Postfix With SASL SMTP-AUTH Rumi, December 2, 2008December 7, 2008 The updated post available at: https://tweenpath.net/2008/11/a-well-formatted-configs-on-procmail-postfix-spamassassin/ Postfix With SMTP-AUTH And TLS Now we install Postfix and Dovecot (Dovecot will be our POP3/IMAP server): yum install cyrus-sasl cyrus-sasl-devel cyrus-sasl-gssapi cyrus-sasl-md5 cyrus-sasl-plain postfix dovecot Next we configure SMTP-AUTH and TLS: postconf -e ‘smtpd_sasl_local_domain =’ postconf -e ‘smtpd_sasl_auth_enable = yes’ postconf -e ‘smtpd_sasl_security_options = noanonymous’ postconf -e ‘broken_sasl_auth_clients = yes’ postconf -e ‘smtpd_sasl_authenticated_header = yes’ postconf -e ‘smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination’ postconf -e ‘inet_interfaces = all’ postconf -e ‘mynetworks = 127.0.0.0/8’ We must edit /usr/lib/sasl2/smtpd.conf so that Postfix allows PLAIN and LOGIN logins. On a 64Bit Centos 5.2 you must edit the file /usr/lib64/sasl2/smtpd.conf instead. It should look like this: vi /usr/lib/sasl2/smtpd.conf pwcheck_method: saslauthd mech_list: plain login Afterwards we create the certificates for TLS: mkdir /etc/postfix/ssl cd /etc/postfix/ssl/ openssl genrsa -des3 -rand /etc/hosts -out smtpd.key 1024 chmod 600 smtpd.key openssl req -new -key smtpd.key -out smtpd.csr openssl x509 -req -days 3650 -in smtpd.csr -signkey smtpd.key -out smtpd.crt openssl rsa -in smtpd.key -out smtpd.key.unencrypted mv -f smtpd.key.unencrypted smtpd.key openssl req -new -x509 -extensions v3_ca -keyout cakey.pem -out cacert.pem -days 3650 Next we configure Postfix for TLS: postconf -e ‘smtpd_tls_auth_only = no’ postconf -e ‘smtp_use_tls = yes’ postconf -e ‘smtpd_use_tls = yes’ postconf -e ‘smtp_tls_note_starttls_offer = yes’ postconf -e ‘smtpd_tls_key_file = /etc/postfix/ssl/smtpd.key’ postconf -e ‘smtpd_tls_cert_file = /etc/postfix/ssl/smtpd.crt’ postconf -e ‘smtpd_tls_CAfile = /etc/postfix/ssl/cacert.pem’ postconf -e ‘smtpd_tls_loglevel = 1’ postconf -e ‘smtpd_tls_received_header = yes’ postconf -e ‘smtpd_tls_session_cache_timeout = 3600s’ postconf -e ‘tls_random_source = dev:/dev/urandom’ Then we set the hostname in our Postfix installation (make sure you replace server1.example.com with your own hostname): postconf -e ‘myhostname = server1.example.com’ After these configuration steps you should now have a /etc/postfix/main.cf that looks like this (I have removed all comments from it): cat /etc/postfix/main.cf queue_directory = /var/spool/postfix command_directory = /usr/sbin daemon_directory = /usr/libexec/postfix mail_owner = postfix inet_interfaces = all mydestination = $myhostname, localhost.$mydomain, localhost unknown_local_recipient_reject_code = 550 alias_maps = hash:/etc/aliases alias_database = hash:/etc/aliases debug_peer_level = 2 debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin xxgdb $daemon_directory/$process_name $process_id & sleep 5 sendmail_path = /usr/sbin/sendmail.postfix newaliases_path = /usr/bin/newaliases.postfix mailq_path = /usr/bin/mailq.postfix setgid_group = postdrop html_directory = no manpage_directory = /usr/share/man sample_directory = /usr/share/doc/postfix-2.3.3/samples readme_directory = /usr/share/doc/postfix-2.3.3/README_FILES smtpd_sasl_local_domain = smtpd_sasl_auth_enable = yes smtpd_sasl_security_options = noanonymous broken_sasl_auth_clients = yes smtpd_sasl_authenticated_header = yes smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination mynetworks = 127.0.0.0/8 smtpd_tls_auth_only = no smtp_use_tls = yes smtpd_use_tls = yes smtp_tls_note_starttls_offer = yes smtpd_tls_key_file = /etc/postfix/ssl/smtpd.key smtpd_tls_cert_file = /etc/postfix/ssl/smtpd.crt smtpd_tls_CAfile = /etc/postfix/ssl/cacert.pem smtpd_tls_loglevel = 1 smtpd_tls_received_header = yes smtpd_tls_session_cache_timeout = 3600s tls_random_source = dev:/dev/urandom myhostname = server1.example.com By default, CentOS’ Dovecot daemon provides only IMAP and IMAPs services. Because we also want POP3 and POP3s we must configure Dovecot to do so. We edit /etc/dovecot.conf and enable the line protocols = imap imaps pop3 pop3s: vi /etc/dovecot.conf […] # Base directory where to store runtime data. #base_dir = /var/run/dovecot/ # Protocols we want to be serving: imap imaps pop3 pop3s # If you only want to use dovecot-auth, you can set this to “none”. protocols = imap imaps pop3 pop3s # IP or host address where to listen in for connections. It’s not currently # possible to specify multiple addresses. “*” listens in all IPv4 interfaces. # “[::]” listens in all IPv6 interfaces, but may also listen in all IPv4 # interfaces depending on the operating system. […] Now start Postfix, saslauthd, and Dovecot: chkconfig –levels 235 sendmail off chkconfig –levels 235 postfix on chkconfig –levels 235 saslauthd on chkconfig –levels 235 dovecot on /etc/init.d/sendmail stop /etc/init.d/postfix start /etc/init.d/saslauthd start /etc/init.d/dovecot start To see if SMTP-AUTH and TLS work properly now run the following command: telnet localhost 25 After you have established the connection to your Postfix mail server type ehlo localhost If you see the lines 250-STARTTLS and 250-AUTH PLAIN LOGIN everything is fine. [root@server1 ssl]# telnet localhost 25 Trying 127.0.0.1… Connected to localhost.localdomain (127.0.0.1). Escape character is ‘^]’. 220 server1.example.com ESMTP Postfix ehlo localhost 250-server1.example.com 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 DSN quit 221 2.0.0 Bye Connection closed by foreign host. [root@server1 ssl]# Type quit to return to the system’s shell. 11.1 Maildir Dovecot uses Maildir format (not mbox), so if you install ISPConfig on the server, please make sure you enable Maildir under Management -> Server -> Settings -> Email. ISPConfig will then do the necessary configuration. If you do not want to install ISPConfig, then you must configure Postfix to deliver emails to a user’s Maildir (you can also do this if you use ISPConfig – it doesn’t hurt ;-)): postconf -e ‘home_mailbox = Maildir/’ postconf -e ‘mailbox_command =’ /etc/init.d/postfix restart Src: http://www.howtoforge.com/perfect-server-centos-5.2-p5 Collected Articles Configurations (Linux)