2008 - Debian 4 - Postfix + SASL + TLS

|=--------------------------=[ Postfix + SASL + TLS ]=---------------------=|
+---------------------------------------------------------------------------+
|                                                                           |
|       Instalacia Postfixu s podporou overovania SASL + TLS                |
|                                  Debian 4.0 Etch                          |
|                                                                           |
+---------------------------------------------------------------------------+
|=-------------------------------=[ BH 2007 ]=-----------------------------=|

Configuring postfix with SASL authentication. SASL is set up so that
the user authenticates through PAM, that is, with their own account password.
Since this data travels the network unencrypted, use SSL as well.

        # apt-get install postfix libsasl2 sasl2-bin libsasl2-modules libdb3-util procmail

        # dpkg-reconfigure postfix
        --------------------------
        General type of configuration? <-- Internet Site
        Where should mail for root go <-- [prazdne]
        Mail name? <-- server1.example.com
        Other destinations to accept mail for? (blank for none) <-- server.domena.sk, localhost.domena.sk, localhost.localdomain, localhost
        Force synchronous updates on mail queue? <-- No
        Local networks? <-- 127.0.0.0/8
        Use procmail for local delivery? <-- Yes
        Mailbox size limit <-- 0
        Local address extension character? <-- +
        Internet protocols to use? <-- all

        # postconf -e 'smtpd_sasl_local_domain ='
        # postconf -e 'smtpd_sasl_auth_enable = yes'
        # postconf -e 'smtpd_sasl_security_options = noanonymous'
        # postconf -e 'broken_sasl_auth_clients = yes'
        # postconf -e 'smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination'
        # postconf -e 'inet_interfaces = all'
        # echo 'pwcheck_method: saslauthd' >> /etc/postfix/sasl/smtpd.conf
        # echo 'mech_list: plain login' >> /etc/postfix/sasl/smtpd.conf

        Since postfix runs chrooted in /var/spool/postfix, SASL has to go into the jail as well.
        ----------------------------------------------------------------------------------------
        # mkdir -p /var/spool/postfix/var/run/saslauthd

        Edit /etc/default/saslauthd to turn SASL on. Set the directive
        START = yes
        a zmenime riadok
        OPTIONS="-c" na OPTIONS="-c -m /var/spool/postfix/var/run/saslauthd -r"

        Restartneme SASL demona
        -----------------------
        # /etc/init.d/saslauthd start

        # mkdir /etc/postfix/ssl
        # cd /etc/postfix/ssl/
        # openssl genrsa -des3 -rand /etc/hosts -out smtpd.key 1024
        # chmod 600 smtpd.key
        # openssl req -new -key smtpd.key -out smtpd.csr
        ------------------------------------------------
        Country Name (2 letter code) [AU]:SK
        State or Province Name (full name) [Some-State]:Slovakia
        Locality Name (eg, city) []:Mesto
        Organization Name (eg, company) [Internet Widgits Pty Ltd]:domena.sk
        Organizational Unit Name (eg, section) []:
        Common Name (eg, YOUR name) []:server.domena.sk
        Email Address []:postmaster@domena.sk

        Please enter the following 'extra' attributes
        to be sent with your certificate request
        A challenge password []: prazdne
        An optional company name []: prazdne
        ------------------------------------------------
        # openssl x509 -req -days 3650 -in smtpd.csr -signkey smtpd.key -out smtpd.crt
        # openssl rsa -in smtpd.key -out smtpd.key.unencrypted
        # mv -f smtpd.key.unencrypted smtpd.key
        # openssl req -new -x509 -extensions v3_ca -keyout cakey.pem -out cacert.pem -days 3650

        # postconf -e 'smtpd_tls_auth_only = no'
        # postconf -e 'smtp_use_tls = yes'
        # postconf -e 'smtpd_use_tls = yes'
        # postconf -e 'smtp_tls_note_starttls_offer = yes'
        # postconf -e 'smtpd_tls_key_file = /etc/postfix/ssl/smtpd.key'
        # postconf -e 'smtpd_tls_cert_file = /etc/postfix/ssl/smtpd.crt'
        # postconf -e 'smtpd_tls_CAfile = /etc/postfix/ssl/cacert.pem'
        # postconf -e 'smtpd_tls_loglevel = 1'
        # postconf -e 'smtpd_tls_received_header = yes'
        # postconf -e 'smtpd_tls_session_cache_timeout = 3600s'
        # postconf -e 'tls_random_source = dev:/dev/urandom'
        # postconf -e 'myhostname = server.domena.sk'

        # /etc/init.d/postfix restart

        tools -> accounts -> mail -> nazov_uctu -> servers -> log_on_using_secure_password_authentication = check
        tools -> accounts -> mail -> nazov_uctu -> servers -> my_server_requires_authentication = check
        tools -> accounts -> mail -> nazov_uctu -> advanced -> this_server_requires_a_secure_connection(SSL) = check

============================================================================================
 Setting postfix to authenticate over SASL when it connects to another SMTP server,
 which requires authentication. When postfix wants to connect to mail.domena.sk
 the login and password from /etc/postfix/sasl_passwd are used
============================================================================================

        # touch /etc/postfix/sasl_passwd
        # nano /etc/postfix/sasl_passwd
        -------------------------------
        domena.sk       ucet:heslo

        # postmap /etc/postfix/sasl_passwd
        # nano /etc/postfix/main.cf
        ---------------------------
        smtp_sasl_auth_enable=yes
        smtp_sasl_password_maps=hash:/etc/postfix/sasl_passwd

        # /etc/init.d/postfix reload

        Install stunnel
        ---------------
        # apt-get install stunnel4

        Pridanie uzivatela a skupiny smtps
        ----------------------------------
        # groupadd smtps
        # useradd -d /dev/null -g smtps -s /bin/false smtps

        Nastartujeme stunnel v client mode pre protokol smtp pocuvajuci na localhoste:465 a
        napajajuci sa na vzdialeny stroj mail.client23.example:465 pod uzivatelom a skupinou smtps.
        ------------------------------------------------------------------------------------
        # stunnel -c -d 127.0.0.1:465 -o /var/log/SMTPS_tunnel.log -n smtp -s smtps -g smtps -r mail.client23.example:465

        # touch /etc/postfix/sasl_passwd
        # nano /etc/postfix/sasl_passwd
        -------------------------------
        localhost       ucet@server:HESLO

        # postmap /etc/postfix/sasl_passwd
        # nano /etc/postfix/main.cf
        ---------------------------
        relayhost = localhost:465
        smtp_sasl_auth_enable=yes
        smtp_sasl_password_maps=hash:/etc/postfix/sasl_passwd
        smtp_sasl_security_options = noanonymous
        smtp_use_tls = no

        # /etc/init.d/postfix reload