Postfix SMTP authentication using dovecot

From Notes_Wiki
Revision as of 12:11, 19 December 2014 by Saurabh (talk | contribs) (Created page with "<yambe:breadcrumb>Postfix_server_configuration|Postfix server configuration</yambe:breadcrumb> =Postfix SMTP authentication using dovecot= Postfix SMTP authentication can wor...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)

<yambe:breadcrumb>Postfix_server_configuration|Postfix server configuration</yambe:breadcrumb>

Postfix SMTP authentication using dovecot

Postfix SMTP authentication can work using both dovecot and cyrus. To use dovecot for SMTP authentication use following steps:

  1. In /etc/dovecot/conf.d/10-master.conf as part of "service auth" there should be a unix_listener at /var/spool/postfix/private/auth using following configuration:
    service auth {
    unix_listener auth-userdb {
    }
    # Postfix smtp-auth
    unix_listener /var/spool/postfix/private/auth {
    mode = 0660
    user = postfix
    group = postfix
    }
    }
  2. In /etc/dovecot/conf.d/10-auth.conf set auth_mechanisms to both plain and login using:
    auth_mechanisms = plain login
  3. Configure postfix to use socket created by dovecot for authentication using following lines appended in /etc/postfix/main.cf file:
    #Indicates use dovecot auth
    smtpd_sasl_type = dovecot
    #Specified location of authentication socket supplied by dovecot
    #wrt /var/spool/postfix
    smtpd_sasl_path = private/auth
    #Enable SASL authentication
    smtpd_sasl_auth_enable = yes
    #Also advertize "AUTH PLAIN=" along with "AUTH PLAIN " to support broken clients esp outlook
    broken_sasl_auth_clients = yes
    #Do not allow anonymous access for SASL. Very important
    #If SSL or TLS is configured then perhaps noplaintext over
    #non-encryption channel can also be configured
    smtpd_sasl_security_options = noanonymous
    #smtpd_sasl_security_options = noanonymous, noplaintext
    #Do not allow anonymous access for SASL over TLS/SSL. Here
    #plaintext auth should not be a problem
    smtpd_sasl_tls_security_options = noanonymous
    #Allow relay for anybody sending to mydomain and allow relay from trusted networks.
    #Further allow relay to any destination from anywhere for authenticated clients
    smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
    #Append username of user who authentication in email headers
    smtpd_sasl_authenticated_header = yes

Steps learned from http://www.postfix.org/SASL_README.html#server_sasl_enable



<yambe:breadcrumb>Postfix_server_configuration|Postfix server configuration</yambe:breadcrumb>