I have a clean install of postfix and dovecot-core dovecot-imapd dovecot-lmtpd installed on Debian 8 OS.
I want to configure mail to work with PAM but I want to restrict it to users who are part of the usermail
group so not every linux user has mail access.
I'd also like to make sure the following files were configured properly. I want to make sure user/pass is not sent in plain text and that it is encrypted.
I am showing only the lines I have modified. For a section I wasn't sure of, I have asked a question.
dovecot/10-auth.conf
disable_plaintext_auth = yes
auth_username_chars = abcdefg....AbCdefg...0123...@
Should plain login
be used for Secure SMTP and IMAPS or just plain
?
auth_mechanisms = plain login
This if for PAM authentication
!include auth-system.conf.ext
dovecot/10-master.conf
All others are commented out so only IMAPS will work.
service imap-login {
inet_listener imaps {
port = 993
ssl = yes
}
|
Is postfix
the correct user, or should I be using dovecot here?
service lmtp {
unix_listener /var/spool/postfix/private/dovecot-lmtp {
mode = 0600
user = postfix
group = postfix
}
service auth {
Do I need to use this instead of Postfix smtp-auth?
unix_listener auth-userdb {
#mode =
#user =
#group =
}
Should this be using postfix
or dovecot
as the user?
# Postfix smtp-auth
unix_listener /var/spool/postfix/private/auth {
mode = 0666
user=postfix
group=postfix
}
dovecot/10-mail.conf
Is it okay to use maildir instead of Maildir? Would email clients or the server have issues using all lowercase?
mail_location = maildir:~/Maildir
dovecot/10-ssl.conf
ssl = required
ssl_cert = /etc/dovecot/*.pem
ssl_key = /etc/dovecot/private/*.pem
Do I need to exclude !SSLv2 and !SSLv3 to force TLS?
Here is the output of dovecot -n:
mail_location = maildir:~/Maildir
namespace inbox {
inbox = yes
location =
prefix =
}
passdb {
driver = pam
}
protocols = imap lmtp
service auth {
unix_listener /var/spool/postfix/private/auth {
group = postfix
user = postfix
mode = 0666
}
}
service imap-login {
inet_listener imaps {
port = 993
ssl = yes
}
}
service lmtp {
unix_listener /var/spool/postfix/private/dovecot-lmtp {
group = postfix
user = postfix
mode = 0600
}
}
ssl = required
userdb {
driver = passwd
}
postfix/main.cf
virtual_transport = lmtp:unix:private/dovecot-lmtp
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_tls_auth_only = yes
postfix/master.cf
I just uncommented this line:
submission inet n - - - - smtpd
UPDATE:
With this config I'm getting an error message when trying to send mail from client to a gmail acount. My iPhone also gets an authentication error message. The user has been created and using the password entered.
Warning: hostname mobile.a.b.c.d-mycingular.net does not resolve to address a.b.c.d
connect from unknown
warning: SASL: connect to private/auth failed: no such file or directory
fatal: no SASL authentication mechanisms
/usr/lib/postfix/smtpd bad command startup --throttling