2

I am trying to make postfix not to auth users on port 25 but only on 587 and using STARTTLS. I have tried may different confs, but no success so far.

main.cf:

    ...
    smtpd_sasl_auth_enable =yes
    smtpd_sasl_authenticated_header = yes
    smtpd_sasl_local_domain = $myhostname
    smtpd_sasl_security_options = noanonymous
    smtpd_sasl_type = dovecot
    broken_sasl_auth_clients = yes
    smtpd_sasl_path = private/auth
    allow_mail_to_commands = alias
    allow_mail_to_files = alias

    smtpd_data_restrictions = reject_unauth_pipelining
    smtpd_helo_required = yes

    smtpd_sender_restrictions = permit_sasl_authenticated

    smtpd_recipient_restrictions =
      reject_non_fqdn_sender,
      reject_non_fqdn_helo_hostname,
      reject_unknown_recipient_domain,
      reject_non_fqdn_recipient,
      reject_invalid_hostname,
      permit_sasl_authenticated,
      reject_unauth_destination

    smtpd_use_tls = yes
    smtp_use_tls = yes
    #smtpd_tls_security_level = may
    #smtp_tls_security_level = encrypt

    smtpd_tls_auth_only = yes
    smtpd_tls_mandatory_protocols = !SSLv3, !SSLv2
    smtp_tls_note_starttls_offer = yes
    smtpd_tls_key_file = /etc/ssl/postfix/smtpd.pem
    smtpd_tls_cert_file = /etc/ssl/postfix/smtpd.pem
    smtpd_tls_CAfile = /etc/ssl/postfix/smtpd.pem
    smtpd_tls_session_cache_timeout = 3600s
    smtpd_tls_loglevel = 1
    smtpd_tls_received_header = yes
    tls_random_source = dev:/dev/urandom
    ...

master:

    # service type  private unpriv  chroot  wakeup  maxproc command + args
    #               (yes)   (yes)   (yes)   (never) (100)
    # ==========================================================================
    smtp      inet  n       -       n       -       -       smtpd
    #  -o smtp_sasl_auth_enable=yes
    submission inet n       -       n       -       -       smtpd
    #  -o content_filter=spamassassin
      -o smtpd_tls_security_level=encrypt
    #  user=spamd argv=/usr/local/bin/spamc -f -e /usr/local/libexec/dovecot/deliver -f ${sender} -d ${recipient}
    #  -o smtpd_enforce_tls=yes
    #  -o syslog_name=postfix/submission
      -o smtpd_sasl_auth_enable=yes
    #  -o smtpd_reject_unlisted_recipient=no
    #  -o smtpd_client_restrictions=$mua_client_restrictions
      -o smtpd_client_restrictions=permit_sasl_authenticated,reject
    #  -o smtpd_helo_restrictions=$mua_helo_restrictions
    #  -o smtpd_sender_restrictions=$mua_sender_restrictions
    #  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
    #  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
    #  -o milter_macro_daemon_name=ORIGINATING
    #smtps     inet  n       -       n       -       -       smtpd
    #  -o syslog_name=postfix/smtps
    #  -o smtpd_tls_security_level=encrypt
    #  -o smtpd_tls_wrappermode=yes
    #  -o smtpd_sasl_auth_enable=yes
    #  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
    #  -o smtpd_reject_unlisted_recipient=no
    #  -o smtpd_client_restrictions=$mua_client_restrictions
    #  -o smtpd_helo_restrictions=$mua_helo_restrictions
    #  -o smtpd_sender_restrictions=$mua_sender_restrictions
    #  -o smtpd_recipient_restrictions=
    #  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
    #  -o milter_macro_daemon_name=ORIGINATING
    #628       inet  n       -       n       -       -       qmqpd
    pickup    unix  n       -       n       60      1       pickup
    ...

Maybe, I miss something.. Thank you

  • 1
    I can understand wanting to mandate TLS - which is a good idea - but why do you care what port users do this on? – MadHatter Jul 16 '15 at 14:43
  • Can you explain about the exact problem? The term no success was vague. Can you post the relevant maillog entry and any error message? – masegaloeh Jul 16 '15 at 15:17
  • I have noticed that using thunderbird at the outgoing server settings, if I choose port 25 and security none, it accepts it without any problem. It works. All I want to do is to prevent that. Thank you for your time! – klimac Jul 16 '15 at 19:42
4

Add this in your master.cf:

submission inet n       -       -       -       -       smtpd
  -o smtpd_sasl_auth_enable=yes
  ...

And remove smtpd_sasl_auth_enable = yes from your main.cf leaving the default no.

  • I have made those changes but still, I can send emails via port 25 and sec. none. – klimac Jul 17 '15 at 8:13
  • 1
    Did you reload the postfix daemon? As this works for me, could you please post the current main.cf and master.cf after the change? – sebix Jul 17 '15 at 8:42
  • Won't port 465 still work with this config? Do we need to add something like -o smtpd_tls_security_level=none to smtp inet n - y - - smtpd? – TCB13 Feb 11 '18 at 21:40
  • @TCB13 totally depends on what your main.cf looks like – sebix Feb 15 '18 at 11:14
  • @sebix my config is similar to the one at the OP. – TCB13 Feb 16 '18 at 2:52
-1

Please make the below change on master.conf . Comment the below line . smtp inet n - n - - smtpd

Add the below line 587 inet n - n - - smtpd

netstat -tulpan | grep -i master tcp 0 0 127.0.0.1:587 0.0.0.0:* LISTEN 7168/master

  • How is this any better than the already-accepted answer? – womble Jul 26 '18 at 0:05
-2

In /etc/postfix/main.cf you will add/change

smtpd_tls_security_level = encrypt

This will ENFORCE the use of TLS, so that the Postfix SMTP server announces STARTTLS and accepts no mail without TLS encryption

Then, in your /etc/postfix/master.cf you will override it for port 587 (the submission port) by overriding the parameter:

submission inet n       -       n       -       -       smtpd
  -o smtpd_tls_security_level=encrypt

This requires TLS for all submission (port 587) connections.

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.