postfix-master/SOHO_README.html

   1 <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN"
   2         "http://www.w3.org/TR/html4/loose.dtd">
   3
   4 <html>
   5
   6 <head>
   7
   8 <title>Postfix Small/Home Office Hints and Tips</title>
   9
  10 <meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
  11
  12 </head>
  13
  14 <body>
  15
  16 <h1><img src="postfix-logo.jpg" width="203" height="98" ALT="">Postfix Small/Home Office Hints and Tips</h1>
  17
  18 <hr>
  19
  20 <h2>Overview</h2>
  21
  22 <p> This document combines hints and tips for "small office/home
  23 office" applications into one document so that they are easier to
  24 find. The text describes the mail sending side only. If your machine
  25 does not receive mail directly (i.e. it does not have its own
  26 Internet domain name and its own fixed IP address), then you will
  27 need a solution such as "fetchmail", which is outside the scope of
  28 the Postfix documentation.  </p>
  29
  30 <ul>
  31
  32 <li> <p> Selected topics from the <a href="STANDARD_CONFIGURATION_README.html">STANDARD_CONFIGURATION_README</a> document: </p>
  33
  34 <ul>
  35
  36 <li><a href="#stand_alone">Postfix on a stand-alone Internet host</a>
  37
  38 <li><a href="#fantasy">Postfix on hosts without a real
  39 Internet hostname</a>
  40
  41 </ul>
  42
  43 <p> Selected topics from the <a href="SASL_README.html">SASL_README</a> document: </p>
  44
  45 <ul>
  46
  47 <li><a href="#client_sasl_enable">Enabling SASL authentication in the
  48 Postfix SMTP client</a></li>
  49
  50 <li><a href="#client_sasl_sender">Configuring Sender-Dependent SASL
  51 authentication </a></li>
  52
  53 </ul>
  54
  55 </ul>
  56
  57 <p> See the <a href="SASL_README.html">SASL_README</a> and <a href="STANDARD_CONFIGURATION_README.html">STANDARD_CONFIGURATION_README</a> documents for
  58 further information on these topics. </p>
  59
  60 <h2><a name="stand_alone">Postfix on a stand-alone Internet host</a></h2>
  61
  62 <p> Postfix should work out of the box without change on a stand-alone
  63 machine that has direct Internet access.  At least, that is how
  64 Postfix installs when you download the Postfix source code via
  65 <a href="http://www.postfix.org/">http://www.postfix.org/</a>. </p>
  66
  67 <p> You can use the command "<b>postconf -n</b>" to find out what
  68 settings are overruled by your <a href="postconf.5.html">main.cf</a>. Besides a few pathname
  69 settings, few parameters should be set on a stand-alone box, beyond
  70 what is covered in the <a href="BASIC_CONFIGURATION_README.html">BASIC_CONFIGURATION_README</a> document: </p>
  71
  72 <blockquote>
  73 <pre>
  74 /etc/postfix/<a href="postconf.5.html">main.cf</a>:
  75     # Optional: send mail as user@domainname instead of user@hostname.
  76     #<a href="postconf.5.html#myorigin">myorigin</a> = $<a href="postconf.5.html#mydomain">mydomain</a>
  77
  78     # Optional: specify NAT/proxy external address.
  79     #<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a> = 1.2.3.4
  80
  81     # Alternative 1: don't relay mail from other hosts.
  82     <a href="postconf.5.html#mynetworks_style">mynetworks_style</a> = host
  83     <a href="postconf.5.html#relay_domains">relay_domains</a> =
  84
  85     # Alternative 2: relay mail from local clients only.
  86     # <a href="postconf.5.html#mynetworks">mynetworks</a> = 192.168.1.0/28
  87     # <a href="postconf.5.html#relay_domains">relay_domains</a> =
  88 </pre>
  89 </blockquote>
  90
  91 <p> See also the section "<a href="#fantasy">Postfix on hosts without
  92 a real Internet hostname</a>" if this is applicable to your configuration.
  93 </p>
  94
  95 <h2><a name="fantasy">Postfix on hosts without a real Internet
  96 hostname</a></h2>
  97
  98 <p> This section is for hosts that don't have their own Internet
  99 hostname.  Typically these are systems that get a dynamic IP address
 100 via DHCP or via dialup. Postfix will let you send and receive mail
 101 just fine between accounts on a machine with a fantasy name. However,
 102 you cannot use a fantasy hostname in your email address when sending
 103 mail into the Internet, because no-one would be able to reply to
 104 your mail. In fact, more and more sites refuse mail addresses with
 105 non-existent domain names. </p>
 106
 107 <p> Note: the following information is Postfix version dependent.
 108 To find out what Postfix version you have, execute the command
 109 "<b>postconf <a href="postconf.5.html#mail_version">mail_version</a></b>". </p>
 110
 111 <h3>Solution 1: Postfix version 2.2 and later </h3>
 112
 113 <p> Postfix 2.2 uses the <a href="generic.5.html">generic(5)</a> address mapping to replace
 114 local fantasy email addresses by valid Internet addresses.  This
 115 mapping happens ONLY when mail leaves the machine; not when you
 116 send mail between users on the same machine. </p>
 117
 118 <p> The following example presents additional configuration. You
 119 need to combine this with basic configuration information as
 120 discussed the first half of this document. </p>
 121
 122 <blockquote>
 123 <pre>
 124 1 /etc/postfix/<a href="postconf.5.html">main.cf</a>:
 125 2     <a href="postconf.5.html#smtp_generic_maps">smtp_generic_maps</a> = hash:/etc/postfix/generic
 126 3
 127 4 /etc/postfix/generic:
 128 5     his@localdomain.local             hisaccount@hisisp.example
 129 6     her@localdomain.local             heraccount@herisp.example
 130 7     @localdomain.local                hisaccount+local@hisisp.example
 131 </pre>
 132 </blockquote>
 133
 134 <p> When mail is sent to a remote host via SMTP: </p>
 135
 136 <ul>
 137
 138 <li> <p> Line 5 replaces <i>his@localdomain.local</i> by his ISP
 139 mail address, </p>
 140
 141 <li> <p> Line 6 replaces <i>her@localdomain.local</i> by her ISP
 142 mail address, and </p>
 143
 144 <li> <p> Line 7 replaces other local addresses by his ISP account,
 145 with an address extension of +<i>local</i> (this example assumes
 146 that the ISP supports "+" style address extensions). </p>
 147
 148 </ul>
 149
 150 <p>Specify <b>dbm</b> instead of <b>hash</b> if your system uses
 151 <b>dbm</b> files instead of <b>db</b> files. To find out what lookup
 152 tables Postfix supports, use the command "<b>postconf -m</b>".  </p>
 153
 154 <p> Execute the command "<b>postmap /etc/postfix/generic</b>"
 155 whenever you change the generic table. </p>
 156
 157 <h3>Solution 2: Postfix version 2.1 and earlier </h3>
 158
 159 <p> The solution with older Postfix systems is to use valid
 160 Internet addresses where possible, and to let Postfix map valid
 161 Internet addresses to local fantasy addresses. With this, you can
 162 send mail to the Internet and to local fantasy addresses, including
 163 mail to local fantasy addresses that don't have a valid Internet
 164 address of their own.</p>
 165
 166 <p> The following example presents additional configuration. You
 167 need to combine this with basic configuration information as
 168 discussed the first half of this document. </p>
 169
 170 <blockquote>
 171 <pre>
 172  1 /etc/postfix/<a href="postconf.5.html">main.cf</a>:
 173  2     <a href="postconf.5.html#myhostname">myhostname</a> = hostname.localdomain
 174  3     <a href="postconf.5.html#mydomain">mydomain</a> = localdomain
 175  4
 176  5     <a href="postconf.5.html#canonical_maps">canonical_maps</a> = hash:/etc/postfix/canonical
 177  6
 178  7     <a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a> = hash:/etc/postfix/virtual
 179  8
 180  9 /etc/postfix/canonical:
 181 10     your-login-name    your-account@your-isp.com
 182 11
 183 12 /etc/postfix/virtual:
 184 13     your-account@your-isp.com       your-login-name
 185 </pre>
 186 </blockquote>
 187
 188 <p> Translation: </p>
 189
 190 <ul>
 191
 192 <li> <p> Lines 2-3: Substitute your fantasy hostname here. Do not
 193 use a domain name that is already in use by real organizations
 194 on the Internet. See <a href="http://tools.ietf.org/html/rfc2606">RFC 2606</a> for examples of domain
 195 names that are guaranteed not to be owned by anyone. </p>
 196
 197 <li> <p> Lines 5, 9, 10: This provides the mapping from
 198 "your-login-name@hostname.localdomain" to "your-account@your-isp.com".
 199 This part is required. </p>
 200
 201 <li> <p> Lines 7, 12, 13: Deliver mail for "your-account@your-isp.com"
 202 locally, instead of sending it to the ISP. This part is not required
 203 but is convenient.
 204
 205 </ul>
 206
 207 <p>Specify <b>dbm</b> instead of <b>hash</b> if your system uses
 208 <b>dbm</b> files instead of <b>db</b> files. To find out what lookup
 209 tables Postfix supports, use the command "<b>postconf -m</b>".  </p>
 210
 211 <p> Execute the command "<b>postmap /etc/postfix/canonical</b>"
 212 whenever you change the canonical table. </p>
 213
 214 <p> Execute the command "<b>postmap /etc/postfix/virtual</b>"
 215 whenever you change the virtual table. </p>
 216
 217 <h2><a name="client_sasl_enable">Enabling SASL authentication in the
 218 Postfix SMTP/LMTP client</a></h2>
 219
 220 <p> This section shows a typical scenario where the Postfix SMTP
 221 client sends all messages via a mail gateway server that requires
 222 SASL authentication. </p>
 223
 224 <blockquote>
 225
 226 <strong> Trouble solving tips: </strong>
 227
 228 <ul>
 229
 230 <li> <p> If your SASL logins fail with "SASL authentication failure:
 231 No worthy mechs found" in the mail logfile, then see the section
 232 "<a href="SASL_README.html#client_sasl_policy">Postfix SMTP/LMTP
 233 client policy - SASL mechanism <em>properties</em></a>".
 234
 235 <li> <p> For a solution to a more obscure class of SASL authentication
 236 failures, see "<a href="SASL_README.html#client_sasl_filter">Postfix
 237 SMTP/LMTP client policy - SASL mechanism <em>names</em></a>".
 238
 239 </ul>
 240
 241 </blockquote>
 242
 243 <p> To make the example more readable we introduce it in two parts.
 244 The first part takes care of the basic configuration, while the
 245 second part sets up the username/password information.  </p>
 246
 247 <blockquote>
 248 <pre>
 249 /etc/postfix/<a href="postconf.5.html">main.cf</a>:
 250     <a href="postconf.5.html#smtp_sasl_auth_enable">smtp_sasl_auth_enable</a> = yes
 251     <a href="postconf.5.html#relayhost">relayhost</a> = [mail.isp.example]
 252     # Alternative form:
 253     # <a href="postconf.5.html#relayhost">relayhost</a> = [mail.isp.example]:submission
 254     <a href="postconf.5.html#smtp_sasl_password_maps">smtp_sasl_password_maps</a> = hash:/etc/postfix/sasl_passwd
 255 </pre>
 256 </blockquote>
 257
 258 <ul>
 259
 260 <li> <p> The <code><a href="postconf.5.html#smtp_sasl_auth_enable">smtp_sasl_auth_enable</a></code> setting enables
 261 client-side authentication. We will configure the client's username
 262 and password information in the second part of the example. </p>
 263 </li>
 264
 265 <li> <p> The <code><a href="postconf.5.html#relayhost">relayhost</a></code> setting forces the Postfix SMTP
 266 to send all remote messages to the specified mail server instead
 267 of trying to deliver them directly to their destination. </p> </li>
 268
 269 <li> <p> In the <code><a href="postconf.5.html#relayhost">relayhost</a></code> setting, the "<code>[</code>"
 270 and "<code>]</code>" prevent the Postfix SMTP client from looking
 271 up MX (mail exchanger) records for the enclosed name.  </p> </li>
 272
 273 <li> <p> The <code><a href="postconf.5.html#relayhost">relayhost</a></code> destination may also specify a
 274 non-default TCP port. For example, the alternative form
 275 <code>[mail.isp.example]:submission</code> tells Postfix to connect
 276 to TCP network port 587, which is reserved for email client
 277 applications.  </p> </li>
 278
 279 <li> <p> The Postfix SMTP client is compatible with SMTP servers
 280 that use the non-standard "<code>AUTH=<em>method.</em>...</code>"
 281 syntax in response to the EHLO command; this requires no additional
 282 Postfix client configuration. </p> </li>
 283
 284 <li> <p> The Postfix SMTP client does not support the obsolete
 285 "wrappermode" protocol, which uses TCP port <code>465</code> on the
 286 SMTP server.  See <a href="TLS_README.html">TLS_README</a> for a solution that uses the
 287 <code>stunnel</code> command.  </p> </li>
 288
 289 <li> <p> With the <code><a href="postconf.5.html#smtp_sasl_password_maps">smtp_sasl_password_maps</a></code> parameter,
 290 we configure the Postfix SMTP client to send username and password
 291 information to the mail gateway server. As discussed in the next
 292 section, the Postfix SMTP client supports multiple ISP accounts.
 293 For this reason the username and password are stored in a table
 294 that contains one username/password combination for each mail gateway
 295 server.  </p>
 296
 297 </ul>
 298
 299 <blockquote>
 300 <pre>
 301 /etc/postfix/sasl_passwd:
 302     # destination                   credentials
 303     [mail.isp.example]              username:password
 304     # Alternative form:
 305     # [mail.isp.example]:submission username:password
 306 </pre>
 307 </blockquote>
 308
 309 <blockquote>
 310
 311 <strong>Important</strong>
 312
 313 <p> Keep the SASL client password file in <code>/etc/postfix</code>,
 314 and make the file read+write only for <code>root</code> to protect
 315 the username/password combinations against other users. The Postfix
 316 SMTP client will still be able to read the SASL client passwords.
 317 It opens the file as user <code>root</code> before it drops privileges,
 318 and before entering an optional chroot jail. </p>
 319
 320 </blockquote>
 321
 322 <ul>
 323
 324 <li> <p> Use the <code>postmap</code> command whenever you
 325 change the <code>/etc/postfix/sasl_passwd</code> file. </p> </li>
 326
 327 <li> <p> If you specify the "<code>[</code>" and "<code>]</code>"
 328 in the <code><a href="postconf.5.html#relayhost">relayhost</a></code> destination, then you must use the
 329 same form in the <code><a href="postconf.5.html#smtp_sasl_password_maps">smtp_sasl_password_maps</a></code> file.  </p>
 330 </li>
 331
 332 <li> <p> If you specify a non-default TCP Port (such as
 333 "<code>:submission</code>" or "<code>:587</code>") in the
 334 <code><a href="postconf.5.html#relayhost">relayhost</a></code> destination, then you must use the same form
 335 in the <code><a href="postconf.5.html#smtp_sasl_password_maps">smtp_sasl_password_maps</a></code> file.  </p> </li>
 336
 337 </ul>
 338
 339 <h2><a name="client_sasl_sender">Configuring Sender-Dependent SASL
 340 authentication</a></h2>
 341
 342 <p> Postfix supports different ISP accounts for different sender
 343 addresses (version 2.3 and later).  This can be useful when one
 344 person uses the same machine for work and for personal use, or when
 345 people with different ISP accounts share the same Postfix server.
 346 </p>
 347
 348 <p> To make this possible, Postfix supports per-sender SASL passwords
 349 and per-sender relay hosts. In the example below, the Postfix SMTP
 350 client will search the SASL password file by sender address before
 351 it searches that same file by destination.  Likewise, the Postfix
 352 <a href="trivial-rewrite.8.html">trivial-rewrite(8)</a> daemon will search the per-sender <a href="postconf.5.html#relayhost">relayhost</a> file,
 353 and use the default <code><a href="postconf.5.html#relayhost">relayhost</a></code> setting only as a final
 354 resort.  </p>
 355
 356 <blockquote>
 357 <pre>
 358 /etc/postfix/<a href="postconf.5.html">main.cf</a>:
 359     <a href="postconf.5.html#smtp_sender_dependent_authentication">smtp_sender_dependent_authentication</a> = yes
 360     <a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a> = hash:/etc/postfix/sender_relay
 361     <a href="postconf.5.html#smtp_sasl_auth_enable">smtp_sasl_auth_enable</a> = yes
 362     <a href="postconf.5.html#smtp_sasl_password_maps">smtp_sasl_password_maps</a> = hash:/etc/postfix/sasl_passwd
 363     <a href="postconf.5.html#relayhost">relayhost</a> = [mail.isp.example]
 364     # Alternative form:
 365     # <a href="postconf.5.html#relayhost">relayhost</a> = [mail.isp.example]:submission
 366 </pre>
 367 </blockquote>
 368
 369 <blockquote>
 370 <pre>
 371 /etc/postfix/sasl_passwd:
 372     # Per-sender authentication; see also /etc/postfix/sender_relay.
 373     user1@example.com               username2:password2
 374     user2@example.net               username2:password2
 375     # Login information for the default <a href="postconf.5.html#relayhost">relayhost</a>.
 376     [mail.isp.example]              username:password
 377     # Alternative form:
 378     # [mail.isp.example]:submission username:password
 379 </pre>
 380 </blockquote>
 381
 382 <blockquote>
 383 <pre>
 384 /etc/postfix/sender_relay:
 385     # Per-sender provider; see also /etc/postfix/sasl_passwd.
 386     user1@example.com               [mail.example.com]:submission
 387     user2@example.net               [mail.example.net]
 388 </pre>
 389 </blockquote>
 390
 391 <ul>
 392
 393 <li> <p> If you are creative, then you can try to combine the two
 394 tables into one single MySQL database, and configure different
 395 Postfix queries to extract the appropriate information. </p>
 396
 397 <li> <p> Specify dbm instead of hash if your system uses dbm files
 398 instead of db files. To find out what lookup tables Postfix supports,
 399 use the command "postconf -m". </p>
 400
 401 <li> <p> Execute the command "postmap /etc/postfix/sasl_passwd"
 402 whenever you change the sasl_passwd table. </p>
 403
 404 <li> <p> Execute the command "postmap /etc/postfix/sender_relay"
 405 whenever you change the sender_relay table. </p>
 406
 407 </ul>
 408
 409 </body>
 410
 411 </html>