PLAIN Smtpd Auth with Postfix (faster than light)

Ok, you have a small postfix deployed, and you need a fast but effective protection from third people using your server as a rocket-delivering-spam.

The first thing to do, is to configure the variable mynetworks to allow only certain netblocks to use postfix to send email all over the world: mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 X.X.X.X/XX Look out: the ips should be in CIDR notation, so you probably need to apt-get install ipcalc.

Using ipcalc is straight-forward. For example, think our servers are located on the netblock from 188.57.33.80 to 188.57.33.87: $ ipcalc 188.57.33.80 - 188.57.33.87 deaggregate 188.57.33.80 - 188.57.33.87 188.57.33.80/29 Here it is.

Next level is to configure smtp login, if you don’t have a subnet for your clients. aptitude install sasl2-bin libsasl2-modules libsasl2-2 Now enable daemon and configure it for being accessed by postfix, editing /etc/default/saslauthd: START=yes OPTIONS="-c -m /var/spool/postfix/var/run/saslauthd"

Now tell to postfix to use saslauth in /etc/postfix/sasl/smtpd.conf: pwcheck_method: saslauthd mech_list: PLAIN LOGIN

And enable it in /etc/postfix/main.cf: smtpd_sasl_auth_enable = yes broken_sasl_auth_clients = yes smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination

In case of:

postfix/smtpd[638]: warning: SASL authentication failure: cannot connect to saslauthd server: Permission denied

Hint: add postfix to sasl group: $ adduser postfix sasl