1<!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" 2 "http://www.w3.org/TR/html4/loose.dtd"> 3 4<html> 5 6<head> 7 8<title>Postfix Small/Home Office Hints and Tips</title> 9 10<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> 11 12</head> 13 14<body> 15 16<h1><img src="postfix-logo.jpg" width="203" height="98" ALT="">Postfix Small/Home Office Hints and Tips</h1> 17 18<hr> 19 20<h2>Overview</h2> 21 22<p> This document combines hints and tips for "small office/home 23office" applications into one document so that they are easier to 24find. The text describes the mail sending side only. If your machine 25does not receive mail directly (i.e. it does not have its own 26Internet domain name and its own fixed IP address), then you will 27need a solution such as "fetchmail", which is outside the scope of 28the Postfix documentation. </p> 29 30<ul> 31 32<li> <p> Selected topics from the <a href="STANDARD_CONFIGURATION_README.html">STANDARD_CONFIGURATION_README</a> document: </p> 33 34<ul> 35 36<li><a href="#stand_alone">Postfix on a stand-alone Internet host</a> 37 38<li><a href="#fantasy">Postfix on hosts without a real 39Internet hostname</a> 40 41</ul> 42 43<p> Selected topics from the <a href="SASL_README.html">SASL_README</a> document: </p> 44 45<ul> 46 47<li><a href="#client_sasl_enable">Enabling SASL authentication in the 48Postfix SMTP client</a></li> 49 50<li><a href="#client_sasl_sender">Configuring Sender-Dependent SASL 51authentication </a></li> 52 53</ul> 54 55</ul> 56 57<p> See the <a href="SASL_README.html">SASL_README</a> and <a href="STANDARD_CONFIGURATION_README.html">STANDARD_CONFIGURATION_README</a> documents for 58further information on these topics. </p> 59 60<h2><a name="stand_alone">Postfix on a stand-alone Internet host</a></h2> 61 62<p> Postfix should work out of the box without change on a stand-alone 63machine that has direct Internet access. At least, that is how 64Postfix installs when you download the Postfix source code via 65<a href="http://www.postfix.org/">http://www.postfix.org/</a>. </p> 66 67<p> You can use the command "<b>postconf -n</b>" to find out what 68settings are overruled by your <a href="postconf.5.html">main.cf</a>. Besides a few pathname 69settings, few parameters should be set on a stand-alone box, beyond 70what is covered in the <a href="BASIC_CONFIGURATION_README.html">BASIC_CONFIGURATION_README</a> document: </p> 71 72<blockquote> 73<pre> 74/etc/postfix/<a href="postconf.5.html">main.cf</a>: 75 # Optional: send mail as user@domainname instead of user@hostname. 76 #<a href="postconf.5.html#myorigin">myorigin</a> = $<a href="postconf.5.html#mydomain">mydomain</a> 77 78 # Optional: specify NAT/proxy external address. 79 #<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a> = 1.2.3.4 80 81 # Alternative 1: don't relay mail from other hosts. 82 <a href="postconf.5.html#mynetworks_style">mynetworks_style</a> = host 83 <a href="postconf.5.html#relay_domains">relay_domains</a> = 84 85 # Alternative 2: relay mail from local clients only. 86 # <a href="postconf.5.html#mynetworks">mynetworks</a> = 192.168.1.0/28 87 # <a href="postconf.5.html#relay_domains">relay_domains</a> = 88</pre> 89</blockquote> 90 91<p> See also the section "<a href="#fantasy">Postfix on hosts without 92a real Internet hostname</a>" if this is applicable to your configuration. 93</p> 94 95<h2><a name="fantasy">Postfix on hosts without a real Internet 96hostname</a></h2> 97 98<p> This section is for hosts that don't have their own Internet 99hostname. Typically these are systems that get a dynamic IP address 100via DHCP or via dialup. Postfix will let you send and receive mail 101just fine between accounts on a machine with a fantasy name. However, 102you cannot use a fantasy hostname in your email address when sending 103mail into the Internet, because no-one would be able to reply to 104your mail. In fact, more and more sites refuse mail addresses with 105non-existent domain names. </p> 106 107<p> Note: the following information is Postfix version dependent. 108To find out what Postfix version you have, execute the command 109"<b>postconf <a href="postconf.5.html#mail_version">mail_version</a></b>". </p> 110 111<h3>Solution 1: Postfix version 2.2 and later </h3> 112 113<p> Postfix 2.2 uses the <a href="generic.5.html">generic(5)</a> address mapping to replace 114local fantasy email addresses by valid Internet addresses. This 115mapping happens ONLY when mail leaves the machine; not when you 116send mail between users on the same machine. </p> 117 118<p> The following example presents additional configuration. You 119need to combine this with basic configuration information as 120discussed the first half of this document. </p> 121 122<blockquote> 123<pre> 1241 /etc/postfix/<a href="postconf.5.html">main.cf</a>: 1252 <a href="postconf.5.html#smtp_generic_maps">smtp_generic_maps</a> = <a href="DATABASE_README.html#types">hash</a>:/etc/postfix/generic 1263 1274 /etc/postfix/generic: 1285 his@localdomain.local hisaccount@hisisp.example 1296 her@localdomain.local heraccount@herisp.example 1307 @localdomain.local hisaccount+local@hisisp.example 131</pre> 132</blockquote> 133 134<p> When mail is sent to a remote host via SMTP: </p> 135 136<ul> 137 138<li> <p> Line 5 replaces <i>his@localdomain.local</i> by his ISP 139mail address, </p> 140 141<li> <p> Line 6 replaces <i>her@localdomain.local</i> by her ISP 142mail address, and </p> 143 144<li> <p> Line 7 replaces other local addresses by his ISP account, 145with an address extension of +<i>local</i> (this example assumes 146that the ISP supports "+" style address extensions). </p> 147 148</ul> 149 150<p>Specify <b>dbm</b> instead of <b>hash</b> if your system uses 151<b>dbm</b> files instead of <b>db</b> files. To find out what lookup 152tables Postfix supports, use the command "<b>postconf -m</b>". </p> 153 154<p> Execute the command "<b>postmap /etc/postfix/generic</b>" 155whenever you change the generic table. </p> 156 157<h3>Solution 2: Postfix version 2.1 and earlier </h3> 158 159<p> The solution with older Postfix systems is to use valid 160Internet addresses where possible, and to let Postfix map valid 161Internet addresses to local fantasy addresses. With this, you can 162send mail to the Internet and to local fantasy addresses, including 163mail to local fantasy addresses that don't have a valid Internet 164address of their own.</p> 165 166<p> The following example presents additional configuration. You 167need to combine this with basic configuration information as 168discussed the first half of this document. </p> 169 170<blockquote> 171<pre> 172 1 /etc/postfix/<a href="postconf.5.html">main.cf</a>: 173 2 <a href="postconf.5.html#myhostname">myhostname</a> = hostname.localdomain 174 3 <a href="postconf.5.html#mydomain">mydomain</a> = localdomain 175 4 176 5 <a href="postconf.5.html#canonical_maps">canonical_maps</a> = <a href="DATABASE_README.html#types">hash</a>:/etc/postfix/canonical 177 6 178 7 <a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a> = <a href="DATABASE_README.html#types">hash</a>:/etc/postfix/virtual 179 8 180 9 /etc/postfix/canonical: 18110 your-login-name your-account@your-isp.com 18211 18312 /etc/postfix/virtual: 18413 your-account@your-isp.com your-login-name 185</pre> 186</blockquote> 187 188<p> Translation: </p> 189 190<ul> 191 192<li> <p> Lines 2-3: Substitute your fantasy hostname here. Do not 193use a domain name that is already in use by real organizations 194on the Internet. See <a href="http://tools.ietf.org/html/rfc2606">RFC 2606</a> for examples of domain 195names that are guaranteed not to be owned by anyone. </p> 196 197<li> <p> Lines 5, 9, 10: This provides the mapping from 198"your-login-name@hostname.localdomain" to "your-account@your-isp.com". 199This part is required. </p> 200 201<li> <p> Lines 7, 12, 13: Deliver mail for "your-account@your-isp.com" 202locally, instead of sending it to the ISP. This part is not required 203but is convenient. 204 205</ul> 206 207<p>Specify <b>dbm</b> instead of <b>hash</b> if your system uses 208<b>dbm</b> files instead of <b>db</b> files. To find out what lookup 209tables Postfix supports, use the command "<b>postconf -m</b>". </p> 210 211<p> Execute the command "<b>postmap /etc/postfix/canonical</b>" 212whenever you change the canonical table. </p> 213 214<p> Execute the command "<b>postmap /etc/postfix/virtual</b>" 215whenever you change the virtual table. </p> 216 217<h2><a name="client_sasl_enable">Enabling SASL authentication in the 218Postfix SMTP/LMTP client</a></h2> 219 220<p> This section shows a typical scenario where the Postfix SMTP 221client sends all messages via a mail gateway server that requires 222SASL authentication. </p> 223 224<blockquote> 225 226<strong> Trouble solving tips: </strong> 227 228<ul> 229 230<li> <p> If your SASL logins fail with "SASL authentication failure: 231No worthy mechs found" in the mail logfile, then see the section 232"<a href="SASL_README.html#client_sasl_policy">Postfix SMTP/LMTP 233client policy - SASL mechanism <em>properties</em></a>". 234 235<li> <p> For a solution to a more obscure class of SASL authentication 236failures, see "<a href="SASL_README.html#client_sasl_filter">Postfix 237SMTP/LMTP client policy - SASL mechanism <em>names</em></a>". 238 239</ul> 240 241</blockquote> 242 243<p> To make the example more readable we introduce it in two parts. 244The first part takes care of the basic configuration, while the 245second part sets up the username/password information. </p> 246 247<blockquote> 248<pre> 249/etc/postfix/<a href="postconf.5.html">main.cf</a>: 250 <a href="postconf.5.html#smtp_sasl_auth_enable">smtp_sasl_auth_enable</a> = yes 251 <a href="postconf.5.html#relayhost">relayhost</a> = [mail.isp.example] 252 # Alternative form: 253 # <a href="postconf.5.html#relayhost">relayhost</a> = [mail.isp.example]:submission 254 <a href="postconf.5.html#smtp_sasl_password_maps">smtp_sasl_password_maps</a> = <a href="DATABASE_README.html#types">hash</a>:/etc/postfix/sasl_passwd 255</pre> 256</blockquote> 257 258<ul> 259 260<li> <p> The <code><a href="postconf.5.html#smtp_sasl_auth_enable">smtp_sasl_auth_enable</a></code> setting enables 261client-side authentication. We will configure the client's username 262and password information in the second part of the example. </p> 263</li> 264 265<li> <p> The <code><a href="postconf.5.html#relayhost">relayhost</a></code> setting forces the Postfix SMTP 266to send all remote messages to the specified mail server instead 267of trying to deliver them directly to their destination. </p> </li> 268 269<li> <p> In the <code><a href="postconf.5.html#relayhost">relayhost</a></code> setting, the "<code>[</code>" 270and "<code>]</code>" prevent the Postfix SMTP client from looking 271up MX (mail exchanger) records for the enclosed name. </p> </li> 272 273<li> <p> The <code><a href="postconf.5.html#relayhost">relayhost</a></code> destination may also specify a 274non-default TCP port. For example, the alternative form 275<code>[mail.isp.example]:submission</code> tells Postfix to connect 276to TCP network port 587, which is reserved for email client 277applications. </p> </li> 278 279<li> <p> The Postfix SMTP client is compatible with SMTP servers 280that use the non-standard "<code>AUTH=<em>method.</em>...</code>" 281syntax in response to the EHLO command; this requires no additional 282Postfix client configuration. </p> </li> 283 284<li> <p> The Postfix SMTP client does not support the obsolete 285"wrappermode" protocol, which uses TCP port <code>465</code> on the 286SMTP server. See <a href="TLS_README.html">TLS_README</a> for a solution that uses the 287<code>stunnel</code> command. </p> </li> 288 289<li> <p> With the <code><a href="postconf.5.html#smtp_sasl_password_maps">smtp_sasl_password_maps</a></code> parameter, 290we configure the Postfix SMTP client to send username and password 291information to the mail gateway server. As discussed in the next 292section, the Postfix SMTP client supports multiple ISP accounts. 293For this reason the username and password are stored in a table 294that contains one username/password combination for each mail gateway 295server. </p> 296 297</ul> 298 299<blockquote> 300<pre> 301/etc/postfix/sasl_passwd: 302 # destination credentials 303 [mail.isp.example] username:password 304 # Alternative form: 305 # [mail.isp.example]:submission username:password 306</pre> 307</blockquote> 308 309<blockquote> 310 311<strong>Important</strong> 312 313<p> Keep the SASL client password file in <code>/etc/postfix</code>, 314and make the file read+write only for <code>root</code> to protect 315the username/password combinations against other users. The Postfix 316SMTP client will still be able to read the SASL client passwords. 317It opens the file as user <code>root</code> before it drops privileges, 318and before entering an optional chroot jail. </p> 319 320</blockquote> 321 322<ul> 323 324<li> <p> Use the <code>postmap</code> command whenever you 325change the <code>/etc/postfix/sasl_passwd</code> file. </p> </li> 326 327<li> <p> If you specify the "<code>[</code>" and "<code>]</code>" 328in the <code><a href="postconf.5.html#relayhost">relayhost</a></code> destination, then you must use the 329same form in the <code><a href="postconf.5.html#smtp_sasl_password_maps">smtp_sasl_password_maps</a></code> file. </p> 330</li> 331 332<li> <p> If you specify a non-default TCP Port (such as 333"<code>:submission</code>" or "<code>:587</code>") in the 334<code><a href="postconf.5.html#relayhost">relayhost</a></code> destination, then you must use the same form 335in the <code><a href="postconf.5.html#smtp_sasl_password_maps">smtp_sasl_password_maps</a></code> file. </p> </li> 336 337</ul> 338 339<h2><a name="client_sasl_sender">Configuring Sender-Dependent SASL 340authentication</a></h2> 341 342<p> Postfix supports different ISP accounts for different sender 343addresses (version 2.3 and later). This can be useful when one 344person uses the same machine for work and for personal use, or when 345people with different ISP accounts share the same Postfix server. 346</p> 347 348<p> To make this possible, Postfix supports per-sender SASL passwords 349and per-sender relay hosts. In the example below, the Postfix SMTP 350client will search the SASL password file by sender address before 351it searches that same file by destination. Likewise, the Postfix 352<a href="trivial-rewrite.8.html">trivial-rewrite(8)</a> daemon will search the per-sender <a href="postconf.5.html#relayhost">relayhost</a> file, 353and use the default <code><a href="postconf.5.html#relayhost">relayhost</a></code> setting only as a final 354resort. </p> 355 356<blockquote> 357<pre> 358/etc/postfix/<a href="postconf.5.html">main.cf</a>: 359 <a href="postconf.5.html#smtp_sender_dependent_authentication">smtp_sender_dependent_authentication</a> = yes 360 <a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a> = <a href="DATABASE_README.html#types">hash</a>:/etc/postfix/sender_relay 361 <a href="postconf.5.html#smtp_sasl_auth_enable">smtp_sasl_auth_enable</a> = yes 362 <a href="postconf.5.html#smtp_sasl_password_maps">smtp_sasl_password_maps</a> = <a href="DATABASE_README.html#types">hash</a>:/etc/postfix/sasl_passwd 363 <a href="postconf.5.html#relayhost">relayhost</a> = [mail.isp.example] 364 # Alternative form: 365 # <a href="postconf.5.html#relayhost">relayhost</a> = [mail.isp.example]:submission 366</pre> 367</blockquote> 368 369<blockquote> 370<pre> 371/etc/postfix/sasl_passwd: 372 # Per-sender authentication; see also /etc/postfix/sender_relay. 373 user1@example.com username2:password2 374 user2@example.net username2:password2 375 # Login information for the default <a href="postconf.5.html#relayhost">relayhost</a>. 376 [mail.isp.example] username:password 377 # Alternative form: 378 # [mail.isp.example]:submission username:password 379</pre> 380</blockquote> 381 382<blockquote> 383<pre> 384/etc/postfix/sender_relay: 385 # Per-sender provider; see also /etc/postfix/sasl_passwd. 386 user1@example.com [mail.example.com]:submission 387 user2@example.net [mail.example.net] 388</pre> 389</blockquote> 390 391<ul> 392 393<li> <p> If you are creative, then you can try to combine the two 394tables into one single MySQL database, and configure different 395Postfix queries to extract the appropriate information. </p> 396 397<li> <p> Specify dbm instead of hash if your system uses dbm files 398instead of db files. To find out what lookup tables Postfix supports, 399use the command "postconf -m". </p> 400 401<li> <p> Execute the command "postmap /etc/postfix/sasl_passwd" 402whenever you change the sasl_passwd table. </p> 403 404<li> <p> Execute the command "postmap /etc/postfix/sender_relay" 405whenever you change the sender_relay table. </p> 406 407</ul> 408 409</body> 410 411</html> 412
