5.9 KiB

Raw Blame History Unescape Escape

Alias

Tag

Date

DocType

Hierarchy

TimeStamp

location

CollapseMetaTable

Postfix

Server

2021-09-10

Personal

NonRoot

51.514678599999996

-0.18378583926867909

Yes

Parent:: Selfhosting, Server Alias, Server Cloud, Server Tools

name Save
type command
action Save current file
id Save

^button-TNSave

Configuring Postfix

title: Summary
collapse: open
This note goes through the installation of Postfix, an email-handling solution for servers.

style: number

Installation

Installation is simple and opens a dialogue box. Steps are described below:

Install Postfix

~~~
sudo apt-get install -y postfix postfix-pgsql -y
~~~

Configuration screen

Choose 'Internet Site'

System mail name

Define a name and make a note of it for further use.

Generic configuration

title: Documentation
[Basic config](https://github.com/simple-login/app)

The basic configuration is run in detail below.

Main.cf

~~~
/etc/postfix/main.cf
~~~

Edit the file whilst editing the following values:

myhostname (current server)
mydomain (associated domain)
my origin (associated domain)

title: main.cf
~~~
 ###### POSTFIX config file, adapted for SimpleLogin
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no

###### appending .domain is the MUA's job.
append_dot_mydomain = no

###### Uncomment the next line to generate "delayed mail" warnings
######## delay_warning_time = 4h

readme_directory = no

###### See http://www.postfix.org/COMPATIBILITY_README.html -- default to 2 on fresh installs.
compatibility_level = 2

###### TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtp_tls_security_level = may
smtpd_tls_security_level = may

###### See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
###### information on enabling SSL in the smtp client.

alias_maps = hash:/etc/aliases
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 240.0.0.0/24

###### Set your domain here
mydestination =
myhostname = app.mydomain.com
mydomain = mydomain.com
myorigin = mydomain.com

relay_domains = pgsql:/etc/postfix/pgsql-relay-domains.cf
transport_maps = pgsql:/etc/postfix/pgsql-transport-maps.cf

###### HELO restrictions
smtpd_delay_reject = yes
smtpd_helo_required = yes
smtpd_helo_restrictions =
    permit_mynetworks,
    reject_non_fqdn_helo_hostname,
    reject_invalid_helo_hostname,
    permit

###### Sender restrictions:
smtpd_sender_restrictions =
    permit_mynetworks,
    reject_non_fqdn_sender,
    reject_unknown_sender_domain,
    permit

###### Recipient restrictions:
smtpd_recipient_restrictions =
   reject_unauth_pipelining,
   reject_non_fqdn_recipient,
   reject_unknown_recipient_domain,
   permit_mynetworks,
   reject_unauth_destination,
   reject_rbl_client zen.spamhaus.org,
   reject_rbl_client bl.spamcop.net,
   permit
~~~

relay domains

~~~
/etc/postfix/pgsql-relay-domains.cf
~~~

Below is the default config for the file (replace mydomain.com with relevant value):

title: master.cf
~~~
###### postgres config
hosts = localhost
user = myuser
password = mypassword
dbname = simplelogin

query = SELECT domain FROM custom_domain WHERE domain='%s' AND verified=true
    UNION SELECT '%s' WHERE '%s' = 'mydomain.com' LIMIT 1;
~~~

transport maps

~~~
/etc/postfix/pgsql-transport-maps.cf
~~~

Below is the standard declaration of the file (replace mydomain.com with the relevant value):

title: pgsql-transport-maps.cf
~~~
###### postgres config
hosts = localhost
user = myuser
password = mypassword
dbname = simplelogin

###### forward to smtp:127.0.0.1:20381 for custom domain AND email domain
query = SELECT 'smtp:127.0.0.1:20381' FROM custom_domain WHERE domain = '%s' AND verified=true
    UNION SELECT 'smtp:127.0.0.1:20381' WHERE '%s' = 'mydomain.com' LIMIT 1;
~~~

Generic commands

Restart the service

~~~
sudo systemctl restart postfix
~~~

Allow external connections

title: Documentation
[Fwd to external smtp](https://github.com/simple-login/app/discussions/612)

Incoming

Ports

Ports (25, 465, 587) need to be opened by the firewall:

~~~
sudo ufw allow (port)/tcp
~~~

Networks

Definition of permitted networks to restrict access (in Configuring Postfix#Main cf).

Submission/SMTPD

~~~
/etc/postfix/master.cf
~~~

Options are coded in the file by default. Uncheck necessary directives.

SSL cert

Postfix SSL certs need to match that of the server (in Configuring Postfix#Main cf).

SASL

Tutorial

Add SASL users

title: add a user
~~~
sudo saslpasswd2 -c -u (mydomain.tld) (username)
~~~

title: check number of users
~~~
sudo sasldblistusers2
~~~

Outgoing

Allow for connecting to an external SMTP - not tested.

Monitor Postfix

Monitor outgoing emails

Unfortunately there is no built-in functionality to monitor specifically outgoing emails. The following command can however be used and grans relevant info from mail.log:

~~~
sudo grep "status=sent" /var/log/mail.log | egrep -ve 'postfix/(cleanup|pickup|master|qmgr|smtpd|local|pipe)'
~~~

Monitor SMTP connections

~~~
sudo tail -f /var/log/mail.log
~~~

5.9 KiB Raw Blame History Unescape Escape