Postfix as a SASL authenticated, TLS enabled Relay
Postfix is a well established, open source mail transfer agent (MTA) that routes and delivers email. One of its main strengths compared to other MTAs like Sendmail, is its ease of operation and fairly straight forward, plain text configuration.
Postfix routes mail only from clients in trusted networks, from clients that have authenticated with SASL, or to domains that are configured as authorized relay destinations.[1]
In this post we are going to configure Postfix as a SMTP relay to Mailgun's edge SMTP API (although this will work to any other SMTP endpoint, given the correct credentials) using Simple Authentication Security Layer (SASL) on Ubuntu Linux.
First, let's install some prerequisites and the postfix server:
To verify what SASL plugins the Postfix installation supports, run:
From the above output we can see that the server side of Postfix supports both Cyrus and Dovecot SASL, where the client side supports only Cyrus SASL, at least in this prepackaged version of Postfix.
There are two important configuration files that drive the Postfix server - master.cf and main.cf.
The master.cf configures all of Postfix subsystems like smtpd, the queue, relay, cleaned etc. This is where we specify if the Postfix subsystem will run in a jailed environments, if we desire verbose logging and on what ports (besides port 25) we would like the SMTP server to listen to.
Here's an example showing SMTP running in a chroot jail using verbose logging and listening on port 25 AND 2525:
The main.cf configuration file specifies a small subset of all configuration options that control most of Postfix . Parameters not explicitly specified are left at their default values [2].
Bellow is a working configuration of Postfix as a Relay, using TLS and SASL for authentication, with some tuning parameters as an example:
Please see [2] for detailed explanation on what all of the above configuration options do, but for the purpose of this post let's focus on the Client side of the config, responsible for authenticating Postfix with the upstream SMTP server to which it will relay mail.
First, we specify the upstream server we want our Postfix server to relay to (line 30). Next, we enable SASL and specify the credential file that will be used to pass to the relay host (lines 31 and 32).
The plain text sasl_passwd file looks like the following:
The first column contains the destination SMTP server to which Postfix will relay mail to. The second column specifies the credentials for the user domain (e.g. user@yourdomain.org).
To generate a hashed version of the file run:
The file should be secured and only read by root (Postfix reads that file before it chroots and drops privileges).
Next, let's configure SASL on the server side of our Postfix installation - this will be authenticating SMTP request coming from the sending clients.
SASL is implemented separately from Postfix. Postfix uses client libraries to communicate with SASL enabled backends (Cyrus SASL's libsasl). There are various SASL implementations like Cyrus SASL and Dovecot, authentication backends and mechanisms, some requiring just a static file, others LDAP, or database access, and yet others connecting to a SASL password verification service, such as saslauthd.
To keep things simple we are going to use the Cyrus SASL with the sasldb auxiliary property plugin (auxprop), which is a static file on disk that does not require the use of the saslauthd service [3].
The configuration for the plugin looks like the following:
The third line specifies the authentication mechanisms that the plugin will expose and allow.
Next, we need to create the credentials for a client that will be allowed to connect to the Postfix server:
Because the packaged Postfix on Ubuntu runs in a chroot environment, we need to copy the password database so that Postfix can read it and adjust permissions (lines 5 and 6) and restart Postfix.
To test, connect to Postfix using telnet, netcat, swaks, or your favorite tool, and you should be able to see the enabled authentication methods:
This minimal setup should be enough to create a TLS, SASL enabled Postfix relay.
If you prefer to use more scalable authentication backend such as LDAP or Postgres, you can use many of the available auxprop plugins, for example:
To leverage the saslauthd Cyrus SASL password verification service, we need the following configuration:
In the above configuration the saslauthd process will use the sasldb file on disk as its authentication mechanism. In this case communication between the Postfix SMTP server - the Cyrus SASL's libsasl - and the saslauthd server happens over a UNIX-domain socket.
On Ubuntu, due to the fact that Postfix runs in a chroot environment we need to ensure it can talk to the saslauthd service:
