Phase 2: Postfix MTA

Phase 2: Postfix MTA

Objective

Install and configure postfix as the Mail Transfer Agent. SMTP reception on port 25, authenticated submission on port 587, TLS via Vault-issued certificate.

Concepts

Term Meaning

MTA (Mail Transfer Agent)

Software that transfers mail between servers via SMTP. Postfix is the MTA.

SMTP (Simple Mail Transfer Protocol)

Protocol for sending mail. Port 25 for server-to-server, port 587 for client-to-server.

STARTTLS

Upgrades a plaintext SMTP connection to encrypted. Not the same as implicit TLS.

Relay

Forwarding mail to another server. An open relay forwards for anyone — a security disaster.

mynetworks

Postfix parameter defining which IPs can relay without authentication.

SASL

Authentication framework. Postfix uses it to verify client identity on the submission port.

Installation

sudo dnf install -y postfix cyrus-sasl cyrus-sasl-plain
sudo systemctl enable --now postfix

Vault TLS Certificate

# Issue certificate from Vault PKI
vault write -format=json pki_int/issue/domus-server \
  common_name="mail-01.inside.domusdigitalis.dev" \
  alt_names="mail-01" \
  ttl="8760h" | tee /tmp/mail-cert.json

# Extract cert and key
jq -r '.data.certificate' /tmp/mail-cert.json | sudo tee /etc/ssl/certs/mail-01.crt
jq -r '.data.private_key' /tmp/mail-cert.json | sudo tee /etc/ssl/private/mail-01.key
jq -r '.data.issuing_ca' /tmp/mail-cert.json | sudo tee /etc/ssl/certs/mail-01-ca.crt
sudo chmod 600 /etc/ssl/private/mail-01.key

# Clean up
rm /tmp/mail-cert.json

Core Configuration (main.cf)

# Before
sudo postconf -n | head -20

# Key parameters
sudo postconf -e "myhostname = mail-01.inside.domusdigitalis.dev"
sudo postconf -e "mydomain = inside.domusdigitalis.dev"
sudo postconf -e "myorigin = \$mydomain"
sudo postconf -e "inet_interfaces = all"
sudo postconf -e "mydestination = \$myhostname, localhost.\$mydomain, localhost, \$mydomain"
sudo postconf -e "mynetworks = 10.50.1.0/24, 127.0.0.0/8"
sudo postconf -e "home_mailbox = Maildir/"

# TLS
sudo postconf -e "smtpd_tls_cert_file = /etc/ssl/certs/mail-01.crt"
sudo postconf -e "smtpd_tls_key_file = /etc/ssl/private/mail-01.key"
sudo postconf -e "smtpd_tls_CAfile = /etc/ssl/certs/mail-01-ca.crt"
sudo postconf -e "smtpd_tls_security_level = may"
sudo postconf -e "smtpd_tls_loglevel = 1"

# After
sudo postconf -n | head -20

Submission Port (master.cf)

Enable authenticated submission on port 587:

# Uncomment submission block in master.cf
sudo sed -i '/^#submission/,/^#  -o smtpd_reject_unlisted_recipient/{s/^#//}' /etc/postfix/master.cf

# Verify
sudo awk '/^submission/,/^[^ ]/' /etc/postfix/master.cf | head -10

Firewall and SELinux

# Firewalld
sudo firewall-cmd --permanent --add-service=smtp
sudo firewall-cmd --permanent --add-port=587/tcp
sudo firewall-cmd --reload
sudo firewall-cmd --list-all

# SELinux — postfix ports should already be labeled
sudo semanage port -l | grep smtp

Restart and Verify

sudo systemctl restart postfix
sudo systemctl status postfix

# Test SMTP banner
echo "QUIT" | nc 10.50.1.91 25

# Send test message
echo "Subject: Test from Phase 2" | sendmail -v evan@inside.domusdigitalis.dev

# Check delivery
sudo tail -20 /var/log/maillog
ls -la ~/Maildir/new/

Verification Checklist

  • Postfix running: systemctl is-active postfix

  • SMTP responds: nc 10.50.1.91 25 shows banner

  • TLS works: openssl s_client -starttls smtp -connect 10.50.1.91:25

  • Submission port open: nc 10.50.1.91 587

  • Local delivery works: test message in ~/Maildir/new/

  • Not an open relay: telnet 10.50.1.91 25 from outside mynetworks, attempt relay → rejected