Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to configure a secondary postfix to enable SMTP AUTH against my main postfix server (postfix + ldap auth + cyrus)

I've follow http://www.postfix.org/SASL_README.html#client_sasl adding:

smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous 
relayhost = []

the config files of secondary postfix are:

# postconf -n
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
debug_peer_level = 2
html_directory = no
inet_interfaces = localhost,
inet_protocols = all
local_recipient_maps =
mail_owner = postfix
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
mydestination = $myhostname, localhost.$mydomain, localhost
mydomain = ddol-test.com
mynetworks =,
myorigin = $myhostname
newaliases_path = /usr/bin/newaliases.postfix
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-2.6.6/README_FILES
relay_domains = $mydestination
relayhost = []
sample_directory = /usr/share/doc/postfix-2.6.6/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
transport_maps =
unknown_local_recipient_reject_code = 550

# cat /etc/postfix/sasl_passwd
[]         666mgimeno@pre.ddol.es:1234

When I send a mail, it is correctly redirected to .66.98 but it do not auth on it and the behavior of the email is like it for a non authenticated user.

This is my main postfix configuration:

# cat main.cf

smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes

smtpd_sasl_authenticated_header = yes
smtpd_sasl_path = smtpd

smtpd_helo_restrictions =

smtpd_sender_restrictions =

smtpd_recipient_restrictions =
        check_policy_service inet:,
        check_policy_service inet:,
        reject_rbl_client bl.spamcop.net,
        reject_rbl_client psbl.surriel.com,
        reject_rbl_client sbl.spamhaus.org,
        reject_rbl_client xbl.spamhaus.org,
        reject_rbl_client zen.spamhaus.org,
        reject_rbl_client combined.rbl.msrbl.net,
        reject_rbl_client relays.ordb.org,
        reject_rbl_client list.dsbl.org,
        reject_rbl_client sbl-xbl.spamhaus.org,
        reject_rbl_client dnsbl.njabl.org,

header_checks = pcre:/etc/postfix/header_checks

smtpd_end_of_data_restrictions =
        check_policy_service inet:

soft_bounce = no

smtpd_helo_required = yes

smtpd_delay_reject = yes
disable_vrfy_command = yes

smtpd_sender_login_maps = ldap:/etc/postfix/sender_maps

amavisd-new_destination_concurrency_limit = 20

virtual_alias_maps = ldap:/etc/postfix/mailRedirect ldap:/etc/postfix/virtual ldap:/etc/postfix/catch-all

smtpd_sasl_local_domain =

smtp_tls_security_level = may
smtpd_tls_security_level = may
smtpd_tls_auth_only = no
smtp_tls_note_starttls_offer = yes
smtpd_tls_key_file = /etc/ssl/private/smtpd.key
smtpd_tls_cert_file = /etc/ssl/certs/smtpd.crt
smtpd_tls_CAfile = /etc/ssl/certs/cacert.pem
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom


Right now, any mail sent from secondary postfix, is relayed to main postfix but it passes all the checks as it was for a non authenticated user, but I don't want that. I would like that the behavior of the email was the same as an authenticated user and stops in "permit_sasl_authenticated" in smtpd_recipient_restrictions.

share|improve this question
If your secondary postfix server is on network, this will happen as permit_mynetworks is before permit_sasl_authenticated in your smtpd_recipient_restrictions –  topdog Jul 24 '12 at 15:22
in my main config the variable is mynetworks =, so it never will match –  magiza83 Jul 24 '12 at 15:30
if I add the rule "reject_unauthenticated_sender_login_mismatch" i will only allow auth users to send through my main server, and this is the error I get when I try to send someting: "Jul 24 17:24:30 mail postfix/smtpd[8294]: NOQUEUE: reject: RCPT from unknown[]: 553 5.7.1 <666mgimeno@pre.ddol.es>: Sender address rejected: not logged in; from=<666mgimeno@pre.ddol.es> to=<yeah@mola.com> proto=ESMTP helo=<mx-test.ddol-test.com>" As you can see, secondary postfix is not sending as an auth user. And I don't know how to configure it. –  magiza83 Jul 24 '12 at 15:31
if I delete the rule "reject_unauthenticated_sender_login_mismatch" the error is: "Jul 24 17:41:45 mail postfix/smtpd[8451]: NOQUEUE: reject: RCPT from unknown[]: 554 5.7.1 <mgimeno@yeah.com>: Relay access denied; from=<666mgimeno@pre.ddol.es> to=<mgimeno@yeah.com> proto=ESMTP helo=<mx-test.ddol-test.com>" due to "reject_unauth_destination" rule –  magiza83 Jul 24 '12 at 15:46

1 Answer 1

up vote 1 down vote accepted

Your problem is here:

smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
relayhost = []

Note that you've used 'smtpd' rather than 'smtp'. This means you're setting up sasl for the listening deamon, not the sending agent.

Here's what I use in mine:

# use authentication
relayhost = [mail.messagingengine.com]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/saslpass
smtp_sasl_security_options = noanonymous

And it's working fine.

Oh - and the content of saslpass is:

mail.messagingengine.com myuser@my.domain:mypass

Note the colon and the space. I'm guessing you'll need to do the IP address there instead, or put an entry in /etc/hosts and use a name. The @my.domain is because messagingengine uses fully qualified email addresses for login. You probably just need a username.

share|improve this answer
thanks, you are totally right. and now it's working perfectly. –  magiza83 Jul 25 '12 at 7:51
you're welcome. I took the 'cyrus' tag off, since it's not really cyrus related at all. –  Bron Gondwana Jul 25 '12 at 11:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.