In this guide, we’ll see how to install, configure and enable TLS encryption and SMTP authentication on Postfix, a free mail transfer agent for Ubuntu. This will allow your web server to send email notifications (for WordPress for example) and to do it in a way that respect the encryption standards.

This guide is for Ubuntu 16.04, but note that this tutorial should also perfectly work on an Ubuntu 14.04 web server.

1. Install Postfix

1. Run this command to start the Postfix installation:

apt-get install postfix

2. Choose “Internet Site”

3. Enter the FQDN of the server

2. Edit the Aliases

Edit this file:

nano /etc/aliases

Add the missing “root” line:

# See man 5 aliases for format
postmaster:    root
root:          [email protected]

For more informations:

3. Reconfigure Postfix

To ensure everything is set properly, we’ll run this command:

sudo dpkg-reconfigure postfix

If not done already, change the System Domain name to your FQDN:

hostname.domain.com

In the “Root and postmaster mail recipient” field, add the name of the main admin user:

your_admin_user_name

Other destinations for mail:

server1.example.com, example.com, localhost.example.com, localhost

Force synchronous updates on mail queue? Answer: No

Leave the local networks as is.

Mailbox size limit (bytes): 0

Local address extension character: +

Internet protocols to use: all

4. Optional: Configure the mailbox format (Advanced Users Only)

If you are not sure about this, just skip it and go directly to step 5.

To configure the mailbox format for Maildir:

sudo postconf -e 'home_mailbox = Maildir/'

You may need to issue this as well:

sudo postconf -e 'mailbox_command ='

Note: This will place new mail in /home/username/Maildir so you will need to configure your Mail Delivery Agent to use the same path.

5. Enable TLS Encryption For Postfix

Configure Postfix to do SMTP AUTH using SASL (saslauthd):

sudo postconf -e 'smtpd_sasl_local_domain ='
sudo postconf -e 'smtpd_sasl_auth_enable = yes'
sudo postconf -e 'smtpd_sasl_security_options = noanonymous'
sudo postconf -e 'broken_sasl_auth_clients = yes'
sudo postconf -e 'smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination'
sudo postconf -e 'inet_interfaces = all'

Create or edit this file:

nano /etc/postfix/sasl/smtpd.conf

Add the following lines:

pwcheck_method: saslauthd
mech_list: plain login

6. Generate certificates to be used for TLS encryption and/or certificate Authentication

touch smtpd.key
chmod 600 smtpd.key
openssl genrsa 1024 > smtpd.key
openssl req -new -key smtpd.key -x509 -days 3650 -out smtpd.crt
openssl req -new -x509 -extensions v3_ca -keyout cakey.pem -out cacert.pem -days 3650
sudo mv smtpd.key /etc/ssl/private/
sudo mv smtpd.crt /etc/ssl/certs/
sudo mv cakey.pem /etc/ssl/private/
sudo mv cacert.pem /etc/ssl/certs/

7. Configure Postfix to do TLS encryption for both incoming and outgoing mail

sudo postconf -e 'smtp_tls_security_level = may'
sudo postconf -e 'smtpd_tls_security_level = may'
sudo postconf -e 'smtpd_tls_auth_only = no'
sudo postconf -e 'smtp_tls_note_starttls_offer = yes'
sudo postconf -e 'smtpd_tls_key_file = /etc/ssl/private/smtpd.key'
sudo postconf -e 'smtpd_tls_cert_file = /etc/ssl/certs/smtpd.crt'
sudo postconf -e 'smtpd_tls_CAfile = /etc/ssl/certs/cacert.pem'
sudo postconf -e 'smtpd_tls_loglevel = 1'
sudo postconf -e 'smtpd_tls_received_header = yes'
sudo postconf -e 'smtpd_tls_session_cache_timeout = 3600s'
sudo postconf -e 'tls_random_source = dev:/dev/urandom'

Remember to change this to yours:

sudo postconf -e 'myhostname = server1.example.com'

8. Restart the postfix daemon like this

sudo /etc/init.d/postfix restart

9. Configure Postfix To Use SASL For SMTP AUTH

Install libsasl2-2, sasl2-bin and libsasl2-modules

apt-get install libsasl2-2 sasl2-bin libsasl2-modules

Edit this file in order to activate saslauthd:

nano /etc/default/saslauthd

Remove # in front of START=yes, add the PWDIR, PARAMS, and PIDFILE lines and edit the OPTIONS line at the end:

# This needs to be uncommented before saslauthd will be run automatically
START=yes

PWDIR="/var/spool/postfix/var/run/saslauthd"
PARAMS="-m ${PWDIR}"
PIDFILE="${PWDIR}/saslauthd.pid"

# You must specify the authentication mechanisms you wish to use.
# This defaults to "pam" for PAM support, but may also include
# "shadow" or "sasldb", like this:
# MECHANISMS="pam shadow"

MECHANISMS="pam"

# Other options (default: -c)
# See the saslauthd man page for information about these options.
#
# Example for postfix users: "-c -m /var/spool/postfix/var/run/saslauthd"
# Note: See /usr/share/doc/sasl2-bin/README.Debian
#OPTIONS="-c"

#make sure you set the options here otherwise it ignores params above and will not work
OPTIONS="-c -m /var/spool/postfix/var/run/saslauthd"

We then update the dpkg “state” of /var/spool/postfix/var/run/saslauthd. The saslauthd init script uses this setting to create the missing directory with the appropriate permissions and ownership:

sudo dpkg-statoverride --force --update --add root sasl 755 /var/spool/postfix/var/run/saslauthd

Note: This may report an error that “–update given” and the “/var/spool/postfix/var/run/saslauthd” directory does not exist. You can ignore this because when you start saslauthd next it will be created.

Apparently, the saslauthd looks for the config file /etc/saslauthd and not for /etc/default/saslauthd. This link fixes this issue:

sudo ln -s /etc/default/saslauthd /etc/saslauthd

10. Finally, start saslauthd

sudo /etc/init.d/saslauthd start

To see if SMTP-AUTH and TLS work properly now run the following command:

telnet localhost 25

After you have established the connection to your postfix mail server type:

ehlo localhost

If you see the lines:

250-STARTTLS
250-AUTH

…among others, everything is working. Type quit to return to the system’s shell.

Your server should now send encrypted messages. If you still get a warning from your email provider, consider adding an SPF text to your DNS.

To get more information about Postfix and its options, check Help Ubuntu.