Postfix: Authentikasi SMTP untuk Client
Revision as of 05:55, 8 May 2015 by Onnowpurbo (talk | contribs)
Sumber: http://postfix.state-of-mind.de/patrick.koetter/smtpauth/smtp_auth_mailclients.html
Siapkan Dovecot
Edit agar dovecot siap digunakan sebagai auth server untuk postfix
vim /etc/dovecot/conf.d/10-master.conf
Pastikan
## The listener is added under the service auth section ##
service auth {
unix_listener /var/spool/postfix/private/auth {
mode = 0660
user = postfix
group = postfix
} ##end listener
} ## end service auth
Definisi diatas akan membuka socket /var/spool/postfix/private/auth dengan permission 0660 untuk Postfix.
vim /etc/dovecot/conf.d/10-auth.conf
auth_mechanisms = plain login
plain authetication mechanism untuk Postfix
restart Dovecot
service dovecot restart
Preparing Postfix
Masukan parameter SASL ke config file
vim /etc/postfix/main.cf
#### SASL #### ## specify SASL type ## smtpd_sasl_type = dovecot
## path to the SASL socket relative to postfix spool directory i.e. /var/spool/postfix ## smtpd_sasl_path = private/auth ## postfix appends the domain name for SASL logins that do not have the domain part ## smtpd_sasl_local_domain = example.tst ## SASL default policy ## smtpd_sasl_security_options = noanonymous ## for legacy application compatibility ## broken_sasl_auth_clients = yes ## enable SMTP auth ## smtpd_sasl_auth_enable = yes ## smtp checks ## ## these checks are based on first match, so sequence is important ## smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_sasl_auth_enable = yes smtpd_sasl_security_options = noanonymous smtpd_sasl_local_domain = $myhostname broken_sasl_auth_clients = yes ... smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, check_relay_domains
Masukan SSL/TLS parameter ke config file
vim /etc/postfix/main.cf
#### SSL/TLS parameters #### ## 'encrypt' will enforce SSL. Not recommended for live servers ## smtpd_tls_security_level = may #smtpd_tls_security_level = encrypt smtpd_tls_received_header = yes smtpd_tls_auth_only = no ## loglevel 3 or 4 can be used during troubleshooting ## smtpd_tls_loglevel = 1 ## path to certificate and key file ## smtpd_tls_cert_file = /etc/ssl/certs/postfixcert.pem smtpd_tls_key_file = /etc/ssl/private/postfixkey.pem smtpd_use_tls=yes ## server will announce STARTTLS ## smtp_tls_note_starttls_offer = yes smtpd_tls_session_cache_timeout = 3600s
Restart Postfix
service postfix restart
Cek Relay
$ telnet mail.example.tst 25
ehlo mail.example.tst 250- mail.example.tst 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 DSN