Building and Installing

The README files give plenty of clues about how to modify the initial compilation line. You just need to merge all the bits together. In this case we're adding in:

1. libpcre.so which is in /opt/sfw
2. SASL which we installed in /usr/local/cyrus-sasl-x.y.z
3. STARTTLS which requires OpenSSL in /usr/sfw

cd .../postfix-2.2.5

make -f Makefile.init makefiles \
 "CCARGS=-DHAS_PCRE \
         -I/opt/sfw/include \
         -DUSE_SASL_AUTH \
         -I/usr/local/cyrus-sasl-2.1.21/include/sasl \
         -DUSE_TLS -I/usr/sfw/include" \
 "AUXLIBS=-L/opt/sfw/lib \
          -R/opt/sfw/lib \
          -lpcre \
          -L/usr/local/cyrus-sasl-2.1.21/lib \
          -R/usr/local/cyrus-sasl-2.1.21/lib \
          -lsasl2 \
          -R/usr/sfw/lib \
          -L/usr/sfw/lib \
          -lssl \
          -lcrypto"

make

C=/usr/local/cyrus-sasl-2.1.22
make -f Makefile.init makefiles \
 "CCARGS=-DHAS_PCRE \
         -I/opt/sfw/include \
         -DUSE_SASL_AUTH \
         -DUSE_CYRUS_SASL \
         -I$C/include/sasl \
         -DUSE_TLS -I/usr/sfw/include" \
 "AUXLIBS=-L/opt/sfw/lib \
          -R/opt/sfw/lib \
          -lpcre \
          -L$C/lib \
          -R$C/lib \
          -lsasl2 \
          -R/usr/sfw/lib \
          -L/usr/sfw/lib \
          -lssl \
          -lcrypto"

make

As per the instructions, backup existing bits:

su
mv /usr/sbin/sendmail /usr/sbin/sendmail.OFF
mv /usr/sbin/newaliases /usr/sbin/newaliases.OFF
mv /usr/bin/mailq /usr/bin/mailq.OFF
chmod 755 /usr/sbin/sendmail.OFF /usr/sbin/newaliases.OFF /usr/bin/mailq.OFF

Then ensure the postfix groups and account are available:

groupadd postfix
useradd -g postfix postfix
passwd -l postfix
groupadd postdrop

Before (as root!):

make install

Configuration

content_filter = smtp-amavis:[127.0.0.1]:10024

virtual_transport = lmtp:unix:/var/imap/socket/lmtp
virtual_mailbox_domains = example.org example.net
virtual_mailbox_maps = dbm:/etc/postfix/vmailbox
virtual_alias_maps = dbm:/etc/postfix/virtual pcre:/etc/postfix/virtual_pcre

# enable SASL support in the SMTP server
smtpd_sasl_auth_enable = yes
smtpd_sasl_local_domain = $mydomain
# allow mail relaying by authenticated clients
# default was permit_mynetworks, reject_unauth_destination
smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated reject_unauth_destination

smtpd_tls_cert_file = /etc/postfix/smtp.example.com.pem
smtpd_tls_key_file = $smtpd_tls_cert_file
smtpd_tls_loglevel = 0
smtpd_use_tls = yes

user=cyrus argv=/usr/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}

smtp-amavis unix -      -       n     -       2  lmtp
   -o lmtp_data_done_timeout=1200
   -o lmtp_send_xforward_command=yes
   -o disable_dns_lookups=yes
   -o max_use=20

127.0.0.1:10025 inet n  -       n     -       -  smtpd
   -o content_filter=
   -o local_recipient_maps=
   -o relay_recipient_maps=
   -o smtpd_restriction_classes=
   -o smtpd_delay_reject=no
   -o smtpd_client_restrictions=permit_mynetworks,reject
   -o smtpd_helo_restrictions=
   -o smtpd_sender_restrictions=
   -o smtpd_recipient_restrictions=permit_mynetworks,reject
   -o mynetworks_style=host
   -o mynetworks=127.0.0.0/8
   -o strict_rfc821_envelopes=yes
   -o smtpd_error_sleep_time=0
   -o smtpd_soft_error_limit=1001
   -o smtpd_hard_error_limit=1000
   -o smtpd_client_connection_count_limit=0
   -o smtpd_client_connection_rate_limit=0
   -o receive_override_options=no_header_body_checks,no_unknown_recipient_checks

Virtual Mailbox Configuration

cat <<EOF >> /etc/postfix/vmailbox
# info@example.org     dummy-value
# @example.net         dummy-value
EOF
chmod g-w /etc/postfix/vmailbox
(cd /etc/postfix; postmap vmailbox)

cat <<EOF >> /etc/postfix/virtual
# postmaster@example.org       postmaster
EOF
(cd /etc/postfix; postmap virtual)

cat <<EOF >> /etc/postfix/virtual_pcre
/^((?:post|host|web)master)@/  $1

/^([^@]+)@example.net$/         $1@example.org
EOF

Makefile

I always forget what needs to be updated. It's much easier to edit files willy-nilly then type make:

cat <<EOF > /etc/postfix/Makefile

ALIASES_SRC = /etc/mail/aliases
DBM_MAP_SRCS = vmailbox virtual

ALIASES = \$(patsubst %,%.pag,\${ALIASES_SRC})
MAPS = \$(patsubst %,%.pag,\${DBM_MAP_SRCS})

all : \${ALIASES} \${MAPS}
       postfix check
       postfix reload

\${ALIASES} : \${ALIASES_SRC}
       newaliases

%.pag : %
       postmap /etc/postfix/\$*
EOF
chmod g-w /etc/postfix/Makefile

Ordinary Aliases

We still need to maintain aliases for the default domain. I told you it was a pain.

cat <<EOF >> /etc/mail/aliases
hostmaster: root
webmaster: root
postfix: root
abuse: root

# AMaViS
virusalert: spam
spamalert: spam
virus-quarantine: spam
spam-quarantine: spam
spam.police: spam
EOF

newaliases

Startup

cat <<EOF >/etc/init.d/mail
#! /bin/ksh

# start/stop all mail services

action="\$1"
shift

case "\${action}" in
start)

   echo "mail: \${action}: \c"
   # for x in saslauthd cyrus clamav amavis ; do
   for x in cyrus clamav amavis ; do

       echo "\$x \c"
       /sbin/sh /etc/init.d/\$x \${action}

   done

   echo "postfix"
   postfix start

   ;;

stop)

   echo "postfix"
   postfix stop

   echo "mail: \${action}: \c"
   # for x in amavis clamav cyrus saslauthd ; do
   for x in amavis clamav cyrus ; do

       echo "\$x \c"
       /sbin/sh /etc/init.d/\$x \${action}

   done

   ;;
esac
EOF
chmod a+x /etc/init.d/mail
ln /etc/init.d/mail /etc/rc2.d/S88mail
ln /etc/init.d/mail /etc/rc2.d/K88mail

Modify SASL setup

In order that incoming requests to use our SMTP service can be authenticated (using the same credentials as users use to read their email over IMAP) we need to tell the SMTP daemon (within Postfix) to use the /etc/sasldb2.* files:

cat <<EOF > /usr/local/cyrus-sasl-2.1.21/lib/sasl2/smtpd.conf
pwcheck_method:  auxprop
EOF

SSL

Generate a key for smtp.example.com