boudewijn wrote:Allright: I will use TLS or SSL in the future; it's a nice feature.
I'm using cyrus-sasl.
Lets get sasl going first.
boudewijn wrote:The guide: the one on gentoo-wiki.com (email system for the home network). I haven't used it before. My standard mail setup (about five boxes currently deployed... and stable as a rock) is from gentoo.org itself (the documentation\administration part).
Thought so. No offense to the authors at gentoo-wiki, but I've found most of the articles there inaccurate, incomplete, and/or out of date. Docs at gentoo.org are usually much better, but also get outdated from time to time.
boudewijn wrote:saslauthd and smtpd.conf : please have a look at my start-posts. I don't mindd reposting them, although there might be people who are considering that being spam.
Just want to make sure nothing has changed.
boudewijn wrote:Installed versions:
Code: Select all
Calculating dependencies ...done!
[ebuild R ] dev-libs/cyrus-sasl-2.1.21-r2
[ebuild R ] mail-mta/postfix-2.2.5
You forgot the -v option. I want to see which USE flags are enabled/disabled.
boudewijn wrote:Currently I'm not using any kind of SSL or TLS, the inbound mail is sent without SSL\TLS.
Outbound mail is done using mutt (just like the checking of my mailbox).
smtpd.conf:
Code: Select all
mail boudewijn # cat /usr/lib64/sasl2/smtpd.conf
# $Header: /var/cvsroot/gentoo-x86/mail-mta/postfix/files/smtp.sasl,v 1.2 2004/07/18 03:26:56 dragonheart Exp $
pwcheck_method:saslauthd
mech_list : plain login
mail boudewijn # cat /etc/sasl2/smtpd.conf
# $Header: /var/cvsroot/gentoo-x86/mail-mta/postfix/files/smtp.sasl,v 1.2 2004/07/18 03:26:56 dragonheart Exp $
pwcheck_method:saslauthd
mech_list : plain login
Looks good so far...
boudewijn wrote:And the rest (please tell me if you need more):
Code: Select all
mail postfix # cat main.cf
queue_directory = /var/spool/postfix
command_directory = /usr/sbin
daemon_directory = /usr/lib/postfix
mail_owner = postfix
myorigin = $myhostname
mydestination = $myhostname, localhost.$mydomain, <domain>
unknown_local_recipient_reject_code = 450
mynetworks_style = subnet
mynetworks = 127.0.0.0/8 192.168.1.0/24
mailbox_command = /usr/bin/procmail
debug_peer_level = 2
debugger_command =
PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin:
xxgdb = $daemon_directory/$process_name $process_id & sleep 5
sendmail_path = /usr/sbin/sendmail
newaliases_path = /usr/bin/newaliases
mailq_path = /usr/bin/mailq
setgid_group = postdrop
manpage_directory = /usr/share/man
readme_directory = /usr/share/doc/postfix-2.1.5-r2/readme
default_destination_concurrency_limit = 2
alias_database = hash:/etc/mail/aliases
local_destination_concurrency_limit = 2
alias_maps = hash:/etc/mail/aliases
home_mailbox = .maildir/
masquerade_domains = <domain>
#smtpd_sasl_auth_enable = yes
#smtpd_sasl_security_options = noanonymous
#smtpd_sasl_local_domain =
#broken_sasl_auth_clients = yes
smtpd_recipient_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
reject_unauth_destination
smtpd_use_tls = yes
smtpd_tls_auth_only = yes
smtpd_tls_key_file = /etc/ssl/postfix/server.key
smtpd_tls_cert_file = /etc/ssl/postfix/server.crt
smtpd_tls_CAfile = /etc/ssl/postfix/server.pem
smtpd_tls_loglevel = 3
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom
I don't see either "mydomain" or "myhostname". Thats a problem! Should be something like:
Code: Select all
mydomain = mydomain.nl
myhostname = mailserver.mydomain.nl
Also, you need to change your smtp_recipient_restrictions line to EXCLUDE "smtpd_use_tls = yes" That's not a restriction, its a parameter for TLS/SSL. Remember the whitespace line continuation I mentioned earlier? Jeetje!, Wat ben je aan doen? Graapje. Just kidding
Also comment all the tls stuff for now. That section should appear like so:
Code: Select all
smtpd_recipient_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
reject_unauth_destination
#smtpd_use_tls = yes
#smtpd_tls_auth_only = yes
#smtpd_tls_key_file = /etc/ssl/postfix/server.key
#smtpd_tls_cert_file = /etc/ssl/postfix/server.crt
#smtpd_tls_CAfile = /etc/ssl/postfix/server.pem
#smtpd_tls_loglevel = 3
#smtpd_tls_received_header = yes
#smtpd_tls_session_cache_timeout = 3600s
#tls_random_source = dev:/dev/urandom
boudewijn wrote:Code: Select all
mail postfix # grep -v '^#' master.cf
smtp inet n - n - - smtpd -v
pickup fifo n - n 60 1 pickup
cleanup unix n - n - 0 cleanup
qmgr fifo n - n 300 1 qmgr
rewrite unix - - n - - trivial-rewrite
bounce unix - - n - 0 bounce
defer unix - - n - 0 bounce
trace unix - - n - 0 bounce
verify unix - - n - 1 verify
flush unix n - n 1000? 0 flush
proxymap unix - - n - - proxymap
smtp unix - - n - - smtp
relay unix - - n - - smtp
showq unix n - n - - showq
error unix - - n - - error
local unix - n n - - local
virtual unix - n n - - virtual
lmtp unix - - n - - lmtp
anvil unix - - n - 1 anvil
maildrop unix - n n - - pipe
flags=DRhu user=vmail argv=/usr/local/bin/maildrop -d ${recipient}
old-cyrus unix - n n - - pipe
flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
cyrus unix - n n - - pipe
user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
uucp unix - n n - - pipe
flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
ifmail unix - n n - - pipe
flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp unix - n n - - pipe
flags=Fq. user=foo argv=/usr/local/sbin/bsmtp -f $sender $nexthop $recipient
Looks good. You didn't change anything in master.cf did you (except for the -v for logging)?
boudewijn wrote:Thanks btw, dude!
You're welcome.
boudewijn wrote:edit:
Connecting through telnet now results in normal output:
Code: Select all
bigmac:~ boudewijn$ telnet<domain> 25
Trying <IP>...
Connected to tendam-bremer.nl.
Escape character is '^]'.
220 mail.<domain> ESMTP Postfix
ehlo <domain>
250-mail.<domain>
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250 8BITMIME
^]
telnet> Connection closed.
This looks good.
Apply the changes to main.cf and test again (postfix reload). I think the error messages you are getting:
Code: Select all
Out: 451 Server configuration error
might be related to not having mydomain or myhostname in your main.cf. Check you mail log (/var/log/mail.log) for more specific errors.
Also, did you "postmap /etc/mail/aliases" after you added the root alias? If so, you should have a /etc/mail/aliases.db file.
"postfix check" probably wouldn't hurt either.
EDIT: Forgot to mention something....
This is an excellent guide to Postfix/sasl/tls. Step by step instructions including explaination and testing as you go. Though it is geared toward Redhat, the configuration and testing info is much better than I could ever do here. Suggest you check it out.
)