Postfix - Revision history

Franks at 07:10, 6 June 2019

2019-06-06T07:10:21Z

← Older revision		Revision as of 00:10, 6 June 2019
Line 2:		Line 2:

	[[Postfix:pmm]] is our shell script to review Postfix maillog.		[[Postfix:pmm]] is our shell script to review Postfix maillog.

	[[Postfix:main.cf]] contains additional ideas for your main.cf		[[Postfix:main.cf]] contains additional ideas for your main.cf

	[[Spf]] is how to create SPF records		[[Spf]] is how to create SPF records

Franks at 07:09, 6 June 2019

2019-06-06T07:09:43Z

← Older revision		Revision as of 00:09, 6 June 2019
Line 3:		Line 3:
	[[Postfix:pmm]] is our shell script to review Postfix maillog.		[[Postfix:pmm]] is our shell script to review Postfix maillog.
	[[Postfix:main.cf]] contains additional ideas for your main.cf		[[Postfix:main.cf]] contains additional ideas for your main.cf
			[[Spf]] is how to create SPF records

	== FreeBSD and TLS/SASL ==		== FreeBSD and TLS/SASL ==

Franks at 03:35, 31 August 2007

2007-08-31T03:35:15Z

← Older revision		Revision as of 20:35, 30 August 2007
Line 98:		Line 98:
	smtp_use_tls = yes		smtp_use_tls = yes

	~~Most of this stuff is explained very detailed on~~ the ~~postfix.org site~~, if you have ~~problems like me~~. ~~Other than that it works on my end.~~ ~~Thanks~~.
			== submission ==

			If you want to follow the [[RFC]], or if your [[ISP]] blocks port 25, you might want to have [[ports\|port]] 587 available for [[SMTP]].
			This is trivial in postfix. Remove the # in master.cf:
			submission inet n - n - - smtpd
			and restart postfix

			# postfix reload

			and now you should have both [[ports]] 25 and 587 listening.

Franks: /* OpenBSD and TLS/SASL */

2007-02-27T00:42:15Z

OpenBSD and TLS/SASL

← Older revision		Revision as of 17:42, 26 February 2007
Line 44:		Line 44:
	== OpenBSD and TLS/SASL ==		== OpenBSD and TLS/SASL ==

	I just configured this on my BSD and it seems to work		I just configured this on my BSD and it seems to work.
	a [tcpdump] showed that this works encrypted over the		A [[tcpdump]] showed that this works encrypted over the
	wire. I had to relax the strictness with TLS because		wire. I had to relax the strictness with [[TLS]] because
	my provider's authorized certificate doesn't match		my provider's authorized certificate doesn't match
	with the hostname or something.		with the hostname or something.

Pbug: OpenBSD config

2007-02-25T18:14:53Z

OpenBSD config

← Older revision		Revision as of 11:14, 25 February 2007
Line 41:		Line 41:

	and try to use TLS & SMTP AUTH with your email client, watching the logs.		and try to use TLS & SMTP AUTH with your email client, watching the logs.

			== OpenBSD and TLS/SASL ==

			I just configured this on my BSD and it seems to work
			a [tcpdump] showed that this works encrypted over the
			wire. I had to relax the strictness with TLS because
			my provider's authorized certificate doesn't match
			with the hostname or something.

			Building from ports was like this

			# cd /usr/ports/mail/postfix
			# cd snapshot
			# env FLAVOR=sasl2 make install

			that should build this. My configuration looks like
			this somewhat...:

			# generic mailer stuff
			smtp_generic_maps = hash:/etc/postfix/generic
			# sasl stuff
			broken_sasl_auth_clients = no
			lmtp_sasl_auth_enable = no
			lmtp_sasl_security_options = noplaintext, noanonymous
			lmtp_sasl_tls_security_options = $lmtp_sasl_security_options
			lmtp_sasl_tls_verified_security_options = $lmtp_sasl_tls_security_options
			lmtp_sasl_type = cyrus
			smtp_sasl_auth_enable = yes
			smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
			smtp_sasl_security_options = noplaintext, noanonymous
			smtp_sasl_tls_security_options = $smtp_sasl_security_options
			smtp_sasl_tls_verified_security_options = $smtp_sasl_tls_security_options
			smtp_sasl_type = cyrus
			smtpd_sasl_auth_enable = no
			smtpd_sasl_authenticated_header = no
			smtpd_sasl_path = smtpd
			smtpd_sasl_security_options = noanonymous
			smtpd_sasl_tls_security_options = $smtpd_sasl_security_options
			smtpd_sasl_type = cyrus
			smtp_enforce_tls = yes
			smtp_sasl_tls_security_options = $smtp_sasl_security_options
			smtp_sasl_tls_verified_security_options = $smtp_sasl_tls_security_options
			smtp_starttls_timeout = 300s
			smtp_tls_dkey_file = $smtp_tls_dcert_file
			smtp_tls_enforce_peername = yes
			smtp_tls_key_file = $smtp_tls_cert_file
			smtp_tls_loglevel = 2
			smtp_tls_mandatory_ciphers = medium
			smtp_tls_mandatory_protocols = SSLv3, TLSv1
			smtp_tls_note_starttls_offer = no
			smtp_tls_scert_verifydepth = 5
			smtp_tls_secure_cert_match = nexthop, dot-nexthop
			smtp_tls_security_level = encrypt
			smtp_tls_session_cache_timeout = 3600s
			smtp_tls_verify_cert_match = hostname
			smtp_use_tls = yes

			Most of this stuff is explained very detailed on the postfix.org site, if you have problems like me. Other than that it works on my end. Thanks.

Franks: added link to Postfix:main.cf

2006-11-13T05:17:38Z

added link to Postfix:main.cf

← Older revision		Revision as of 22:17, 12 November 2006
Line 2:		Line 2:

	[[Postfix:pmm]] is our shell script to review Postfix maillog.		[[Postfix:pmm]] is our shell script to review Postfix maillog.
			[[Postfix:main.cf]] contains additional ideas for your main.cf

	== FreeBSD and TLS/SASL ==		== FreeBSD and TLS/SASL ==

Franks at 21:12, 10 December 2005

2005-12-10T21:12:32Z

← Older revision		Revision as of 14:12, 10 December 2005
Line 1:		Line 1:
	[http://www.postfix.org Postfix] is Wietse Venema's sendmail alternative that attempts to be fast, easy to administer, and secure, while at the same time being sendmail compatible enough to not upset existing users.		[http://www.postfix.org Postfix] is Wietse Venema's sendmail alternative that attempts to be fast, easy to administer, and secure, while at the same time being sendmail compatible enough to not upset existing users.

			[[Postfix:pmm]] is our shell script to review Postfix maillog.

	== FreeBSD and TLS/SASL ==		== FreeBSD and TLS/SASL ==

Franks at 00:59, 8 December 2005

2005-12-08T00:59:04Z

New page

[http://www.postfix.org Postfix] is Wietse Venema's sendmail alternative that attempts to be fast, easy to administer, and secure, while at the same time being sendmail compatible enough to not upset existing users.

== FreeBSD and TLS/SASL ==

Ignore the version numbers, the port names are what is important.
# pkg_info | egrep '(postfix|sasl)'
cyrus-sasl-2.1.21_1 RFC 2222 SASL (Simple Authentication and Security Layer)
cyrus-sasl-saslauthd-2.1.21 SASL authentication server for cyrus-sasl2
postfix-2.2.6,1 A secure alternative to widely-used Sendmail

postfix:main.cf:
smtpd_use_tls = yes
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain =
broken_sasl_auth_clients = yes

Anything extra in the directory below I put into the deactivated directory I created.
# ls /usr/local/lib/sasl2/
deactivated libdigestmd5.so.2 libplain.so.2
libcrammd5.a liblogin.a libsasldb.a
libcrammd5.so liblogin.so libsasldb.so
libcrammd5.so.2 liblogin.so.2 libsasldb.so.2
libdigestmd5.a libplain.a smtpd.conf
libdigestmd5.so libplain.so

rc.conf:
saslauthd_enable="YES"

In my case, I used the .pem file I had for imapd. You may have to generate on using mkimapdcert if you don't have [[variables|$file]].pem on your server.
And finally, start everything up.
# /usr/local/etc/rc.d/saslauthd.sh start
# postfix reload

Now

# tail -f /var/log/maillog

and try to use TLS & SMTP AUTH with your email client, watching the logs.