HowTos/Complete Postfix

From Scalix Wiki
Jump to: navigation, search

Scalix Wiki -> How-Tos -> The Complete Postfix Integration How-To

One thing that needs to be said about the below: using postfix with Scalix is not commercially supported. That means that if you're a commercial customer and you contact support with a postfix related problem they cannot help you.

Now that that's been said: have fun integrating postfix with your install! You'll know a bit more about MTA's by the time you're done!


Whether you want to avoid sendmail's archaic configuration syntax, or take advantage of postfix's modern and secure modular architecture, there are plenty of reasons to want to integrate postfix into a Scalix system.

After reading this howto you should be prepared to set up your MTA however you want to have it.

By then you'll have achieved the following:

  • sendmail will be but a memory
  • postfix will accept incoming mail from internet hosts to the domain
  • postfix will allow relaying by authenticated clients
  • postfix will deliver incoming mail that belongs to local-users into the Scalix system
  • amavisd-new will virus-scan and spam-check incoming mail

If you notice issues, please let me know chris -att- scalix -dott- com

Note this solutions for 11GA (NB: the forums post doesn't support multi-instance configurations, this howto supports multi-instance.)

installing postfix

First you'll need to install postfix and stop sendmail. You'll probably want to leave sendmail installed to keep your package management happy - the Scalix Server RPM package depends on sendmail.

I'll go through these examples for RedHat/Fedora, and I've tested everything on Debian as well. If you use SuSE, well, I'm sorry.


Most of the software used in these examples comes from the RHEL 4U4 CD set. If you have a RedHat Network subscription you can just up2date install the packages rather than manually installing.

rpm -ivh postfix-2.2.10-1.RHEL4.2.i386.rpm system-switch-mail-0.5.25-3.noarch.rpm

Now that postfix is installed, switch to it by running system-switch-mail-nox. Then select postfix, and choose OK.

set postfix to listen on the external ip, omsmtpd to a high port

On a standard Scalix system omsmtpd listens to port 25 on the public IP while sendmail listens to port 25 on the loopback address. Because we want to leverage postfix's flexibility to add virus and spam scanning on incoming mail, we'll let postfix listen to both addresses, and have it deliver to omsmtpd running on a high port.

In order to switch omsmtp's listening socket add the line

to the file /var/opt/scalix/*/s/sys/smtpd.cfg while replacing $FQDN with your server's fully qualified domain name. The LISTEN directive must come before the line [SUBMIT] in order to be used by omsmtpd for the normal SMTP socket.

To activate that change, restart omsmtpd with the commands omoff -d0 -w smtpd; omon smtpd

To let postfix take over the newly freed port, remove the line

inet_interfaces = localhost
from the file /etc/postfix/

To active the second change, run /etc/init.d/postfix reload

Postfix has now taken over for omsmtpd. In the next section, we'll integrate them so that postfix passes incoming mail on to omsmtpd.

set up transport

When email is delivered to the system, postfix needs to check which addresses belong to the Scalix server and deliver email to those addresses to omsmtpd. All other email, postfix can deliver directly to its destination.

We'll set postfix up to check in the LDAP directory whether users' addresses are local. Create the file /etc/postfix/ and fill it with the following information about the LDAP directory.

server_host = ldap://localhost:5757
query_filter = mail=%s
bind = no
result_attribute = scalixInstanceMailHost
result_format = smtp:[%s]:10025
size_limit = 1
domain = scalix.demo

Be sure to put your own primary domain in place of scalix.demo above - the rest should be correct.

Configure postfix to use that information for lookups by inserting the line

transport_maps = ldap:/etc/postfix/
at the end of your /etc/postfix/ file.

Now postfix has replaced sendmail and taken part of omsmtpd's job, it needs to accept incoming email from pop3 and imap users. However, those users will need to authenticate with their Scalix passwords in order to relay mail over the system.

setting up smtp-auth

Ensure that cyrus-sasl, cyrus-sasl-md5 and cyrus-sasl-plain are installed on RedHat. On Debian execute apt-get install libsasl2-modules-ldap sasl2-bin to install the necessary authentication helpers.

We'll use saslauthd to authenticate against Scalix's LDAP directory. First let's set saslauthd up to do ldap by setting MECH=ldap in the /etc/sysconfig/saslauthd file. Change the location of saslauthd's conf file and enable caching by setting FLAGS="-O /etc/postfix/saslauthd.conf -c" in the same file. Also set saslauthd to start at boot with /sbin/chkconfig --level 345 saslauthd on

Create the directory /etc/postfix/sasl/ and the file /etc/postfix/sasl/smtpd.conf which you'll fill with the following:

pwcheck_method: saslauthd
mech_list: PLAIN LOGIN
log_level: 5
saslauthd_path: /var/run/saslauthd/mux
auxprop_plugin: ldap

Now we need to tell sasl how to talk to the LDAP directory in /etc/postfix/saslauthd.conf:

ldap_servers: ldap://localhost:389/
ldap_search_base: o=Scalix
ldap_auth_method: bind
ldap_filter: omUlAuthid=%u
ldap_version: 3
ldap_bind_dn: cn=sxadmin,o=scalix
ldap_bind_pw: super_secret

Addtion ( by Marco ):

If you want to check your outgoing mails through the email address just change the ldap_filter to:

ldap_filter: mail=%u

moreover you need to append -r to FLAGS under:

(Debian) /etc/default/saslauthd (RHE) /etc/sysconfig/saslauthd

e.g. FLAGS="-O /etc/postfix/saslauthd.conf -c -r" 

It is easier for outlook users, so they only have to check on that the outgoing smtp requires authentification and can use the same values as for recieving mails.

Don't forget to put your real sxadmin password as bind_pw.

Now that sasl is set up, we need to configure postfix to use it. The following changes to the /etc/postfix/ will cause postfix to use sasl to offer authenticated SMTP.

smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = no
smtpd_sasl_local_domain =
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes

To require authentication in order to relay email over the system set the following rules, also in the /etc/postfix/ file.

smtpd_client_restrictions =

smtpd_sender_restrictions =

smtpd_recipient_restrictions =

Just doing authenticated smtp isn't enough in the modern internet, we should protect our passwords with encryption as well.

configure tls on postfix

In order to encrypt SMTP (or any other) communication, you'll need a certificate. if you've never generated one before, this should be a pretty good starting place to get a handle on how ssl works, generate your first certificate signing request and self-sign it. It should be noted that this information is erroneous for Centos 5 and possibly RHEL5, due to the crypto-utils package not being available for these platforms. An alternate method to generate the keys are :

/usr/bin/openssl genrsa 1024 > /etc/pki/tls/private/localhost.key
chmod go-rwx /etc/pki/tls/private/localhost.key
cd /etc/pki/tls/certs
make testcert

If you have generated a certificate before, either use that one or do it again. Come back when you have your certificate and place the files in /etc/ssl.

The following will configure postfix offer TLS to any other server it talks to while making TLS a requirement for authenticated sessions.

smtpd_use_tls = yes
smtpd_tls_auth_only = yes
smtpd_tls_key_file = /etc/ssl/key.pem
smtpd_tls_cert_file = /etc/ssl/cert.pem
smtpd_tls_CAfile = /etc/ssl/cacert.pem
smtpd_tls_security_level = may
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom

Now that the server is ready for the rigors of the internet, let's shore up our defenses by adding some malware protection.

protect against spam and virii

Unfortunately, RedHat doesn't package much in the way of defensive software in RHEL4. I'd recommend installing amavisd-new from rpmforge via apt. Amavisd is a wrapper which encompasses best of breed anti-spam like spam assassin as well as anti-virus like ClamAV. If you have enterprise anti-virus licenses you can almost certainly integrate that product into Amavis (assuming it runs on Linux) to strengthen your defenses against malware.

Download apt and rpmforge from Dag's APT and RPM-Forge sites.

Install both rpms, then run apt-get update to get a current copy of the package lists.

Once everything is synchronized, run apt-get install clamav clamd spamassassin razor-agents perl-Razor-Agent amavisd-new to get a nice set of anti-spam and anti-virus tools.

Start amavisd with /etc/init.d/amavisd start, start spamassassin with /etc/init.d/spamassassin start and start clamav with /etc/init.d/clamd start to get them all ready.

Tell postfix about the newly installed services by adding the following to the bottom of /etc/postfix/

smtp-amavis unix -      -       n     -       2  smtp
    -o smtp_data_done_timeout=1200
    -o smtp_send_xforward_command=yes
    -o disable_dns_lookups=yes
    -o max_use=20 inet n  -       n     -       -  smtpd
    -o content_filter=
    -o smtpd_restriction_classes=
    -o smtpd_delay_reject=no
    -o smtpd_client_restrictions=permit_mynetworks,reject
    -o smtpd_helo_restrictions=
    -o smtpd_sender_restrictions=
    -o smtpd_recipient_restrictions=permit_mynetworks,reject
    -o smtpd_data_restrictions=reject_unauth_pipelining
    -o smtpd_end_of_data_restrictions=
    -o mynetworks=
    -o smtpd_error_sleep_time=0
    -o smtpd_soft_error_limit=1001
    -o smtpd_hard_error_limit=1000
    -o smtpd_client_connection_count_limit=0
    -o smtpd_client_connection_rate_limit=0
    -o smtpd_milters=
    -o local_header_rewrite_clients=
    -o local_recipient_maps=
    -o relay_recipient_maps=
    -o receive_override_options=no_header_body_checks,no_unknown_recipient_checks

Instruct postfix to use amavisd as a content filter by adding the following to the bottom of /etc/postfix/


Now postfix will send incoming mail to amavis to have it checked for virii and spam, and it's time to make a couple of specific settings.

activating amavisd and clamav

in /etc/amavisd.conf

set your domain name

$mydomain = 'scalix.demo';

uncomment the clamav virus scanner to activate it

   \&ask_daemon, ["CONTSCAN {}\n", "/var/run/clamav/clamd"],
   qr/\bOK$/, qr/\bFOUND$/,
   qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],

edit /etc/clamd.conf to include:

AllowSupplementaryGroups yes
LocalSocket /var/run/clamav/clamd

hardening postfix

In order to make your mail server more resilient to attack you may want to consider adding the security configuration to postfix.

Only accept email from well behaved MTA's by replacing the configuration provided above with the following:

smtpd_helo_required = yes
disable_vrfy_command = yes

smtpd_client_restrictions = 
smtpd_recipient_restrictions = 
smtpd_sender_restrictions = 

This is just a start, take a look at this and this to get started fighting spam with postfix!

test your setup

Send yourself some email, and look at the full headers. You should see lines like
X-Virus-Scanned: amavisd-new at scalix.demo
in the full email headers.

You can also watch the mail log with tail -n 50 -f /var/log/maillog or tail -n 50 -f /var/log/mail.log depending on your system setup.

You'll see your test emails go by looking something like the following

Jun  2 07:20:09 rightbrain postfix/qmgr[9701]: 0AA6816860D: from=<user1@scalix.demo>, size=920, nrcpt=2 (queue active)
Jun  2 07:20:09 rightbrain amavis[9768]: (09768-01) Passed CLEAN, LOCAL [] [] <user1@scalix.demo> -> <user1@scalix.demo>,<user2@scalix.demo>, Message-ID: <4660D7D0.5080706@scalix.demo>, mail_id: SQBCQ+o1haQX, Hits: 1.459, queued_as: 0AA6816860D, 23958 ms
Jun  2 07:20:09 rightbrain postfix/smtp[9887]: <[]: 250 2.6.0 Ok, id=09768-01, from MTA([]:10025): 250 Ok: queued as 0AA6816860D
Jun  2 07:20:09 rightbrain postfix/smtp[9887]: B0E0D16860A: to=<user1@scalix.demo>, relay=[], delay=27, status=sent (250 2.6.0 Ok, id=09768-01, from MTA([]:10025): 250 Ok: queued as 0AA6816860D)
Jun  2 07:20:15 rightbrain postfix/smtp[9905]: 0AA6816860D: to=<user1@scalix.demo>, relay=rightbrain.scalix.demo[], delay=6, status=sent (250 Ok)

Enjoy your spiffy mail server!