Setting Up a Secure Postfix Mail Server with Authentication on AlmaLinux 9

In this comprehensive guide, we’ll configure a full-featured Postfix email server on AlmaLinux 9 with SASL authentication. This setup allows authenticated users to send emails securely, making it ideal for personal servers or small business environments. We’ll cover installation, configuration, security hardening, and testing.

Why Use Postfix with Authentication?

Postfix is a powerful, open-source mail transfer agent (MTA) known for its security and reliability. Enabling SASL authentication lets users authenticate before sending emails, preventing unauthorized relaying and enhancing control over your mail server.

Prerequisites

A AlmaLinux 9 server with root access
A registered domain name (replace yourdomain.com with your actual domain)
Basic knowledge of Linux command-line operations

1. Install and Initialize Postfix

sudo dnf update -y
sudo dnf install postfix -y

# Enable and start the service
sudo systemctl enable --now postfix
sudo systemctl status postfix

2. Configure Core Postfix Settings

Edit /etc/postfix/main.cf to define server behavior and security parameters:

# Server Identity
myhostname = mail.yourdomain.com
mydomain = yourdomain.com
myorigin = $mydomain

# Network Configuration
inet_interfaces = all # Listen on all interfaces (adjust based on your security requirements)
inet_protocols = all # Enable IPv4/IPv6

# Mail Delivery Rules
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
mynetworks =127.0.0.0/8 [::1]/128 # Restrict unauthenticated relaying to localhost

# Mail Storage
home_mailbox = Maildir/ # Use Maildir format for email storage

# SMTP Banner
smtpd_banner = $myhostname ESMTP Postfix

Verify syntax and apply changes:

sudo postfix check
sudo systemctl reload postfix

3. Enable SASL Authentication

Install SASL libraries and configure PAM authentication:

# Install SASL packages
sudo dnf install cyrus-sasl cyrus-sasl-plain -y

# Configure SASL daemon
echo 'MECH=pam' | sudo tee -a /etc/sysconfig/saslauthd
sudo systemctl enable --now saslauthd
sudo systemctl status saslauthd

4. Configure Postfix to Use SASL

Modify /etc/postfix/main.cf to enable authentication and restrict relay access:

# Enable SASL authentication
smtpd_sasl_auth_enable = yes

# Security policies
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes # Enable compatibility with older clients

# Relay control: Allow authenticated users
smtpd_recipient_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
reject_unauth_destination

Create the SASL configuration file:

sudo mkdir -p /etc/sasl2
echo -e "pwcheck_method: saslauthd\nmech_list: plain login" | sudo tee /etc/sasl2/smtpd.conf
sudo systemctl reload postfix

5. Create User Accounts for Authentication

Add a user account to test authentication:

sudo adduser newuser
sudo passwd newuser

6. Test the Configuration

Install Swaks, a command-line SMTP testing tool:

sudo dnf install epel-release -y
sudo dnf install swaks

# Test authentication and email delivery
swaks \
--server localhost \
--port25 \
--helo smtp.server.com \
--to [email protected] \
--from [email protected] \
--auth LOGIN \
--auth-user newuser \
--auth-password 'your_secure_password' \
--tls \
--body "Subject: Test Email via Swaks\n\nThis is a test message."

Critical Security Considerations

Restrict mynetworks: Only allow trusted networks to bypass authentication.

Tags: `Postfix, AlmaLinux9, SASL Authentication, Email Server, Linux Configuration, Cyrus SASL, SMTP Authentication, Systemd Services, Mail Server Setup, Email Security, Swaks Testing Tool, Linux Command Line, Maildir, EPEL Repository, PAM Authentication, Postfix Configuration, User Management, Network Security, SMTP Relay, Installation Guide, Configuration Guide, Linux System Administration, Open Source Tools, Security Best Practices`