Postfix SMTP AUTH support for relayhost

by Ben Franske Email

Tonight I changed my relayhost for my outgoing home mail server to one that requires me to use SMTP AUTH so I needed to modify my main.cf on the outgoing server as follows.

Added the following settings to /etc/postfix/main.cf:
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options =

Create /etc/postfix/sasl_passwd as follows:
my.mail.relay.net username:password

Because the password is in cleartext make it root only:
# chown root:root /etc/postfix/sasl_passwd && chmod 600 /etc/postfix/sasl_passwd

Create the hash file:
# postmap /etc/postfix/sasl_passwd

Make the hash file world readable:
# chmod 644 /etc/postfix/sasl_passwd

Reload the Postfix config:
# /etc/init.d/postfix reload

4 comments

Comment from: Curtis Brown [Visitor] · http://www.SpectralDesign.Net
You say:

Make the hash file world readable:
# chmod 644 /etc/postfix/sasl_passwd

But shouldn't that be:
chmod 644 /etc/postfix/sasl_passwd.db

???
When I do the postmap command you show it doesn't alter the mother file, but it makes a .db file.
11/12/05 @ 19:58
Comment from: Ben Franske [Member] Email · http://ben.franske.com
Hmm. Now that I look at it I think you're right, but if you were going to do it that way I think you would change smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd to smtp_sasl_password_maps = /etc/postfix/sasl_passwd.db or something similar. I think that my original method hashes the file on demand instead of accessing a pre-hashed file.
11/13/05 @ 16:31
Comment from: sysmonk [Visitor] Email · http://dev.datavoid.org
First of all, if you specify hash:/etc/postfix/sasl_passwd, then postfix accesses /etc/postfix/sasl_passwd.db and not /etc/postfix/sasl_passwd.
Secondly, you have to chmod the sasl_passwd.db, and not sasl_passwd. ( i'm talking about the second chmod).
And, if you chmod 644, then you'll have security problems, because the .db file IS NOT encrypted, and anyone can read the file with a simple editor.
So, the solution would be to chown it to postfix:postfix and chmod 600 the sasl_passwd.db.
05/18/07 @ 03:45
Comment from: sysmonk [Visitor] Email · http://dev.datavoid.org/
oh, and here's a link to a Proof of concept:

http://p.data.lt/67
05/18/07 @ 03:52

Leave a comment


Your email address will not be revealed on this site.

Your URL will be displayed.
(Line breaks become <br />)
(Name, email & website)
(Allow users to contact you through a message form (your email will not be revealed.)