Title: Configure Postfix
Course: CIS 208: Linux/UNIX III: Intermediate System Administration, Networking, and Security ~ For IGNITE Review > Section: Learning Modules

Configure Postfix

Postfix is becoming one of the most popular mail transport agents because it is open source and easier to manage than sendmail, the traditional mail transport agent.  The default settings on a Red Hat derivative distribution include postfix, but it is configured to not accept email connections from the network.

"Postfix and Dovecot" by Linux Screenshots is licensed CC BY 2.0

- Ensure that other MTAs are not running or configured to run at boot.

for service in sendmail exim qmail ssmtp; do
chkconfig $service off; service $service stop; done &>/dev/null

- The following command will install postfix if it is not installed or upgrade it if a newer version is available.

yum install postfix
chkconfig postfix on

- The main configuration file is /etc/postfix/main.cf.  Several options will need to be customized, depending on how the server will be used.  Here are some of the commonly updated options.

myhostname: the fully qualified domain name of this server
mydomain: the fully qualified domain name of the primary domain for which it receives email
myorigin: usually set to be $mydomain
inet_interfaces: select localhost, or select all to accept email from the network
inet_protocols: select ipv4 if ipv6 is disabled, or select all for both ipv4 and ipv6
mydestination: a list of domain names for which email will be accepted, including localhost, $mydomain and any other alternate domains
mynetworks_style: select class, subnet or host addressing method for mynetworks
mynetworks:  include all classes, subnets or hosts which are trusted to relay email

- To implement an SSL certificate lines similar to the following will need to be added to the /etc/postfix/main.cf file.  Create or purchase an SSL certificate then include a section similar to this.

smtpd_tls_security_level = may
smtpd_tls_key_file = /etc/pki/tls/private/mail.example.com.key
smtpd_tls_cert_file = /etc/pki/tls/certs/mail.example.com.cert
# smtpd_tls_CAfile = /etc/pki/tls/root.crt
smtpd_tls_loglevel = 1
smtpd_tls_session_cache_timeout = 3600s
smtpd_tls_session_cache_database = btree:/var/spool/postfix/smtpd_tls_cache
tls_random_source = dev:/dev/urandom
smtpd_tls_auth_only = yes

- While there are over 600 options that can be configured, the default values generally do not need to be changed.  The "postconf" command will list the current configuration, while "postconf -d" shows the default settings and "postconf -n" shows the non-default settings.  For example, if email cannot be delivered because of size restrictions, use "postconf | grep size_limit" to see options with a maximum allowable size.
- Restart or reload the postfix service after updating the configurations.
- User accounts may need to be created and passwords assigned to the appropriate users.  Any dummy account which forwards email does not need a user account, but a dummy account which accepts email does need to have a user created.

- After the accounts have been created, edit the /etc/aliases file to manage forwarding.  In the example below, email to root is forwarded to two addresses, one within the domain and one an external address.  Email sent to info goes to a secretary and email sent to sales goes to three users.

root:           cmiller carltm@anotherdomain.com
info:           sforth
sales:          dewey cheatham howe

- One additional step is to install dovecot to provide pop3 and imap4 access to users' mailboxes.

yum install dovecot

- Create or purchase an SSL certificate for client usage.  Then update the configuration in /etc/dovecot/conf.d/10-ssl.conf.  Verify that the disable_plaintext_auth option is set to yes in /etc/dovecot/conf.d/10-auth.conf.  Start or restart the dovecot service and set it to start automatically at boot.