that the Nginx web server can read the Let's Encrypt certificate and key you previously created: + + ```command + sudo setfacl -R -m u:www-data:rx /etc/letsencrypt/live/ /etc/letsencrypt/archive/ + ``` + +### Step 9h: PostfixAdmin Configuration + +By default, PostfixAdmin stores configuration data in the `/var/www/postfixadmin/config.inc.php` file. However, to avoid potential conflicts during upgrades, it is recommended to create a separate `config.local.php` file for server-specific settings. + +Create and open the `config.local.php` file for editing: + +```command +sudo nano /var/www/postfixadmin/config.local.php +``` + +Add the following content to the `config.local.php` file, replacing {{< placeholder "POSTFIXADMIN_PASSWORD" >}} with the actual `postfixadmin` user database password you previously created: + +```file {title="/var/www/postfixadmin/config.local.php"} +}}'; + $CONF['database_name'] = 'postfixadmin'; + $CONF['encrypt'] = 'dovecot:ARGON2I'; + $CONF['dovecotpw'] = "/usr/bin/doveadm pw -r 5"; + // @ to silence openbase_dir stuff; see https://github.com/postfixadmin/postfixadmin/issues/171 + if(@file_exists('/usr/bin/doveadm')) { + $CONF['dovecotpw'] = "/usr/bin/doveadm pw -r 5"; # debian +} +``` + +When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. + +### Step 9i: Virtual Web Host + +To create a virtual host for PostfixAdmin using Nginx, set up a separate Nginx configuration file for the domain. + +1. Use the following command create a new Nginx configuration file for PostfixAdmin, replacing {{< placeholder "example.tld" >}} with your actual domain name: + + ```command + sudo nano /etc/nginx/sites-available/postfixadmin.{{< placeholder "example.tld" >}}.conf + ``` + + Insert the following contents into the file, again replacing {{< placeholder "example.tld" >}} with your actual domain name: + + ```file {title="/etc/nginx/sites-available/postfixadmin.{{< placeholder "example.tld" >}}.conf"} + server { + listen 80; + listen [::]:80; + + server_name postfixadmin.{{< placeholder "example.tld" >}}; + + root /var/www/postfixadmin/public/; + index index.php index.html; + + access_log /var/log/nginx/postfixadmin_access.log; + error_log /var/log/nginx/postfixadmin_error.log; + + location / { + try_files $uri $uri/ /index.php; + } + + location ~ ^/(.+\.php)$ { + try_files $uri =404; + fastcgi_pass unix:/run/php/php8.3-fpm.sock; + fastcgi_index index.php; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + include /etc/nginx/fastcgi_params; + } + } + + server { + listen 443 ssl; + listen [::]:443 ssl; + + server_name postfixadmin.{{< placeholder "example.tld" >}}; + + root /var/www/postfixadmin/public/; + index index.php index.html; + + access_log /var/log/nginx/postfixadmin_access.log; + error_log /var/log/nginx/postfixadmin_error.log; + + location / { + try_files $uri $uri/ /index.php; + } + + location ~ ^/(.+\.php)$ { + try_files $uri =404; + fastcgi_pass unix:/run/php/php8.3-fpm.sock; + fastcgi_index index.php; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + include /etc/nginx/fastcgi_params; + } + ssl_certificate /etc/letsencrypt/live/mail.{{< placeholder "example.tld" >}}/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/mail.{{< placeholder "example.tld" >}}/privkey.pem; + ssl_session_timeout 5m; + ssl_protocols TLSv1.2 TLSv1.3; + } + ``` + + When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. + +1. You need to update the Let's Encrypt certificate and key. Create a symbolic link between the configuration file in `/etc/nginx/sites-available` and `/etc/nginx/sites-enabled`. Make sure to replace {{< placeholder "example.tld" >}} with your actual domain name in the configuration filename: + + ```command + sudo ln -s /etc/nginx/sites-available/postfixadmin.{{< placeholder "example.tld" >}}.conf /etc/nginx/sites-enabled/ + ``` + +### Step 9j: Let's Encrypt Update + +Update the Let's Encrypt certificate to include the virtual host you just created. Although it is possible to create different Let's Encrypt certificates for each virtual host, you can also use one certificate to validate all hostnames. + +1. Rerun the `certbot` command to update the Let's Encrypt certificate and include the virtual host you created. Replace {{< placeholder "example.tld" >}} with your actual domain name. Notice that this time, you're using the `-d` switch twice, once for each virtual host. + + ```command + sudo certbot certonly -a nginx --staple-ocsp -d mail.{{< placeholder "example.tld" >}} -d postfixadmin.{{< placeholder "example.tld" >}} + ``` + + When prompted, select option `E` to expand the existing certificate to cover multiple hostnames. If the expansion succeeds, the new certificate and private key covers both hostnames: + + ```output + Successfully received certificate. + Certificate is saved at: /etc/letsencrypt/live/mail.{{< placeholder "example.tld" >}}/fullchain.pem + Key is saved at: /etc/letsencrypt/live/mail.{{< placeholder "example.tld" >}}/privkey.pem + This certificate expires on 2024-09-12. + These files will be updated when the certificate renews. + Certbot has set up a scheduled task to automatically renew this certificate in the background. + ``` + +1. Verify the Nginx configuration using the following command: + + ```command + sudo nginx -t + ``` + + Ensure that the output indicates a successful configuration as shown below: + + ```output + nginx: the configuration file /etc/nginx/nginx.conf syntax is ok + nginx: configuration file /etc/nginx/nginx.conf test is successful + ``` + +1. Once you have validated your configuration and ensured there are no errors, reload Nginx to apply the changes: + + ```command + sudo systemctl reload nginx + ``` + +1. Restart Postfix and Dovecot to load the updated certificate: + + ```command + sudo systemctl restart postfix + sudo systemctl restart dovecot + ``` + +### Step 9k: Final PostfixAdmin Setup + +1. In your web browser, enter the following URL to access the PostfixAdmin setup screen, replacing {{< placeholder "example.tld" >}} with your domain name. + + ```command + https://postfixadmin.{{< placeholder "example.tld" >}}/setup.php + ``` + + {{< note >}} + Ensure that you have valid A and/or AAAA records in your DNS for `postfixadmin.{{< placeholder "example.tld" >}}`. If the page doesn't load, check the error log in the `/var/log/nginx` directory and/or the main `/var/log/syslog` file for any configuration errors. + {{< /note >}} + +1. Once the setup page loads, enter a setup password to proceed: + + ![The PostFixAdmin initial setup page.](PostFixAdmin-Setup-Page.png) + +1. After entering the password, you see a hashed version of it. Copy the entire hashed string, which is used in the PostfixAdmin `config.local.php` file. + + ```output + $CONF['setup_password'] = '$2y$10$d5COgAVA4qZtTJCo9znWaOB4c2bHjbtwwlr8TOLbIp6P3lidinH5W'; + ``` + +1. Open the PostfixAdmin config file for editing. + + ```command + sudo nano /var/www/postfixadmin/config.local.php + ``` + +1. Paste the setup password string as the last line of the config file. + + ```file {title="/var/www/postfixadmin/config.local.php"} + + if(@file_exists('/usr/bin/doveadm')) { + $CONF['dovecotpw'] = "/usr/bin/doveadm pw -r 5"; # debian + } + $CONF['setup_password'] = '$2y$10$d5COgAVA4qZtTJCo9znWaOB4c2bHjbtwwlr8TOLbIp6P3lidinH5W'; + ``` + + When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. + +1. To allow the `www-data` user access to read the Let's Encrypt certificate and Dovecot stats, run the following commands: + + ```command + sudo setfacl -R -m u:www-data:rx /etc/letsencrypt/live/ /etc/letsencrypt/archive/ + sudo setfacl -R -m u:www-data:rwx /var/run/dovecot/stats-reader /var/run/dovecot/stats-writer + ``` + + {{< note >}} + If you encounter an ARGON2I error later on during the PostfixAdmin account setup, rerun these two commands. + {{< /note >}} + +1. Reload the setup page in your browser, and if requested, log in using the setup password you entered earlier. You may encounter some database warnings, but you can ignore them as they pertain to database types not used in this setup. + +1. At the bottom of the page, enter the **Setup password** you just created, your external email address for **Admin**, and a new super-admin password: + + ![The PostFixAdmin super-admin creation page.](PostFixAdmin-SuperAdmin-Creation-Page.png) + +1. After entering the password, click the link at the bottom of the page to access the main login page. Alternatively, you can use the following login URL: + + ```command + https://postfixadmin.{{< placeholder "example.tld" >}}/login.php + ``` + +### Step 9l: Virtual Mail Setup in PostfixAdmin + +1. Open a web browser and navigate to `https://postfixadmin.{{< placeholder "example.tld" >}}/login.php` (replace `{{< placeholder "example.tld" >}}` with your domain name). Log in using the super-admin credentials you previously set up. + +1. In the top menu, click on **Domain List** and select **New Domain**. Enter the name of the domain you want to create under **Domain**. It is recommended to include your server's native domain since we are assuming all accounts on this system are virtual. For example, use `{{< placeholder "example.tld" >}}` instead of `mail.{{< placeholder "example.tld" >}}`. + + ![The PostFixAdmin ne domain creation page.](PostFixAdmin-New-Domain.png) + + Regarding the other settings on this page: + + - **Aliases**: You can specify the maximum number of aliases and users per domain. The default is `10` for each, but you can set these values as desired. Use `0` to indicate an unlimited number. + - **Mail server is backup MX**: Since you are setting up a primary server, leave the option for this to be a backup mail exchanger (MX) unchecked. + - **Active**: Choose whether to enable or disable the virtual domain. It is recommended to enable the domain unless there are specific reasons to disable it, such as scheduling it to operate within certain dates. + - **Add default mail aliases** Keep this box checked to set up standard management aliases. These aliases are commonly used for administrative and troubleshooting purposes: + + - `abuse@{{< placeholder "example.tld" >}}` + - `hostmaster@{{< placeholder "example.tld" >}}` + - `postmaster@{{< placeholder "example.tld" >}}` + - `webmaster@{{< placeholder "example.tld" >}}` + + - **Pass expires**: sets a maximum age for users' passwords in that domain. The default setting of 365 days is recommended, but you can adjust it according to your preferences. + + When done, click **Add Domain**. + +1. Now, you can create your first user account. Click on the **Virtual Lists** menu at the top of the page and select **Add Mailbox**. + + ![The PostFixAdmin new mailbox creation page.](PostFixAdmin-Add-Mailbox.png) + + - **Username**: Enter a username and select the domain from the dropdown menu. Since you have only created one virtual domain so far, there is only one option in the menu. + - **Password**: Choose a strong password and enter it twice. + - **Name**: This is a space for the user's full name. + - **Quota**: Optionally set a quota (maximum storage limit in megabytes) for the user. + - **Active**: Leave this box checked unless you have a specific reason to disable it. + - **Send Welcom email**: Leave this box checked unless you have a specific reason to disable it. + - **Other e-mail**: It is a good practice to enter an alternative email address (preferably from a separate domain on a separate server) for password recovery purposes. + +### Step 9m: Client Setup and Server Validation + +1. To validate your email server, add a new account to an email client such as [Mozilla Thunderbird](https://www.thunderbird.net/en-US/), [GNOME Evolution](https://help.gnome.org/users/evolution/stable/), or [Microsoft Outlook](https://www.microsoft.com/en-us/microsoft-365/outlook/email-and-calendar-software-microsoft-outlook). While the specific configuration of each client is beyond the scope of this guide, there are a few common settings to check: + + - For sending and receiving emails, use the entire email address as the username (e.g., `username@example.com` instead of just `username`). + - For receiving email, specify IMAP on TCP port `993` using TLS/SSL. + - For sending email, specify either submission on TCP port `587` using STARTTLS or, for Microsoft Outlook clients, TCP port `465` using TLS/SSL. + +1. After configuring an account in your mail client, test your setup by sending and receiving emails to and from another address on a different server. You should be able to both receive and send emails using your new account. You now have a working email service. + +1. If you encounter any errors during the setup, don't worry. Instead of starting over, check the following log files for specific error messages: `/var/log/mail.log` and `/var/log/syslog`. These log entries should provide clues about the source of the problem. You can also search the web using the specific error message along with "dovecot postfix" to find relevant information and solutions. + +1. There are a few housekeeping tasks to complete: + + - In PostfixAdmin, edit the four standard aliases created when you configured a domain. By default, these aliases point to dummy addresses such as `abuse@change-this-to-your.domain.tld`. Now that you have a working email address, you should edit these (under Virtual List/Virtual List) to point to your actual email address. + + - In the `/etc/dovecot/conf.d/10-auth.conf` file, you added two lines for verbose debugging. Both lines begin with the string `auth_debug`. To avoid log bloat, you can comment out or delete both lines and then restart Dovecot. + + - Consider configuring valid Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) records in your DNS to combat spam. Optionally, you can also set up a Domain Message Authentication, Reporting & Conformance (DMARC) record to specify how your server handles failed SPF and/or DKIM validations, as well as request reports from other servers. Linode provides a [separate email server guide](https://www.linode.com/docs/guides/configure-spf-and-dkim-in-postfix-on-debian-8/) for SPF, DKIM, and DMARC configuration. + + - Stay vigilant about [security vulnerabilities](https://ubuntu.com/security/notices) by keeping your operating system and server software up to date. Regularly applying patches and updates is crucial for maintaining a secure server. + + - Make regular backups of your server. Consider using [Akamai's Backups service](https://www.linode.com/docs/products/storage/backups/), which can automate your backups with a single click. + +## Conclusion + +You now know how to set up an email server. You know how to put key email protocols to work, and how to integrate them with DNS, databases, and graphical management tools. Properly configured, your new email server can run for years, making it a good pairing with Ubuntu’s LTS on an Akamai compute instance. Email represents one of the most useful services you can provide, the Akamai cloud offers an ideal platform on which to provision your next server. \ No newline at end of file From 23cbabf529256c4e6c688030a55812d8d4697423 Mon Sep 17 00:00:00 2001 From: Adam Overa Date: Fri, 14 Jun 2024 17:09:45 -0400 Subject: [PATCH 4/6] Small Fixes 1 --- .../guides/email/postfix/how-to-setup-an-email-server/index.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/docs/guides/email/postfix/how-to-setup-an-email-server/index.md b/docs/guides/email/postfix/how-to-setup-an-email-server/index.md index f4566621d29..4ac3a05cdea 100644 --- a/docs/guides/email/postfix/how-to-setup-an-email-server/index.md +++ b/docs/guides/email/postfix/how-to-setup-an-email-server/index.md @@ -68,11 +68,10 @@ Before you begin, it’s important to understand five key assumptions this guide | `{{< placeholder "example.tld" >}}`| Your custom domain name. | | `{{< placeholder "IPv4_ADDRESS" >}}` | Your system's public IPv4 address. | | `{{< placeholder "IPv4_ADDRESS" >}}` | Your system's public IPv6 address. | - | `{{< placeholder "EXAMPLE_USER" >}}` | The username of the limited sudo user. | | `{{< placeholder "external@email.tld" >}}` | A working external email address. | | `{{< placeholder "POSTFIXADMIN_PASSWORD" >}}` | Your PostfixAdmin database user password. | -1. As a developer, you should already be familiar with the Linux command line, the nano text editor (or any other editor capable of editing plain text files), and basic networking concepts. Akamai has quick guides on [SMTP](/docs/guides/what-is-smtp/) and [IMAP/POP](/docs/guides/what-are-pop-and-imap/) to bring you up to speed on the way these protocols work. +1. As a developer, you should already be familiar with the Linux command line and basic networking concepts. Akamai has quick guides on [SMTP](/docs/guides/what-is-smtp/) and [IMAP/POP](/docs/guides/what-are-pop-and-imap/) to bring you up to speed on the way these protocols work. 1. Although Postfix and Dovecot servers can operate in the *system* or *virtual* mode, only virtual mode is used here. In system mode, only users with local logins can send and receive emails. They do so with lookups against the operating system’s `/etc/passwd` file, and all system mode users reside in a single domain. In contrast, virtual mode allows an unlimited number of domains, users, and aliases, all unrelated to the underlying operating system. From 50d922bab1117902d23572959f75f425613302e8 Mon Sep 17 00:00:00 2001 From: John Dutton Date: Fri, 25 Oct 2024 17:21:14 -0400 Subject: [PATCH 5/6] copy edits and formatting changes --- .../how-to-setup-an-email-server/index.md | 732 ++++++++---------- 1 file changed, 340 insertions(+), 392 deletions(-) diff --git a/docs/guides/email/postfix/how-to-setup-an-email-server/index.md b/docs/guides/email/postfix/how-to-setup-an-email-server/index.md index 4ac3a05cdea..6ec2e857f4c 100644 --- a/docs/guides/email/postfix/how-to-setup-an-email-server/index.md +++ b/docs/guides/email/postfix/how-to-setup-an-email-server/index.md @@ -16,44 +16,36 @@ external_resources: - '[Post Office Protocol (POP)](https://www.rfc-editor.org/rfc/rfc1939)' --- -Email may be the one true universal app, but no provider’s offering is really "free". Large-scale service providers mine user data for sale to advertisers. Others charge usage fees by the message, user, domain, and/or megabyte. To truly get control over your messaging, the best bet is to run your own email server. +This guide walks through how to build an email server using two open source email server packages, [Postfix](https://www.postfix.org/) and [Dovecot](https://dovecot.org/). Also included are steps on setting up virtual domains, users, and aliases using [PostfixAdmin](https://postfixadmin.github.io/postfixadmin/), a web-based front end for managing Postfix and Dovecot. -While email server configuration is not trivial, it provides you with much greater privacy and flexibility. You have complete control over which domains and users you host, and how much storage you allot to each. You also gain a deeper knowledge of the key email protocols and how they work together. +## Email System Protocols and Encryption -This guide walks through how to build an email server at Akamai using [Postfix](https://www.postfix.org/) and [Dovecot](https://dovecot.org/), two popular open source email server packages. You also learn how to set up virtual domains, users, and aliases using [PostfixAdmin](https://postfixadmin.github.io/postfixadmin/), a web-based front end for managing Postfix and Dovecot. - -Before delving into the details, first, consider why you wouldn’t want to run your own email server. Setup isn’t difficult, but it is time-consuming. You need to set aside a significant chunk of time (several hours, at minimum) to ensure your server functions properly. You also need to commit to ongoing maintenance of your server, both to keep it regularly patched and to troubleshoot any delivery issues. If you don’t have time for system administration tasks or don’t mind the privacy tradeoffs, consider using a commercial email service instead. - -## A Quick Introduction to Email Systems - -The email server built in this guide uses just four main protocols: +The email server built in this guide uses four protocols: - [Simple Mail Transfer Protocol (SMTP)](https://www.rfc-editor.org/rfc/rfc5321) -- [message submission](https://www.rfc-editor.org/rfc/rfc6409) +- [Message submission](https://www.rfc-editor.org/rfc/rfc6409) - [Internet Message Access Protocol (IMAP)](https://www.rfc-editor.org/rfc/rfc9051) - [Post Office Protocol (POP)](https://www.rfc-editor.org/rfc/rfc1939). -SMTP works for message delivery, optionally from client to server, and always between servers. Clients often use a separate protocol called submission to move messages from mail clients, called *mail user agents* (MUAs), to mail servers, called *mail transfer agents* (MTAs). MTAs always communicate over **SMTP**. +**SMTP** works for message delivery between servers and optionally from client to server. Clients often use a separate protocol called "submission" to move messages from mail clients (mail user agents, or **MUAs**) to mail servers (mail transfer agents, or **MTAs**). MTAs always communicate over SMTP. -IMAP and POP are *message retrieval* protocols. They operate exclusively between a local mail server and an MUA. +**IMAP** and **POP** are message retrieval protocols and operate exclusively between a local mail server and an MUA. -None of the mail protocols encrypt data in transit by themselves. In this guide, learn how to use Transport Layer Security (TLS) mechanisms to build encrypted tunnels between MUAs and your mail server. While your server is capable of TLS-encrypting traffic with other servers, that's only if the remote servers also support TLS. The free [Let's Encrypt](https://letsencrypt.org/) service provides certificates and private keys on which TLS relies. +This guide uses Transport Layer Security (TLS) mechanisms to build encrypted tunnels between MUAs and your mail server since none of these mail protocols encrypt data in transit by themselves. Your server is capable of TLS-encrypting traffic with other servers, but only if the remote servers also support TLS. The free [Let's Encrypt](https://letsencrypt.org/) service provides certificates and private keys on which TLS relies. -Postfix is a widely used open source SMTP server, and it’s included in most Linux distributions, including Ubuntu. Similarly, Dovecot is a common IMAP and POP server, and it too is available as an Ubuntu package. +Postfix is a widely-used open source SMTP server and is included in most Linux distributions, including Ubuntu. Dovecot is also a common IMAP and POP server and is available as an Ubuntu package. ## Before You Begin -Before you begin, it’s important to understand five key assumptions this guide makes: +1. This guide recommends using a **Dedicated 8 GB** Compute Instance using **Ubuntu 24.04 LTS**. This plan size is the recommended starting point for an email server for a small to medium enterprise. See our [Get started with Compute Instances](https://techdocs.akamai.com/cloud-computing/docs/getting-started-with-compute-instances) and [Create a Compute Instance](https://techdocs.akamai.com/cloud-computing/docs/create-a-compute-instance) guides. -1. If you do not already have a virtual machine to use, create a Compute Instance. See our [Getting Started with Linode](/docs/products/platform/get-started/) and [Creating a Compute Instance](/docs/products/compute/compute-instances/guides/create/) guides. +1. Follow our [Setting Up and Securing a Compute Instance](/docs/products/compute/compute-instances/guides/set-up-and-secure/) guide to update and secure your system. Make sure to set the timezone, configure your hostname, create a limited user account, and harden SSH access. - Use **Ubuntu 24.04 LTS** to create the Linode instance. Ubuntu LTS distributions are a good choice for servers because [they are fully supported with security patches for five years following the release date](https://ubuntu.com/about/release-cycle). - - Select the **Dedicated 8 GB** plan with 4 CPUs, 160 GB storage, and a 5 TB transfer. This is a sane starting point for an email server for a small to medium enterprise. - -1. Follow our [Setting Up and Securing a Compute Instance](/docs/products/compute/compute-instances/guides/set-up-and-secure/) guide to update your system. Also set the timezone, configure your hostname, create a limited user account, and harden SSH access. + {{< note type="warning" title="Do not enable IPv6" >}} + When setting up and securing your Compute Instance, do not enable IPv6. Enabling IPv6 may cause issues later when Certbot attempts to update the Let's Encrypt certificate. + {{< /note >}} - This guide sets up a mail server called `mail.{{< placeholder "example.tld" >}}`, but you should substitute your own domain name and configure the `/etc/hosts` file as shown: + This guide sets up a mail server called `mail.{{< placeholder "example.tld" >}}`. Substitute your own domain name, and configure the `/etc/hosts` file as shown below: ```file {title="/etc/hosts"} 127.0.0.1 localhost @@ -61,56 +53,56 @@ Before you begin, it’s important to understand five key assumptions this guide {{< placeholder "IPv6_ADDRESS" >}} mail.{{< placeholder "example.tld" >}} ``` -1. The commands, file contents, and other instructions provided throughout this guide may include example values. These are typically domain names, IP addresses, usernames, passwords, and other values that are unique to you. The table below identifies these example values and explains what to replace them with: +1. The commands, file contents, and other instructions provided throughout this guide include example values. These are typically domain names, IP addresses, usernames, passwords, and other values that are unique to you. The table below identifies these example values and explains what to replace them with: | Example Values: | Replace With: | | -- | -- | | `{{< placeholder "example.tld" >}}`| Your custom domain name. | | `{{< placeholder "IPv4_ADDRESS" >}}` | Your system's public IPv4 address. | - | `{{< placeholder "IPv4_ADDRESS" >}}` | Your system's public IPv6 address. | + | `{{< placeholder "IPv6_ADDRESS" >}}` | Your system's public IPv6 address. | | `{{< placeholder "external@email.tld" >}}` | A working external email address. | | `{{< placeholder "POSTFIXADMIN_PASSWORD" >}}` | Your PostfixAdmin database user password. | -1. As a developer, you should already be familiar with the Linux command line and basic networking concepts. Akamai has quick guides on [SMTP](/docs/guides/what-is-smtp/) and [IMAP/POP](/docs/guides/what-are-pop-and-imap/) to bring you up to speed on the way these protocols work. +1. Familiarity with [SMTP](/docs/guides/what-is-smtp/) and [IMAP/POP](/docs/guides/what-are-pop-and-imap/) protocols. -1. Although Postfix and Dovecot servers can operate in the *system* or *virtual* mode, only virtual mode is used here. In system mode, only users with local logins can send and receive emails. They do so with lookups against the operating system’s `/etc/passwd` file, and all system mode users reside in a single domain. In contrast, virtual mode allows an unlimited number of domains, users, and aliases, all unrelated to the underlying operating system. +1. Although Postfix and Dovecot servers can operate in the *system* or *virtual* mode, only virtual mode is used in this setup. -With those caveats in mind, you can move on to building your email server. + In system mode, only users with local logins can send and receive emails. System mode users do this with lookups against the operating system’s `/etc/passwd` file with all users residing in a single domain. Virtual mode allows an unlimited number of domains, users, and aliases, all unrelated to the underlying operating system. -{{< note >}} +{{< note title="Non-root users recommended" >}} This guide is written for a non-root user. Commands that require elevated privileges are prefixed with `sudo`. If you’re not familiar with the `sudo` command, see the [Users and Groups](/docs/guides/linux-users-and-groups/) guide. {{< /note >}} ## Step 1: Configure DNS -1. Configure the Domain Name System (DNS). Although this may seem unrelated to email, working DNS is the *single most important requirement in this guide*. DNS misconfiguration is a very common source of delivery problems. +Email servers require at least two DNS records, **A** and **MX**: -1. Email servers require at least two DNS records: +- An **A** record binds a hostname like `mail.{{< placeholder "example.tld" >}}` to an IPv4 address. +- An **MX** (Mail eXchanger) record indicates the server handles email for the provided domain. +- **Optional**: An **AAAA** record binds `mail.{{< placeholder "example.tld" >}}` to an IPv6 address. - - An **A** record to bind a hostname like `mail.{{< placeholder "example.tld" >}}` to an IPv4 address. - - An **MX** (Mail eXchanger) record indicates this server handles email for this domain. - - **Optional**: An **AAAA** record to bind `mail.{{< placeholder "example.tld" >}}` to an IPv6 address. +See our [A and AAAA records](https://techdocs.akamai.com/cloud-computing/docs/a-and-aaaa-records) and [MX records](https://techdocs.akamai.com/cloud-computing/docs/mx-records) guides. -1. Follow these steps to use Akamai's free DNS service: +1. Follow the below steps to configure DNS using [DNS Manager](https://techdocs.akamai.com/cloud-computing/docs/getting-started-with-dns-manager): - - Click the **Domains** menu at the left of the main dashboard. - - Create a domain with your domain name (e.g., {{< placeholder "example.tld" >}}). - - Add **A**, **MX**, and any other records as needed. - - Update your domain at your registrar to point to the **NS** records that Akamai provides. + 1. Log into Cloud Manager. + 1. Click the **Domains** tab on the left dashboard. + 1. Create a domain with your domain name (e.g., {{< placeholder "example.tld" >}}). + 1. Add **A**, **MX**, and any other records as needed. + 1. Update your domain from your registrar to use [Linode's authoritative name servers](https://techdocs.akamai.com/cloud-computing/docs/configure-your-domains-authoritative-name-servers). - {{< note >}} - Linode does not actually block SMTP ports in the us-west data center, so it’s safe to ignore this warning. If your data center does block inbound traffic on TCP ports `25`, `465`, or `587`, go ahead and open a support ticket asking that inbound and outbound access to these ports be opened for your server. + {{< note title="Blocked SMTP Ports" >}} + If your data center blocks inbound traffic on TCP ports `25`, `465`, or `587`, open a [Support ticket](https://www.linode.com/support/) requesting inbound and outbound access to these ports be opened for your server. {{< /note >}} -1. **Optional**: Update the reverse DNS (RDNS) information so that at least one of your server’s IP addresses points back to the hostname `mail.{{< placeholder "example.tld" >}}`. - -1. Follow these steps to edit RDNS: +1. **Optional**: Update the [reverse DNS (rDNS)](https://techdocs.akamai.com/cloud-computing/docs/configure-rdns-reverse-dns-on-a-compute-instance#setting-reverse-dns) information to point one of your server’s IP addresses back to your hostname `mail.{{< placeholder "example.tld" >}}`: - Click on the **Linodes** tab of the main dashboard. + - Select your Linode. - Select the **Network** tab. - - In the **IP addresses** section, you can set RDNS for each IP address. Each RDNS setting creates a pointer (PTR) record that associates an IP address with a hostname. + - In the **IP Addresses** section, set rDNS for your preferred IP address using the **Edit RDNS** option. Each rDNS setting creates a pointer (PTR) record that associates an IP address with a hostname. -1. Before proceeding further, it's crucial to verify that the DNS records for your server are working correctly. You can use the `dig` tool to validate each record. Here are example commands to verify that the **A**, **AAAA**, **MX**, and **PTR** records exist for the server: +1. Verify your DNS records are functioning by using the `dig` utility to validate each record. Below are example commands you can use to verify **A**, **AAAA**, **MX**, and **PTR** records exist for the server. Note that DNS propagation may take up to 24 hours: - Validate the **A** record for `mail.{{< placeholder "example.tld" >}}`: @@ -164,25 +156,23 @@ This guide is written for a non-root user. Commands that require elevated privil ## Step 2: Install Postfix -1. Install the Postfix SMTP server package using the command below: +1. Install the Postfix SMTP server package: ```command sudo apt install postfix ``` - The installer prompts you to pick a server type, the default option is **Internet Site**. Enter a hostname, such as `mail.{{< placeholder "example.tld" >}}` and optionally choose whether to restart services. + The installer prompts you to pick a server type, the default option is **Internet Site**. Enter a hostname, such as `mail.{{< placeholder "example.tld" >}}`, and optionally choose whether to restart services. - {{< note >}} You may encounter the same setup screen again when upgrading Postfix in the future. If so, choose **No configuration** to retain your current settings. - {{< /note >}} -1. After the installation completes, verify that you have the correct version of Postfix: +1. Once installation is complete, verify your version of Postfix: ```command sudo postconf mail_version ``` - The version displayed (`3.8.6`) is standard on Ubuntu 24.04 LTS: + As of this writing, the version displayed (`3.8.6`) is standard on Ubuntu 24.04 LTS: ```output mail_version = 3.8.6 @@ -194,16 +184,16 @@ This guide is written for a non-root user. Commands that require elevated privil sudo ss -lnpt | grep master ``` - The following output is displayed: + The following output should be displayed: ```output LISTEN 0 100 0.0.0.0:25 0.0.0.0:* users:(("master",pid=2157,fd=13)) LISTEN 0 100 [::]:25 [::]:* users:(("master",pid=2157,fd=14)) ``` - The output above indicates that the Postfix server is listening for incoming connections on TCP port `25` for both IPv4 and IPv6 on any IP address. + This indicates the Postfix server is listening for incoming connections on TCP port `25` for both IPv4 and IPv6 on any IP address. -1. Verify that your server can make outbound SMTP connections: +1. Verify your server can make outbound SMTP connections: ```command sudo nc gmail-smtp-in.l.google.com 25 @@ -215,35 +205,33 @@ This guide is written for a non-root user. Commands that require elevated privil 220 mx.google.com ESMTP 00721157ae682-62ccae740b7si23680997b3.287 - gsmtp ``` - If not, check internal and/or firewall rules to ensure outbound TCP port `25` is allowed. You can exit this session and return to the terminal prompt by pressing CTRL+C. + If you do not get the above output, check internal and/or firewall rules to ensure outbound TCP port `25` is allowed. You can exit this session and return to the terminal prompt by pressing CTRL+C. -1. To set the hostname in Postfix, open the main Postfix configuration file: +1. To set the hostname in Postfix, open the main Postfix configuration file using the text editor of your choice: ```command sudo nano /etc/postfix/main.cf ``` - Find the `myhostname` parameter and set it to the desired hostname. + Find the `myhostname` parameter, set it to your desired hostname, and save your changes: ```file {title="/etc/postfix/main.cf" linenostart="37"} myhostname = {{< placeholder "mail.example.tld" >}} ``` - When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. - 1. Reload Postfix: ```command sudo systemctl reload postfix ``` -1. Update the `/etc/aliases` file to receive messages from the system itself. +1. Open and update the `/etc/aliases` file to receive messages from the system: ```command sudo nano /etc/aliases ``` - Edit the file to set `root` to a real email address where you can reliably receive mail. + Set `root` to a working email address where you can reliably receive mail, and save your changes: ```file {title="/etc/aliases" hl_lines="3"} # See man 5 aliases for format @@ -251,52 +239,50 @@ This guide is written for a non-root user. Commands that require elevated privil root: {{< placeholder "external@email.tld" >}} ``` - When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. - 1. Rebuild the alias database: ```command sudo newaliases ``` -1. Verify that the system can send an outgoing message to the external address where you can receive email: +1. Send a test message to verify the system can send an outgoing message to your external email address: ```command echo "test email" | sudo sendmail {{< placeholder "external@email.tld" >}} ``` - Verify that you received the message on the remote end. You should receive an email from `root` with no subject and `test email` as the body content. If not, you may need to check `/var/log/mail.log` for troubleshooting. + Verify you received the message at your working email address. The message should be an email from `root` with no subject and `test email` as the body content. If not, you may need to check `/var/log/mail.log` for troubleshooting. ## Step 3: Let's Encrypt and Nginx -As configured so far, Postfix does not encrypt traffic in transit. To avoid having traffic intercepted, enable Transport Layer Security (TLS) to set up encrypted tunnels between mail clients and your server. TLS relies on certificates, which in turn require a working Web server and access to the free [Let's Encrypt](https://letsencrypt.org/) service. +To avoid having traffic intercepted, enable Transport Layer Security (TLS) to set up encrypted tunnels between mail clients and your server. TLS relies on certificates, which in turn require a working web server and access to the free [Let's Encrypt](https://letsencrypt.org/) service. -1. Install `certbot`, a tool that automates Let's Encrypt certificate creation and maintenance. +1. Install `certbot`, a tool that automates Let's Encrypt certificate creation and maintenance: ```command sudo apt install certbot ``` -1. Install the [Nginx](https://nginx.org/) web server, which is required for Let's Encrypt setup and later for PostfixAdmin: +1. Install the [NGINX](https://nginx.org/) web server. This is required for Let's Encrypt setup and later for PostfixAdmin: ```command sudo apt install nginx ``` -1. Install the Python3 Nginx `certbot` plugin: +1. Install the Python3 NGINX `certbot` plugin: ```command sudo apt install python3-certbot-nginx ``` -1. Define a virtual host for Nginx by creating a file `/etc/nginx/conf.d/mail.{{< placeholder "example.tld" >}}`: +1. Define a virtual host for NGINX by creating a file `/etc/nginx/conf.d/mail.{{< placeholder "example.tld" >}}`: ```command sudo nano /etc/nginx/conf.d/mail.{{< placeholder "example.tld" >}}.conf ``` - Add the following contents to the file, replacing {{< placeholder "example.tld" >}} with your domain name: + Add the following contents to the file, replacing {{< placeholder "example.tld" >}} with your domain name. When complete, save your changes: ```file {title="/etc/nginx/conf.d/mail.{{< placeholder "example.tld" >}}.conf" lang="conf"} server { @@ -312,21 +298,19 @@ As configured so far, Postfix does not encrypt traffic in transit. To avoid havi } ``` - When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. - -1. Ensure that the `/usr/share/nginx/html` directory exists by creating it: +1. Create the `/usr/share/nginx/html` directory if it does not already exist: ```command sudo mkdir -p /usr/share/nginx/html ``` -1. Restart Nginx to load the new virtual host configuration: +1. Restart NGINX to load the new virtual host configuration: ```command sudo systemctl restart nginx ``` -1. Verify that Nginx is running: +1. Verify NGINX is running: ```command sudo systemctl status nginx @@ -338,9 +322,9 @@ As configured so far, Postfix does not encrypt traffic in transit. To avoid havi Active: active (running) since Mon 2024-06-10 11:12:29 EDT; 4s ago ``` - You can exit this session and return to the terminal prompt by pressing CTRL+C. + Exit this session and return to the terminal prompt by pressing CTRL+C. -1. Before generating a Let's Encrypt certificate, test your setup by including the `--dry-run` parameter in the certificate request. Replace {{< placeholder "external@email.tld" >}} with a real email address where you can reliably receive mail and {{< placeholder "example.tld" >}} with your actual domain name: +1. Test your setup with the `--dry-run` parameter in the certificate request. Replace {{< placeholder "external@email.tld" >}} with your working external email address and {{< placeholder "example.tld" >}} with your domain name: ```command sudo certbot certonly --dry-run -a nginx --agree-tos --no-eff-email --staple-ocsp --email {{< placeholder "external@email.tld" >}} -d mail.{{< placeholder "example.tld" >}} @@ -353,7 +337,7 @@ As configured so far, Postfix does not encrypt traffic in transit. To avoid havi The dry run was successful. ``` -1. If the response indicates that the dry run was successful, proceed to obtain the certificate for real by running the same command without the `--dry-run` switch: +1. If the response indicates a successful dry run, proceed to obtain the certificate by running the same command without the `--dry-run` option: ```command sudo certbot certonly -a nginx --agree-tos --no-eff-email --staple-ocsp --email {{< placeholder "external@email.tld" >}} -d mail.{{< placeholder "example.tld" >}} @@ -382,7 +366,7 @@ As configured so far, Postfix does not encrypt traffic in transit. To avoid havi sudo nano /etc/postfix/main.cf ``` - Scroll down to the `# TLS parameters` section. First, locate the `smtpd_tls_cert_file` and `smtpd_tls_key_file` parameters, and replace their values with the file locations from `certbot`. If not present, add the remaining highlighted lines to enable TLS transport and enforce TLSv1.2 or TLSv1.3: + Locate the `# TLS parameters` section. Find the `smtpd_tls_cert_file` and `smtpd_tls_key_file` parameters, and replace their values with the file locations from the `certbot` command output above. If not present, add the remaining highlighted lines to enable TLS transport and enforce TLSv1.2 or TLSv1.3. When complete, save your changes: ```file {title="/etc/postfix/main.cf" linenostart="26" hl_lines="2-3,5-6,10-15"} # TLS parameters @@ -402,12 +386,10 @@ As configured so far, Postfix does not encrypt traffic in transit. To avoid havi smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 ``` - {{< note >}} - TLS prior to version 1.2 and all versions of Secure Sockets Layer (SSL) are insecure, and you should disallow them. + {{< note type=warning title="TLS and SSL version security" >}} + TLS prior to version 1.2, and all versions of Secure Sockets Layer (SSL), are insecure and should be disallowed. {{< /note >}} - When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. - 1. Restart Postfix to apply the changes: ```command @@ -416,9 +398,9 @@ As configured so far, Postfix does not encrypt traffic in transit. To avoid havi ## Step 4: Submission -The steps below enable mail clients to submit outgoing mail to your server using the submission protocol instead of SMTP. This is necessary because many ISPs block SMTP (TCP port `25`) but allow outgoing submission connections (TCP ports `465` and/or `587`). Separating SMTP and submission functions can also help with troubleshooting. +The steps below enable mail clients to submit outgoing mail to your server using the submission protocol instead of SMTP. This is necessary since many ISPs block SMTP (TCP port `25`) but allow outgoing submission connections (TCP ports `465` and/or `587`). Separating SMTP and submission functions can also help with troubleshooting. -1. Open the `/etc/postfix/master.cf` file for editing. +1. Open the `/etc/postfix/master.cf` file: ```command sudo nano /etc/postfix/master.cf @@ -438,7 +420,7 @@ The steps below enable mail clients to submit outgoing mail to your server using -o smtpd_sasl_path=private/auth ``` - If you or your users run Outlook and need to use the Secure SMTP (SMTPS) protocol on TCP port `465`, add the following lines as well: + If you or your users run Outlook and need to use the Secure SMTP (SMTPS) protocol on TCP port `465`, also add the following lines: ```file {title="/etc/postfix/master.cf" linenostart="150"} smtps inet n - y - - smtpd @@ -451,7 +433,7 @@ The steps below enable mail clients to submit outgoing mail to your server using -o smtpd_sasl_path=private/auth ``` - When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. + When done, save your changes. 1. Restart Postfix to apply the changes. @@ -478,15 +460,15 @@ The steps below enable mail clients to submit outgoing mail to your server using ## Step 5: Dovecot -The Postfix server allows your server to send outgoing messages and receive emails from others. However, you need a different server, *Dovecot*, for your clients to retrieve mail from the server. +The Postfix server allows your server to send outgoing messages and receive emails from others. However, you need a different server, *Dovecot*, for your clients to retrieve mail. -1. First, install Dovecot using the following command: +1. Install Dovecot: ```command sudo apt install dovecot-core dovecot-imapd ``` - {{< note >}} + {{< note title="POP3 Support" >}} POP3 support is optional. However, unless you have users who specifically require the older POP3 protocol, it's recommended to use IMAP. Should POP3 support be required, use the command below: ```command @@ -494,13 +476,13 @@ The Postfix server allows your server to send outgoing messages and receive emai ``` {{< /note >}} -1. You can verify the Dovecot installation by running the following command: +1. Verify the Dovecot installation: ```command dovecot --version ``` - For Ubuntu 24.04 LTS, the Dovecot version is `2.3.21`: + As of this writing, the Dovecot version for Ubuntu 24.04 LTS is `2.3.21`: ```output 2.3.21 (47349e2482) @@ -512,7 +494,7 @@ The Postfix server allows your server to send outgoing messages and receive emai sudo nano /etc/dovecot/dovecot.conf ``` - Add the following line directly under `# Enable installed protocols`: + Add the following line directly under `# Enable installed protocols`, and save your changes: ```file {title="/etc/dovecot/dovecot.conf" lang="conf" linenostart="23" hl_Lines="2"} # Enable installed protocols @@ -520,33 +502,29 @@ The Postfix server allows your server to send outgoing messages and receive emai !include_try /usr/share/dovecot/protocols.d/*.protocol ``` - LMTP is explained in the [next section](/docs/guides/how-to-setup-an-email-server/#step-6-local-message-storage-lmtp). + LMTP protocol is explained in the next section: [Local Message Storage (LMTP)](/docs/guides/how-to-setup-an-email-server/#step-6-local-message-storage-lmtp). - {{< note >}} - If using POP3, change the line to include `pop3`: + If using POP3 protocol, edit the line to also include `pop3`: ```file {title="/etc/dovecot/dovecot.conf" lang="conf" linenostart="23" hl_Lines="2"} # Enable installed protocols protocols = imap lmtp pop3 !include_try /usr/share/dovecot/protocols.d/*.protocol ``` - {{< /note >}} - - When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. -1. Set the mail folder location and storage type by editing the file `/etc/dovecot/conf.d/10-mail.conf`. +1. Set the mail folder location and storage type by editing the `/etc/dovecot/conf.d/10-mail.conf` file: ```command sudo nano /etc/dovecot/conf.d/10-mail.conf ``` - Find the `mail_location = mbox:~/mail:INBOX=/var/mail/%u` line and change it to: + Locate the `mail_location = mbox:~/mail:INBOX=/var/mail/%u` line, and change the value to read: ```file {title="/etc/dovecot/conf.d/10-mail.conf" lang="conf" linenostart="30"} mail_location = maildir:~/Maildir ``` - When done press CTRL+X, followed by Y then Enter to save the file and exit `nano`. + Save your changes. 1. Add the Dovecot user to the `mail` group to ensure proper permissions. @@ -560,7 +538,7 @@ The Postfix server allows your server to send outgoing messages and receive emai info: Adding user `dovecot' to group `mail' ... ``` -1. Verify that the `dovecot` user is added to the `mail` group: +1. Verify the `dovecot` user is added to the `mail` group: ```command groups dovecot @@ -572,105 +550,105 @@ The Postfix server allows your server to send outgoing messages and receive emai ## Step 6: Local Message Storage (LMTP) -Because Postfix also uses `mbox` by default rather than `Maildir`, some additional configuration is necessary to ensure messages enter Dovecot in `Maildir` format. Instead of using Postfix’s built-in local delivery agent (LDA), which defaults to `mbox`, configure LMTP (a local version of SMTP) to deliver messages to Dovecot in `Maildir` format. +Since Postfix uses `mbox` by default rather than `Maildir`, some additional configuration is necessary to ensure messages enter Dovecot in `Maildir` format. Instead of using Postfix’s built-in local delivery agent (LDA) which defaults to `mbox`, configure LMTP (a local version of SMTP) to deliver messages to Dovecot in `Maildir` format. -1. First, install LMTP: +1. Install LMTP: ```command sudo apt install dovecot-lmtpd ``` -1. Now open the Dovecot `10-master.conf` file: +1. Open the Dovecot `10-master.conf` file: ```command sudo nano /etc/dovecot/conf.d/10-master.conf ``` - - Search for the following section: + Find the `service lmtp` section: - ```file {title="/etc/dovecot/conf.d/10-master.conf" lang="conf" linenostart="57"} - service lmtp { - unix_listener lmtp { - #mode = 0666 - } + ```file {title="/etc/dovecot/conf.d/10-master.conf" lang="conf" linenostart="57"} + service lmtp { + unix_listener lmtp { + #mode = 0666 + } - # Create inet listener only if you can't use the above UNIX socket - #inet_listener lmtp { - # Avoid making LMTP visible for the entire internet - #address = - #port = - #} + # Create inet listener only if you can't use the above UNIX socket + #inet_listener lmtp { + # Avoid making LMTP visible for the entire internet + #address = + #port = + #} + } + ``` + + Replace it with the following code, ensuring the opening and closing braces match: + + ```file {title="/etc/dovecot/conf.d/10-master.conf" lang="conf" linenostart="57"} + service lmtp { + unix_listener /var/spool/postfix/private/dovecot-lmtp { + mode = 0600 + user = postfix + group = postfix } - ``` + } + ``` - Replace it with the following code, ensuring the opening and closing braces match: + At the end of the file, add the following section to allow PostfixAdmin to read statistics from Dovecot: - ```file {title="/etc/dovecot/conf.d/10-master.conf" lang="conf" linenostart="57"} - service lmtp { - unix_listener /var/spool/postfix/private/dovecot-lmtp { - mode = 0600 - user = postfix - group = postfix - } + ```file {title="/etc/dovecot/conf.d/10-master.conf" lang="conf" linenostart="129"} + service stats { + unix_listener stats-reader { + user = www-data + group = www-data + mode = 0660 } - ``` + unix_listener stats-writer { + user = www-data + group = www-data + mode = 0660 + } + } + ``` + + Enable Simple Authentication and Security Layer (SASL) communications between Postfix and Dovecot. Locate the `unix_listener auth-userdb` block in the `service auth` section: - - At the end of the file, add the following section to allow PostfixAdmin to read statistics from Dovecot. - - ```file {title="/etc/dovecot/conf.d/10-master.conf" lang="conf" linenostart="129"} - service stats { - unix_listener stats-reader { - user = www-data - group = www-data - mode = 0660 - } - unix_listener stats-writer { - user = www-data - group = www-data - mode = 0660 - } + ```file {title="/etc/dovecot/conf.d/10-master.conf" lang="conf" linenostart="84"} + unix_listener auth-userdb { + #mode = 0666 + #user = + #group = } - ``` - - Enable Simple Authentication and Security Layer (SASL) communications between Postfix and Dovecot. Locate the `unix_listener auth-userdb {` line in the `service auth {` section: + # Postfix smtp-auth + #unix_listener /var/spool/postfix/private/auth { + # mode = 0666 + #} + ``` - ```file {title="/etc/dovecot/conf.d/10-master.conf" lang="conf" linenostart="84"} - unix_listener auth-userdb { - #mode = 0666 - #user = - #group = - } + Comment out the `unix_listener auth-userdb` section, and uncomment the `unix_listener /var/spool/postfix/private/auth` section: - # Postfix smtp-auth - #unix_listener /var/spool/postfix/private/auth { - # mode = 0666 - #} - ``` + ```file {title="/etc/dovecot/conf.d/10-master.conf" lang="conf" linenostart="84"} + #unix_listener auth-userdb { + #mode = 0666 + #user = + #group = + #} - Make the following adjustments:: - - ```file {title="/etc/dovecot/conf.d/10-master.conf" lang="conf" linenostart="84"} - #unix_listener auth-userdb { - #mode = 0666 - #user = - #group = - #} - - # Postfix smtp-auth - unix_listener /var/spool/postfix/private/auth { - mode = 0660 - user = postfix - group = postifx - } - ``` + # Postfix smtp-auth + unix_listener /var/spool/postfix/private/auth { + mode = 0660 + user = postfix + group = postifx + } + ``` - {{< note type="warning" >}} - Ensure the file maintains matching sets of opening and closing curly braces. If there is a mismatched set, dovecot does not start or restart. If you get an error when starting or restarting Dovecot, check `/var/log/syslog` to find the offending line in the `10-master.conf` configuration file. + {{< note type="warning" title="Check your braces syntax" >}} + Ensure the file maintains matching sets of opening and closing curly braces. If there is a mismatched set, Dovecot does not start or restart. If you get an error when starting or restarting Dovecot, check `/var/log/syslog` to find the offending line in the `10-master.conf` configuration file. {{< /note >}} - When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. + When complete, save your changes. -1. Add the Nginx user, `www-data`, to the dovecot group and grant permissions using ACLs: +1. Add the NGINX user `www-data` to the `dovecot` group and grant permissions using ACLs: ```command sudo gpasswd -a www-data dovecot @@ -690,20 +668,18 @@ Because Postfix also uses `mbox` by default rather than `Maildir`, some addition sudo nano /etc/postfix/main.cf ``` - Add the following two lines to the end of the file: + Add the following two lines to the end of the file, and save your changes: ```file {title="/etc/postfix/main.cf" linenostart="54"} mailbox_transport = lmtp:unix:private/dovecot-lmtp smtputf8_enable = no ``` - The first line tells Postfix to use a Unix socket to communicate over LMTP to the Dovecot service you just created. The second line disables [an extension for internationalized mail](https://www.rfc-editor.org/rfc/rfc6531) that Dovecot doesn’t support as of version 2.3.21, the version included with Ubuntu 24.04 LTS. - - When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. + The first line tells Postfix to use a Unix socket to communicate over LMTP to the Dovecot service. The second line disables [an extension for internationalized mail](https://www.rfc-editor.org/rfc/rfc6531) that Dovecot doesn’t support as of version 2.3.21, the version included with Ubuntu 24.04 LTS. ## Step 7: Dovecot Authentication and Encryption -Just as you configured Postfix to use TLS to encrypt Postfix data in transit, you need to do the same for Dovecot traffic. +Similar to Postfix, Dovecot traffic must be configured to use TLS to encrypt data in transit. 1. Open the `/etc/dovecot/conf.d/10-auth.conf` file: @@ -711,7 +687,7 @@ Just as you configured Postfix to use TLS to encrypt Postfix data in transit, yo sudo nano /etc/dovecot/conf.d/10-auth.conf ``` - Uncomment the following line to disable plaintext authentication when TLS encryption is not used: + Uncomment the `disable_plaintext_auth` line to disable plaintext authentication when TLS encryption is not used: ```file {title="/etc/dovecot/conf.d/10-auth.conf" lang="conf" linenostart="10"} disable_plaintext_auth = yes @@ -723,7 +699,7 @@ Just as you configured Postfix to use TLS to encrypt Postfix data in transit, yo auth_mechanisms = plain login ``` - When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. + Save your changes. 1. Open the `/etc/dovecot/conf.d/10-ssl.conf` file: @@ -731,7 +707,7 @@ Just as you configured Postfix to use TLS to encrypt Postfix data in transit, yo sudo nano /etc/dovecot/conf.d/10-ssl.conf ``` - To enable the TLS encryption change the line `ssl = yes` into `ssl =required`: + Change the line `ssl = yes` to `ssl =required` to enable TLS encryption: ```file {title="/etc/dovecot/conf.d/10-ssl.conf" lang="conf" linenostart="6"} ssl = required @@ -750,13 +726,13 @@ Just as you configured Postfix to use TLS to encrypt Postfix data in transit, yo ssl_min_protocol = TLSv1.2 ``` - Set the server to prefer its own ciphers to protect email. This ensures the server determines the order in which to attempt different ciphers. This means it's not at the mercy of a client that starts with a weak cipher. Uncomment the `ssl_prefer_server_ciphers` parameter and change it from `no` to `yes`. + Set the server to prefer its own ciphers to protect email. This ensures the server determines the order in which to attempt different ciphers and protects against clients starting with a weak cipher. Uncomment the `ssl_prefer_server_ciphers` parameter and change it from `no` to `yes`. ```file {title="/etc/dovecot/conf.d/10-ssl.conf" lanf="conf" linenostart="75"} ssl_prefer_server_ciphers = yes ``` - When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. + Save your changes when complete. 1. Open the `/etc/ssl/openssl.cnf` file: @@ -770,17 +746,17 @@ Just as you configured Postfix to use TLS to encrypt Postfix data in transit, yo #providers = provider_sect ``` - When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. + Save your changes. - {{< note >}} - Version 3.0.2 of OpenSSL included with Ubuntu 22.04 LTS supports FIPS by default, but Dovecot doesn’t. If you leave FIPS enabled, you’re likely to see errors like the following in your log files: + {{< note title="FIPS Support" >}} + Version 3.0.2 of OpenSSL included with Ubuntu 22.04 LTS supports FIPS by default, but Dovecot does not. If FIPS is left enabled, you may see errors similar to the following in your log files: ```output imap-login: Error: Failed to initialize SSL server context: Can't load SSL certificate: error:25066067:DSO support routines:dlfcn_load:could not load the shared library: filename(libproviders.so) ``` {{< /note >}} -1. Restart Postfix and Dovecot using the following commands: +1. Restart Postfix and Dovecot: ```command sudo systemctl restart postfix @@ -789,15 +765,15 @@ Just as you configured Postfix to use TLS to encrypt Postfix data in transit, yo ## Step 8: MariaDB -Since the server is running in virtual mode, with domains, users, and aliases existing independent of the underlying operating system, you need a place to store account data. This guide uses [MariaDB](https://mariadb.com/), an open source fork of the [MySQL](https://www.mysql.com/) database, for storing mail accounts and related info. MariaDB is also a requirement for PostfixAdmin, the graphical management tool installed in the next step. +Since the server runs in virtual mode, with domains, users, and aliases existing independent of the underlying operating system, a location to store account data must be configured. This guide uses [MariaDB](https://mariadb.com/) for storing mail accounts and related info. MariaDB is also a requirement for PostfixAdmin, the graphical management tool installed in the next step. -1. To begin, install the MariaDB server and client packages: +1. Install the MariaDB server and client packages: ```command sudo apt install mariadb-server mariadb-client ``` -1. The installation routine should conclude by starting MariaDB. Verify this with a `status` command: +1. When installation completes, MariaDB should start automatically. Verify MariaDB is running with the `status` command: ```command sudo systemctl status mariadb @@ -812,15 +788,13 @@ Since the server is running in virtual mode, with domains, users, and aliases ex ... ``` - Press the Q key to exit the status output and return to the terminal prompt. - - {{< note >}} If MariaDB isn't running, use the following command to launch it: ```command sudo systemctl start mariadb ``` - {{< /note >}} + + Press the Q key to exit the status output and return to the terminal prompt. 1. Enable MariaDB to start every time the system reboots: @@ -833,7 +807,7 @@ Since the server is running in virtual mode, with domains, users, and aliases ex Executing: /usr/lib/systemd/systemd-sysv-install enable mariadb ``` -1. It's important to secure the database, and the MariaDB server includes a script for this: +1. Run the included `mysql_secure_installation` script to secure the database: ```command sudo mysql_secure_installation @@ -858,31 +832,31 @@ Since the server is running in virtual mode, with domains, users, and aliases ex Thanks for using MariaDB! ``` - Your database server is now secured against the most common attacks. - ## Step 9: PostfixAdmin -PostfixAdmin is a simple management tool for Postfix/Dovecot that simplifies email administration tasks. After installing PostfixAdmin, you can manage your domains, users, and alias accounts from any web browser. +PostfixAdmin is a management tool for Postfix/Dovecot that helps with email administration tasks, and allows you to manage your domains, users, and alias accounts from a web browser. + +### Prerequisite: DNS Configuration for PostfixAdmin -While PostfixAdmin makes email server management easy, installation takes multiple steps, though none are difficult. This guide breaks down the instructions into several subsections explained below. The configuration steps may seem daunting, but most of them are required for virtual email support, even without a graphical management interface. +Even though PostfixAdmin runs on the same host, you must use a different hostname such as `postfixadmin.{{< placeholder "example.tld" >}}` for email management. To do this, add **A** and/or **AAAA** DNS records for your new hostname. -### Step 9a: DNS Configuration +If you’re using the Linode DNS Manager to manage your DNS, select the **Domains** menu on the left side of the Cloud Manager dashboard (see [Step 1](/docs/guides/how-to-setup-an-email-server/#step-1-linode-server-creation)). Point `postfixadmin.{{< placeholder "example.tld" >}}` to the same IP address(es) you are using for `mail.{{< placeholder "example.tld" >}}`. -Even though PostfixAdmin runs on the same host, use a different hostname such as `postfixadmin.{{< placeholder "example.tld" >}}` for email management. To do so, you need to add DNS **A** and/or **AAAA** records for this new hostname. If you’re using Akamai as your DNS provider, access the **Domains** menu at the left of the Cloud dashboard, the same as in [Step 1](/docs/guides/how-to-setup-an-email-server/#step-1-linode-server-creation). You can point `postfixadmin.{{< placeholder "example.tld" >}}` to the same IP address(es) you are using for `mail.{{< placeholder "example.tld" >}}`. +Note that DNS propagation may take up to 24 hours. -### Step 9b: Download the Latest PostfixAdmin +### Download the Latest Version of PostfixAdmin -To ensure the best experience with PostfixAdmin and avoid potential issues, it is recommended to install it from GitHub instead of the Ubuntu package. Here's why: +It is recommended to install PostfixAdmin from GitHub rather than the Ubuntu package to ensure the best overall experience, including the following benefits: -- **Upgrades and Compatibility**: The included PostfixAdmin version in Ubuntu packages may not always be up-to-date with the latest features and bug fixes. Additionally, upgrades to the underlying Ubuntu operating system can potentially break the included version. +- **Upgrades and Compatibility**: The included PostfixAdmin version in Ubuntu packages may not always be up-to-date with the latest features and bug fixes. Upgrades to the underlying Ubuntu operating system may also potentially break the included version. -- **Avoiding Login Errors**: The Ubuntu package version of PostfixAdmin may sometimes result in "Invalid token!" errors when attempting to log in. Installing from the GitHub repository can help mitigate these issues and provide a smoother experience. +- **Avoiding Login Errors**: The Ubuntu package version of PostfixAdmin may sometimes result in `Invalid token!` errors when attempting to log in. Installing from the GitHub repository can help mitigate this issue. -- **Consistency with Nginx**: Since Nginx is your web server, the Ubuntu package version of PostfixAdmin may attempt to install and use Apache. This can lead to conflicts and configuration issues. Installing from the GitHub repository ensures consistency and compatibility with Nginx. +- **NGINX Compatibility**: The Ubuntu package version of PostfixAdmin may attempt to install and use the Apache web server. This can lead to conflicts and configuration issues since your system is already using NGINX. Installing from the GitHub repository ensures consistency and compatibility with NGINX. -To ensure the latest version of PostfixAdmin is installed, follow the steps below to download it from the GitHub repository: +Follow the steps below to download the latest version of PostfixAdmin from the GitHub repository: -1. Change to the `/tmp` directory: +1. Navigate to the `/tmp` directory: ```command cd /tmp @@ -894,10 +868,10 @@ To ensure the latest version of PostfixAdmin is installed, follow the steps belo sudo apt install wget ``` -1. Visit the [GitHub page for PostfixAdmin](https://github.com/postfixadmin/postfixadmin/releases) and note the latest release version. As of writing this guide, the current release is version **3.3.13**. If there is a newer release available, substitute `3.3.13` in the command below with the appropriate version for the latest release: +1. Visit the [GitHub page for PostfixAdmin](https://github.com/postfixadmin/postfixadmin/releases) and note the latest release version. Substitute `{{< placeholder "3.3.13" >}}` in the command below with the appropriate version for the latest release: ```command - wget https://github.com/postfixadmin/postfixadmin/archive/refs/tags/postfixadmin-3.3.13.tar.gz + wget https://github.com/postfixadmin/postfixadmin/archive/refs/tags/postfixadmin-{{< placeholder "3.3.13" >}}.tar.gz ``` 1. Once the download is complete, use the following commands to extract the archive and move it to the `/var/www` directory: @@ -914,23 +888,19 @@ To ensure the latest version of PostfixAdmin is installed, follow the steps belo sudo rm postfixadmin-3.3.13.tar.gz ``` -You now have the latest version of PostfixAdmin downloaded and extracted to the `/var/www/postfixadmin` directory. This ensures you have the most up-to-date features and fixes for managing your email server. +### Install Required PHP Modules for PostfixAdmin -### Step 9c: Install Required PHP Modules for PostfixAdmin - -PostfixAdmin is a PHP-based application, and it requires several PHP modules to function properly. You can install all the necessary modules with a single command: +PostfixAdmin is a PHP-based application and requires several PHP modules to function properly. Install all the necessary modules with the following command: ```command sudo apt install php8.3-fpm php8.3-imap php8.3-mbstring php8.3-mysql php8.3-curl php8.3-zip php8.3-xml php8.3-bz2 php8.3-intl php8.3-gmp php8.3-redis ``` -These modules provide essential functionality for PostfixAdmin to work properly. - -### Step 9d: Database Initialization +### Database Initialization -To store email settings, you need to create a MariaDB database for PostfixAdmin and a corresponding user. +To store email settings, create a MariaDB database for PostfixAdmin and a corresponding user. -1. First, log in to MariaDB as the root user: +1. Log in to MariaDB as the root user: ```command sudo mysql -u root @@ -948,7 +918,7 @@ To store email settings, you need to create a MariaDB database for PostfixAdmin MariaDB [(none)]> ``` -1. Next, create a PostfixAdmin database and name it `postfixadmin`: +1. Create a PostfixAdmin database and name it `postfixadmin`: ```command create database postfixadmin; @@ -958,7 +928,7 @@ To store email settings, you need to create a MariaDB database for PostfixAdmin Query OK, 1 row affected (0.000 sec) ``` -1. Now create a PostfixAdmin user and also name it `postfixadmin`. Remember to replace {{< placeholder "POSTFIXADMIN_PASSWORD" >}} with a strong password of your choice: +1. Create a PostfixAdmin user, and also name it `postfixadmin` for consistency. Replace {{< placeholder "POSTFIXADMIN_PASSWORD" >}} with a strong password of your choice: ```command create user 'postfixadmin'@'localhost' identified by '{{< placeholder "POSTFIXADMIN_PASSWORD" >}}'; @@ -968,11 +938,7 @@ To store email settings, you need to create a MariaDB database for PostfixAdmin Query OK, 0 rows affected (0.001 sec) ``` - {{< note >}} - While you can name the database and user anything, for consistency this guide use `postfixadmin` for both. - {{< /note >}} - -1. Grant all privileges on the `postfixadmin` database to the user you just created: +1. Grant all privileges on the `postfixadmin` database to the `postfixadmin` user: ```command grant all privileges on postfixadmin.* to 'postfixadmin'@'localhost'; @@ -1002,23 +968,23 @@ To store email settings, you need to create a MariaDB database for PostfixAdmin Bye ``` -### Step 9e: Postfix-MariaDB Integration +### Postfix-MariaDB Integration -Configure Postfix to send and receive mail on behalf of virtual users and domains, not just those with accounts on the local operating system. This requires installing a package that adds MySQL/MariaDB mapping support to Postfix. +Configure Postfix to send and receive mail on behalf of virtual users and domains. This requires installing a package that adds MySQL and MariaDB mapping support to Postfix. -1. First, install the `postfix-mysql` package: +1. Install the `postfix-mysql` package: ```command sudo apt install postfix-mysql ``` -1. Now edit the main Postfix configuration file: +1. Edit the main Postfix configuration file: ```command sudo nano /etc/postfix/main.cf ``` - To allow Dovecot to deliver messages to virtual users, add the following lines to the end of the file: + To allow Dovecot to deliver messages to virtual users, add the following lines to the end of the file, and save your changes: ```file {title="/etc/postfix/main.cf" linenostart="56"} virtual_mailbox_domains = proxy:mysql:/etc/postfix/sql/mysql_virtual_domains_maps.cf @@ -1032,15 +998,13 @@ Configure Postfix to send and receive mail on behalf of virtual users and domain virtual_transport = lmtp:unix:private/dovecot-lmtp ``` - When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. - 1. Create a directory for the virtual domains, users, and aliases you just pointed to: ```command sudo mkdir -p /etc/postfix/sql ``` -1. Create the following six files in the `/etc/postfix/sql` directory, substituting the {{< placeholder "POSTFIXADMIN_PASSWORD" >}} you used in the previous step when setting up the `postfixadmin` database. +1. Create the following six files in the `/etc/postfix/sql` directory. In each file, substitute {{< placeholder "POSTFIXADMIN_PASSWORD" >}} with the password you used when setting up the `postfixadmin` database. - Create the `mysql_virtual_domains_maps.cf` file: @@ -1048,7 +1012,7 @@ Configure Postfix to send and receive mail on behalf of virtual users and domain sudo nano /etc/postfix/sql/mysql_virtual_domains_maps.cf ``` - The `mysql_virtual_domains_maps.cf` file contents are as follows: + Add the `mysql_virtual_domains_maps.cf` file contents as follows, and save your changes: ```file {title="/etc/postfix/sql/mysql_virtual_domains_maps.cf"} user = postfixadmin @@ -1058,15 +1022,13 @@ Configure Postfix to send and receive mail on behalf of virtual users and domain query = SELECT domain FROM domain WHERE domain='%s' AND active = '1' ``` - When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. - - Create the `mysql_virtual_mailbox_maps.cf` file: ```command sudo nano /etc/postfix/sql/mysql_virtual_mailbox_maps.cf ``` - The `mysql_virtual_mailbox_maps.cf` file contents are as follows: + Add the `mysql_virtual_mailbox_maps.cf` file contents as follows, and save your changes: ```file {title="/etc/postfix/sql/mysql_virtual_mailbox_maps.cf"} user = postfixadmin @@ -1080,15 +1042,13 @@ Configure Postfix to send and receive mail on behalf of virtual users and domain #expansion_limit = 100 ``` - When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. - - Create the `mysql_virtual_alias_domain_mailbox_maps.cf` file: ```command sudo nano /etc/postfix/sql/mysql_virtual_alias_domain_mailbox_maps.cf ``` - The `mysql_virtual_alias_domain_mailbox_maps.cf` file contents are as follows: + Add the `mysql_virtual_alias_domain_mailbox_maps.cf` file contents as follows, and save your changes: ```file {title="/etc/postfix/sql/mysql_virtual_alias_domain_mailbox_maps.cf"} user = postfixadmin @@ -1098,15 +1058,13 @@ Configure Postfix to send and receive mail on behalf of virtual users and domain query = SELECT maildir FROM mailbox,alias_domain WHERE alias_domain.alias_domain = '%d' and mailbox.username = CONCAT('%u', '@', alias_domain.target_domain) AND mailbox.active = 1 AND alias_domain.active='1' ``` - When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. - - Create the `mysql_virtual_alias_maps.cf` file: ```command sudo nano /etc/postfix/sql/mysql_virtual_alias_maps.cf ``` - The `mysql_virtual_alias_maps.cf` file contents are as follows: + Add the `mysql_virtual_alias_maps.cf` file contents as follows, and save your changes: ```file {title="/etc/postfix/sql/mysql_virtual_alias_maps.cf"} user = postfixadmin @@ -1117,15 +1075,13 @@ Configure Postfix to send and receive mail on behalf of virtual users and domain #expansion_limit = 100 ``` - When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. - - Create the `mysql_virtual_alias_domain_maps.cf` file: ```command sudo nano /etc/postfix/sql/mysql_virtual_alias_domain_maps.cf ``` - The `mysql_virtual_alias_domain_maps.cf` file contents are as follows: + Add the `mysql_virtual_alias_domain_maps.cf` file contents as follows, and save your changes: ```file {title="/etc/postfix/sql/mysql_virtual_alias_domain_maps.cf"} user = postfixadmin @@ -1135,15 +1091,13 @@ Configure Postfix to send and receive mail on behalf of virtual users and domain query = SELECT goto FROM alias,alias_domain WHERE alias_domain.alias_domain = '%d' and alias.address = CONCAT('%u', '@', alias_domain.target_domain) AND alias.active = 1 AND alias_domain.active='1' ``` - When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. - - Create the `mysql_virtual_alias_domain_catchall_maps.cf` file: ```command sudo nano /etc/postfix/sql/mysql_virtual_alias_domain_catchall_maps.cf ``` - The `mysql_virtual_alias_domain_catchall_maps.cf` file contents are as follows: + Add the `mysql_virtual_alias_domain_catchall_maps.cf` file contents as follows, and save your changes: ```file {title="/etc/postfix/sql/mysql_virtual_alias_domain_catchall_maps.cf"} user = postfixadmin @@ -1153,16 +1107,14 @@ Configure Postfix to send and receive mail on behalf of virtual users and domain query = SELECT goto FROM alias,alias_domain WHERE alias_domain.alias_domain = '%d' and alias.address = CONCAT('@', alias_domain.target_domain) AND alias.active = 1 AND alias_domain.active='1' ``` - When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. - -1. Lock down the ownership and permissions of the files in the `/etc/postfix/sql` directory so that they are only readable by `postfix` and `root`: +1. Secure ownership and permissions of the files in the `/etc/postfix/sql` directory so that they are only readable by `postfix` and `root`: ```command sudo chmod 0640 /etc/postfix/sql/* sudo setfacl -R -m u:postfix:rx /etc/postfix/sql/ ``` -1. During [Postfix installation in step 2](/docs/guides/how-to-setup-an-email-server/#step-2-install-postfix), the `mydestination` parameter may have been set to include the canonical hostname (e.g., `mail.{{< placeholder "example.tld" >}}`). However, since you've enabled virtual users and domains, the canonical hostname is no longer needed. Open the main Postfix configuration file: +1. During [Postfix installation in step 2](/docs/guides/how-to-setup-an-email-server/#step-2-install-postfix), the `mydestination` parameter may have been set to include the canonical hostname (e.g., `mail.{{< placeholder "example.tld" >}}`). Since virtual users and domains have been enabled, the canonical hostname is no longer needed. Open the main Postfix configuration file: ```command sudo nano /etc/postfix/main.cf @@ -1183,7 +1135,7 @@ Configure Postfix to send and receive mail on behalf of virtual users and domain virtual_gid_maps = static:2000 ``` - When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. + When done, save your changes. 1. Create a user named `vmail` with user and group ID `2000`, as defined in the previous step: @@ -1212,11 +1164,11 @@ Configure Postfix to send and receive mail on behalf of virtual users and domain sudo systemctl restart postfix ``` -### Step 9f: Dovecot-MariaDB Integration +### Dovecot-MariaDB Integration -As as with Postfix, you also need to configure Dovecot to work with the `postfixadmin` database. +Like Postfix, Dovecot must be configured to work with the `postfixadmin` database. -1. Start by installing the package that enables Dovecot-SQL integration: +1. Install the package that enables Dovecot-SQL integration: ```command sudo apt install dovecot-mysql @@ -1228,53 +1180,51 @@ As as with Postfix, you also need to configure Dovecot to work with the `postfix sudo nano /etc/dovecot/conf.d/10-mail.conf ``` - Find the `mail_location` line and add a new `mail_home` parameter for virtual users below it: + Find the `mail_location` line. Below it, add a new `mail_home` parameter for virtual users, and save your changes: ```file {title="/etc/dovecot/conf.d/10-mail.conf" lang="conf" linenostart="30" hl_lines="2"} mail_location = maildir:~/Maildir mail_home = /var/vmail/%d/%n/ ``` - When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. - -1. Now open Dovecot's authentication file: +1. Open Dovecot's authentication file: ```command sudo nano /etc/dovecot/conf.d/10-auth.conf ``` - - Uncomment the `auth_username_format` line: - - ```file {title="/etc/dovecot/conf.d/10-auth.conf" lang="conf" linenostart="51"} - auth_username_format = %Lu - ``` + Uncomment the `auth_username_format` line: - By default, postfix uses the entire email address (e.g. `UserName@example.tld`) as the username. The `L` converts usernames to lowercase characters (e.g. `username@example.tld`) before sending them to the database. + ```file {title="/etc/dovecot/conf.d/10-auth.conf" lang="conf" linenostart="51"} + auth_username_format = %Lu + ``` - - Uncomment the following line to enable SQL queries of the MariaDB database: + By default, postfix uses the entire email address (e.g. `UserName@example.tld`) as the username. The `L` converts usernames to lowercase characters (e.g. `username@example.tld`) before sending them to the database. - ```file {title="/etc/dovecot/conf.d/10-auth.conf" lang="conf" linenostart="123"} - !include auth-sql.conf.ext - ``` + Uncomment the following line to enable SQL queries of the MariaDB database: - - Add the following two lines at the bottom of the file for initial troubleshooting: + ```file {title="/etc/dovecot/conf.d/10-auth.conf" lang="conf" linenostart="123"} + !include auth-sql.conf.ext + ``` - ```file {title="/etc/dovecot/conf.d/10-auth.conf" lang="conf" linenostart="128"} - auth_debug = yes - auth_debug_passwords = yes - ``` + At the bottom of the file, temporarily add the following two lines to send login errors to `/var/log/mail.log`, and save your changes: - These send login errors to `/var/log/mail.log`. Once you’ve verified that users can log in successfully, it’s OK to delete these lines. + ```file {title="/etc/dovecot/conf.d/10-auth.conf" lang="conf" linenostart="128"} + auth_debug = yes + auth_debug_passwords = yes + ``` - When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. + Once you’ve verified users can log in successfully, these two lines may be deleted. The rest of your changes should remain intact. -1. Now, open the `dovecot-sql.conf.ext` file. +1. Open the `dovecot-sql.conf.ext` file: ```command sudo nano /etc/dovecot/dovecot-sql.conf.ext ``` - All lines in this file are commented out. You may want to keep the existing comments, which are useful as documentation. Add the following lines at the bottom of the file, making sure to replace the {{< placeholder "POSTFIXADMIN_PASSWORD" >}} in the `connect` line with the `postfixadmin` user's database password you created earlier. However, leave the word `password` as-is in the `password_query` line. + All lines in this file are automatically commented out, and may remain useful as documentation. + + At the bottom of the file, add the following lines, replacing the {{< placeholder "POSTFIXADMIN_PASSWORD" >}} in the `connect` line with the `postfixadmin` user's database password you created earlier. Make sure to leave the word `password` as-is in the `password_query` line: ```file {title="/etc/dovecot/dovecot-sql.conf.ext" linenostart="145"} driver = mysql @@ -1285,42 +1235,42 @@ As as with Postfix, you also need to configure Dovecot to work with the `postfix iterate_query = SELECT username AS user FROM mailbox ``` - When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. + Save your changes when complete. -1. Restart Dovecot to apply the changes. +1. Restart Dovecot to apply the changes: ```command sudo systemctl restart dovecot ``` -### Step 9g: Access Control Lists (ACLs) +### Access Control Lists (ACLs) -PostfixAdmin uses a `templates_c` directory, and the Nginx web server needs access to that directory. As in [step 6](/docs/guides/how-to-setup-an-email-server/#step-6-local-message-storage-lmtp), you can use ACLs to grant access. +PostfixAdmin uses a `templates_c` directory, and access to that directory must be granted to NGINX. As in [step 6](/docs/guides/how-to-setup-an-email-server/#step-6-local-message-storage-lmtp), you can use ACLs to grant access. -1. Create the `templates_c` directory and set the appropriate permissions: +1. Create the `templates_c` directory, and set the appropriate permissions: ```command sudo mkdir -p /var/www/postfixadmin/templates_c sudo setfacl -R -m u:www-data:rwx /var/www/postfixadmin/templates_c/ ``` -1. Ensure that the Nginx web server can read the Let's Encrypt certificate and key you previously created: +1. Ensure NGINX can read the Let's Encrypt certificate and key you previously created: ```command sudo setfacl -R -m u:www-data:rx /etc/letsencrypt/live/ /etc/letsencrypt/archive/ ``` -### Step 9h: PostfixAdmin Configuration +### PostfixAdmin Configuration -By default, PostfixAdmin stores configuration data in the `/var/www/postfixadmin/config.inc.php` file. However, to avoid potential conflicts during upgrades, it is recommended to create a separate `config.local.php` file for server-specific settings. +By default, PostfixAdmin stores configuration data in the `/var/www/postfixadmin/config.inc.php` file. To avoid potential conflicts during upgrades, it is recommended to create a separate `config.local.php` file for server-specific settings. -Create and open the `config.local.php` file for editing: +Create and open the `config.local.php` file: ```command sudo nano /var/www/postfixadmin/config.local.php ``` -Add the following content to the `config.local.php` file, replacing {{< placeholder "POSTFIXADMIN_PASSWORD" >}} with the actual `postfixadmin` user database password you previously created: +Add the following content to the `config.local.php` file, replacing {{< placeholder "POSTFIXADMIN_PASSWORD" >}} with the `postfixadmin` user database password you previously created: ```file {title="/var/www/postfixadmin/config.local.php"} CTRL+X, followed by Y then Enter to save the file and exit `nano`. +When done, save your changes. -### Step 9i: Virtual Web Host +### Create a Virtual Web Host -To create a virtual host for PostfixAdmin using Nginx, set up a separate Nginx configuration file for the domain. +To create a virtual host for PostfixAdmin using NGINX, a separate NGINX configuration file for the domain must be set up. -1. Use the following command create a new Nginx configuration file for PostfixAdmin, replacing {{< placeholder "example.tld" >}} with your actual domain name: +Create a new NGINX configuration file for PostfixAdmin, replacing {{< placeholder "example.tld" >}} with your domain name: - ```command - sudo nano /etc/nginx/sites-available/postfixadmin.{{< placeholder "example.tld" >}}.conf - ``` +```command +sudo nano /etc/nginx/sites-available/postfixadmin.{{< placeholder "example.tld" >}}.conf +``` - Insert the following contents into the file, again replacing {{< placeholder "example.tld" >}} with your actual domain name: +Paste the following contents into the file, replacing {{< placeholder "example.tld" >}} with your domain name where necessary: - ```file {title="/etc/nginx/sites-available/postfixadmin.{{< placeholder "example.tld" >}}.conf"} - server { - listen 80; - listen [::]:80; +```file {title="/etc/nginx/sites-available/postfixadmin.{{< placeholder "example.tld" >}}.conf"} +server { + listen 80; + listen [::]:80; - server_name postfixadmin.{{< placeholder "example.tld" >}}; + server_name postfixadmin.{{< placeholder "example.tld" >}}; - root /var/www/postfixadmin/public/; - index index.php index.html; + root /var/www/postfixadmin/public/; + index index.php index.html; - access_log /var/log/nginx/postfixadmin_access.log; - error_log /var/log/nginx/postfixadmin_error.log; + access_log /var/log/nginx/postfixadmin_access.log; + error_log /var/log/nginx/postfixadmin_error.log; - location / { - try_files $uri $uri/ /index.php; - } + location / { + try_files $uri $uri/ /index.php; + } - location ~ ^/(.+\.php)$ { - try_files $uri =404; - fastcgi_pass unix:/run/php/php8.3-fpm.sock; - fastcgi_index index.php; - fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; - include /etc/nginx/fastcgi_params; - } + location ~ ^/(.+\.php)$ { + try_files $uri =404; + fastcgi_pass unix:/run/php/php8.3-fpm.sock; + fastcgi_index index.php; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + include /etc/nginx/fastcgi_params; } +} - server { - listen 443 ssl; - listen [::]:443 ssl; +server { + listen 443 ssl; + listen [::]:443 ssl; - server_name postfixadmin.{{< placeholder "example.tld" >}}; + server_name postfixadmin.{{< placeholder "example.tld" >}}; - root /var/www/postfixadmin/public/; - index index.php index.html; + root /var/www/postfixadmin/public/; + index index.php index.html; - access_log /var/log/nginx/postfixadmin_access.log; - error_log /var/log/nginx/postfixadmin_error.log; + access_log /var/log/nginx/postfixadmin_access.log; + error_log /var/log/nginx/postfixadmin_error.log; - location / { - try_files $uri $uri/ /index.php; - } + location / { + try_files $uri $uri/ /index.php; + } - location ~ ^/(.+\.php)$ { - try_files $uri =404; - fastcgi_pass unix:/run/php/php8.3-fpm.sock; - fastcgi_index index.php; - fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; - include /etc/nginx/fastcgi_params; - } - ssl_certificate /etc/letsencrypt/live/mail.{{< placeholder "example.tld" >}}/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/mail.{{< placeholder "example.tld" >}}/privkey.pem; - ssl_session_timeout 5m; - ssl_protocols TLSv1.2 TLSv1.3; + location ~ ^/(.+\.php)$ { + try_files $uri =404; + fastcgi_pass unix:/run/php/php8.3-fpm.sock; + fastcgi_index index.php; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + include /etc/nginx/fastcgi_params; } - ``` + ssl_certificate /etc/letsencrypt/live/mail.{{< placeholder "example.tld" >}}/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/mail.{{< placeholder "example.tld" >}}/privkey.pem; + ssl_session_timeout 5m; + ssl_protocols TLSv1.2 TLSv1.3; +} +``` + +When done, save your changes. + +### Update Let's Encrypt - When done, press CTRL+X, followed by Y then Enter to save the file and exit `nano`. +The Let's Encrypt certificate and key must also be updated to include the virtual host you created. While it is possible to create different Let's Encrypt certificates for each virtual host, you can also use one certificate to validate all hostnames. -1. You need to update the Let's Encrypt certificate and key. Create a symbolic link between the configuration file in `/etc/nginx/sites-available` and `/etc/nginx/sites-enabled`. Make sure to replace {{< placeholder "example.tld" >}} with your actual domain name in the configuration filename: +1. Create a symbolic link between the configuration file in `/etc/nginx/sites-available` and `/etc/nginx/sites-enabled`. Remember to replace {{< placeholder "example.tld" >}} with your domain name in the configuration file name: ```command sudo ln -s /etc/nginx/sites-available/postfixadmin.{{< placeholder "example.tld" >}}.conf /etc/nginx/sites-enabled/ ``` -### Step 9j: Let's Encrypt Update - -Update the Let's Encrypt certificate to include the virtual host you just created. Although it is possible to create different Let's Encrypt certificates for each virtual host, you can also use one certificate to validate all hostnames. - -1. Rerun the `certbot` command to update the Let's Encrypt certificate and include the virtual host you created. Replace {{< placeholder "example.tld" >}} with your actual domain name. Notice that this time, you're using the `-d` switch twice, once for each virtual host. +1. Rerun the `certbot` command to update the Let's Encrypt certificate and include the virtual host, replacing {{< placeholder "example.tld" >}} with your domain name. Note that the command uses the `-d` switch twice, once for each virtual host. ```command sudo certbot certonly -a nginx --staple-ocsp -d mail.{{< placeholder "example.tld" >}} -d postfixadmin.{{< placeholder "example.tld" >}} ``` - When prompted, select option `E` to expand the existing certificate to cover multiple hostnames. If the expansion succeeds, the new certificate and private key covers both hostnames: + When prompted, select option `E` to expand the existing certificate to cover multiple hostnames. If the expansion succeeds, the new certificate and private key cover both hostnames: ```output Successfully received certificate. @@ -1438,20 +1388,20 @@ Update the Let's Encrypt certificate to include the virtual host you just create Certbot has set up a scheduled task to automatically renew this certificate in the background. ``` -1. Verify the Nginx configuration using the following command: +1. Verify the NGINX configuration: ```command sudo nginx -t ``` - Ensure that the output indicates a successful configuration as shown below: + Confirm that the output indicates a successful configuration: ```output nginx: the configuration file /etc/nginx/nginx.conf syntax is ok nginx: configuration file /etc/nginx/nginx.conf test is successful ``` -1. Once you have validated your configuration and ensured there are no errors, reload Nginx to apply the changes: +1. Reload NGINX to apply the changes: ```command sudo systemctl reload nginx @@ -1464,7 +1414,7 @@ Update the Let's Encrypt certificate to include the virtual host you just create sudo systemctl restart dovecot ``` -### Step 9k: Final PostfixAdmin Setup +### Final PostfixAdmin Setup 1. In your web browser, enter the following URL to access the PostfixAdmin setup screen, replacing {{< placeholder "example.tld" >}} with your domain name. @@ -1472,27 +1422,27 @@ Update the Let's Encrypt certificate to include the virtual host you just create https://postfixadmin.{{< placeholder "example.tld" >}}/setup.php ``` - {{< note >}} - Ensure that you have valid A and/or AAAA records in your DNS for `postfixadmin.{{< placeholder "example.tld" >}}`. If the page doesn't load, check the error log in the `/var/log/nginx` directory and/or the main `/var/log/syslog` file for any configuration errors. + {{< note title="Check Your DNS Records" >}} + Ensure that you have valid A and/or AAAA records in your DNS for `postfixadmin.example.tld`. If the page doesn't load, check the error log in the `/var/log/nginx` directory and/or the main `/var/log/syslog` file for any configuration errors. {{< /note >}} 1. Once the setup page loads, enter a setup password to proceed: ![The PostFixAdmin initial setup page.](PostFixAdmin-Setup-Page.png) -1. After entering the password, you see a hashed version of it. Copy the entire hashed string, which is used in the PostfixAdmin `config.local.php` file. +1. After entering the password, a hashed version of it should be displayed. Copy the entire hashed string, which is used in the PostfixAdmin `config.local.php` file. ```output $CONF['setup_password'] = '$2y$10$d5COgAVA4qZtTJCo9znWaOB4c2bHjbtwwlr8TOLbIp6P3lidinH5W'; ``` -1. Open the PostfixAdmin config file for editing. +1. Open the PostfixAdmin config file: ```command sudo nano /var/www/postfixadmin/config.local.php ``` -1. Paste the setup password string as the last line of the config file. +1. Paste the setup password string as the last line of the config file, and save your changes: ```file {title="/var/www/postfixadmin/config.local.php"} CTRL+X, followed by Y then Enter to save the file and exit `nano`. - -1. To allow the `www-data` user access to read the Let's Encrypt certificate and Dovecot stats, run the following commands: +1. Allow the `www-data` user access to read the Let's Encrypt certificate and Dovecot stats: ```command sudo setfacl -R -m u:www-data:rx /etc/letsencrypt/live/ /etc/letsencrypt/archive/ sudo setfacl -R -m u:www-data:rwx /var/run/dovecot/stats-reader /var/run/dovecot/stats-writer ``` - {{< note >}} + {{< note title="ARGON2I Errors" >}} If you encounter an ARGON2I error later on during the PostfixAdmin account setup, rerun these two commands. {{< /note >}} -1. Reload the setup page in your browser, and if requested, log in using the setup password you entered earlier. You may encounter some database warnings, but you can ignore them as they pertain to database types not used in this setup. +1. Reload the setup page in your browser, and if requested, log in using the setup password you entered earlier. If you encounter database warnings, they can be ignored since they pertain to database types not used in this setup. -1. At the bottom of the page, enter the **Setup password** you just created, your external email address for **Admin**, and a new super-admin password: +1. At the bottom of the page, enter the **Setup password** you created, your external email address for **Admin**, and a new super-admin password: ![The PostFixAdmin super-admin creation page.](PostFixAdmin-SuperAdmin-Creation-Page.png) -1. After entering the password, click the link at the bottom of the page to access the main login page. Alternatively, you can use the following login URL: +1. After entering the password, click the link at the bottom of the page to access the main login page. Alternatively, you can use the following login URL, replacing `{{< placeholder "example.tld" >}}` with your domain name: ```command https://postfixadmin.{{< placeholder "example.tld" >}}/login.php ``` -### Step 9l: Virtual Mail Setup in PostfixAdmin +### Virtual Mail Setup in PostfixAdmin -1. Open a web browser and navigate to `https://postfixadmin.{{< placeholder "example.tld" >}}/login.php` (replace `{{< placeholder "example.tld" >}}` with your domain name). Log in using the super-admin credentials you previously set up. +1. Open a web browser and navigate to `https://postfixadmin.{{< placeholder "example.tld" >}}/login.php`, replacing `{{< placeholder "example.tld" >}}` with your domain name. Log in using the super-admin credentials you previously set up. -1. In the top menu, click on **Domain List** and select **New Domain**. Enter the name of the domain you want to create under **Domain**. It is recommended to include your server's native domain since we are assuming all accounts on this system are virtual. For example, use `{{< placeholder "example.tld" >}}` instead of `mail.{{< placeholder "example.tld" >}}`. +1. In the top menu, click on **Domain List** and select **New Domain**. Enter the name of the domain you want to create under **Domain**. It is recommended to include your server's native domain since it's assumed all accounts on the system are virtual. For example, use `{{< placeholder "example.tld" >}}` instead of `mail.{{< placeholder "example.tld" >}}`: ![The PostFixAdmin ne domain creation page.](PostFixAdmin-New-Domain.png) - Regarding the other settings on this page: + Other settings on this page: - - **Aliases**: You can specify the maximum number of aliases and users per domain. The default is `10` for each, but you can set these values as desired. Use `0` to indicate an unlimited number. - - **Mail server is backup MX**: Since you are setting up a primary server, leave the option for this to be a backup mail exchanger (MX) unchecked. + - **Aliases**: Specify the maximum number of aliases and users per domain. The default is `10` for each. Use `0` to indicate an unlimited number. + - **Mail server is backup MX**: Leave the option for this unchecked since this is a primary server. - **Active**: Choose whether to enable or disable the virtual domain. It is recommended to enable the domain unless there are specific reasons to disable it, such as scheduling it to operate within certain dates. - **Add default mail aliases** Keep this box checked to set up standard management aliases. These aliases are commonly used for administrative and troubleshooting purposes: @@ -1557,46 +1505,46 @@ Update the Let's Encrypt certificate to include the virtual host you just create - `postmaster@{{< placeholder "example.tld" >}}` - `webmaster@{{< placeholder "example.tld" >}}` - - **Pass expires**: sets a maximum age for users' passwords in that domain. The default setting of 365 days is recommended, but you can adjust it according to your preferences. + - **Pass expires**: Sets a maximum age for users' passwords in that domain. The default setting of 365 days is recommended, but this can be adjusted according to your preferences. When done, click **Add Domain**. -1. Now, you can create your first user account. Click on the **Virtual Lists** menu at the top of the page and select **Add Mailbox**. +1. Create your first user account by clicking on the **Virtual Lists** menu at the top of the page and selecting **Add Mailbox**: ![The PostFixAdmin new mailbox creation page.](PostFixAdmin-Add-Mailbox.png) - - **Username**: Enter a username and select the domain from the dropdown menu. Since you have only created one virtual domain so far, there is only one option in the menu. + - **Username**: Enter a username and select the domain from the dropdown menu. Since you have only created one virtual domain so far, there should be one option in the menu. - **Password**: Choose a strong password and enter it twice. - - **Name**: This is a space for the user's full name. + - **Name**: The user's full name. - **Quota**: Optionally set a quota (maximum storage limit in megabytes) for the user. - **Active**: Leave this box checked unless you have a specific reason to disable it. - **Send Welcom email**: Leave this box checked unless you have a specific reason to disable it. - - **Other e-mail**: It is a good practice to enter an alternative email address (preferably from a separate domain on a separate server) for password recovery purposes. + - **Other e-mail**: It is considered a best practice to enter an alternative email address (preferably from a separate domain on a separate server) for password recovery purposes. -### Step 9m: Client Setup and Server Validation +### Client Setup and Server Validation -1. To validate your email server, add a new account to an email client such as [Mozilla Thunderbird](https://www.thunderbird.net/en-US/), [GNOME Evolution](https://help.gnome.org/users/evolution/stable/), or [Microsoft Outlook](https://www.microsoft.com/en-us/microsoft-365/outlook/email-and-calendar-software-microsoft-outlook). While the specific configuration of each client is beyond the scope of this guide, there are a few common settings to check: +1. Validate your email server by adding a new account to an email client such as [Mozilla Thunderbird](https://www.thunderbird.net/en-US/), [GNOME Evolution](https://help.gnome.org/users/evolution/stable/), or [Microsoft Outlook](https://www.microsoft.com/en-us/microsoft-365/outlook/email-and-calendar-software-microsoft-outlook). While the specific configuration of an email client is beyond the scope of this guide, consider the common settings below: - For sending and receiving emails, use the entire email address as the username (e.g., `username@example.com` instead of just `username`). - For receiving email, specify IMAP on TCP port `993` using TLS/SSL. - For sending email, specify either submission on TCP port `587` using STARTTLS or, for Microsoft Outlook clients, TCP port `465` using TLS/SSL. -1. After configuring an account in your mail client, test your setup by sending and receiving emails to and from another address on a different server. You should be able to both receive and send emails using your new account. You now have a working email service. +1. Test your setup by sending and receiving emails to and from another address on a different server. You should be able to both receive and send emails using your new account. This confirms a functioning email service. -1. If you encounter any errors during the setup, don't worry. Instead of starting over, check the following log files for specific error messages: `/var/log/mail.log` and `/var/log/syslog`. These log entries should provide clues about the source of the problem. You can also search the web using the specific error message along with "dovecot postfix" to find relevant information and solutions. +1. If you encounter any errors during the setup, check the `/var/log/mail.log` and `/var/log/syslog` log files for specific error messages. These log entries should provide clues about the source of the problem. -1. There are a few housekeeping tasks to complete: - - - In PostfixAdmin, edit the four standard aliases created when you configured a domain. By default, these aliases point to dummy addresses such as `abuse@change-this-to-your.domain.tld`. Now that you have a working email address, you should edit these (under Virtual List/Virtual List) to point to your actual email address. + {{< note title="Tip: Search Using Error Messages" >}} + Search the web using the specific error message along with "Dovecot Postfix" to find helpful information and solutions. + {{< /note >}} - - In the `/etc/dovecot/conf.d/10-auth.conf` file, you added two lines for verbose debugging. Both lines begin with the string `auth_debug`. To avoid log bloat, you can comment out or delete both lines and then restart Dovecot. +### Maintenance and Final Steps - - Consider configuring valid Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) records in your DNS to combat spam. Optionally, you can also set up a Domain Message Authentication, Reporting & Conformance (DMARC) record to specify how your server handles failed SPF and/or DKIM validations, as well as request reports from other servers. Linode provides a [separate email server guide](https://www.linode.com/docs/guides/configure-spf-and-dkim-in-postfix-on-debian-8/) for SPF, DKIM, and DMARC configuration. +- In PostfixAdmin, edit the four standard aliases created when you configured a domain. By default, these aliases point to dummy addresses such as `abuse@change-this-to-your.domain.tld`. Now that you have a working email address, these should be changed (under Virtual List/Virtual List) to point to your actual email address. - - Stay vigilant about [security vulnerabilities](https://ubuntu.com/security/notices) by keeping your operating system and server software up to date. Regularly applying patches and updates is crucial for maintaining a secure server. +- In the `/etc/dovecot/conf.d/10-auth.conf` file, two lines were added for verbose debugging, both beginning with the string `auth_debug`. To avoid crowded logs, these lines can be commented out or deleted. Restart Dovecot to apply your changes. - - Make regular backups of your server. Consider using [Akamai's Backups service](https://www.linode.com/docs/products/storage/backups/), which can automate your backups with a single click. +- Consider configuring valid Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) records in your DNS to combat spam. Optionally, you can also set up a Domain Message Authentication, Reporting & Conformance (DMARC) record to specify how your server handles failed SPF and/or DKIM validations, as well as request reports from other servers. See our [separate email server guide](/docs/guides/configure-spf-and-dkim-in-postfix-on-debian-8/) for SPF, DKIM, and DMARC configuration. -## Conclusion +- Stay vigilant about [security vulnerabilities](https://ubuntu.com/security/notices) by keeping your operating system and server software up to date. Regularly apply patches and updates to help maintain a secure server. -You now know how to set up an email server. You know how to put key email protocols to work, and how to integrate them with DNS, databases, and graphical management tools. Properly configured, your new email server can run for years, making it a good pairing with Ubuntu’s LTS on an Akamai compute instance. Email represents one of the most useful services you can provide, the Akamai cloud offers an ideal platform on which to provision your next server. \ No newline at end of file +- Make regular backups of your server. Consider using our [Backup Service](https://techdocs.akamai.com/cloud-computing/docs/backup-service) to automate your backups. \ No newline at end of file From 6b9d4ba1dbafe2101b129bc3909cc863f61c9b47 Mon Sep 17 00:00:00 2001 From: John Dutton Date: Mon, 28 Oct 2024 16:05:54 -0400 Subject: [PATCH 6/6] copy edit --- .../postfix/how-to-setup-an-email-server/index.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/guides/email/postfix/how-to-setup-an-email-server/index.md b/docs/guides/email/postfix/how-to-setup-an-email-server/index.md index 6ec2e857f4c..031bbb65c0d 100644 --- a/docs/guides/email/postfix/how-to-setup-an-email-server/index.md +++ b/docs/guides/email/postfix/how-to-setup-an-email-server/index.md @@ -42,7 +42,7 @@ Postfix is a widely-used open source SMTP server and is included in most Linux d 1. Follow our [Setting Up and Securing a Compute Instance](/docs/products/compute/compute-instances/guides/set-up-and-secure/) guide to update and secure your system. Make sure to set the timezone, configure your hostname, create a limited user account, and harden SSH access. {{< note type="warning" title="Do not enable IPv6" >}} - When setting up and securing your Compute Instance, do not enable IPv6. Enabling IPv6 may cause issues later when Certbot attempts to update the Let's Encrypt certificate. + When setting up and securing your Compute Instance, do not enable IPv6. Enabling IPv6 may cause issues later when Certbot attempts to [update the Let's Encrypt certificate](#update-lets-encrypt). {{< /note >}} This guide sets up a mail server called `mail.{{< placeholder "example.tld" >}}`. Substitute your own domain name, and configure the `/etc/hosts` file as shown below: @@ -97,10 +97,10 @@ See our [A and AAAA records](https://techdocs.akamai.com/cloud-computing/docs/a- 1. **Optional**: Update the [reverse DNS (rDNS)](https://techdocs.akamai.com/cloud-computing/docs/configure-rdns-reverse-dns-on-a-compute-instance#setting-reverse-dns) information to point one of your server’s IP addresses back to your hostname `mail.{{< placeholder "example.tld" >}}`: - - Click on the **Linodes** tab of the main dashboard. - - Select your Linode. - - Select the **Network** tab. - - In the **IP Addresses** section, set rDNS for your preferred IP address using the **Edit RDNS** option. Each rDNS setting creates a pointer (PTR) record that associates an IP address with a hostname. + 1. Click on the **Linodes** tab of the main dashboard. + 1. Select your Linode. + 1. Select the **Network** tab. + 1. In the **IP Addresses** section, set rDNS for your preferred IP address using the **Edit RDNS** option. Each rDNS setting creates a pointer (PTR) record that associates an IP address with a hostname. 1. Verify your DNS records are functioning by using the `dig` utility to validate each record. Below are example commands you can use to verify **A**, **AAAA**, **MX**, and **PTR** records exist for the server. Note that DNS propagation may take up to 24 hours: