Chapter 9. Securing the Postfix service

Procedure

1. Set up Dovecot:

   1. Include the following lines in the /etc/dovecot/conf.d/10-master.conf file:

      service auth {
        unix_listener /var/spool/postfix/private/auth {
          mode = 0660
          user = postfix
          group = postfix
        }
      }

      Copy to Clipboard Toggle word wrap

      The previous example uses UNIX-domain sockets for communication between Postfix and Dovecot. The example also assumes default Postfix SMTP server settings, which include the mail queue located in the /var/spool/postfix/ directory, and the application running under the postfix user and group.

   2. Optional: Set up Dovecot to listen for Postfix authentication requests through TCP:

      service auth {
        inet_listener {
            port = <port-number>
        }
      }

      Copy to Clipboard Toggle word wrap

   3. Specify the method that the email client uses to authenticate with Dovecot by editing the auth_mechanisms parameter in /etc/dovecot/conf.d/10-auth.conf file:

      auth_mechanisms = plain login

      Copy to Clipboard Toggle word wrap

      The auth_mechanisms parameter supports different plaintext and non-plaintext authentication methods.

2. Set up Postfix by modifying the /etc/postfix/main.cf file:

   1. Enable SMTP Authentication on the Postfix SMTP server:

      smtpd_sasl_auth_enable = yes

      Copy to Clipboard Toggle word wrap

   2. Enable the use of Dovecot SASL implementation for SMTP Authentication:

      smtpd_sasl_type = dovecot

      Copy to Clipboard Toggle word wrap

   3. Provide the authentication path relative to the Postfix queue directory. Note that the use of a relative path ensures that the configuration works regardless of whether the Postfix server runs in chroot or not:

      smtpd_sasl_path = private/auth

      Copy to Clipboard Toggle word wrap

      This step uses UNIX-domain sockets for communication between Postfix and Dovecot.

      To configure Postfix to look for Dovecot on a different machine in case you use TCP sockets for communication, use configuration values similar to the following:

      smtpd_sasl_path = inet: <IP_address> : <port_number>

      Copy to Clipboard Toggle word wrap

      In the previous example, replace the ip-address with the IP address of the Dovecot machine and port-number with the port number specified in Dovecot’s /etc/dovecot/conf.d/10-master.conf file.

   4. Specify SASL mechanisms that the Postfix SMTP server makes available to clients. Note that you can specify different mechanisms for encrypted and unencrypted sessions.

      smtpd_sasl_security_options = noanonymous, noplaintext
      smtpd_sasl_tls_security_options = noanonymous

      Copy to Clipboard Toggle word wrap

      The previous directives specify that during unencrypted sessions, no anonymous authentication is allowed and no mechanisms that transmit unencrypted user names or passwords are allowed. For encrypted sessions that use TLS, only non-anonymous authentication mechanisms are allowed.