| « VoIP and Conferencing | 2002 National Public Radio Documentary on New Orleans Hurricane Threat » |
Postfix SMTP AUTH support for relayhost
09/06/05
Postfix SMTP AUTH support for relayhost
Tonight I changed my relayhost for my outgoing home mail server to one that requires me to use SMTP AUTH so I needed to modify my main.cf on the outgoing server as follows.
Added the following settings to /etc/postfix/main.cf:
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options =
Create /etc/postfix/sasl_passwd as follows:
my.mail.relay.net username:password
Because the password is in cleartext make it root only:
# chown root:root /etc/postfix/sasl_passwd && chmod 600 /etc/postfix/sasl_passwd
Create the hash file:
# postmap /etc/postfix/sasl_passwd
Make the hash file world readable:
# chmod 644 /etc/postfix/sasl_passwd
Reload the Postfix config:
# /etc/init.d/postfix reload
5 comments
Make the hash file world readable:
# chmod 644 /etc/postfix/sasl_passwd
But shouldn't that be:
chmod 644 /etc/postfix/sasl_passwd.db
???
When I do the postmap command you show it doesn't alter the mother file, but it makes a .db file.
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd to smtp_sasl_password_maps = /etc/postfix/sasl_passwd.db or something similar. I think that my original method hashes the file on demand instead of accessing a pre-hashed file. Secondly, you have to chmod the sasl_passwd.db, and not sasl_passwd. ( i'm talking about the second chmod).
And, if you chmod 644, then you'll have security problems, because the .db file IS NOT encrypted, and anyone can read the file with a simple editor.
So, the solution would be to chown it to postfix:postfix and chmod 600 the sasl_passwd.db.
http://p.data.lt/67
You need to have the sasl_passwd file owned by root:root or root:wheel (depending on the OS), with 0600 permissions. Otherwise you could potentially expose your server. Postfix will still be able to read the file, because it gets started with root privileges.
To sum it up, Ben is right, and these are the right commands to issue:
[quote]
# chown root:root /etc/postfix/sasl_passwd && chmod 600 /etc/postfix/sasl_passwd
#### or, on BSD-like boxes ####
# chown root:wheel /etc/postfix/sasl_passwd && chmod 600 /etc/postfix/sasl_passwd
Also, remember to run (as root):
# postmap /etc/postfix/sasl_passwd whenever you change the sasl_passwd file
Cheers,
Matt
This post has 1 feedback awaiting moderation...
Comment feed for this postLeave a comment
