Postfix is the default Mail Transfer Agent (MTA) in Ubuntu. It attempts to be fast and easy to administer and secure. It is compatible with the MTA sendmail. This section explains how to install and configure postfix. It also explains how to set it up as an SMTP server using a secure connection (for sending emails securely).
Untuk menginstal postfix dengan SMTP-AUTH dan Transport Layer Security (TLS), jalankan perintah berikut:
sudo apt-get install postfix
Cukup tekan enter saat proses instalasi mengajukan pertanyaan, konfigurasi lebih baik dilakukan dalam tahap selanjutnya saja.
Untuk mengkonfigurasi postfix, jalankan perintah berikut:
sudo dpkg-reconfigure postfix
Sebuan antarmuka pengguna akan tampil. Di setiap layar, pilih nilai seperti berikut:
Ok
Situs Internet
TAK ADA
mail.contoh.com
mail.contoh.com, localhost.localdomain, localhost
No
127.0.0.0/8
Yes
0
+
all
![]() |
|
Ganti mail.example.com dengan hostname server mail Anda. |
The next steps are to configure
postfix to use SASL for SMTP
AUTH. Rather than editing the configuration file directly,
you can use the postconf command to configure
all postfix parameters. The
configuration parameters will be stored in
/etc/postfix/main.cf
file. Later if you
wish to re-configure a particular parameter, you can either
run the command or change it manually in the file.
Mengkonfigurasi Postfix agar dapat SMTP AUTH menggunakan SASL (saslauthd):
postconf -e 'smtpd_sasl_local_domain =' postconf -e 'smtpd_sasl_auth_enable = yes' postconf -e 'smtpd_sasl_security_options = noanonymous' postconf -e 'broken_sasl_auth_clients = yes' postconf -e 'smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination' postconf -e 'inet_interfaces = all'
Open the /etc/postfix/sasl/smtpd.conf
file and add the following lines to end of the file:
pwcheck_method: saslauthd mech_list: plain login
Next, configure the digital certificate for TLS. When asked questions, follow the instructions and answer appropriately.
openssl genrsa -des3 -rand /etc/hosts -out smtpd.key 1024 chmod 600 smtpd.key openssl req -new -key smtpd.key -out smtpd.csr openssl x509 -req -days 365 -in smtpd.csr -signkey smtpd.key -out smtpd.crt openssl rsa -in smtpd.key -out smtpd.key.unencrypted mv -f smtpd.key.unencrypted smtpd.key openssl req -new -x509 -extensions v3_ca -keyout cakey.pem -out cacert.pem -days 3650 sudo mv smtpd.key /etc/ssl/private/ sudo mv smtpd.crt /etc/ssl/certs/ sudo mv cakey.pem /etc/ssl/private/ sudo mv cacert.pem /etc/ssl/certs/
![]() |
|
You can get the digital certificate from a certificate authority. Alternatively, you can create the certificate yourself. Refer to Creating a self Signed Certification sub-section for more details. |
Mengkonfigurasi Postfix untuk melakukan enkripsi TLS pada surat yang masuk dan keluar:
postconf -e 'smtpd_tls_auth_only = no' postconf -e 'smtp_use_tls = yes' postconf -e 'smtpd_use_tls = yes' postconf -e 'smtp_tls_note_starttls_offer = yes' postconf -e 'smtpd_tls_key_file = /etc/ssl/private/smtpd.key' postconf -e 'smtpd_tls_cert_file = /etc/ssl/certs/smtpd.crt' postconf -e 'smtpd_tls_CAfile = /etc/ssl/certs/cacert.pem' postconf -e 'smtpd_tls_loglevel = 1' postconf -e 'smtpd_tls_received_header = yes' postconf -e 'smtpd_tls_session_cache_timeout = 3600s' postconf -e 'tls_random_source = dev:/dev/urandom' postconf -e 'myhostname = mail.example.com'
![]() |
|
After you run all the commands, the SMTP AUTH is configured with postfix. The self-signed cerficiate is created for TLS and it is configured with postfix. |
Sekarang, berkas /etc/postfix/main.cf
akan terlihat seperti ini.
The postfix initial configuration is complete. Run the following command to start postfix daemon:
sudo /etc/init.d/postfix start
Now the postfix daemon is installed, configured and run successfully. Postfix supports SMTP AUTH as defined in RFC2554. It is based on SASL. However it is still necessary to set up SASL authentication before you can use SMTP.
The libsasl2, sasl2-bin and libsasl2-modules are necessary to enable SMTP AUTH using SASL. You can install these applications if you have not installed them already.
sudo apt-get install libsasl2 sasl2-bin
A few changes are necessary to make it work properly. Because Postfix runs chrooted in /var/spool/postfix
, SASL needs to be configured to run in the false root (/var/run/saslauthd
becomes /var/spool/postfix/var/run/saslauthd
):
mkdir -p /var/spool/postfix/var/run/saslauthd rm -rf /var/run/saslauthd
To activate saslauthd, edit the file /etc/default/saslauthd
, and change or add the START variable. In order to configure saslauthd to run in the false root, add the PWDIR, PIDFILE and PARAMS variables. Finally, configure the MECHANISMS variable to your liking. The file should look like this:
# This needs to be uncommented before saslauthd will be run # automatically START=yes PWDIR="/var/spool/postfix/var/run/saslauthd" PARAMS="-m ${PWDIR}" PIDFILE="${PWDIR}/saslauthd.pid" # You must specify the authentication mechanisms you wish to use. # This defaults to "pam" for PAM support, but may also include # "shadow" or "sasldb", like this: # MECHANISMS="pam shadow" MECHANISMS="pam"
![]() |
|
If you prefer, you can use shadow instead of pam. This will use MD5 hashed password transfer and is perfectly secure. The username and password needed to authenticate will be those of the users on the system you are using on the server. |
Selanjutnya, update dpkg "state" dari /var/spool/portfix/var/run/saslauthd
. Skrip init saslauthd menggunakan setting ini untuk membuat direktori hilang dengan hak akses dan hak kepemilikan yang sesuai:
dpkg-statoverride --force --update --add root sasl 755 /var/spool/postfix/var/run/saslauthd
SMTP AUTH configuration is complete. Now it is time to start and test the setup. You can run the following command to start the SASL daemon:
sudo /etc/init.d/saslauthd start
To see if SMTP-AUTH and TLS work properly, run the following command:
telnet mail.example.com 25
After you have established the connection to the postfix mail server, type:
ehlo mail.example.com
If you see the following lines among others, then everything is working perfectly. Type quit to exit.
250-STARTTLS 250-AUTH LOGIN PLAIN 250-AUTH=LOGIN PLAIN 250 8BITMIME