Postfix: Authentikasi SMTP untuk Client - Revision history

Onnowpurbo: /* Preparing Postfix */

2015-05-07T23:18:03Z

Preparing Postfix

Onnowpurbo: /* Generate Certificate */

2015-05-07T23:07:13Z

Generate Certificate

Onnowpurbo at 23:06, 7 May 2015

2015-05-07T23:06:55Z

Onnowpurbo: /* Cek SMTP AUTH Support */

2015-05-07T23:01:51Z

Cek SMTP AUTH Support

Onnowpurbo at 22:56, 7 May 2015

2015-05-07T22:56:20Z

Onnowpurbo at 22:55, 7 May 2015

2015-05-07T22:55:12Z

Onnowpurbo at 22:50, 7 May 2015

2015-05-07T22:50:05Z

Onnowpurbo at 07:15, 2 May 2015

2015-05-02T07:15:51Z

Onnowpurbo at 06:52, 2 May 2015

2015-05-02T06:52:51Z

Show changes

Onnowpurbo: /* Referensi */

2015-05-02T06:51:19Z

Referensi

@@ Line 97: / Line 97: @@
   smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
-Atau ringkas-nya
+Ringkas-nya
   smtpd_sasl_type = dovecot
@@ Line 140: / Line 140: @@
   tls_random_source = dev:/dev/urandom
-−
 ==Restart Postfix==

@@ Line 67: / Line 67: @@
   A challenge password []:password
   An optional company name []:OnnoCenter
 ==Preparing Postfix==

@@ Line 30: / Line 30: @@
   service dovecot restart
 ==Preparing Postfix==
@@ Line 45: / Line 97: @@
   ## postfix appends the domain name for SASL logins that do not have the domain part ##
-  smtpd_sasl_local_domain = example.tst
+  smtpd_sasl_local_domain = $myhostname
   ## SASL default policy ##
@@ Line 60: / Line 112: @@
   smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
   smtpd_sasl_auth_enable = yes
   smtpd_sasl_security_options = noanonymous
@@ Line 90: / Line 145: @@
   ## path to certificate and key file ##
-  smtpd_tls_cert_file = /etc/ssl/certs/postfixcert.pem
+  smtpd_tls_key_file = /etc/postfix/ssl/onnocenter.id.key
-  smtpd_tls_key_file = /etc/ssl/private/postfixkey.pem
+  smtpd_tls_cert_file = /etc/postfix/ssl/onnocenter.id.crt
   smtpd_use_tls=yes
@@ Line 98: / Line 153: @@
   smtpd_tls_session_cache_timeout = 3600s
 ==Restart Postfix==

@@ Line 125: / Line 125: @@
 ==Cek SMTP AUTH Support==
-.3. Check for SMTP AUTH support
+ telnet onnocenter.id 25
-So, now that we've have enabled SASL authentication in the configuration we need to verify that Postfix serves us the new feature. We check from a remote host and telnet to the Postfix server.
+Harusnya keluar
-S: 220 mail.example.com ESMTP Postfix
+ Connected to onnocenter.id.
-C: EHLO example.com
+ Escape character is '^]'.
-S: 250-mail.example.com
+onnocenter.id ESMTP
-S: 250-PIPELINING
+ ehlo onnocenter.id
-S: 250-SIZE 10240000
+-onnocenter.id
-S: 250-VRFY
+-PIPELINING
-S: 250-ETRN
+-SIZE 10240000
-S: 250-AUTH PLAIN LOGIN DIGEST-MD5 CRAM-MD5 GSSAPI
+-VRFY
-S: 250-AUTH=PLAIN LOGIN DIGEST-MD5 CRAM-MD5 GSSAPI
+-ETRN
-S: 250-XVERP
+-STARTTLS
-S: 250 8BITMIME
+-AUTH PLAIN LOGIN
-C: quit
+-AUTH=PLAIN LOGIN
-S: 221 Bye
+-ENHANCEDSTATUSCODES
-Notice the two new lines?
+Buat password
--AUTH PLAIN LOGIN DIGEST-MD5 CRAM-MD5 GSSAPI
+ printf 'username\0username\0password' | mmencode
-These are the lines that Postfix issues when it offers the use of SMTP AUTH and we can see two things from looking at them:
+atau
-First let us remember the insecure fallback feature:
+ perl -MMIME::Base64 -e 'print encode_base64("username\0username\0password");'
 ==Referensi==

@@ Line 123: / Line 123: @@
@@ Line 134: / Line 209: @@
 * http://postfix.state-of-mind.de/patrick.koetter/smtpauth/smtp_auth_mailclients.html
 * http://xmodulo.com/enable-user-authentication-postfix-smtp-server-sasl.html
 * http://postfix.state-of-mind.de/patrick.koetter/smtpauth/smtp_auth_mailclients.html

@@ Line 2: / Line 2: @@
-Every mail server administrator dreads his or her server becoming compromised by spammers. A lot of effort, time and even money is spent on securing mail servers and making sure that the servers do not become open relay.
+==Siapkan Dovecot==
-To combat against spambots in an SMTP server, Postfix in general uses the mynetworks parameter to specify the trusted sender network i.e., LAN. In a typical scenario, the users stationed in the internal LAN are legitimate users, and Postfix will happily accept SMTP requests from them, and forward the emails towards destination. Although this used to be the standard practice in the past, today's users want mobility. Everyone wants to be able to send/receive emails in their phones/tablets/laptops at work, home, on the go, or even from their favorite coffee shop around the corner. For people who are in the fields for critical services, a simple email alert could save a lot of time, effort and money.
+Edit agar dovecot siap digunakan sebagai auth server untuk postfix
-To cope up with the mobility need, Postfix started to support another method of validating users. Simple Authentication and Security Layer (SASL) is a framework that can be used by many connection-oriented Internet protocols for securing data, servers and users. With SASL enabled, Postfix will not accept any incoming SMTP connections without proper authentication. As smart spammer can imitate a legitimate email account, no SMTP from even internal users are accepted without authentication.
+ vim /etc/dovecot/conf.d/10-master.conf
-==Preparing Dovecot==
+Pastikan
   ## The listener is added under the service auth section ##
@@ Line 33: / Line 19: @@
   } ## end service auth
-The above definition places the socket to be used by Postfix at /var/spool/postfix/private/auth with permission 0660 for Postfix only.
+Definisi diatas akan membuka socket /var/spool/postfix/private/auth dengan permission 0660 untuk Postfix.
   vim /etc/dovecot/conf.d/10-auth.conf
@@ Line 39: / Line 25: @@
   auth_mechanisms = plain login
-The above parameter provides the plain login authentication mechanisms for Postfix.
+plain authetication mechanism untuk Postfix
-Finally, for the changes to take effect, we restart the Dovecot service as follows.
+restart Dovecot
   service dovecot restart
@@ Line 47: / Line 33: @@
 ==Preparing Postfix==
-Necessary SST/TLS and SASL parameters are added in the configuration file main.cf.
+Masukan parameter SASL ke config file
   vim /etc/postfix/main.cf
@@ Line 86: / Line 72: @@
-SSL/TLS specific parameters are added to the server as well.
+Masukan SSL/TLS parameter ke config file
   vim /etc/postfix/main.cf
@@ Line 114: / Line 99: @@
   smtpd_tls_session_cache_timeout = 3600s
-Now Postfix is reloaded with updated settings.
+==Restart Postfix==
   service postfix restart
-Based on the requirements, permit_mynetworks can be allowed or denied later on.
+==Cek Relay==
-To sum up, SASL can provide additional security to a mail server by enforcing mandatory authentication to users for SMTP requests. As users may use a mail server from anywhere, SASL can meet with the security requirements that do not conflict with the mobility of users.
+ $ telnet mail.example.tst 25
-Hope this helps.
+ ehlo  mail.example.tst

@@ Line 1: / Line 1: @@
 Sumber: http://postfix.state-of-mind.de/patrick.koetter/smtpauth/smtp_auth_mailclients.html
 Every mail server administrator dreads his or her server becoming compromised by spammers. A lot of effort, time and even money is spent on securing mail servers and making sure that the servers do not become open relay.
@@ Line 18: / Line 14: @@
      SSL/TLS support for the mail server3
-Preparing Dovecot
+==Preparing Dovecot==
 Backing up configuration files prior to modification is always a good idea.
@@ Line 25: / Line 21: @@
 First of all, a listener is added to Dovecot. Postfix will use this listener to communicate with Dovecot.
-## The listener is added under the service auth section ##
+ vim /etc/dovecot/conf.d/10-master.conf
 service auth {
-	unix_listener /var/spool/postfix/private/auth {
+ ## The listener is added under the service auth section ##
-		mode = 0660
+ service auth {
-        	user = postfix
+ 	unix_listener /var/spool/postfix/private/auth {
-        	group = postfix
+ 		mode = 0660
-  	} ##end listener
+         	user = postfix
-} ## end service auth
+         	group = postfix
 The above definition places the socket to be used by Postfix at /var/spool/postfix/private/auth with permission 0660 for Postfix only.
-auth_mechanisms = plain login
+ vim /etc/dovecot/conf.d/10-auth.conf
 The above parameter provides the plain login authentication mechanisms for Postfix.
 Finally, for the changes to take effect, we restart the Dovecot service as follows.
-Preparing Postfix
+ service dovecot restart
 Necessary SST/TLS and SASL parameters are added in the configuration file main.cf.
-#### SASL ####
+ vim /etc/postfix/main.cf
-## path to the SASL socket relative to postfix spool directory i.e. /var/spool/postfix ##
+ #### SASL ####
-smtpd_sasl_path = private/auth
+ ## specify SASL type ##
-## postfix appends the domain name for SASL logins that do not have the domain part ##
+ ## path to the SASL socket relative to postfix spool directory i.e. /var/spool/postfix ##
-smtpd_sasl_local_domain = example.tst
+ smtpd_sasl_path = private/auth
-−
-## SASL default policy ##
+ ## postfix appends the domain name for SASL logins that do not have the domain part ##
-smtpd_sasl_security_options = noanonymous
+ smtpd_sasl_local_domain = example.tst
-−
-## for legacy application compatibility ##
+ ## SASL default policy ##
-broken_sasl_auth_clients = yes
+ smtpd_sasl_security_options = noanonymous
-−
-## enable SMTP auth ##
+ ## for legacy application compatibility ##
-smtpd_sasl_auth_enable = yes
+ broken_sasl_auth_clients = yes
-−
-## smtp checks ##
+ ## enable SMTP auth ##
-## these checks are based on first match, so sequence is important ##
+ smtpd_sasl_auth_enable = yes
 smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
@@ Line 89: / Line 89: @@
 SSL/TLS specific parameters are added to the server as well.
-#### SSL/TLS parameters ####
+ vim /etc/postfix/main.cf
-## 'encrypt' will enforce SSL. Not recommended for live servers ##
+ #### SSL/TLS parameters ####
 smtpd_tls_security_level = may
-#smtpd_tls_security_level = encrypt
+ ## 'encrypt' will enforce SSL. Not recommended for live servers ##
-## loglevel 3 or 4 can be used during troubleshooting ##
+ service postfix restart
 At this point, Postfix will not allow SMTP connections without authentication.

← Older revision		Revision as of 06:51, 2 May 2015
Line 205:		Line 205:

	* http://postfix.state-of-mind.de/patrick.koetter/smtpauth/smtp_auth_mailclients.html		* http://postfix.state-of-mind.de/patrick.koetter/smtpauth/smtp_auth_mailclients.html
		+	* http://xmodulo.com/enable-user-authentication-postfix-smtp-server-sasl.html