Postfix: SMTP Authentication for Clients with DOVECOT (en)

Prepare Dovecot

Edit to prepare Dovecot as an auth server for Postfix:

vim /etc/dovecot/conf.d/10-master.conf

Ensure:

service auth {
   ...
   unix_listener /var/spool/postfix/private/auth {
       mode = 0660
       user = postfix
       group = postfix
   } ##end listener
   ...
}

Edit:

vim /etc/dovecot/conf.d/10-auth.conf

Ensure:

auth_mechanisms = plain login

Edit:

vim /etc/dovecot/conf.d/10-ssl.conf

Ensure:

ssl = yes

Edit Postfix

Edit:

vim /etc/postfix/main.cf

Ensure:

# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
 
smtpd_tls_auth_only = no
smtpd_tls_loglevel = 1
smtpd_recipient_restrictions = 
permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination
smtp_tls_security_level = may
smtpd_tls_security_level = may
smtp_tls_note_starttls_offer = yes
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
 
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_local_domain =
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
smtpd_sasl_auth_enable = yes
 
smtpd_relay_restrictions = permit_mynetworks,
         permit_sasl_authenticated,
         reject_unauth_destination

Edit:

vim /etc/postfix/master.cf

Ensure:

submission inet n       -       -       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_reject_unlisted_recipient=no
#  -o smtpd_client_restrictions=$mua_client_restrictions
#  -o smtpd_helo_restrictions=$mua_helo_restrictions
#  -o smtpd_sender_restrictions=$mua_sender_restrictions
#  -o smtpd_recipient_restrictions=
  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING
smtps     inet  n       -       -       -       -       smtpd
  -o syslog_name=postfix/smtps
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_reject_unlisted_recipient=no
#  -o smtpd_client_restrictions=$mua_client_restrictions
#  -o smtpd_helo_restrictions=$mua_helo_restrictions
#  -o smtpd_sender_restrictions=$mua_sender_restrictions
#  -o smtpd_recipient_restrictions=
  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING

Ensure all mail functions

Telnet, type:

telnet localhost 25
ehlo test

Output:

250-onnocenter.or.id
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-AUTH PLAIN LOGIN
250-AUTH=PLAIN LOGIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN

Ensure presence of:

• STARTTLS
• AUTH

Type:

netstat -nl4

Output:

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 0.0.0.0:25              0.0.0.0:*               LISTEN     
tcp        0      0 127.0.0.1:953           0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:993             0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:995             0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:587             0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:110             0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:143             0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:465             0.0.0.0:*               LISTEN

For easy setup on Android clients, ensure your machine has hostname:

smtp.yourdomain
pop3.yourdomain
imap.yourdomain

Setup in Mail Android

Set SMTP:

• login required
• START/TLS
• port 465

References

• http://wiki2.dovecot.org/HowTo/PostfixAndDovecotSASL