{"id":963,"date":"2025-04-14T18:51:02","date_gmt":"2025-04-14T12:51:02","guid":{"rendered":"https:\/\/mellowhost.com\/blog\/?p=963"},"modified":"2025-04-14T18:56:47","modified_gmt":"2025-04-14T12:56:47","slug":"installing-and-configuring-postfix-with-authentication-on-almalinux-9","status":"publish","type":"post","link":"https:\/\/mellowhost.com\/blog\/installing-and-configuring-postfix-with-authentication-on-almalinux-9.html","title":{"rendered":"Setting Up a Secure Postfix Mail Server with Authentication on AlmaLinux 9"},"content":{"rendered":"<h1>Setting Up a Secure Postfix Mail Server with Authentication on AlmaLinux 9<\/h1>\n<p>In this comprehensive guide, we&#8217;ll configure a full-featured Postfix email server on AlmaLinux 9 with SASL authentication. This setup allows authenticated users to send emails securely, making it ideal for personal servers or small business environments. We&#8217;ll cover installation, configuration, security hardening, and testing.<\/p>\n<h2>Why Use Postfix with Authentication?<\/h2>\n<p>Postfix is a powerful, open-source mail transfer agent (MTA) known for its security and reliability. Enabling SASL authentication lets users authenticate before sending emails, preventing unauthorized relaying and enhancing control over your mail server.<\/p>\n<h2>Prerequisites<\/h2>\n<ul>\n<li>A AlmaLinux 9 server with root access<\/li>\n<li>A registered domain name (replace <code>yourdomain.com<\/code> with your actual domain)<\/li>\n<li>Basic knowledge of Linux command-line operations<\/li>\n<\/ul>\n<h2>1. Install and Initialize Postfix<\/h2>\n<pre><code>sudo dnf update -y\nsudo dnf install postfix -y\n\n# Enable and start the service\nsudo systemctl enable --now postfix\nsudo systemctl status postfix\n<\/code><\/pre>\n<h2>2. Configure Core Postfix Settings<\/h2>\n<p>Edit <code>\/etc\/postfix\/main.cf<\/code> to define server behavior and security parameters:<\/p>\n<pre><code># Server Identity\nmyhostname = mail.yourdomain.com\nmydomain = yourdomain.com\nmyorigin = $mydomain\n\n# Network Configuration\ninet_interfaces = all # Listen on all interfaces (adjust based on your security requirements)\ninet_protocols = all # Enable IPv4\/IPv6\n\n# Mail Delivery Rules\nmydestination = $myhostname, localhost.$mydomain, localhost, $mydomain\nmynetworks =127.0.0.0\/8 [::1]\/128 # Restrict unauthenticated relaying to localhost\n\n# Mail Storage\nhome_mailbox = Maildir\/ # Use Maildir format for email storage\n\n# SMTP Banner\nsmtpd_banner = $myhostname ESMTP Postfix\n<\/code><\/pre>\n<p>Verify syntax and apply changes:<\/p>\n<pre><code>sudo postfix check\nsudo systemctl reload postfix\n<\/code><\/pre>\n<h2>3. Enable SASL Authentication<\/h2>\n<p>Install SASL libraries and configure PAM authentication:<\/p>\n<pre><code># Install SASL packages\nsudo dnf install cyrus-sasl cyrus-sasl-plain -y\n\n# Configure SASL daemon\necho 'MECH=pam' | sudo tee -a \/etc\/sysconfig\/saslauthd\nsudo systemctl enable --now saslauthd\nsudo systemctl status saslauthd\n<\/code><\/pre>\n<h2>4. Configure Postfix to Use SASL<\/h2>\n<p>Modify <code>\/etc\/postfix\/main.cf<\/code> to enable authentication and restrict relay access:<\/p>\n<pre><code># Enable SASL authentication\nsmtpd_sasl_auth_enable = yes\n\n# Security policies\nsmtpd_sasl_security_options = noanonymous\nbroken_sasl_auth_clients = yes # Enable compatibility with older clients\n\n# Relay control: Allow authenticated users\nsmtpd_recipient_restrictions =\npermit_mynetworks,\npermit_sasl_authenticated,\nreject_unauth_destination\n<\/code><\/pre>\n<p>Create the SASL configuration file:<\/p>\n<pre><code>sudo mkdir -p \/etc\/sasl2\necho -e \"pwcheck_method: saslauthd\\nmech_list: plain login\" | sudo tee \/etc\/sasl2\/smtpd.conf\nsudo systemctl reload postfix\n<\/code><\/pre>\n<h2>5. Create User Accounts for Authentication<\/h2>\n<p>Add a user account to test authentication:<\/p>\n<pre><code>sudo adduser newuser\nsudo passwd newuser\n<\/code><\/pre>\n<h2>6. Test the Configuration<\/h2>\n<p>Install Swaks, a command-line SMTP testing tool:<\/p>\n<pre><code>sudo dnf install epel-release -y\nsudo dnf install swaks\n\n# Test authentication and email delivery\nswaks \\\n--server localhost \\\n--port25 \\\n--helo smtp.server.com \\\n--to test@yourdomain.com \\\n--from test2@yourdomain.com \\\n--auth LOGIN \\\n--auth-user newuser \\\n--auth-password 'your_secure_password' \\\n--tls \\\n--body \"Subject: Test Email via Swaks\\n\\nThis is a test message.\"\n<\/code><\/pre>\n<h2>Critical Security Considerations<\/h2>\n<ul>\n<li><strong>Restrict <code>mynetworks<\/code>:<\/strong> Only allow trusted networks to bypass authentication.<\/li>\n<\/ul>\n<p>Tags: `Postfix, AlmaLinux9, SASL Authentication, Email Server, Linux Configuration, Cyrus SASL, SMTP Authentication, Systemd Services, Mail Server Setup, Email Security, Swaks Testing Tool, Linux Command Line, Maildir, EPEL Repository, PAM Authentication, Postfix Configuration, User Management, Network Security, SMTP Relay, Installation Guide, Configuration Guide, Linux System Administration, Open Source Tools, Security Best Practices`<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Setting Up a Secure Postfix Mail Server with Authentication on AlmaLinux 9 In this comprehensive guide, we&#8217;ll configure a full-featured Postfix email server on AlmaLinux 9 with SASL authentication. This setup allows authenticated users to send emails securely, making it ideal for personal servers or small business environments. We&#8217;ll cover installation, configuration, security hardening, and &hellip; <a href=\"https:\/\/mellowhost.com\/blog\/installing-and-configuring-postfix-with-authentication-on-almalinux-9.html\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;Setting Up a Secure Postfix Mail Server with Authentication on AlmaLinux 9&#8221;<\/span><\/a><\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[13,211],"tags":[],"_links":{"self":[{"href":"https:\/\/mellowhost.com\/blog\/wp-json\/wp\/v2\/posts\/963"}],"collection":[{"href":"https:\/\/mellowhost.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mellowhost.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mellowhost.com\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/mellowhost.com\/blog\/wp-json\/wp\/v2\/comments?post=963"}],"version-history":[{"count":4,"href":"https:\/\/mellowhost.com\/blog\/wp-json\/wp\/v2\/posts\/963\/revisions"}],"predecessor-version":[{"id":967,"href":"https:\/\/mellowhost.com\/blog\/wp-json\/wp\/v2\/posts\/963\/revisions\/967"}],"wp:attachment":[{"href":"https:\/\/mellowhost.com\/blog\/wp-json\/wp\/v2\/media?parent=963"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mellowhost.com\/blog\/wp-json\/wp\/v2\/categories?post=963"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mellowhost.com\/blog\/wp-json\/wp\/v2\/tags?post=963"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}