The Book of Postfix: State of the Art Message Transport

Best practices for Postfix--the popular alternative to Sendmail. Developed with security and speed in mind, Postfix has become a popular alternative to Sendmail and comes preinstalled in many Linux distributions as the default mailer. __The Book of Postfix__ is a complete guide to Postfix whether used at home, as a mailrelay or virus-scanning gateway, or as a company mailserver. Practical examples show how to deal with daily challenges like protecting mail users from spam and viruses, managing multiple domains, and offering roaming access. About the Authors Acknowledgments Ralf Hildebrandt Patrick Koetter About This Book Additional Resources Postfix Documentation, How-tos, and FAQs Mailing Lists Conventions Used in This Book Domains and Names Used in This Book The Local Domain Our Provider Scripts Comments 1: An Introduction to Postfix Part I: Basics 2: Preparing Your Host and Environment Hostname Connectivity TCP Port 25 System Time and Timestamps Syslog Name Resolution (DNS) DNS for Mail Servers A Records PTR Records MX Records 3: Mail Server for a Single Domain The Minimum Configuration Configuring Postfix Setting the Hostname in the smtpd Banner Setting the Domain Mail Is Accepted For Setting the Domain to Be Appended to Outgoing Messages Mapping Mail Sent to root to a Different Mailbox Starting Postfix and Testing Mail Delivery to root Mapping Email Addresses to Usernames Setting Permissions to Make Postfix Relay Email from Your Network 4: Dial-up Mail Server for a Single Domain Disabling DNS Resolution Adjusting Relay Permissions Setting the ISP Relay Host Deferring Message Transport Triggering Message Delivery Configuring Relay Permissions for a Relay Host POP-before-SMTP SMTP Authentication 5: Anatomy of Postfix Postfix Daemons Postfix Queues Maps Map Types How Postfix Queries Maps External Sources Command-Line Utilities postfix postalias postcat postmap postdrop postkick postlock postlog postqueue postsuper Part II: Content Control 6: A Postmaster’s Primer to Email Message Transport Basics Why Do You Need to Know This? Controlling the SMTP Communication (Envelope) Controlling the Message Content Headers Body Attachments 7: How Message Transfer Restrictions Work Restriction Triggers Restriction Types Generic Restrictions Switchable Restrictions Customizable Restrictions Additional UCE Control Parameters Application Ranges Building Restrictions Notation Moment of Evaluation Influence of Actions on Restriction Evaluation Slowing Down Bad Clients Restriction Classes 8: Using Message Transfer Restrictions How to Build and Test Restrictions Simulating the Impact of Restrictions Making Restrictions Effective Immediately Restriction Defaults Requiring RFC Conformance Restricting the Hostname in HELO/EHLO Restricting the Envelope Sender Restricting the Envelope Recipient Maintaining RFC Conformance Empty Envelope Sender Special Role Accounts Processing Order for RFC Restrictions Antispam Measures Preventing Obvious Forgeries Bogus Nameserver Records Bounces to Multiple Recipients Using DNS Blacklists Verifying the Sender Restriction Process Order Uses for Restriction Classes 9: How Built-in Content Filters Work How Do Checks Work? Applying Checks to Separate Message Sections What’s So Special about These Parameters? When Does Postfix Apply Checks? What Actions Can Checks Invoke? 10: Using Built-in Content Filters Checking Postfix for Checks Support Building Postfix with PCRE Map Support Safely Implementing Header or Body Filtering Adding a Regular Expression and Setting a WARN Action Creating a Test Pattern Does the Regular Expression Match the Test Pattern? Setting the Check in the Main Configuration Testing with Real Mail Checking Headers Rejecting Messages Holding Delivery Removing Headers Discarding Messages Redirecting Messages Filtering Messages Checking MIME Headers Checking Headers in Attached Messages Checking the Body 11: How External Content Filters Work When Is the Best Moment to Filter Content? Filters and Address Rewriting content_filter: Queuing First, Filtering Later Filter-Delegation Daemons The Basics of Configuring content_filter smtpd_proxy_filter: Filtering First, Queuing Later Considerations for Proxy Filters The Basics of Configuring smtpd_proxy_filter 12: Using External Content Filters Appending Disclaimers to Messages with a Script Installing alterMIME and Creating the Filter Script Configuring Postfix for the Disclaimer Script Testing the Filter Scanning for Viruses with content_filter and amavisd-new Installing amavisd-new Testing amavisd-new Optimizing amavisd-new Performance Configuring Postfix to Use amavisd-new Testing the Postfix amavisd-new Filter Scanning for Viruses with smtpd_proxy_filter and amavisd-new Configuring Postfix to Use amavisd-new with smtpd_proxy_filter Part III: Advanced Configurations 13: Mail Gateways Basic Setup Setting Gateway Relay Permissions Setting a Relay Domain on the Gateway Setting the Internal Mail Host on the Gateway Defining Relay Recipients Advanced Gateway Setup Improving Security on the Mail Gateway Using Postfix with Microsoft Exchange Server Configuring Exchange and Postfix Communication NAT Setup 14: A Mail Server for Multiple Domains Virtual Alias Domains Setting the Virtual Alias Domain Name Creating a Recipient Address Map Configuring Postfix to Receive Mail for Virtual Alias Domains Testing Virtual Alias Domain Settings Advanced Mappings Virtual Mailbox Domains Checking Postfix for Virtual Delivery Agent Support Basic Configuration Advanced Configuration Database-Driven Virtual Mailbox Domains Checking Postfix for MySQL Map Support Building Postfix to Support MySQL Maps Configuring the Database Testing Database-Driven Virtual Mailbox Domains 15: Understanding SMTP Authentication The Architecture and Configuration of Cyrus SASL Which Approach Is Best? SASL: The Simple Authentication and Security Layer Authentication Interface SMTP AUTH Mechanisms Authentication Methods (Password-Verification Services) Authentication Backends Planning Server-Side SMTP Authentication Finding Clients and Their Supported Mechanisms Defining the Authentication Backend and Password-Verification Service Installing and Configuring Cyrus SASL Installing Cyrus SASL Creating the Postfix Application Configuration File Configuring Logging and the Log Level Setting the Password-Verification Service Selecting SMTP AUTH Mechanisms Configuring saslauthd Configuring Auxiliary Plug-ins (auxprop) Testing the Authentication The Future of SMTP AUTH 16: SMTP Authentication Checking Postfix for SMTP AUTH Support Adding SMTP AUTH Support to Postfix Server-Side SMTP Authentication Enabling and Configuring the Server Testing Server-Side SMTP AUTH Advanced Server Settings Client-Side SMTP Authentication AUTH for the Postfix SMTP Client Testing Client-Side SMTP AUTH The lmtp Client 17: Understanding Transport Layer Security TLS Basics How TLS Works Understanding Certificates How to Establish Trust Which Certification Authority Suits Your Needs? Creating Certificates Required Information Creating the CA Certificate Distributing and Installing the CA Certificate Creating Your Server’s Certificate Signing Your Server’s Certificate Preparing Certificates for Use in Postfix 18: Using Transport Layer Security Checking Postfix for TLS Support Building Postfix with TLS Support Building and Installing OpenSSL from Source Code Building Postfix with TLS Server-Side TLS Basic Server Configuration Server Performance Tuning Server-Side Measures to Secure the SMTP AUTH Handshake Server-Side Certificate-Based Relaying Tightening the TLS Server Client-Side TLS Basic Client Configuration Selective TLS Use Client Performance Tuning Securing Client SMTP AUTH Client-Side Certificate-Based Relaying Tightening Client-Side TLS 19: A Company Mail Server Conceptual Overview The LDAP Directory Structure Choosing Attributes in a Postfix Schema Branch Design Building User Objects Creating List Objects Adding Attributes for the Remaining Servers Basic Configuration Configuring Cyrus SASL Configuring OpenLDAP Configuring Postfix and LDAP Configuring Courier Maildrop Configuring Courier IMAP Advanced Configuration Expanding the Directory Adding Authentication to Servers Protecting Directory Data Encrypting LDAP Queries Enforcing Valid Sender Addresses 20: Running Postfix in a chroot Environment How Does a chroot Jail Work? Basic Principles of a chroot Setup Technical Implementation How Does chroot Affect Postfix? Helper Scripts for chroot chrooted Daemons chroot Libraries, Configuration Files, and Other Files Overcoming chroot Restrictions Part IV: Tuning Postfix 21: Remote Client Concurrency and Request Rate Limiting The Basics of Rate Limiting Gathering Rate Statistics Running the anvil Daemon Changing the anvil Log Interval Limiting Client-Connection Frequency Testing Client-Connection Rate Limits Restricting Simultaneous Client Connections Testing Simultaneous Client-Connection Limits Exempting Clients from Limits 22: Performance Tuning Basic Enhancements Speeding Up DNS Lookups Confirming That Your Server Is Not Listed as an Open Relay Refusing Messages to Nonexistent Users Blocking Messages from Blacklisted Networks Refusing Messages from Unknown Sender Domains Reducing the Retransmission Attempt Frequency Finding Bottlenecks Incoming Queue Bottlenecks Maildrop Queue Bottlenecks Deferred Queue Bottlenecks Active Queue Bottlenecks Asynchronous Bounce Queue Congestion Inequality Using Fallback Relays Tuning for Higher Throughput Configuring an Alternative Transport Appendices A: Installing Postfix The Postfix Source Code Applying Patches Building and Installing from Source Code Starting and Stopping Postfix Installing Postfix on Debian Linux Installing Postfix Starting and Stopping Postfix Installing an Update Building from a Debian Source Package Installing Postfix on Red Hat Linux Getting Postfix for Red Hat Linux Building an RPM from an SRPM Switching to Postfix Removing the Sendmail MTA Starting and Stopping Postfix in Red Hat Linux B: Troubleshooting Postfix Problems Starting Postfix and Viewing the Log Connecting to Postfix Checking the Network Verifying the Listening Process Getting Postfix to Use Your Configuration Settings Reporting Postfix Problems Getting More Logging Information Client-Specific Logging Logging and qmgr Other Configuration Errors Intricacies of the chroot Jail Solving Filesystem Problems Library Hell Daemon Inconsistencies Fork Hell Stress-Testing Postfix Disk I/O Too Many Connections C: CIDR and SMTP Standards Reference Subnets in CIDR Notation Server Response Codes Glossary Index Updates

Best practices for Postfix—the popular alternative to Sendmail.

Developed with security and speed in mind, Postfix has become a popular alternative to Sendmail and comes preinstalled in many Linux distributions as the default mailer. The Book of Postfix is a complete guide to Postfix whether used at home, as a mailrelay or virus-scanning gateway, or as a company mailserver. Practical examples show how to deal with daily challenges like protecting mail users from spam and viruses, managing multiple domains, and offering roaming access.

The Book of Postfix explains in detail how to set up Postfix (a UNIX email server) for three uses: home office use, as a mail relay/virus wall, or as a company mail server. Practical and comprehensive, the book shows the reader how to deal with everyday challenges like protecting mail users from spam and viruses, providing multiple domains, and roaming access.

The Book of Postfix explains in detail how to configure Postfix, the famous message transfer agent by Wietse Venema, for various uses. Practical and comprehensive, the book shows the reader how to deal with everyday challenges like protecting mail users from spam and viruses, providing multiple domains, and roaming access. The Book of Postfix is written by [Ralf Hildebrandt][1] and [Patrick Koetter][2] - active members of the Postfix Mailing list, contributors of HOWTOS and long time postmasters themselves. Read the [Table of Contents][3] to get an idea what the book will deal with in detail. [1]: http://www.postfix-book.com/ralf_hildebrandt.html [2]: http://www.postfix-book.com/patrick_koetter.html [3]: http://www.postfix-book.com/toc.html An Introduction to Postfix Preparing Your Host and Environment Mail Server for a Single Domain Dial-Up Mail Server for a Singe Domain Anatomy of Postfix A Postmaster's Primer to Email Understanding Restrictions Restrictions Understanding Checks Checks Understanding Filters Filters Mail Relays A Mail Server for Multiple Domains SMTP Authentication Primer SMTP Authentication Understanding Transport Layer Security Transport Layer Security A Company Mail Server Running Postfix in a chroot Environment Rate Limiting Performance Tuning Installation Troubleshooting Postfix CIDR and SMTP Standards Reference If there's some weird technical term that you don't know, check the Glossary. Developed with security and speed in mind, Postfix has become a popular alternative to Sendmail. The Book of Postfix is a complete guide to Postfix whether used by the home user, as a mailrelay or virus scanning gateway, or as a company mailserver. Practical examples show how to deal with daily challenges like protecting mail users from spam and viruses, managing multiple domains, and offering roaming access.