Recently we migrated to Office 365 and with this started the process of decomissing on premises Microsoft Exchange. Our network infrastructure still required an SMTP server for email alerts. To solve this I created a Postfix SMTP email forwarding server on Ubuntu 20.04.1. On the campus LAN I use a PA-220 firewall with a Internet connection and create a isolated server vlan behind the firewall to host this mail server. This allows for maximum security and control utilising Palo Alto App-ID and vulnerability protection. Any SMTP email messages going across the firewall destined for the ISPs mail server that are malicous will be blocked by the PA. I also dont have to use Office 365 for network management alerts. The incoming mail servers on the O365 service require external ip’s to be permitted and they are very sensitive to email protection such as SPF. <\/p>\n
Here are the steps to create your own Postfix server:<\/p>\n
1. Create an Ubuntu 20.04.1 VM and network it. Postfix is lightweight and scales easily. I went with 2vCPU and 4GB of memory. In this example the server has one vnic logically connected to the firewall\/isp segment and one vnic connected to the campus LAN. The routing table is configured within Ubuntu to set the default gateway to be the vnic connected to the firewall and specific routes to the campus core via the LAN vnic. We have configured the postfix instance to accept mail from the ‘mynetworks’ variable on port tcp\/25 and forward it to the ‘relayhost’ variable which is the upstream ISPs secure SMTP server (on port 587). Because we are using secure smtp we need to set the sasl variables which is basically the username and password to use for each connection to the secure upstream mail server.<\/p>\n 4. Configure the sasl password and set the correct permissions: 4. Test the postfix configuration: Recently we migrated to Office 365 and with this started the process of decomissing on premises Microsoft Exchange. Our network infrastructure still required an SMTP…<\/p>\n","protected":false},"author":2,"featured_media":906,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[31,33],"tags":[],"class_list":["post-904","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-linux","category-mail"],"acf":[],"yoast_head":"\n
\n2. Install the postfix binaries:
\nsudo apt update
\nsudo apt upgrade
\nsudo apt install mailutils
\nsudo apt install libsasl2-modules<\/code>
\n3. Configure your postfix install. In this example we are setting postfix to forward to our secure upstream ISP SMTP mail server.
\nsudo nano \/etc\/postfix\/main.cf
\nsmtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
\nmyhostname = myserver.domain.com
\nalias_maps = hash:\/etc\/aliases
\nalias_database = hash:\/etc\/aliases
\nmyorigin = \/etc\/mailname
\nmydestination = $myhostname, myserver.domain.com, malfurion, localhost.localdomain, localhost
\nrelayhost = [mail.isp.server.com]:587
\nmynetworks = 127.0.0.0\/8 192.168.0.0\/16
\nmailbox_size_limit = 0
\nrecipient_delimiter = +
\ninet_interfaces = all
\ninet_protocols = all
\n# enable SASL authentication
\nsmtp_sasl_auth_enable = yes
\n# disallow methods that allow anonymous authentication.
\nsmtp_sasl_security_options = noanonymous
\n# where to find sasl_passwd
\nsmtp_sasl_password_maps = hash:\/etc\/postfix\/sasl_passwd<\/code><\/p>\n
\nsudo nano \/etc\/postfix\/sasl_passwd
\n[mail.isp.server.com]:587 username@domain.com:password<\/code>
\nsudo postmap \/etc\/postfix\/sasl_passwd
\nsudo chown root:root \/etc\/postfix\/sasl_passwd \/etc\/postfix\/sasl_passwd.db
\nsudo chmod 0600 \/etc\/postfix\/sasl_passwd \/etc\/postfix\/sasl_passwd.db
\nsudo service postfix restart
\nsudo service postfix status<\/p>\n
\necho \"Test email fwd\" | mail -s \"Mail fwd from Postfix - your.servers.dns.name\" -a \"From: mailfwd@domain.com\" externalperson@domain2.com<\/code>
\nYou can check the mail queue with the command ‘mailq’ or tail the log:
\ntail -f \/var\/log\/mail.log<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"