8.7 KiB
Getting started with Postfix, an open source mail transfer agent
Postfix is a great program that routes and delivers email to accounts that are external to the system. It is currently used by approximately 33% of internet mail servers. In this article, I'll explain how you can use Postfix to send mail using Gmail with two-factor authentication enabled.
Before you get Postfix up and running, however, you need to have some items lined up. Following are instructions on how to get it working on a number of distros.
Prerequisites
- An installed OS (Ubuntu/Debian/Fedora/Centos/Arch/FreeBSD/OpenSUSE)
- A Google account with two-factor authentication
- A working internet connection
Step 1: Prepare Google
Open a web browser and log into your Google account. Once you’re in, go to your settings by clicking your picture and selecting "Google Account.” Click “Sign-in & security” and scroll down to "App passwords.” Use your password to log in. Then you can create a new app password (I named mine "postfix Setup”).
Note the crazy password (shown below), which I will use throughout this article.
Step 2: Install Postfix
Before you can configure the mail client, you need to install it. You must also install either the mailutils or mailx utility, depending on the OS you're using. Here's how to install it for each OS:
Debian/Ubuntu :
apt-get update && apt-get install postfix mailutils
Fedora :
dnf update && dnf install postfix mailx
Centos :
yum update && yum install postfix mailx cyrus-sasl cyrus-sasl-plain
Arch :
pacman -Sy postfix mailutils
FreeBSD :
portsnap fetch extract update
cd /usr/ports/mail/postfix
make config
In the configuration dialog, select "SASL support." All other options can remain the same.
From there: make install clean
Install mailx from the binary package: pkg install mailx
OpenSUSE :
zypper update && zypper install postfix mailx cyrus-sasl
Step 3: Set up Gmail authentication
Once you've installed Postfix, you can set up Gmail authentication. Since you have created the app password, you need to put it in a configuration file and lock it down so no one else can see it. Fortunately, this is simple to do:
Ubuntu/Debian/Fedora/Centos/Arch/OpenSUSE :
vim /etc/postfix/sasl_passwd
Add this line:
[smtp.gmail.com]:587 ben.heffron@gmail.com:thgcaypbpslnvgce
Save and close the file. Since your Gmail password is stored as plaintext, make the file accessible only by root to be extra safe.
chmod 600 /etc/postfix/sasl_passwd
FreeBSD :
vim /usr/local/etc/postfix/sasl_passwd
Add this line:
[smtp.gmail.com]:587 ben.heffron@gmail.com:thgcaypbpslnvgce
Save and close the file. Since your Gmail password is stored as plaintext, make the file accessible only by root to be extra safe.
chmod 600 /usr/local/etc/postfix/sasl_passwd
Step 4: Get Postfix moving
This step is the "meat and potatoes"—everything you've done so far has been preparation.
Postfix gets its configuration from the main.cf file, so the settings in this file are critical. For Google, it is mandatory to enable the correct SSL settings.
Here are the six options you need to enter or update on the main.cf to make it work with Gmail (from the SASL readme):
- The smtp_sasl_auth_enable setting enables client-side authentication. We will configure the client’s username and password information in the second part of the example.
- The relayhost setting forces the Postfix SMTP to send all remote messages to the specified mail server instead of trying to deliver them directly to their destination.
- With the smtp_sasl_password_maps parameter, we configure the Postfix SMTP client to send username and password information to the mail gateway server.
- Postfix SMTP client SASL security options are set using smtp_sasl_security_options , with a whole lot of options. In this case, it will be nothing; otherwise, Gmail won’t play nicely with Postfix.
- The smtp_tls_CAfile is a file containing CA certificates of root CAs trusted to sign either remote SMTP server certificates or intermediate CA certificates.
- From the configure settings page: stmp_use_tls uses TLS when a remote SMTP server announces STARTTLS support, the default is not using TLS.
Ubuntu/Debian/Arch
These three OSes keep their files (certificates and main.cf) in the same location, so this is all you need to put in there:
vim /etc/postfix/main.cf
If the following values aren’t there, add them:
relayhost = [smtp.gmail.com]:587
smtp_use_tls = yes
smtp_sasl_auth_enable = yes
smtp_sasl_security_options =
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
Save and close the file.
Fedora/CentOS
These two OSes are based on the same underpinnings, so they share the same updates.
vim /etc/postfix/main.cf
If the following values aren’t there, add them:
relayhost = [smtp.gmail.com]:587
smtp_use_tls = yes
smtp_sasl_auth_enable = yes
smtp_sasl_security_options =
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_tls_CAfile = /etc/ssl/certs/ca-bundle.crt
Save and close the file.
OpenSUSE
vim /etc/postfix/main.cf
If the following values aren’t there, add them:
relayhost = [smtp.gmail.com]:587
smtp_use_tls = yes
smtp_sasl_auth_enable = yes
smtp_sasl_security_options =
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_tls_CAfile = /etc/ssl/ca-bundle.pem
Save and close the file.
OpenSUSE also requires that you modify the Postfix master process configuration file master.cf. Open it for editing:
vim /etc/postfix/master.cf
Uncomment the line that reads:
#tlsmgr unix - - n 1000? 1 tlsmg
It should look like this:
tlsmgr unix - - n 1000? 1 tlsmg
Save and close the file.
FreeBSD
vim /usr/local/etc/postfix/main.cf
If the following values aren’t there, add them:
relayhost = [smtp.gmail.com]:587
smtp_use_tls = yes
smtp_sasl_auth_enable = yes
smtp_sasl_security_options =
smtp_sasl_password_maps = hash:/usr/local/etc/postfix/sasl_passwd
smtp_tls_CAfile = /etc/mail/certs/cacert.pem
Save and close the file.
Step 5: Set up the password file
Remember that password file you created? Now you need to feed it into Postfix using postmap. This is part of the mailutils or mailx utilities.
Debian, Ubuntu, Fedora, CentOS, OpenSUSE, Arch Linux
postmap /etc/postfix/sasl_passwd
FreeBSD
postmap /usr/local/etc/postfix/sasl_passwd
Step 6: Get Postfix grooving
To get all the settings and configurations working, you must restart Postfix.
Debian, Ubuntu, Fedora, CentOS, OpenSUSE, Arch Linux
These guys make it simple to restart:
systemctl restart postfix.service
FreeBSD
To start Postfix at startup, edit /etc/rc.conf:
vim /etc/rc.conf
Add the line:
postfix_enable=YES
Save and close the file. Then start Postfix by running:
service postfix start
Step 7: Test it
Now for the big finale—time to test it to see if it works. The mail command is another tool installed with mailutils or mailx.
echo Just testing my sendmail gmail relay" | mail -s "Sendmail gmail Relay" ben.heffron@gmail.com
This is what I used to test my settings, and then it came up in my Gmail.
Now you can use Gmail with two-factor authentication in your Postfix setup.
via: https://opensource.com/article/18/8/postfix-open-source-mail-transfer-agent
作者：Ben Heffron 选题：lujun9972 译者：译者ID 校对：校对者ID