After a considerable amount of research, I have configured my postfix server to use dovecot to accept SMTPS connections over port 465 and everything works swimmingly.

Unfortunately, I forgot that, unless I listen to port 25, I'm not going to receive any e-mail from the net.

I'm hoping somebody knows off the top of their head how to open up port 25 on Postfix for anonymous users, but disallow relaying and any other bad things on that port. And to leave the port 465 the way it is.

As to my current configuration, I changed the master.cf file:

smtps      inet  n       -       n       -       -       smtpd

and the main.cf file:

# Use our SSL certificates
smtpd_tls_cert_file = .....cer
smtpd_tls_key_file = .....key
smtpd_tls_security_level = may

# Use Dovecot for SASL authentication
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
broken_sasl_auth_clients = yes
smtpd_recipient_restrictions = permit_sasl_authenticated, reject_unauth_destination

Any help is appreciated!

  • How much did you change in main.cf? By default it allows port 25. It would be useful if you posted your complete main.cf and output of postconf -n. – James O'Gorman Jun 22 '12 at 19:44

ADD (and do not replace) the following line to master.conf to enable 25 again

smtp      inet  n       -       n       -       -       smtpd

Relay-control is done in main.cf, so you may want to use something like that:

smtpd_client_restrictions =
    check_client_access hash:/etc/postfix/policyd_weight_client_whitelist
    check_recipient_access hash:/etc/postfix/policyd_weight_recipient_whitelist
    check_policy_service inet:

The last line is for amavis. Anyway, smtpd_client_restrictions is what you search, and here you have more precise url: http://www.postfix.org/BASIC_CONFIGURATION_README.html#relay_from

  • Thanks! It ends up that all I had to do was add the line to master.conf that allows Postfix to listed to SMTP. – Monkey Boson Jun 25 '12 at 20:52
  • 1
    The documentation you linked to suggested that the restriction "reject_unauth_destination" does exactly what I was looking for, namely "allow Postfix to be the final destination, but not a relay". – Monkey Boson Jun 25 '12 at 21:09

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.