---
Alias: ["Postfix"]
Tag: ["🖥️", "📧"]
Date: 2021-09-10
DocType: "Personal"
Hierarchy: "NonRoot"
TimeStamp:
location: [51.514678599999996, -0.18378583926867909]
CollapseMetaTable: true
---
Parent:: [[Selfhosting]], [[Server Alias]], [[Server Cloud]], [[Server Tools]], [[Server VPN]]
---
^Top
 
```button
name Save
type command
action Save current file
id Save
```
^button-TNSave
 
# Configuring Postfix
 
```ad-abstract
title: Summary
collapse: open
This note goes through the installation of Postfix, an email-handling solution for servers.
```
 
```toc
style: number
```
 
---
 
### Installation
[[#^Top|TOP]]
 
Installation is simple and opens a dialogue box. Steps are described below:
1. **Install Postfix**
```ad-command
~~~bash
sudo apt-get install -y postfix postfix-pgsql -y
~~~
```
2. **Configuration screen**
Choose 'Internet Site'
3. **System mail name**
Define a name and make a note of it for further use.
 
---
 
### Generic configuration
[[#^Top|TOP]]
 
```ad-note
title: Documentation
[Basic config ](https://github.com/simple-login/app )
```
The basic configuration is run in detail below.
 
#### Main.cf
[[#^Top|TOP]]
```ad-path
/etc/postfix/main.cf
```
Edit the file whilst editing the following values:
1. myhostname (current server)
2. mydomain (associated domain)
3. my origin (associated domain)
```ad-code
title: main.cf
~~~bash
###### POSTFIX config file, adapted for SimpleLogin
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no
###### appending .domain is the MUA's job.
append_dot_mydomain = no
###### Uncomment the next line to generate "delayed mail" warnings
######## delay_warning_time = 4h
readme_directory = no
###### See http://www.postfix.org/COMPATIBILITY_README.html -- default to 2 on fresh installs.
compatibility_level = 2
###### TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtp_tls_security_level = may
smtpd_tls_security_level = may
###### See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
###### information on enabling SSL in the smtp client.
alias_maps = hash:/etc/aliases
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 240.0.0.0/24
###### Set your domain here
mydestination =
myhostname = app.mydomain.com
mydomain = mydomain.com
myorigin = mydomain.com
relay_domains = pgsql:/etc/postfix/pgsql-relay-domains.cf
transport_maps = pgsql:/etc/postfix/pgsql-transport-maps.cf
###### HELO restrictions
smtpd_delay_reject = yes
smtpd_helo_required = yes
smtpd_helo_restrictions =
permit_mynetworks,
reject_non_fqdn_helo_hostname,
reject_invalid_helo_hostname,
permit
###### Sender restrictions:
smtpd_sender_restrictions =
permit_mynetworks,
reject_non_fqdn_sender,
reject_unknown_sender_domain,
permit
###### Recipient restrictions:
smtpd_recipient_restrictions =
reject_unauth_pipelining,
reject_non_fqdn_recipient,
reject_unknown_recipient_domain,
permit_mynetworks,
reject_unauth_destination,
reject_rbl_client zen.spamhaus.org,
reject_rbl_client bl.spamcop.net,
permit
~~~
```
 
#### relay domains
[[#^Top|TOP]]
```ad-path
/etc/postfix/pgsql-relay-domains.cf
```
Below is the default config for the file (replace mydomain.com with relevant value):
```ad-code
title: master.cf
~~~bash
###### postgres config
hosts = localhost
user = myuser
password = mypassword
dbname = simplelogin
query = SELECT domain FROM custom_domain WHERE domain='%s' AND verified=true
UNION SELECT '%s' WHERE '%s' = 'mydomain.com' LIMIT 1;
~~~
```
 
#### transport maps
[[#^Top|TOP]]
```ad-path
/etc/postfix/pgsql-transport-maps.cf
```
Below is the standard declaration of the file (replace mydomain.com with the relevant value):
```ad-code
title: pgsql-transport-maps.cf
~~~bash
###### postgres config
hosts = localhost
user = myuser
password = mypassword
dbname = simplelogin
###### forward to smtp:127.0.0.1:20381 for custom domain AND email domain
query = SELECT 'smtp:127.0.0.1:20381' FROM custom_domain WHERE domain = '%s' AND verified=true
UNION SELECT 'smtp:127.0.0.1:20381' WHERE '%s' = 'mydomain.com' LIMIT 1;
~~~
```
 
#### Generic commands
[[#^Top|TOP]]
##### Restart the service
```ad-command
~~~bash
sudo systemctl restart postfix
~~~
```
 
---
 
### Allow external connections
[[#^Top|TOP]]
 
```ad-note
title: Documentation
[Fwd to external smtp ](https://github.com/simple-login/app/discussions/612 )
```
 
#### Incoming
[[#^Top|TOP]]
##### Ports
Ports (25, 465, 587) need to be opened by the firewall:
```ad-command
~~~bash
sudo ufw allow (port)/tcp
~~~
```
 
##### Networks
[[#^Top|TOP]]
Definition of permitted networks to restrict access (in [[Configuring Postfix#Main cf|main.cf]]).
 
##### Submission/SMTPD
```ad-path
/etc/postfix/master.cf
```
Options are coded in the file by default. Uncheck necessary directives.
 
##### SSL cert
[[#^Top|TOP]]
Postfix SSL certs need to match that of the server (in [[Configuring Postfix#Main cf|main.cf]]).
 
##### SASL
[[#^Top|TOP]]
[Tutorial ](https://github.com/webmin/webmin/issues/58 )
 
##### Add SASL users
```ad-command
title: add a user
~~~bash
sudo saslpasswd2 -c -u (mydomain.tld) (username)
~~~
```
```ad-command
title: check number of users
~~~bash
sudo sasldblistusers2
~~~
```
 
#### Outgoing
Allow for connecting to an external SMTP - not tested.
 
---
 
### Monitor Postfix
[[#^Top|TOP]]
 
#### Monitor outgoing emails
Unfortunately there is no built-in functionality to monitor specifically outgoing emails. The following command can however be used and grans relevant info from `mail.log` :
```ad-command
~~~bash
sudo grep "status=sent" /var/log/mail.log | egrep -ve 'postfix/(cleanup|pickup|master|qmgr|smtpd|local|pipe)'
~~~
```
 
#### Monitor SMTP connections
```ad-command
~~~bash
sudo tail -f /var/log/mail.log
~~~
```
 
#### Identify IPs with Failed Logins
```ad-command
~~~bash
sudo grep " warning: " /var/log/mail.log |cut -d '[' -f3 |cut -d ']' -f1 |sort -u
~~~
```
 
And
 
```ad-command
~~~bash
sudo grep " reject: " /var/log/mail.log |cut -d '[' -f3 |cut -d ']' -f1 |sort -u
~~~
```
[[#^Top|TOP]]
 
 
