--- Alias: ["Postfix"] Tag: ["Server", "Email"] Date: 2021-09-10 DocType: "Personal" Hierarchy: "NonRoot" TimeStamp: location: [51.514678599999996, -0.18378583926867909] CollapseMetaTable: Yes --- Parent:: [[Selfhosting]], [[Server Alias]], [[Server Cloud]], [[Server Tools]], [[Server VPN]] --- ^Top   ```button name Save type command action Save current file id Save ``` ^button-TNSave   # Configuring Postfix   ```ad-abstract title: Summary collapse: open This note goes through the installation of Postfix, an email-handling solution for servers. ```   ```toc style: number ```   ---   ### Installation [[#^Top|TOP]]   Installation is simple and opens a dialogue box. Steps are described below: 1. **Install Postfix** ```ad-command ~~~bash sudo apt-get install -y postfix postfix-pgsql -y ~~~ ``` 2. **Configuration screen** Choose 'Internet Site' 3. **System mail name** Define a name and make a note of it for further use.   ---   ### Generic configuration [[#^Top|TOP]]   ```ad-note title: Documentation [Basic config](https://github.com/simple-login/app) ``` The basic configuration is run in detail below.   #### Main.cf [[#^Top|TOP]] ```ad-path ~~~ /etc/postfix/main.cf ~~~ ``` Edit the file whilst editing the following values: 1. myhostname (current server) 2. mydomain (associated domain) 3. my origin (associated domain) ```ad-code title: main.cf ~~~ ###### POSTFIX config file, adapted for SimpleLogin smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu) biff = no ###### appending .domain is the MUA's job. append_dot_mydomain = no ###### Uncomment the next line to generate "delayed mail" warnings ######## delay_warning_time = 4h readme_directory = no ###### See http://www.postfix.org/COMPATIBILITY_README.html -- default to 2 on fresh installs. compatibility_level = 2 ###### TLS parameters smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache smtp_tls_security_level = may smtpd_tls_security_level = may ###### See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for ###### information on enabling SSL in the smtp client. alias_maps = hash:/etc/aliases mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 240.0.0.0/24 ###### Set your domain here mydestination = myhostname = app.mydomain.com mydomain = mydomain.com myorigin = mydomain.com relay_domains = pgsql:/etc/postfix/pgsql-relay-domains.cf transport_maps = pgsql:/etc/postfix/pgsql-transport-maps.cf ###### HELO restrictions smtpd_delay_reject = yes smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, permit ###### Sender restrictions: smtpd_sender_restrictions = permit_mynetworks, reject_non_fqdn_sender, reject_unknown_sender_domain, permit ###### Recipient restrictions: smtpd_recipient_restrictions = reject_unauth_pipelining, reject_non_fqdn_recipient, reject_unknown_recipient_domain, permit_mynetworks, reject_unauth_destination, reject_rbl_client zen.spamhaus.org, reject_rbl_client bl.spamcop.net, permit ~~~ ```   #### relay domains [[#^Top|TOP]] ```ad-path ~~~ /etc/postfix/pgsql-relay-domains.cf ~~~ ``` Below is the default config for the file (replace mydomain.com with relevant value): ```ad-code title: master.cf ~~~ ###### postgres config hosts = localhost user = myuser password = mypassword dbname = simplelogin query = SELECT domain FROM custom_domain WHERE domain='%s' AND verified=true UNION SELECT '%s' WHERE '%s' = 'mydomain.com' LIMIT 1; ~~~ ```   #### transport maps [[#^Top|TOP]] ```ad-path ~~~ /etc/postfix/pgsql-transport-maps.cf ~~~ ``` Below is the standard declaration of the file (replace mydomain.com with the relevant value): ```ad-code title: pgsql-transport-maps.cf ~~~ ###### postgres config hosts = localhost user = myuser password = mypassword dbname = simplelogin ###### forward to smtp:127.0.0.1:20381 for custom domain AND email domain query = SELECT 'smtp:127.0.0.1:20381' FROM custom_domain WHERE domain = '%s' AND verified=true UNION SELECT 'smtp:127.0.0.1:20381' WHERE '%s' = 'mydomain.com' LIMIT 1; ~~~ ```   #### Generic commands [[#^Top|TOP]] ##### Restart the service ```ad-command ~~~bash sudo systemctl restart postfix ~~~ ```   ---   ### Allow external connections [[#^Top|TOP]]   ```ad-note title: Documentation [Fwd to external smtp](https://github.com/simple-login/app/discussions/612) ```   #### Incoming [[#^Top|TOP]] ##### Ports Ports (25, 465, 587) need to be opened by the firewall: ```ad-command ~~~bash sudo ufw allow (port)/tcp ~~~ ```   ##### Networks [[#^Top|TOP]] Definition of permitted networks to restrict access (in [[Configuring Postfix#Main cf|main.cf]]).   ##### Submission/SMTPD ```ad-path ~~~ /etc/postfix/master.cf ~~~ ``` Options are coded in the file by default. Uncheck necessary directives.   ##### SSL cert [[#^Top|TOP]] Postfix SSL certs need to match that of the server (in [[Configuring Postfix#Main cf|main.cf]]).   ##### SASL [[#^Top|TOP]] [Tutorial](https://github.com/webmin/webmin/issues/58)   ##### Add SASL users ```ad-command title: add a user ~~~bash sudo saslpasswd2 -c -u (mydomain.tld) (username) ~~~ ``` ```ad-command title: check number of users ~~~bash sudo sasldblistusers2 ~~~ ```   #### Outgoing Allow for connecting to an external SMTP - not tested.   ---   ### Monitor Postfix [[#^Top|TOP]]   #### Monitor outgoing emails Unfortunately there is no built-in functionality to monitor specifically outgoing emails. The following command can however be used and grans relevant info from `mail.log`: ```ad-command ~~~bash sudo grep "status=sent" /var/log/mail.log | egrep -ve 'postfix/(cleanup|pickup|master|qmgr|smtpd|local|pipe)' ~~~ ```   #### Monitor SMTP connections ```ad-command ~~~bash sudo tail -f /var/log/mail.log ~~~ ``` [[#^Top|TOP]]