external/ibm-public/postfix/dist/html/SOHO_README.html

   1 <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN"
   2         "http://www.w3.org/TR/html4/loose.dtd">
   3
   4 <html>
   5
   6 <head>
   7
   8 <title>Postfix Small/Home Office Hints and Tips</title>
   9
  10 <meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
  11
  12 </head>
  13
  14 <body>
  15
  16 <h1><img src="postfix-logo.jpg" width="203" height="98" ALT="">Postfix Small/Home Office Hints and Tips</h1>
  17
  18 <hr>
  19
  20 <h2>Overview</h2>
  21
  22 <p> This document combines hints and tips for "small office/home
  23 office" applications into one document so that they are easier to
  24 find. The text describes the mail sending side only. If your machine
  25 does not receive mail directly (i.e. it does not have its own
  26 Internet domain name and its own fixed IP address), then you will
  27 need a solution such as "fetchmail", which is outside the scope of
  28 the Postfix documentation.  </p>
  29
  30 <ul>
  31
  32 <li> <p> Selected topics from the <a href="STANDARD_CONFIGURATION_README.html">STANDARD_CONFIGURATION_README</a> document: </p>
  33
  34 <ul>
  35
  36 <li><a href="#stand_alone">Postfix on a stand-alone Internet host</a>
  37
  38 <li><a href="#fantasy">Postfix on hosts without a real
  39 Internet hostname</a>
  40
  41 </ul>
  42
  43 <p> Selected topics from the <a href="SASL_README.html">SASL_README</a> document: </p>
  44
  45 <ul>
  46
  47 <li><a href="#client_sasl">Enabling SASL authentication in the
  48 Postfix SMTP client</a></li>
  49
  50 <li><a href="#client_sasl_sender">Supporting multiple ISP accounts
  51 in the Postfix SMTP client</a></li>
  52
  53 </ul>
  54
  55 </ul>
  56
  57 <p> See the <a href="SASL_README.html">SASL_README</a> and <a href="STANDARD_CONFIGURATION_README.html">STANDARD_CONFIGURATION_README</a> documents for
  58 further information on these topics. </p>
  59
  60 <h2><a name="stand_alone">Postfix on a stand-alone Internet host</a></h2>
  61
  62 <p> Postfix should work out of the box without change on a stand-alone
  63 machine that has direct Internet access.  At least, that is how
  64 Postfix installs when you download the Postfix source code via
  65 <a href="http://www.postfix.org/">http://www.postfix.org/</a>. </p>
  66
  67 <p> You can use the command "<b>postconf -n</b>" to find out what
  68 settings are overruled by your <a href="postconf.5.html">main.cf</a>. Besides a few pathname
  69 settings, few parameters should be set on a stand-alone box, beyond
  70 what is covered in the <a href="BASIC_CONFIGURATION_README.html">BASIC_CONFIGURATION_README</a> document: </p>
  71
  72 <blockquote>
  73 <pre>
  74 /etc/postfix/<a href="postconf.5.html">main.cf</a>:
  75     # Optional: send mail as user@domainname instead of user@hostname.
  76     #<a href="postconf.5.html#myorigin">myorigin</a> = $<a href="postconf.5.html#mydomain">mydomain</a>
  77
  78     # Optional: specify NAT/proxy external address.
  79     #<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a> = 1.2.3.4
  80
  81     # Alternative 1: don't relay mail from other hosts.
  82     <a href="postconf.5.html#mynetworks_style">mynetworks_style</a> = host
  83     <a href="postconf.5.html#relay_domains">relay_domains</a> =
  84
  85     # Alternative 2: relay mail from local clients only.
  86     # <a href="postconf.5.html#mynetworks">mynetworks</a> = 192.168.1.0/28
  87     # <a href="postconf.5.html#relay_domains">relay_domains</a> =
  88 </pre>
  89 </blockquote>
  90
  91 <p> See also the section "<a href="#fantasy">Postfix on hosts without
  92 a real Internet hostname</a>" if this is applicable to your configuration.
  93 </p>
  94
  95 <h2><a name="fantasy">Postfix on hosts without a real Internet
  96 hostname</a></h2>
  97
  98 <p> This section is for hosts that don't have their own Internet
  99 hostname.  Typically these are systems that get a dynamic IP address
 100 via DHCP or via dialup. Postfix will let you send and receive mail
 101 just fine between accounts on a machine with a fantasy name. However,
 102 you cannot use a fantasy hostname in your email address when sending
 103 mail into the Internet, because no-one would be able to reply to
 104 your mail. In fact, more and more sites refuse mail addresses with
 105 non-existent domain names. </p>
 106
 107 <p> Note: the following information is Postfix version dependent.
 108 To find out what Postfix version you have, execute the command
 109 "<b>postconf <a href="postconf.5.html#mail_version">mail_version</a></b>". </p>
 110
 111 <h3>Solution 1: Postfix version 2.2 and later </h3>
 112
 113 <p> Postfix 2.2 uses the <a href="generic.5.html">generic(5)</a> address mapping to replace
 114 local fantasy email addresses by valid Internet addresses.  This
 115 mapping happens ONLY when mail leaves the machine; not when you
 116 send mail between users on the same machine. </p>
 117
 118 <p> The following example presents additional configuration. You
 119 need to combine this with basic configuration information as
 120 discussed the first half of this document. </p>
 121
 122 <blockquote>
 123 <pre>
 124 1 /etc/postfix/<a href="postconf.5.html">main.cf</a>:
 125 2     <a href="postconf.5.html#smtp_generic_maps">smtp_generic_maps</a> = hash:/etc/postfix/generic
 126 3
 127 4 /etc/postfix/generic:
 128 5     his@localdomain.local             hisaccount@hisisp.example
 129 6     her@localdomain.local             heraccount@herisp.example
 130 7     @localdomain.local                hisaccount+local@hisisp.example
 131 </pre>
 132 </blockquote>
 133
 134 <p> When mail is sent to a remote host via SMTP: </p>
 135
 136 <ul>
 137
 138 <li> <p> Line 5 replaces <i>his@localdomain.local</i> by his ISP
 139 mail address, </p>
 140
 141 <li> <p> Line 6 replaces <i>her@localdomain.local</i> by her ISP
 142 mail address, and </p>
 143
 144 <li> <p> Line 7 replaces other local addresses by his ISP account,
 145 with an address extension of +<i>local</i> (this example assumes
 146 that the ISP supports "+" style address extensions). </p>
 147
 148 </ul>
 149
 150 <p>Specify <b>dbm</b> instead of <b>hash</b> if your system uses
 151 <b>dbm</b> files instead of <b>db</b> files. To find out what lookup
 152 tables Postfix supports, use the command "<b>postconf -m</b>".  </p>
 153
 154 <p> Execute the command "<b>postmap /etc/postfix/generic</b>"
 155 whenever you change the generic table. </p>
 156
 157 <h3>Solution 2: Postfix version 2.1 and earlier </h3>
 158
 159 <p> The solution with older Postfix systems is to use valid
 160 Internet addresses where possible, and to let Postfix map valid
 161 Internet addresses to local fantasy addresses. With this, you can
 162 send mail to the Internet and to local fantasy addresses, including
 163 mail to local fantasy addresses that don't have a valid Internet
 164 address of their own.</p>
 165
 166 <p> The following example presents additional configuration. You
 167 need to combine this with basic configuration information as
 168 discussed the first half of this document. </p>
 169
 170 <blockquote>
 171 <pre>
 172  1 /etc/postfix/<a href="postconf.5.html">main.cf</a>:
 173  2     <a href="postconf.5.html#myhostname">myhostname</a> = hostname.localdomain
 174  3     <a href="postconf.5.html#mydomain">mydomain</a> = localdomain
 175  4
 176  5     <a href="postconf.5.html#canonical_maps">canonical_maps</a> = hash:/etc/postfix/canonical
 177  6
 178  7     <a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a> = hash:/etc/postfix/virtual
 179  8
 180  9 /etc/postfix/canonical:
 181 10     your-login-name    your-account@your-isp.com
 182 11
 183 12 /etc/postfix/<a href="virtual.8.html">virtual</a>:
 184 13     your-account@your-isp.com       your-login-name
 185 </pre>
 186 </blockquote>
 187
 188 <p> Translation: </p>
 189
 190 <ul>
 191
 192 <li> <p> Lines 2-3: Substitute your fantasy hostname here. Do not
 193 use a domain name that is already in use by real organizations
 194 on the Internet. See <a href="http://tools.ietf.org/html/rfc2606">RFC 2606</a> for examples of domain
 195 names that are guaranteed not to be owned by anyone. </p>
 196
 197 <li> <p> Lines 5, 9, 10: This provides the mapping from
 198 "your-login-name@hostname.localdomain" to "your-account@your-isp.com".
 199 This part is required. </p>
 200
 201 <li> <p> Lines 7, 12, 13: Deliver mail for "your-account@your-isp.com"
 202 locally, instead of sending it to the ISP. This part is not required
 203 but is convenient.
 204
 205 </ul>
 206
 207 <p>Specify <b>dbm</b> instead of <b>hash</b> if your system uses
 208 <b>dbm</b> files instead of <b>db</b> files. To find out what lookup
 209 tables Postfix supports, use the command "<b>postconf -m</b>".  </p>
 210
 211 <p> Execute the command "<b>postmap /etc/postfix/canonical</b>"
 212 whenever you change the canonical table. </p>
 213
 214 <p> Execute the command "<b>postmap /etc/postfix/virtual</b>"
 215 whenever you change the virtual table. </p>
 216
 217 <h2><a name="client_sasl">Enabling SASL authentication in the
 218 Postfix SMTP client</a></h2>
 219
 220 <p> Turn on client-side SASL authentication, and specify a table
 221 with per-host or per-destination username and password information.
 222 The Postfix SMTP client first searches the table for an entry with
 223 the remote SMTP server hostname; if no entry is found, then the
 224 Postfix SMTP client searches the table for
 225 an entry with the next-hop destination.  Usually, that is the
 226 right-hand part of an email address, but it can also be the information
 227 that is specified with the <a href="postconf.5.html#relayhost">relayhost</a> parameter or with a <a href="transport.5.html">transport(5)</a>
 228 table. </p>
 229
 230 <blockquote>
 231 <pre>
 232 /etc/postfix/<a href="postconf.5.html">main.cf</a>:
 233     <a href="postconf.5.html#smtp_sasl_auth_enable">smtp_sasl_auth_enable</a> = yes
 234     <a href="postconf.5.html#smtp_sasl_password_maps">smtp_sasl_password_maps</a> = hash:/etc/postfix/sasl_passwd
 235     <a href="postconf.5.html#smtp_sasl_type">smtp_sasl_type</a> = cyrus
 236     <a href="postconf.5.html#relayhost">relayhost</a> = [mail.myisp.net]
 237     # Alternative form:
 238     # <a href="postconf.5.html#relayhost">relayhost</a> = [mail.myisp.net]:submission
 239
 240 /etc/postfix/sasl_passwd:
 241     [mail.myisp.net]            username:password
 242     [mail.myisp.net]:submission username:password
 243 </pre>
 244 </blockquote>
 245
 246 <p> Notes: </p>
 247
 248 <ul>
 249
 250 <li> <p> The "submission" destination port tells Postfix to send
 251 mail via TCP network port 587, which is normally reserved for email
 252 clients. The default is to send mail to the "smtp" destination port
 253 (TCP port 25), which is used for receiving mail across the internet.
 254 If you use an explicit destination port in <a href="postconf.5.html">main.cf</a>, then you must
 255 use the same form also in the <a href="postconf.5.html#smtp_sasl_password_maps">smtp_sasl_password_maps</a> file.  </p>
 256
 257 <li> <p> Postfix does not deliver mail via TCP port 465 (the obsolete
 258 "wrappermode" protocol). See <a href="TLS_README.html">TLS_README</a> for a solution that uses the
 259 "stunnel" command. </p>
 260
 261 <li> <p> The "[" and "]" prevent Postfix from looking up the MX
 262 (mail exchanger) records for the enclosed name.  If you use this
 263 form in <a href="postconf.5.html">main.cf</a>, then you must use the same form also in the
 264 <a href="postconf.5.html#smtp_sasl_password_maps">smtp_sasl_password_maps</a> file. </p>
 265
 266 <li> <p> The Postfix SMTP client opens the SASL client password
 267 file before entering the optional chroot jail, so you can keep the
 268 file in /etc/postfix and set permissions read / write only for root
 269 to keep the username:password combinations away from other system
 270 users. </p>
 271
 272 <li> <p> Specify <b>dbm</b> instead of <b>hash</b> if your system
 273 uses <b>dbm</b> files instead of <b>db</b> files. To find out what
 274 lookup tables Postfix supports, use the command "<b>postconf -m</b>".
 275 </p>
 276
 277 <li> <p> Execute the command "<b>postmap /etc/postfix/sasl_passwd</b>"
 278 whenever you change the sasl_passwd table. </p>
 279
 280 </ul>
 281
 282 <p> Workarounds: </p>
 283
 284 <ul>
 285
 286 <li> <p> Some remote SMTP servers support PLAIN or LOGIN authentication only.
 287 By default, the Postfix SMTP client does not use authentication
 288 methods that send plaintext passwords, and defers delivery with
 289 the following error message:  "Authentication failed: cannot SASL
 290 authenticate to server". To enable plaintext authentication specify,
 291 for example: </p>
 292
 293 <blockquote>
 294 <pre>
 295 /etc/postfix/<a href="postconf.5.html">main.cf</a>:
 296     <a href="postconf.5.html#smtp_sasl_security_options">smtp_sasl_security_options</a> = noanonymous
 297 </pre>
 298 </blockquote>
 299
 300 <li> <p> Some remote SMTP servers announce authentication mechanisms
 301 that don't actually work. It is possible via the <a href="postconf.5.html#smtp_sasl_mechanism_filter">smtp_sasl_mechanism_filter</a>
 302 parameter to restrict the list of server mechanisms that the Postfix
 303 SMTP client will take into consideration:  </p>
 304
 305 <blockquote>
 306 <pre>
 307 /etc/postfix/<a href="postconf.5.html">main.cf</a>:
 308     <a href="postconf.5.html#smtp_sasl_mechanism_filter">smtp_sasl_mechanism_filter</a> = !gssapi, !external, static:all
 309 </pre>
 310 </blockquote>
 311
 312 <p> In the above example, the Postfix SMTP client will decline to
 313 use mechanisms
 314 that require special infrastructure such as Kerberos or TLS. </p>
 315
 316 <li> <p> The Postfix SMTP client is backwards compatible with SMTP
 317 servers that use the non-standard "AUTH=method..." syntax in response
 318 to the EHLO command; there is no Postfix client configuration needed
 319 to work around it. </p>
 320
 321 </ul>
 322
 323 <h2><a name="client_sasl_sender">Supporting multiple ISP accounts
 324 in the Postfix SMTP client</a></h2>
 325
 326 <p> Postfix version 2.3 supports multiple ISP accounts. This can
 327 be useful when one person uses the same machine for work and for
 328 personal use, or when people with different ISP accounts share the
 329 same Postfix server.  To make this possible, Postfix 2.3 supports
 330 per-sender SASL passwords and per-sender relay hosts. In the example
 331 below, Postfix will search the SASL password file by sender before
 332 it searches that same file by destination. Likewise, Postfix will
 333 search the per-sender <a href="postconf.5.html#relayhost">relayhost</a> file, and use the default <a href="postconf.5.html#relayhost">relayhost</a>
 334 only as a final resort.  </p>
 335
 336 <blockquote>
 337 <pre>
 338 /etc/postfix/<a href="postconf.5.html">main.cf</a>:
 339     <a href="postconf.5.html#smtp_sender_dependent_authentication">smtp_sender_dependent_authentication</a> = yes
 340     <a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a> = hash:/etc/postfix/sender_relay
 341     <a href="postconf.5.html#smtp_sasl_auth_enable">smtp_sasl_auth_enable</a> = yes
 342     <a href="postconf.5.html#smtp_sasl_password_maps">smtp_sasl_password_maps</a> = hash:/etc/postfix/sasl_passwd
 343     <a href="postconf.5.html#relayhost">relayhost</a> = [mail.myisp.net]
 344     # Alternative form:
 345     # <a href="postconf.5.html#relayhost">relayhost</a> = [mail.myisp.net]:submission
 346
 347 /etc/postfix/sasl_passwd:
 348     # Per-sender authentication; see also /etc/postfix/sender_relay.
 349     user1@example.com           username2:password2
 350     user2@example.net           username2:password2
 351     # Login information for the default <a href="postconf.5.html#relayhost">relayhost</a>.
 352     [mail.myisp.net]            username:password
 353     [mail.myisp.net]:submission username:password
 354
 355 /etc/postfix/sender_relay:
 356     # Per-sender provider; see also /etc/postfix/sasl_passwd.
 357     user1@example.com           [mail.example.com]:submission
 358     user2@example.net           [mail.example.net]
 359 </pre>
 360 </blockquote>
 361
 362 <p> Notes: </p>
 363
 364 <ul>
 365
 366 <li> <p> If you are creative, then you can try to combine the two
 367 tables into one single MySQL database, and configure different
 368 Postfix queries to extract the appropriate information. </p>
 369
 370 <li> <p> Specify <b>dbm</b> instead of <b>hash</b> if your system
 371 uses <b>dbm</b> files instead of <b>db</b> files. To find out what
 372 lookup tables Postfix supports, use the command "<b>postconf -m</b>".
 373 </p>
 374
 375 <li> <p> Execute the command "<b>postmap /etc/postfix/sasl_passwd</b>"
 376 whenever you change the sasl_passwd table. </p>
 377
 378 <li> <p> Execute the command "<b>postmap /etc/postfix/sender_relay</b>"
 379 whenever you change the sender_relay table. </p>
 380
 381 </ul>
 382
 383 </body>
 384
 385 </html>