Obsidian/Networks/Postfix config.md

---

Alias: ["Postfix"]
Tag: ["Server", "Email"]
Date: 2021-09-10
DocType: "Personal"
Hierarchy: "NonRoot"
TimeStamp:
location: [51.514678599999996, -0.18378583926867909]
CollapseMetaTable: Yes

---

Parent:: [[Selfhosting]], [[Alias Server]], [[Cloud Server]], [[Tools Server]]

 

```button
name Save
type command
action Save current file
id Save
```
^button-TNSave

 

# Configuring Postfix

 

```ad-abstract
title: Summary
collapse: open
This note goes through the installation of Postfix, an email-handling solution for servers.
```

 

```toc
style: number
```

 

---

 

### Installation

 

Installation is simple and opens a dialogue box. Steps are described below:

1. **Install Postfix**

`sudo apt-get install -y postfix postfix-pgsql -y`

2. **Configuration screen**

Choose 'Internet Site'

3. **System mail name**

Define a name and make a note of it for further use.

 

---

 

### Generic configuration

 

```ad-note
title: Documentation
[Basic config](https://github.com/simple-login/app)
```

The basic configuration is run in detail below.

 

#### Main.cf

```ad-info
title: File path
/etc/postfix/main.cf
```

Edit the file whilst editing the following values:
1. myhostname (current server)
2. mydomain (associated domain)
3. my origin (associated domain)

> ###### POSTFIX config file, adapted for SimpleLogin
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no
>
>###### appending .domain is the MUA's job.
append_dot_mydomain = no
>
>###### Uncomment the next line to generate "delayed mail" warnings
>######## delay_warning_time = 4h
>
>readme_directory = no
>
>###### See http://www.postfix.org/COMPATIBILITY_README.html -- default to 2 on fresh installs.
compatibility_level = 2
>
>###### TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtp_tls_security_level = may
smtpd_tls_security_level = may
>
>###### See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
>###### information on enabling SSL in the smtp client.
>
>alias_maps = hash:/etc/aliases
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 240.0.0.0/24
>
>###### Set your domain here
mydestination =
myhostname = app.mydomain.com
mydomain = mydomain.com
myorigin = mydomain.com
>
>relay_domains = pgsql:/etc/postfix/pgsql-relay-domains.cf
transport_maps = pgsql:/etc/postfix/pgsql-transport-maps.cf
>
>###### HELO restrictions
smtpd_delay_reject = yes
smtpd_helo_required = yes
smtpd_helo_restrictions =
>    permit_mynetworks,
>    reject_non_fqdn_helo_hostname,
>    reject_invalid_helo_hostname,
>    permit
>
>###### Sender restrictions:
smtpd_sender_restrictions =
>    permit_mynetworks,
>    reject_non_fqdn_sender,
>    reject_unknown_sender_domain,
>    permit
>
>###### Recipient restrictions:
smtpd_recipient_restrictions =
>   reject_unauth_pipelining,
>   reject_non_fqdn_recipient,
>   reject_unknown_recipient_domain,
>   permit_mynetworks,
>   reject_unauth_destination,
>   reject_rbl_client zen.spamhaus.org,
>   reject_rbl_client bl.spamcop.net,
>   permit


 

#### relay domains

```ad-info
title: File path
/etc/postfix/pgsql-relay-domains.cf
```

Below is the default config for the file (replace mydomain.com with relevant value):

>###### postgres config
hosts = localhost
user = myuser
password = mypassword
dbname = simplelogin
>
query = SELECT domain FROM custom_domain WHERE domain='%s' AND verified=true
>    UNION SELECT '%s' WHERE '%s' = 'mydomain.com' LIMIT 1;


 

#### transport maps

```ad-info
title: File path
/etc/postfix/pgsql-transport-maps.cf
```

Below is the standard declaration of the file (replace mydomain.com with the relevant value):

>###### postgres config
hosts = localhost
user = myuser
password = mypassword
dbname = simplelogin
>
>###### forward to smtp:127.0.0.1:20381 for custom domain AND email domain
query = SELECT 'smtp:127.0.0.1:20381' FROM custom_domain WHERE domain = '%s' AND verified=true
>    UNION SELECT 'smtp:127.0.0.1:20381' WHERE '%s' = 'mydomain.com' LIMIT 1;

 

#### Generic commands

##### Restart the service

`sudo systemctl restart postfix`

 

---

 

### Allow external connections

 

```ad-note
title: Documentation
[Fwd to external smtp](https://github.com/simple-login/app/discussions/612)
```

 

#### Incoming

1. **Ports**

Ports (25, 465, 587) need to be opened by the firewall:

`sudo ufw allow (port)/tcp`

 

2. **Networks**

Definition of permitted networks to restrict access (in [[Postfix config#Main cf|main.cf]]).

 

3. **Submission/SMTPD**

```ad-info
title: File path
/etc/postfix/master.cf
```

Options are coded in the file by default. Uncheck necessary directives.

 

4. **SSL cert**

Postfix SSL certs need to match that of the server (in [[Postfix config#Main cf|main.cf]]).

 

5. **SASL**

[Tutorial](https://github.com/webmin/webmin/issues/58)

 

#### Outgoing