6

I am trying to make postfix not to auth users on port 25 but only on 587 and using STARTTLS. I have tried may different confs, but no success so far.

main.cf:

    ...
    smtpd_sasl_auth_enable =yes
    smtpd_sasl_authenticated_header = yes
    smtpd_sasl_local_domain = $myhostname
    smtpd_sasl_security_options = noanonymous
    smtpd_sasl_type = dovecot
    broken_sasl_auth_clients = yes
    smtpd_sasl_path = private/auth
    allow_mail_to_commands = alias
    allow_mail_to_files = alias

    smtpd_data_restrictions = reject_unauth_pipelining
    smtpd_helo_required = yes

    smtpd_sender_restrictions = permit_sasl_authenticated

    smtpd_recipient_restrictions =
      reject_non_fqdn_sender,
      reject_non_fqdn_helo_hostname,
      reject_unknown_recipient_domain,
      reject_non_fqdn_recipient,
      reject_invalid_hostname,
      permit_sasl_authenticated,
      reject_unauth_destination

    smtpd_use_tls = yes
    smtp_use_tls = yes
    #smtpd_tls_security_level = may
    #smtp_tls_security_level = encrypt

    smtpd_tls_auth_only = yes
    smtpd_tls_mandatory_protocols = !SSLv3, !SSLv2
    smtp_tls_note_starttls_offer = yes
    smtpd_tls_key_file = /etc/ssl/postfix/smtpd.pem
    smtpd_tls_cert_file = /etc/ssl/postfix/smtpd.pem
    smtpd_tls_CAfile = /etc/ssl/postfix/smtpd.pem
    smtpd_tls_session_cache_timeout = 3600s
    smtpd_tls_loglevel = 1
    smtpd_tls_received_header = yes
    tls_random_source = dev:/dev/urandom
    ...

master:

    # service type  private unpriv  chroot  wakeup  maxproc command + args
    #               (yes)   (yes)   (yes)   (never) (100)
    # ==========================================================================
    smtp      inet  n       -       n       -       -       smtpd
    #  -o smtp_sasl_auth_enable=yes
    submission inet n       -       n       -       -       smtpd
    #  -o content_filter=spamassassin
      -o smtpd_tls_security_level=encrypt
    #  user=spamd argv=/usr/local/bin/spamc -f -e /usr/local/libexec/dovecot/deliver -f ${sender} -d ${recipient}
    #  -o smtpd_enforce_tls=yes
    #  -o syslog_name=postfix/submission
      -o smtpd_sasl_auth_enable=yes
    #  -o smtpd_reject_unlisted_recipient=no
    #  -o smtpd_client_restrictions=$mua_client_restrictions
      -o smtpd_client_restrictions=permit_sasl_authenticated,reject
    #  -o smtpd_helo_restrictions=$mua_helo_restrictions
    #  -o smtpd_sender_restrictions=$mua_sender_restrictions
    #  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
    #  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
    #  -o milter_macro_daemon_name=ORIGINATING
    #smtps     inet  n       -       n       -       -       smtpd
    #  -o syslog_name=postfix/smtps
    #  -o smtpd_tls_security_level=encrypt
    #  -o smtpd_tls_wrappermode=yes
    #  -o smtpd_sasl_auth_enable=yes
    #  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
    #  -o smtpd_reject_unlisted_recipient=no
    #  -o smtpd_client_restrictions=$mua_client_restrictions
    #  -o smtpd_helo_restrictions=$mua_helo_restrictions
    #  -o smtpd_sender_restrictions=$mua_sender_restrictions
    #  -o smtpd_recipient_restrictions=
    #  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
    #  -o milter_macro_daemon_name=ORIGINATING
    #628       inet  n       -       n       -       -       qmqpd
    pickup    unix  n       -       n       60      1       pickup
    ...

Maybe, I miss something.. Thank you

3
  • 1
    I can understand wanting to mandate TLS - which is a good idea - but why do you care what port users do this on?
    – MadHatter
    Jul 16, 2015 at 14:43
  • Can you explain about the exact problem? The term no success was vague. Can you post the relevant maillog entry and any error message?
    – masegaloeh
    Jul 16, 2015 at 15:17
  • I have noticed that using thunderbird at the outgoing server settings, if I choose port 25 and security none, it accepts it without any problem. It works. All I want to do is to prevent that. Thank you for your time!
    – klimac
    Jul 16, 2015 at 19:42

3 Answers 3

6

Add this in your master.cf:

submission inet n       -       -       -       -       smtpd
  -o smtpd_sasl_auth_enable=yes
  ...

And remove smtpd_sasl_auth_enable = yes from your main.cf leaving the default no.

6
  • I have made those changes but still, I can send emails via port 25 and sec. none.
    – klimac
    Jul 17, 2015 at 8:13
  • 1
    Did you reload the postfix daemon? As this works for me, could you please post the current main.cf and master.cf after the change?
    – sebix
    Jul 17, 2015 at 8:42
  • Won't port 465 still work with this config? Do we need to add something like -o smtpd_tls_security_level=none to smtp inet n - y - - smtpd?
    – TCB13
    Feb 11, 2018 at 21:40
  • @TCB13 totally depends on what your main.cf looks like
    – sebix
    Feb 15, 2018 at 11:14
  • @sebix my config is similar to the one at the OP.
    – TCB13
    Feb 16, 2018 at 2:52
-1

Please make the below change on master.conf . Comment the below line . smtp inet n - n - - smtpd

Add the below line 587 inet n - n - - smtpd

netstat -tulpan | grep -i master tcp 0 0 127.0.0.1:587 0.0.0.0:* LISTEN 7168/master

1
  • 1
    How is this any better than the already-accepted answer?
    – womble
    Jul 26, 2018 at 0:05
-2

In /etc/postfix/main.cf you will add/change

smtpd_tls_security_level = encrypt

This will ENFORCE the use of TLS, so that the Postfix SMTP server announces STARTTLS and accepts no mail without TLS encryption

Then, in your /etc/postfix/master.cf you will override it for port 587 (the submission port) by overriding the parameter:

submission inet n       -       n       -       -       smtpd
  -o smtpd_tls_security_level=encrypt

This requires TLS for all submission (port 587) connections.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .