Size: 2109
Comment:
|
Size: 3291
Comment: reapplying changes by ThomasLeuxner
|
Deletions are marked like this. | Additions are marked like this. |
Line 45: | Line 45: |
=== Using SASL with Postfix submission port === When Dovecot is used as the authentication backend for Postfix it is good practice to use a dedicated submission port for the MUAs (TCP 587). Not only can you specify individual parameters in '''master.cf''' overriding the global ones but you will not run into internet mail rejection while the Dovecot Auth Mechanism is unavailable. In this example Postfix is configured to accept TLS encrypted sessions only along with several sanity checks: * Verification of alias ownership via Login Maps * Domainname and recipient plausibility `master.cf` {{{ submission inet n - - - - smtpd -o smtpd_tls_security_level=encrypt -o smtpd_sasl_auth_enable=yes -o smtpd_sasl_type=dovecot -o smtpd_sasl_path=private/auth -o smtpd_sasl_security_options=noanonymous -o smtpd_sasl_local_domain=$myhostname -o smtpd_client_restrictions=permit_sasl_authenticated,reject -o smtpd_sender_login_maps=hash:/etc/postfix/virtual -o smtpd_sender_restrictions=reject_sender_login_mismatch -o smtpd_recipient_restrictions=reject_unknown_recipient_domain,reject_non_fqdn_recipient,permit_sasl_authenticated,reject }}} |
Postfix and Dovecot SASL
Since version 2.3, Postfix supports SMTP AUTH through Dovecot SASL as introduced in the Dovecot 1.0 series. If using Postfix obtained from a binary (such as a .rpm or .deb file), you can check if Postfix was compiled with support for Dovecot SASL by running the command:
postconf -a
Once you have verified that your installation of Postfix supports Dovecot SASL, it's very simple to configure:
Example dovecot.conf excerpt
auth default { mechanisms = plain login passdb pam { } userdb passwd { } socket listen { client { # Assuming the default Postfix $queue_directory setting path = /var/spool/postfix/private/auth mode = 0660 # Assuming the default Postfix user and group user = postfix group = postfix } # deliver and some other programs need also auth-master: #master { # path = /var/run/dovecot/auth-master # mode = 0600 #} } }
Example Postfix main.cf excerpt
smtpd_sasl_type = dovecot # Can be an absolute path, or relative to $queue_directory # Debian/Ubuntu users: Postfix is setup by default to run chrooted, so it is best to leave it as-is below smtpd_sasl_path = private/auth # and the common settings to enable SASL: smtpd_sasl_auth_enable = yes smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
Using SASL with Postfix submission port
When Dovecot is used as the authentication backend for Postfix it is good practice to use a dedicated submission port for the MUAs (TCP 587). Not only can you specify individual parameters in master.cf overriding the global ones but you will not run into internet mail rejection while the Dovecot Auth Mechanism is unavailable. In this example Postfix is configured to accept TLS encrypted sessions only along with several sanity checks:
- Verification of alias ownership via Login Maps
- Domainname and recipient plausibility
master.cf
submission inet n - - - - smtpd -o smtpd_tls_security_level=encrypt -o smtpd_sasl_auth_enable=yes -o smtpd_sasl_type=dovecot -o smtpd_sasl_path=private/auth -o smtpd_sasl_security_options=noanonymous -o smtpd_sasl_local_domain=$myhostname -o smtpd_client_restrictions=permit_sasl_authenticated,reject -o smtpd_sender_login_maps=hash:/etc/postfix/virtual -o smtpd_sender_restrictions=reject_sender_login_mismatch -o smtpd_recipient_restrictions=reject_unknown_recipient_domain,reject_non_fqdn_recipient,permit_sasl_authenticated,reject
See also:
Remark
If Outlook Express (and/or Windows Mail) doesn't seem to login, even though you checked "My server requires authentication" in its configuration, then verify that the "mechanisms" line contains "login" in addition to "plain". "plain" is the default, and most clients can work with it, but Outlook Express needs the "login" mechanism. Also see: