INSTALL.html revision 1.5
1 1.1 tron <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" 2 1.1 tron "http://www.w3.org/TR/html4/loose.dtd"> 3 1.1 tron 4 1.1 tron <html> 5 1.1 tron 6 1.1 tron <head> 7 1.1 tron 8 1.1 tron <title>Postfix Installation From Source Code </title> 9 1.1 tron 10 1.1 tron <meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> 11 1.1 tron 12 1.1 tron </head> 13 1.1 tron 14 1.1 tron <body> 15 1.1 tron 16 1.1 tron <h1><img src="postfix-logo.jpg" width="203" height="98" ALT="">Postfix 17 1.1 tron Installation From Source Code </h1> 18 1.1 tron 19 1.1 tron <hr> 20 1.1 tron 21 1.1 tron <h2> <a name="1">1 - Purpose of this document</a> </h2> 22 1.1 tron 23 1.1 tron <p> If you are using a pre-compiled version of Postfix, you should 24 1.1 tron start with BASIC_CONFIGURATION_README and the general documentation 25 1.1 tron referenced by it. INSTALL is only a bootstrap document to get 26 1.1 tron Postfix up and running from scratch with the minimal number of 27 1.1 tron steps; it should not be considered part of the general documentation. 28 1.1 tron </p> 29 1.1 tron 30 1.1 tron <p> This document describes how to build, install and configure a 31 1.1 tron Postfix system so that it can do one of the following: </p> 32 1.1 tron 33 1.1 tron <ul> 34 1.1 tron 35 1.1 tron <li> Send mail only, without changing an existing Sendmail 36 1.1 tron installation. 37 1.1 tron 38 1.1 tron <li> Send and receive mail via a virtual host interface, still 39 1.1 tron without any change to an existing Sendmail installation. 40 1.1 tron 41 1.1 tron <li> Run Postfix instead of Sendmail. 42 1.1 tron 43 1.1 tron </ul> 44 1.1 tron 45 1.1 tron <p> Topics covered in this document: </p> 46 1.1 tron 47 1.1 tron <ol> 48 1.1 tron 49 1.1 tron <li> <a href="#1">Purpose of this document</a> 50 1.1 tron 51 1.1 tron <li> <a href="#2">Typographical conventions</a> 52 1.1 tron 53 1.1 tron <li> <a href="#3">Documentation</a> 54 1.1 tron 55 1.1 tron <li> <a href="#4">Building on a supported system</a> 56 1.1 tron 57 1.1 tron <li> <a href="#5">Porting Postfix to an unsupported system</a> 58 1.1 tron 59 1.1 tron <li> <a href="#install">Installing the software after successful 60 1.1 tron compilation </a> 61 1.1 tron 62 1.1 tron <li> <a href="#send_only">Configuring Postfix to send mail 63 1.1 tron only </a> 64 1.1 tron 65 1.1 tron <li> <a href="#send_receive">Configuring Postfix to send and 66 1.1 tron receive mail via virtual interface </a> 67 1.1 tron 68 1.1 tron <li> <a href="#replace">Running Postfix instead of Sendmail</a> 69 1.1 tron 70 1.1 tron <li> <a href="#mandatory">Mandatory configuration file edits</a> 71 1.1 tron 72 1.1 tron <li> <a href="#hamlet">To chroot or not to chroot</a> 73 1.1 tron 74 1.1 tron <li> <a href="#care">Care and feeding of the Postfix system</a> 75 1.1 tron 76 1.1 tron </ol> 77 1.1 tron 78 1.1 tron <h2> <a name="2">2 - Typographical conventions</a> </h2> 79 1.1 tron 80 1.1 tron <p> In the instructions below, a command written as </p> 81 1.1 tron 82 1.1 tron <blockquote> 83 1.1 tron <pre> 84 1.1 tron # command 85 1.1 tron </pre> 86 1.1 tron </blockquote> 87 1.1 tron 88 1.1 tron <p> should be executed as the superuser. </p> 89 1.1 tron 90 1.1 tron <p> A command written as </p> 91 1.1 tron 92 1.1 tron <blockquote> 93 1.1 tron <pre> 94 1.5 tron $ command 95 1.1 tron </pre> 96 1.1 tron </blockquote> 97 1.1 tron 98 1.1 tron <p> should be executed as an unprivileged user. </p> 99 1.1 tron 100 1.1 tron <h2> <a name="3">3 - Documentation</a> </h2> 101 1.1 tron 102 1.1 tron <p> Documentation is available as README files (start with the file 103 1.1 tron README_FILES/AAAREADME), as HTML web pages (point your browser to 104 1.1 tron "html/index.html") and as UNIX-style manual pages. </p> 105 1.1 tron 106 1.1 tron <p> You should view the README files with a pager such as more(1) 107 1.1 tron or less(1), because the files use backspace characters in order to 108 1.1 tron produce <b>bold</b> font. To print a README file without backspace 109 1.1 tron characters, use the col(1) command. For example: </p> 110 1.1 tron 111 1.1 tron <blockquote> 112 1.1 tron <pre> 113 1.5 tron $ col -bx <file | lpr 114 1.1 tron </pre> 115 1.1 tron </blockquote> 116 1.1 tron 117 1.1 tron <p> In order to view the manual pages before installing Postfix, 118 1.1 tron point your MANPATH environment variable to the "man" subdirectory; 119 1.1 tron be sure to use an absolute path. </p> 120 1.1 tron 121 1.1 tron <blockquote> 122 1.1 tron <pre> 123 1.5 tron $ export MANPATH; MANPATH="`pwd`/man:$MANPATH" 124 1.5 tron $ setenv MANPATH "`pwd`/man:$MANPATH" 125 1.1 tron </pre> 126 1.1 tron </blockquote> 127 1.1 tron 128 1.1 tron <p> Of particular interest is the postconf(5) manual page that 129 1.1 tron lists all the 500+ configuration parameters. The HTML version of 130 1.1 tron this text makes it easy to navigate around. </p> 131 1.1 tron 132 1.1 tron <p> All Postfix source files have their own built-in manual page. 133 1.1 tron Tools to extract those embedded manual pages are available in the 134 1.1 tron mantools directory. </p> 135 1.1 tron 136 1.1 tron <h2> <a name="4">4 - Building on a supported system</a> </h2> 137 1.1 tron 138 1.1 tron <p> At some point in time, a version of Postfix was supported on: </p> 139 1.1 tron 140 1.1 tron <blockquote> 141 1.1 tron <p> 142 1.1 tron AIX 3.2.5, 4.1.x, 4.2.0, 4.3.x, 5.2 <br> 143 1.1 tron BSD/OS 2.x, 3.x, 4.x <br> 144 1.5 tron FreeBSD 2.x .. 9.x <br> 145 1.1 tron HP-UX 9.x, 10.x, 11.x <br> 146 1.1 tron IRIX 5.x, 6.x <br> 147 1.5 tron Linux Debian 1.3.1 and later <br> 148 1.5 tron Linux RedHat 3.x (January 2004) and later <br> 149 1.5 tron Linux Slackware 3.x and later <br> 150 1.5 tron Linux SuSE 5.x and later <br> 151 1.5 tron Linux Ubuntu 4.10 and later<br> 152 1.1 tron Mac OS X <br> 153 1.1 tron NEXTSTEP 3.x <br> 154 1.5 tron NetBSD 1.x and later <br> 155 1.1 tron OPENSTEP 4.x <br> 156 1.1 tron OSF1.V3 - OSF1.V5 (Digital UNIX) <br> 157 1.1 tron Reliant UNIX 5.x <br> 158 1.1 tron SunOS 4.1.4 (March 2007) <br> 159 1.1 tron SunOS 5.4 - 5.10 (Solaris 2.4..10) <br> 160 1.1 tron Ultrix 4.x (well, that was long ago) <br> 161 1.1 tron </p> 162 1.1 tron </blockquote> 163 1.1 tron 164 1.1 tron <p> or something closely resemblant. </p> 165 1.1 tron 166 1.1 tron <h3>4.1 - Getting started</h3> 167 1.1 tron 168 1.1 tron <p> On Solaris, the "make" command and other utilities for software 169 1.1 tron development are in /usr/ccs/bin, so you MUST have /usr/ccs/bin in 170 1.1 tron your command search path. If these files do not exist, install the 171 1.1 tron development packages first. See the Solaris FAQ item "<a 172 1.1 tron href="http://www.science.uva.nl/pub/solaris/solaris2.html#q6.2">Which 173 1.1 tron packages do I need to install to support a C compiler?</a>". </p> 174 1.1 tron 175 1.1 tron <p> If you need to build Postfix for multiple architectures, use the 176 1.1 tron "lndir" command to build a shadow tree with symbolic links to the 177 1.1 tron source files. "lndir" is part of X11R6. </p> 178 1.1 tron 179 1.1 tron <p> If at any time in the build process you get messages like: "make: 180 1.1 tron don't know how to ..." you should be able to recover by running 181 1.1 tron the following command from the Postfix top-level directory: </p> 182 1.1 tron 183 1.1 tron <blockquote> 184 1.1 tron <pre> 185 1.5 tron $ make -f Makefile.init makefiles 186 1.1 tron </pre> 187 1.1 tron </blockquote> 188 1.1 tron 189 1.1 tron <p> If you copied the Postfix source code after building it on another 190 1.1 tron machine, it is a good idea to cd into the top-level directory and 191 1.1 tron first do this:</p> 192 1.1 tron 193 1.1 tron <blockquote> 194 1.1 tron <pre> 195 1.5 tron $ make tidy 196 1.1 tron </pre> 197 1.1 tron </blockquote> 198 1.1 tron 199 1.1 tron <p> This will get rid of any system dependencies left over from 200 1.1 tron compiling the software elsewhere. </p> 201 1.1 tron 202 1.1 tron <h3>4.2 - What compiler to use</h3> 203 1.1 tron 204 1.1 tron <p> To build with GCC, or with the native compiler if people told me 205 1.1 tron that is better for your system, just cd into the top-level Postfix 206 1.1 tron directory of the source tree and type: </p> 207 1.1 tron 208 1.1 tron <blockquote> 209 1.1 tron <pre> 210 1.5 tron $ make 211 1.1 tron </pre> 212 1.1 tron </blockquote> 213 1.1 tron 214 1.1 tron <p> To build with a non-default compiler, you need to specify the name 215 1.1 tron of the compiler. Here are a few examples: </p> 216 1.1 tron 217 1.1 tron <blockquote> 218 1.1 tron <pre> 219 1.5 tron $ make makefiles CC=/opt/SUNWspro/bin/cc (Solaris) 220 1.5 tron $ make 221 1.1 tron 222 1.5 tron $ make makefiles CC="/opt/ansic/bin/cc -Ae" (HP-UX) 223 1.5 tron $ make 224 1.1 tron 225 1.5 tron $ make makefiles CC="purify cc" 226 1.5 tron $ make 227 1.1 tron </pre> 228 1.1 tron </blockquote> 229 1.1 tron 230 1.1 tron <p> and so on. In some cases, optimization is turned off automatically. </p> 231 1.1 tron 232 1.1 tron <h3>4.3 - Building with optional extensions</h3> 233 1.1 tron 234 1.1 tron By default, Postfix builds as a mail system with relatively few 235 1.1 tron bells and whistles. Support for third-party databases etc. 236 1.1 tron must be configured when Postfix is compiled. The following documents describe how to build Postfix with support for extensions: 237 1.1 tron 238 1.1 tron <blockquote> 239 1.1 tron <table border="1"> 240 1.1 tron 241 1.1 tron <tr> <th>Postfix extension </th> <th>Document </th> <th>Availability</th> 242 1.1 tron </tr> 243 1.1 tron 244 1.1 tron <tr> <td> Berkeley DB database</td> <td>DB_README</td> <td> Postfix 245 1.1 tron 1.0 </td> </tr> 246 1.1 tron 247 1.1 tron <tr> <td> LDAP database</td> <td>LDAP_README</td> <td> Postfix 248 1.1 tron 1.0 </td> </tr> 249 1.1 tron 250 1.1 tron <tr> <td> MySQL database</td> <td>MYSQL_README</td> <td> Postfix 251 1.1 tron 1.0 </td> </tr> 252 1.1 tron 253 1.1 tron <tr> <td> Perl compatible regular expression</td> <td>PCRE_README</td> 254 1.1 tron <td> Postfix 1.0 </td> </tr> 255 1.1 tron 256 1.1 tron <tr> <td> PostgreSQL database</td> <td>PGSQL_README</td> <td> 257 1.1 tron Postfix 2.0 </td> </tr> 258 1.1 tron 259 1.1 tron <tr> <td> SASL authentication </td> <td>SASL_README</td> <td> 260 1.1 tron Postfix 1.0 </td> </tr> 261 1.1 tron 262 1.3 tron <tr> <td> SQLite database</td> <td>SQLITE_README</td> <td> Postfix 263 1.3 tron 2.8 </td> </tr> 264 1.3 tron 265 1.1 tron <tr> <td> STARTTLS session encryption </td> <td>TLS_README</td> <td> 266 1.1 tron Postfix 2.2 </td> </tr> 267 1.1 tron 268 1.1 tron </table> 269 1.1 tron 270 1.1 tron </blockquote> 271 1.1 tron 272 1.1 tron <p> Note: IP version 6 support is compiled into Postfix on operating 273 1.1 tron systems that have IPv6 support. See the IPV6_README file for details. 274 1.1 tron </p> 275 1.1 tron 276 1.1 tron <h3>4.4 - Overriding built-in parameter default settings</h3> 277 1.1 tron 278 1.1 tron <p> All Postfix configuration parameters can be changed by editing 279 1.1 tron a Postfix configuration file, except for one: the parameter that 280 1.1 tron specifies the location of Postfix configuration files. In order to 281 1.1 tron build Postfix with a configuration directory other than /etc/postfix, 282 1.1 tron use: </p> 283 1.1 tron 284 1.1 tron <blockquote> 285 1.1 tron <pre> 286 1.5 tron $ make makefiles CCARGS='-DDEF_CONFIG_DIR=\"/some/where\"' 287 1.5 tron $ make 288 1.1 tron </pre> 289 1.1 tron </blockquote> 290 1.1 tron 291 1.1 tron <p> IMPORTANT: Be sure to get the quotes right. These details matter 292 1.1 tron a lot. </p> 293 1.1 tron 294 1.1 tron <p> Parameters whose defaults can be specified in this way are: </p> 295 1.1 tron 296 1.1 tron <blockquote> 297 1.1 tron 298 1.1 tron <table border="1"> 299 1.1 tron 300 1.1 tron <tr><th> Macro name </th> <th>default value for</th> <th>typical 301 1.1 tron default</th> </tr> 302 1.1 tron 303 1.1 tron <tr> <td>DEF_COMMAND_DIR</td> <td>command_directory</td> 304 1.1 tron <td>/usr/sbin</td> </tr> 305 1.1 tron 306 1.1 tron <tr> <td>DEF_CONFIG_DIR</td> <td>config_directory</td> 307 1.1 tron <td>/etc/postfix</td> </tr> 308 1.1 tron 309 1.1 tron <tr> <td>DEF_DAEMON_DIR</td> <td>daemon_directory</td> 310 1.1 tron <td>/usr/libexec/postfix</td> </tr> 311 1.1 tron 312 1.1 tron <tr> <td>DEF_DATA_DIR</td> <td>data_directory</td> 313 1.2 tron <td>/var/db/postfix</td> </tr> 314 1.1 tron 315 1.1 tron <tr> <td>DEF_MAILQ_PATH</td> <td>mailq_path</td> <td>/usr/bin/mailq</td> 316 1.1 tron </tr> 317 1.1 tron 318 1.1 tron <tr> <td>DEF_HTML_DIR</td> <td>html_directory</td> 319 1.1 tron <td>no</td> </tr> 320 1.1 tron 321 1.1 tron <tr> <td>DEF_MANPAGE_DIR</td> <td>manpage_directory</td> 322 1.1 tron <td>/usr/local/man</td> </tr> 323 1.1 tron 324 1.1 tron <tr> <td>DEF_NEWALIAS_PATH</td> <td>newaliases_path</td> 325 1.1 tron <td>/usr/bin/newaliases</td> </tr> 326 1.1 tron 327 1.1 tron <tr> <td>DEF_QUEUE_DIR</td> <td>queue_directory</td> 328 1.1 tron <td>/var/spool/postfix</td> </tr> 329 1.1 tron 330 1.1 tron <tr> <td>DEF_README_DIR</td> <td>readme_directory</td> 331 1.1 tron <td>no</td> </tr> 332 1.1 tron 333 1.1 tron <tr> <td>DEF_SENDMAIL_PATH</td> <td>sendmail_path</td> 334 1.1 tron <td>/usr/sbin/sendmail</td> </tr> 335 1.1 tron 336 1.1 tron </table> 337 1.1 tron 338 1.1 tron </blockquote> 339 1.1 tron 340 1.1 tron <p> Note: the data_directory parameter (for caches and pseudo-random 341 1.1 tron numbers) was introduced with Postfix version 2.5. </p> 342 1.1 tron 343 1.4 tron <h3>4.5 - Overriding other compile-time features</h3> 344 1.4 tron 345 1.4 tron <p> The general method to override Postfix compile-time features 346 1.4 tron is as follows: </p> 347 1.4 tron 348 1.4 tron <blockquote> 349 1.4 tron <pre> 350 1.5 tron $ make makefiles name=value name=value... 351 1.5 tron $ make 352 1.4 tron </pre> 353 1.4 tron </blockquote> 354 1.4 tron 355 1.4 tron <p> The following is an extensive list of names and values. </p> 356 1.4 tron 357 1.4 tron <table border="1"> 358 1.4 tron 359 1.4 tron <tr> <th colspan="2"> Name/Value </th> <th> Description </th> </tr> 360 1.4 tron 361 1.4 tron <tr> <td colspan="2"> AUXLIBS="object_library..."</td> <td> Specifies 362 1.4 tron one or more non-default object libraries. </td> </tr> 363 1.4 tron 364 1.4 tron <tr> <td colspan="2"> CC=compiler_command</td> <td> Specifies a 365 1.4 tron non-default compiler. On many systems, the default is <tt>gcc</tt>. 366 1.4 tron </td> </tr> 367 1.4 tron 368 1.4 tron <tr> <td colspan="2"> CCARGS="compiler_arguments..."</td> <td> 369 1.4 tron Specifies non-default compiler arguments, for example, a non-default 370 1.4 tron <tt>include</tt> directory. The following directives turn 371 1.4 tron off Postfix features at compile time:</td> </tr> 372 1.4 tron 373 1.4 tron <tr> <td> </td> <td> -DNO_DB </td> <td> Do not build with Berkeley 374 1.4 tron DB support. By default, Berkeley DB support is compiled in on 375 1.4 tron platforms that are known to support this feature. </td> </tr> 376 1.4 tron 377 1.4 tron <tr> <td> </td> <td> -DNO_DEVPOLL </td> <td> Do not build with 378 1.4 tron Solaris <tt>/dev/poll</tt> support. By default, <tt>/dev/poll</tt> 379 1.4 tron support is compiled in on Solaris versions that are known to support 380 1.4 tron this feature. </td> </tr> 381 1.4 tron 382 1.4 tron <tr> <td> </td> <td> -DNO_EPOLL </td> <td> Do not build with Linux 383 1.4 tron EPOLL support. By default, EPOLL support is compiled in on platforms 384 1.4 tron that are known to support this feature. </td> </tr> 385 1.4 tron 386 1.4 tron <tr> <td> </td> <td> -DNO_IPV6 </td> <td> Do not build with IPv6 387 1.4 tron support. By default, IPv6 support is compiled in on platforms that 388 1.4 tron are known to have IPv6 support. Note: this directive is for debugging 389 1.4 tron and testing only. It is not guaranteed to work on all platforms. 390 1.4 tron </td> </tr> 391 1.4 tron 392 1.4 tron <tr> <td> </td> <td> -DNO_KQUEUE </td> <td> Do not build with FreeBSD 393 1.4 tron / NetBSD / OpenBSD / MacOSX KQUEUE support. By default, KQUEUE 394 1.4 tron support is compiled in on platforms that are known to support it. 395 1.4 tron </td> </tr> 396 1.4 tron 397 1.4 tron <tr> <td> </td> <td> -DNO_NIS </td> <td> Do not build with NIS or 398 1.4 tron NISPLUS support. NIS is not available on some recent Linux or Solaris 399 1.4 tron distributions. </td> </tr> 400 1.4 tron 401 1.4 tron <tr> <td> </td> <td> -DNO_PCRE </td> <td> Do not build with PCRE 402 1.4 tron support. By default, PCRE support is compiled in when the 403 1.4 tron <tt>pcre-config</tt> utility is installed. </td> </tr> 404 1.4 tron 405 1.4 tron <tr> <td> </td> <td> -DNO_POSIX_GETPW_R </td> <td> Disable support 406 1.4 tron for POSIX <tt>getpwnam_r/getpwuid_r</tt>. By default Postfix uses 407 1.4 tron these where they are known to be available. </td> </tr> 408 1.4 tron 409 1.4 tron <tr> <td> </td> <td> -DNO_SIGSETJMP </td> <td> Use 410 1.4 tron <tt>setjmp()/longjmp()</tt> instead of <tt>sigsetjmp()/siglongjmp()</tt>. 411 1.4 tron By default, Postfix uses <tt>sigsetjmp()/siglongjmp()</tt> when 412 1.4 tron they are known to be available. </td> </tr> 413 1.4 tron 414 1.4 tron <tr> <td colspan="2"> DEBUG=debug_level </td> <td> Specifies a 415 1.4 tron non-default compiler debugging level. The default is <tt>-g</tt>. 416 1.4 tron Specify DEBUG= to turn off debugging. </td> </tr> 417 1.4 tron 418 1.4 tron <tr> <td colspan="2"> OPT=optimization_level </td> <td> Specifies 419 1.4 tron a non-default optimization level. The default is -O. Specify OPT= 420 1.4 tron to turn off optimization. </td> </tr> 421 1.4 tron 422 1.4 tron <tr> <td colspan="2"> WARN="warning_flags..." </td> <td> Specifies 423 1.4 tron non-default <tt>gcc</tt> compiler warning options for use when 424 1.4 tron "<tt>make</tt>" is invoked in a source subdirectory only. </td> 425 1.4 tron </tr> 426 1.4 tron 427 1.4 tron </table> 428 1.4 tron 429 1.4 tron <h3>4.6 - Support for thousands of processes</h3> 430 1.1 tron 431 1.1 tron <p> The number of connections that Postfix can manage simultaneously 432 1.1 tron is limited by the number of processes that it can run. This number 433 1.1 tron in turn is limited by the number of files and sockets that a single 434 1.1 tron process can open. For example, the Postfix queue manager has a 435 1.1 tron separate connection to each delivery process, and the anvil(8) 436 1.1 tron server has one connection per smtpd(8) process. </p> 437 1.1 tron 438 1.1 tron <p> Postfix version 2.4 and later have no built-in limits on the 439 1.1 tron number of open files or sockets, when compiled on systems that 440 1.1 tron support one of the following: </p> 441 1.1 tron 442 1.1 tron <ul> 443 1.1 tron 444 1.1 tron <li> BSD kqueue(2) (FreeBSD 4.1, NetBSD 2.0, OpenBSD 2.9), 445 1.1 tron 446 1.1 tron <li> Solaris 8 /dev/poll, 447 1.1 tron 448 1.1 tron <li> Linux 2.6 epoll(4). 449 1.1 tron 450 1.1 tron </ul> 451 1.1 tron 452 1.1 tron 453 1.1 tron <p> With other Postfix versions or operating systems, the number 454 1.1 tron of file descriptors per process is limited by the value of the 455 1.1 tron FD_SETSIZE macro. If you expect to run more than 1000 mail delivery 456 1.1 tron processes, you may need to override the definition of the FD_SETSIZE 457 1.1 tron macro to make select() work correctly: </p> 458 1.1 tron 459 1.1 tron <blockquote> 460 1.1 tron <pre> 461 1.5 tron $ make makefiles CCARGS=-DFD_SETSIZE=2048 462 1.1 tron </pre> 463 1.1 tron </blockquote> 464 1.1 tron 465 1.1 tron <p> Warning: the above has no effect on some Linux versions. 466 1.1 tron Apparently, on these systems the FD_SETSIZE value can be changed 467 1.1 tron only by using undocumented interfaces. Currently, that means 468 1.1 tron including <bits/types.h> directly (which is not allowed) and 469 1.1 tron overriding the __FD_SETSIZE macro. Beware, undocumented interfaces 470 1.1 tron can change at any time and without warning. </p> 471 1.1 tron 472 1.1 tron <p> But wait, there is more: none of this will work unless the 473 1.1 tron operating system is configured to handle thousands of connections. 474 1.1 tron See the TUNING_README guide for examples of how to increase the 475 1.1 tron number of open sockets or files. </p> 476 1.1 tron 477 1.4 tron <h3>4.7 - Compiling Postfix, at last</h3> 478 1.1 tron 479 1.1 tron <p> If the command </p> 480 1.1 tron 481 1.1 tron <blockquote> 482 1.1 tron <pre> 483 1.5 tron $ make 484 1.1 tron </pre> 485 1.1 tron </blockquote> 486 1.1 tron 487 1.1 tron <p> is successful, then you can proceed to <a href="#install">install</a> 488 1.1 tron Postfix (section 6). 489 1.1 tron 490 1.1 tron <p> If the command produces compiler error messages, it may be time 491 1.1 tron to search the web or to ask the postfix-users (a] postfix.org mailing 492 1.1 tron list, but be sure to search the mailing list archives first. Some 493 1.1 tron mailing list archives are linked from http://www.postfix.org/. </p> 494 1.1 tron 495 1.1 tron <h2> <a name="5">5 - Porting Postfix to an unsupported system</a> </h2> 496 1.1 tron 497 1.1 tron <p> Each system type that Postfix knows is identified by a unique 498 1.1 tron name. Examples: SUNOS5, FREEBSD4, and so on. When porting Postfix 499 1.1 tron to a new system, the first step is to choose a SYSTEMTYPE name for 500 1.1 tron the new system. You must use a name that includes at least the 501 1.1 tron major version of the operating system (such as SUNOS4 or LINUX2), 502 1.1 tron so that different releases of the same system can be supported 503 1.1 tron without confusion. </p> 504 1.1 tron 505 1.1 tron <p> Add a case statement to the "makedefs" shell script in the 506 1.1 tron source code top-level directory that recognizes the new system 507 1.1 tron reliably, and that emits the right system-specific information. 508 1.1 tron Be sure to make the code robust against user PATH settings; if the 509 1.1 tron system offers multiple UNIX flavors (e.g. BSD and SYSV) be sure to 510 1.1 tron build for the native flavor, instead of the emulated one. </p> 511 1.1 tron 512 1.1 tron <p> Add an "#ifdef SYSTEMTYPE" section to the central util/sys_defs.h 513 1.1 tron include file. You may have to invent new feature macro names. 514 1.1 tron Please choose sensible feature macro names such as HAS_DBM or 515 1.1 tron FIONREAD_IN_SYS_FILIO_H. 516 1.1 tron 517 1.1 tron <p> I strongly recommend against using "#ifdef SYSTEMTYPE" in 518 1.1 tron individual source files. While this may look like the quickest 519 1.1 tron solution, it will create a mess when newer versions of the same 520 1.1 tron SYSTEMTYPE need to be supported. You're likely to end up placing 521 1.1 tron "#ifdef" sections all over the source code again. </p> 522 1.1 tron 523 1.1 tron <h2><a name="install">6 - Installing the software after successful 524 1.1 tron compilation</a></h2> 525 1.1 tron 526 1.1 tron <p> This text describes how to install Postfix from source code. 527 1.1 tron See the PACKAGE_README file if you are building a package for 528 1.1 tron distribution to other systems. </p> 529 1.1 tron 530 1.1 tron <h3>6.1 - Save existing Sendmail binaries</h3> 531 1.1 tron 532 1.1 tron <p> <a name="save">IMPORTANT</a>: if you are REPLACING an existing 533 1.1 tron Sendmail installation with Postfix, you may need to keep the old 534 1.1 tron sendmail program running for some time in order to flush the mail 535 1.1 tron queue. </p> 536 1.1 tron 537 1.1 tron <ul> 538 1.1 tron 539 1.1 tron <li> <p> Some systems implement a mail switch mechanism where 540 1.1 tron different MTAs (Postfix, Sendmail, etc.) can be installed at the 541 1.1 tron same time, while only one of them is actually being used. Examples 542 1.1 tron of such switching mechanisms are the FreeBSD mailwrapper(8) or the 543 1.1 tron Linux mail switch. In this case you should try to "flip" the switch 544 1.1 tron to "Postfix" before installing Postfix. </p> 545 1.1 tron 546 1.1 tron <li> <p> If your system has no mail switch mechanism, execute the 547 1.1 tron following commands (your sendmail, newaliases and mailq programs 548 1.1 tron may be in a different place): </p> 549 1.1 tron 550 1.1 tron <pre> 551 1.1 tron # mv /usr/sbin/sendmail /usr/sbin/sendmail.OFF 552 1.1 tron # mv /usr/bin/newaliases /usr/bin/newaliases.OFF 553 1.1 tron # mv /usr/bin/mailq /usr/bin/mailq.OFF 554 1.1 tron # chmod 755 /usr/sbin/sendmail.OFF /usr/bin/newaliases.OFF \ 555 1.1 tron /usr/bin/mailq.OFF 556 1.1 tron </pre> 557 1.1 tron 558 1.1 tron </ul> 559 1.1 tron 560 1.1 tron <h3>6.2 - Create account and groups</h3> 561 1.1 tron 562 1.1 tron <p> Before you install Postfix for the first time you need to 563 1.1 tron create an account and a group:</p> 564 1.1 tron 565 1.1 tron <ul> 566 1.1 tron 567 1.1 tron <li> <p> Create a user account "postfix" with a user id and group 568 1.1 tron id that are not used by any other user account. Preferably, this 569 1.1 tron is an account that no-one can log into. The account does not need 570 1.1 tron an executable login shell, and needs no existing home directory. 571 1.1 tron My password and group file entries look like this: </p> 572 1.1 tron 573 1.1 tron <blockquote> 574 1.1 tron <pre> 575 1.1 tron /etc/passwd: 576 1.1 tron postfix:*:12345:12345:postfix:/no/where:/no/shell 577 1.1 tron 578 1.1 tron /etc/group: 579 1.1 tron postfix:*:12345: 580 1.1 tron </pre> 581 1.1 tron </blockquote> 582 1.1 tron 583 1.1 tron <p> Note: there should be no whitespace before "postfix:". </p> 584 1.1 tron 585 1.1 tron <li> <p> Create a group "postdrop" with a group id that is not used 586 1.1 tron by any other user account. Not even by the postfix user account. 587 1.1 tron My group file entry looks like: 588 1.1 tron 589 1.1 tron <blockquote> 590 1.1 tron <pre> 591 1.1 tron /etc/group: 592 1.1 tron postdrop:*:54321: 593 1.1 tron </pre> 594 1.1 tron </blockquote> 595 1.1 tron 596 1.1 tron <p> Note: there should be no whitespace before "postdrop:". </p> 597 1.1 tron 598 1.1 tron </ul> 599 1.1 tron 600 1.1 tron <h3>6.3 - Install Postfix</h3> 601 1.1 tron 602 1.1 tron <p> To install or upgrade Postfix from compiled source code, run 603 1.1 tron one of the following commands as the super-user:</p> 604 1.1 tron 605 1.1 tron <blockquote> 606 1.1 tron <pre> 607 1.1 tron # make install (interactive version, first time install) 608 1.1 tron 609 1.1 tron # make upgrade (non-interactive version, for upgrades) 610 1.1 tron </pre> 611 1.1 tron </blockquote> 612 1.1 tron 613 1.1 tron <ul> 614 1.1 tron 615 1.1 tron <li> <p> The interactive version ("make install") asks for pathnames 616 1.1 tron for Postfix data and program files, and stores your preferences in 617 1.1 tron the main.cf file. <b> If you don't want Postfix to overwrite 618 1.1 tron non-Postfix "sendmail", "mailq" and "newaliases" files, specify 619 1.1 tron pathnames that end in ".postfix"</b>. </p> 620 1.1 tron 621 1.1 tron <li> <p> The non-interactive version ("make upgrade") needs the 622 1.1 tron /etc/postfix/main.cf file from a previous installation. If the file 623 1.1 tron does not exist, use interactive installation ("make install") 624 1.1 tron instead. </p> 625 1.1 tron 626 1.1 tron </ul> 627 1.1 tron 628 1.1 tron <h3>6.4 - Configure Postfix</h3> 629 1.1 tron 630 1.1 tron <p> Proceed to the section on how you wish to run Postfix on 631 1.1 tron your particular machine: </p> 632 1.1 tron 633 1.1 tron <ul> 634 1.1 tron 635 1.1 tron <li> <p> <a href="#send_only">Send</a> mail only, without changing 636 1.1 tron an existing Sendmail installation (section 7). </p> 637 1.1 tron 638 1.1 tron <li> <p> <a href="#send_receive">Send and receive</a> mail via a 639 1.1 tron virtual host interface, still without any change to an existing 640 1.1 tron Sendmail installation (section 8). </p> 641 1.1 tron 642 1.1 tron <li> <p> Run Postfix <a href="#replace">instead of</a> Sendmail 643 1.1 tron (section 9). </p> 644 1.1 tron 645 1.1 tron </ul> 646 1.1 tron 647 1.1 tron <h2><a name="send_only">7 - Configuring Postfix to send mail 648 1.1 tron only</a></h2> 649 1.1 tron 650 1.1 tron <p> If you are going to use Postfix to send mail only, there is no 651 1.1 tron need to change your existing sendmail setup. Instead, set up your 652 1.1 tron mail user agent so that it calls the Postfix sendmail program 653 1.1 tron directly. </p> 654 1.1 tron 655 1.1 tron <p> Follow the instructions in the "<a href="#mandatory">Mandatory 656 1.1 tron configuration file edits</a>" in section 10, and review the "<a 657 1.1 tron href="#hamlet">To chroot or not to chroot</a>" text in section 658 1.1 tron 11. </p> 659 1.1 tron 660 1.1 tron <p> You MUST comment out the "smtp inet" entry in /etc/postfix/master.cf, 661 1.1 tron in order to avoid conflicts with the real sendmail. Put a "#" 662 1.1 tron character in front of the line that defines the smtpd service: </p> 663 1.1 tron 664 1.1 tron <blockquote> 665 1.1 tron <pre> 666 1.1 tron /etc/postfix/master.cf: 667 1.1 tron #smtp inet n - n - - smtpd 668 1.1 tron </pre> 669 1.1 tron </blockquote> 670 1.1 tron 671 1.1 tron <p> Start the Postfix system: </p> 672 1.1 tron 673 1.1 tron <blockquote> 674 1.1 tron <pre> 675 1.1 tron # postfix start 676 1.1 tron </pre> 677 1.1 tron </blockquote> 678 1.1 tron 679 1.1 tron <p> or, if you feel nostalgic, use the Postfix sendmail command: </p> 680 1.1 tron 681 1.1 tron <blockquote> 682 1.1 tron <pre> 683 1.1 tron # sendmail -bd -qwhatever 684 1.1 tron </pre> 685 1.1 tron </blockquote> 686 1.1 tron 687 1.1 tron <p> and watch your maillog file for any error messages. The pathname 688 1.1 tron is /var/log/maillog, /var/log/mail, /var/log/syslog, or something 689 1.1 tron else. Typically, the pathname is defined in the /etc/syslog.conf 690 1.1 tron file. </p> 691 1.1 tron 692 1.1 tron <blockquote> 693 1.1 tron <pre> 694 1.5 tron $ egrep '(reject|warning|error|fatal|panic):' /some/log/file 695 1.1 tron </pre> 696 1.1 tron </blockquote> 697 1.1 tron 698 1.1 tron <p> Note: the most important error message is logged first. Later 699 1.1 tron messages are not as useful. </p> 700 1.1 tron 701 1.1 tron <p> In order to inspect the mail queue, use one of the following 702 1.1 tron commands: </p> 703 1.1 tron 704 1.1 tron <blockquote> 705 1.1 tron <pre> 706 1.5 tron $ mailq 707 1.1 tron 708 1.5 tron $ sendmail -bp 709 1.1 tron 710 1.5 tron $ postqueue -p 711 1.1 tron </pre> 712 1.1 tron </blockquote> 713 1.1 tron 714 1.1 tron <p> See also the "<a href="#care">Care and feeding</a>" section 12 715 1.1 tron below. </p> 716 1.1 tron 717 1.1 tron <h2><a name="send_receive">8 - Configuring Postfix to send and 718 1.1 tron receive mail via virtual interface</a></h2> 719 1.1 tron 720 1.1 tron <p> Alternatively, you can use the Postfix system to send AND 721 1.1 tron receive mail while leaving your Sendmail setup intact, by running 722 1.1 tron Postfix on a virtual interface address. Simply configure your mail 723 1.1 tron user agent to directly invoke the Postfix sendmail program. </p> 724 1.1 tron 725 1.1 tron <p> To create a virtual network interface address, study your 726 1.1 tron system ifconfig manual page. The command syntax could be any 727 1.1 tron of: </p> 728 1.1 tron 729 1.1 tron <blockquote> 730 1.1 tron <pre> 731 1.1 tron # <b>ifconfig le0:1 <address> netmask <mask> up</b> 732 1.1 tron # <b>ifconfig en0 alias <address> netmask 255.255.255.255</b> 733 1.1 tron </pre> 734 1.1 tron </blockquote> 735 1.1 tron 736 1.1 tron <p> In the /etc/postfix/main.cf file, I would specify </p> 737 1.1 tron 738 1.1 tron <blockquote> 739 1.1 tron <pre> 740 1.1 tron /etc/postfix/main.cf: 741 1.1 tron myhostname = virtual.host.tld 742 1.1 tron inet_interfaces = $myhostname 743 1.1 tron mydestination = $myhostname 744 1.1 tron </pre> 745 1.1 tron </blockquote> 746 1.1 tron 747 1.1 tron <p> Follow the instructions in the "<a href="#mandatory">Mandatory 748 1.1 tron configuration file edits</a>" in section 10, and review the "<a 749 1.1 tron name="#hamlet">To chroot or not to chroot</a>" text in section 750 1.1 tron 11. </p> 751 1.1 tron 752 1.1 tron <p> Start the Postfix system: </p> 753 1.1 tron 754 1.1 tron <blockquote> 755 1.1 tron <pre> 756 1.1 tron # postfix start 757 1.1 tron </pre> 758 1.1 tron </blockquote> 759 1.1 tron 760 1.1 tron <p> or, if you feel nostalgic, use the Postfix sendmail command: </p> 761 1.1 tron 762 1.1 tron <blockquote> 763 1.1 tron <pre> 764 1.1 tron # sendmail -bd -qwhatever 765 1.1 tron </pre> 766 1.1 tron </blockquote> 767 1.1 tron 768 1.1 tron <p> and watch your maillog file for any error messages. The pathname 769 1.1 tron is /var/log/maillog, /var/log/mail, /var/log/syslog, or something 770 1.1 tron else. Typically, the pathname is defined in the /etc/syslog.conf 771 1.1 tron file. </p> 772 1.1 tron 773 1.1 tron <blockquote> 774 1.1 tron <pre> 775 1.5 tron $ egrep '(reject|warning|error|fatal|panic):' /some/log/file 776 1.1 tron </pre> 777 1.1 tron </blockquote> 778 1.1 tron 779 1.1 tron <p> Note: the most important error message is logged first. Later 780 1.1 tron messages are not as useful. </p> 781 1.1 tron 782 1.1 tron <p> In order to inspect the mail queue, use one of the following 783 1.1 tron commands: </p> 784 1.1 tron 785 1.1 tron <blockquote> 786 1.1 tron <pre> 787 1.5 tron $ mailq 788 1.1 tron 789 1.5 tron $ sendmail -bp 790 1.1 tron 791 1.5 tron $ postqueue -p 792 1.1 tron </pre> 793 1.1 tron </blockquote> 794 1.1 tron 795 1.1 tron <p> See also the "<a href="#care">Care and feeding</a>" section 12 796 1.1 tron below. </p> 797 1.1 tron 798 1.1 tron <h2><a name="replace">9 - Running Postfix instead of Sendmail</a></h2> 799 1.1 tron 800 1.1 tron <p> Prior to installing Postfix you should <a href="#save">save</a> 801 1.1 tron any existing sendmail program files as described in section 6. Be 802 1.1 tron sure to keep the old sendmail running for at least a couple days 803 1.1 tron to flush any unsent mail. To do so, stop the sendmail daemon and 804 1.1 tron restart it as: </p> 805 1.1 tron 806 1.1 tron <blockquote> 807 1.1 tron <pre> 808 1.1 tron # /usr/sbin/sendmail.OFF -q 809 1.1 tron </pre> 810 1.1 tron </blockquote> 811 1.1 tron 812 1.1 tron <p> Note: this is old sendmail syntax. Newer versions use separate 813 1.1 tron processes for mail submission and for running the queue. </p> 814 1.1 tron 815 1.1 tron <p> After you have visited the "<a href="#mandatory">Mandatory 816 1.1 tron configuration file edits</a>" section below, you can start the 817 1.1 tron Postfix system with: </p> 818 1.1 tron 819 1.1 tron <blockquote> 820 1.1 tron <pre> 821 1.1 tron # postfix start 822 1.1 tron </pre> 823 1.1 tron </blockquote> 824 1.1 tron 825 1.1 tron <p> or, if you feel nostalgic, use the Postfix sendmail command: </p> 826 1.1 tron 827 1.1 tron <blockquote> 828 1.1 tron <pre> 829 1.1 tron # sendmail -bd -qwhatever 830 1.1 tron </pre> 831 1.1 tron </blockquote> 832 1.1 tron 833 1.1 tron <p> and watch your maillog file for any error messages. The pathname 834 1.1 tron is /var/log/maillog, /var/log/mail, /var/log/syslog, or something 835 1.1 tron else. Typically, the pathname is defined in the /etc/syslog.conf 836 1.1 tron file. </p> 837 1.1 tron 838 1.1 tron <blockquote> 839 1.1 tron <pre> 840 1.5 tron $ egrep '(reject|warning|error|fatal|panic):' /some/log/file 841 1.1 tron </pre> 842 1.1 tron </blockquote> 843 1.1 tron 844 1.1 tron <p> Note: the most important error message is logged first. Later 845 1.1 tron messages are not as useful. </p> 846 1.1 tron 847 1.1 tron <p> In order to inspect the mail queue, use one of the following 848 1.1 tron commands: </p> 849 1.1 tron 850 1.1 tron <blockquote> 851 1.1 tron <pre> 852 1.5 tron $ mailq 853 1.1 tron 854 1.5 tron $ sendmail -bp 855 1.1 tron 856 1.5 tron $ postqueue -p 857 1.1 tron </pre> 858 1.1 tron </blockquote> 859 1.1 tron 860 1.1 tron <p> See also the "<a href="#care">Care and feeding</a>" section 12 861 1.1 tron below. </p> 862 1.1 tron 863 1.1 tron <h2><a name="mandatory">10 - Mandatory configuration file edits</a></h2> 864 1.1 tron 865 1.1 tron <p> Note: the material covered in this section is covered in more 866 1.1 tron detail in the BASIC_CONFIGURATION_README document. The information 867 1.1 tron presented below is targeted at experienced system administrators. 868 1.1 tron </p> 869 1.1 tron 870 1.1 tron <h3>10.1 - Postfix configuration files</h3> 871 1.1 tron 872 1.1 tron <p> By default, Postfix configuration files are in /etc/postfix. 873 1.1 tron The two most important files are main.cf and master.cf; these files 874 1.1 tron must be owned by root. Giving someone else write permission to 875 1.1 tron main.cf or master.cf (or to their parent directories) means giving 876 1.1 tron root privileges to that person. </p> 877 1.1 tron 878 1.1 tron <p> In /etc/postfix/main.cf, you will have to set up a minimal number 879 1.1 tron of configuration parameters. Postfix configuration parameters 880 1.1 tron resemble shell variables, with two important differences: the first 881 1.1 tron one is that Postfix does not know about quotes like the UNIX shell 882 1.1 tron does.</p> 883 1.1 tron 884 1.1 tron <p> You specify a configuration parameter as: </p> 885 1.1 tron 886 1.1 tron <blockquote> 887 1.1 tron <pre> 888 1.1 tron /etc/postfix/main.cf: 889 1.1 tron parameter = value 890 1.1 tron </pre> 891 1.1 tron </blockquote> 892 1.1 tron 893 1.1 tron <p> and you use it by putting a "$" character in front of its name: </p> 894 1.1 tron 895 1.1 tron <blockquote> 896 1.1 tron <pre> 897 1.1 tron /etc/postfix/main.cf: 898 1.1 tron other_parameter = $parameter 899 1.1 tron </pre> 900 1.1 tron </blockquote> 901 1.1 tron 902 1.1 tron <p> You can use $parameter before it is given a value (that is the 903 1.1 tron second main difference with UNIX shell variables). The Postfix 904 1.1 tron configuration language uses lazy evaluation, and does not look at 905 1.1 tron a parameter value until it is needed at runtime. </p> 906 1.1 tron 907 1.1 tron <p> Whenever you make a change to the main.cf or master.cf file, 908 1.1 tron execute the following command in order to refresh a running mail 909 1.1 tron system: </p> 910 1.1 tron 911 1.1 tron <blockquote> 912 1.1 tron <pre> 913 1.1 tron # postfix reload 914 1.1 tron </pre> 915 1.1 tron </blockquote> 916 1.1 tron 917 1.1 tron <h3>10.2 - Default domain for unqualified addresses</h3> 918 1.1 tron 919 1.1 tron <p> First of all, you must specify what domain will be appended to an 920 1.1 tron unqualified address (i.e. an address without @domain.tld). The 921 1.1 tron "myorigin" parameter defaults to the local hostname, but that is 922 1.1 tron probably OK only for very small sites. </p> 923 1.1 tron 924 1.1 tron <p> Some examples (use only one): </p> 925 1.1 tron 926 1.1 tron <blockquote> 927 1.1 tron <pre> 928 1.1 tron /etc/postfix/main.cf: 929 1.1 tron myorigin = $myhostname (send mail as "user@$myhostname") 930 1.1 tron myorigin = $mydomain (send mail as "user@$mydomain") 931 1.1 tron </pre> 932 1.1 tron </blockquote> 933 1.1 tron 934 1.1 tron <h3>10.3 - What domains to receive locally</h3> 935 1.1 tron 936 1.1 tron <p> Next you need to specify what mail addresses Postfix should deliver 937 1.1 tron locally. </p> 938 1.1 tron 939 1.1 tron <p> Some examples (use only one): </p> 940 1.1 tron 941 1.1 tron <blockquote> 942 1.1 tron <pre> 943 1.1 tron /etc/postfix/main.cf: 944 1.1 tron mydestination = $myhostname, localhost.$mydomain, localhost 945 1.1 tron mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain 946 1.1 tron mydestination = $myhostname 947 1.1 tron </pre> 948 1.1 tron </blockquote> 949 1.1 tron 950 1.1 tron <p>The first example is appropriate for a workstation, the second 951 1.1 tron is appropriate for the mailserver for an entire domain. The third 952 1.1 tron example should be used when running on a virtual host interface.</p> 953 1.1 tron 954 1.1 tron <h3>10.4 - Proxy/NAT interface addresses </h3> 955 1.1 tron 956 1.1 tron <p> The proxy_interfaces parameter specifies all network addresses 957 1.1 tron that Postfix receives mail on by way of a proxy or network address 958 1.1 tron translation unit. You may specify symbolic hostnames instead of 959 1.1 tron network addresses. </p> 960 1.1 tron 961 1.1 tron <p> IMPORTANT: You must specify your proxy/NAT external addresses 962 1.1 tron when your system is a backup MX host for other domains, otherwise 963 1.1 tron mail delivery loops will happen when the primary MX host is down. 964 1.1 tron </p> 965 1.1 tron 966 1.1 tron <p> Example: host behind NAT box running a backup MX host. </p> 967 1.1 tron 968 1.1 tron <blockquote> 969 1.1 tron <pre> 970 1.1 tron /etc/postfix/main.cf: 971 1.1 tron proxy_interfaces = 1.2.3.4 (the proxy/NAT external network address) 972 1.1 tron </pre> 973 1.1 tron </blockquote> 974 1.1 tron 975 1.1 tron <h3>10.5 - What local clients to relay mail from </h3> 976 1.1 tron 977 1.1 tron <p> If your machine is on an open network then you must specify 978 1.1 tron what client IP addresses are authorized to relay their mail through 979 1.1 tron your machine into the Internet. The default setting includes all 980 1.1 tron subnetworks that the machine is attached to. This may give relay 981 1.1 tron permission to too many clients. My own settings are: </p> 982 1.1 tron 983 1.1 tron <blockquote> 984 1.1 tron <pre> 985 1.1 tron /etc/postfix/main.cf: 986 1.1 tron mynetworks = 168.100.189.0/28, 127.0.0.0/8 987 1.1 tron </pre> 988 1.1 tron </blockquote> 989 1.1 tron 990 1.1 tron <h3>10.6 - What relay destinations to accept from strangers </h3> 991 1.1 tron 992 1.1 tron <p> If your machine is on an open network then you must also specify 993 1.1 tron whether Postfix will forward mail from strangers. The default 994 1.1 tron setting will forward mail to all domains (and subdomains of) what 995 1.1 tron is listed in $mydestination. This may give relay permission for 996 1.1 tron too many destinations. Recommended settings (use only one): </p> 997 1.1 tron 998 1.1 tron <blockquote> 999 1.1 tron <pre> 1000 1.1 tron /etc/postfix/main.cf: 1001 1.1 tron relay_domains = (do not forward mail from strangers) 1002 1.1 tron relay_domains = $mydomain (my domain and subdomains) 1003 1.1 tron relay_domains = $mydomain, other.domain.tld, ... 1004 1.1 tron </pre> 1005 1.1 tron </blockquote> 1006 1.1 tron 1007 1.1 tron <h3>10.7 - Optional: configure a smart host for remote delivery</h3> 1008 1.1 tron 1009 1.1 tron <p> If you're behind a firewall, you should set up a relayhost. If 1010 1.1 tron you can, specify the organizational domain name so that Postfix 1011 1.1 tron can use DNS lookups, and so that it can fall back to a secondary 1012 1.1 tron MX host when the primary MX host is down. Otherwise just specify 1013 1.1 tron a hard-coded hostname. </p> 1014 1.1 tron 1015 1.1 tron <p> Some examples (use only one): </p> 1016 1.1 tron 1017 1.1 tron <blockquote> 1018 1.1 tron <pre> 1019 1.1 tron /etc/postfix/main.cf: 1020 1.1 tron relayhost = $mydomain 1021 1.1 tron relayhost = [mail.$mydomain] 1022 1.1 tron </pre> 1023 1.1 tron </blockquote> 1024 1.1 tron 1025 1.1 tron <p> The form enclosed with <tt>[]</tt> eliminates DNS MX lookups. </p> 1026 1.1 tron 1027 1.1 tron <p> By default, the SMTP client will do DNS lookups even when you 1028 1.1 tron specify a relay host. If your machine has no access to a DNS server, 1029 1.1 tron turn off SMTP client DNS lookups like this: </p> 1030 1.1 tron 1031 1.1 tron <blockquote> 1032 1.1 tron <pre> 1033 1.1 tron /etc/postfix/main.cf: 1034 1.1 tron disable_dns_lookups = yes 1035 1.1 tron </pre> 1036 1.1 tron </blockquote> 1037 1.1 tron 1038 1.1 tron <p> The STANDARD_CONFIGURATION_README file has more hints and tips for 1039 1.1 tron firewalled and/or dial-up networks. </p> 1040 1.1 tron 1041 1.1 tron <h3>10.8 - Create the aliases database</h3> 1042 1.1 tron 1043 1.1 tron <p> Postfix uses a Sendmail-compatible aliases(5) table to redirect 1044 1.1 tron mail for local(8) recipients. Typically, this information is kept 1045 1.1 tron in two files: in a text file /etc/aliases and in an indexed file 1046 1.1 tron /etc/aliases.db. The command "postconf alias_maps" will tell you 1047 1.1 tron the exact location of the text file. </p> 1048 1.1 tron 1049 1.1 tron <p> First, be sure to update the text file with aliases for root, 1050 1.1 tron postmaster and "postfix" that forward mail to a real person. Postfix 1051 1.1 tron has a sample aliases file /etc/postfix/aliases that you can adapt 1052 1.1 tron to local conditions. </p> 1053 1.1 tron 1054 1.1 tron <blockquote> 1055 1.1 tron <pre> 1056 1.1 tron /etc/aliases: 1057 1.1 tron root: you 1058 1.1 tron postmaster: root 1059 1.1 tron postfix: root 1060 1.1 tron bin: root 1061 1.1 tron <i>etcetera...</i> 1062 1.1 tron </pre> 1063 1.1 tron </blockquote> 1064 1.1 tron 1065 1.1 tron <p> Note: there should be no whitespace before the ":". </p> 1066 1.1 tron 1067 1.1 tron <p> Finally, build the indexed aliases file with one of the 1068 1.1 tron following commands: </p> 1069 1.1 tron 1070 1.1 tron <blockquote> 1071 1.1 tron <pre> 1072 1.1 tron # newaliases 1073 1.1 tron # sendmail -bi 1074 1.1 tron </pre> 1075 1.1 tron </blockquote> 1076 1.1 tron 1077 1.1 tron <h2><a name="hamlet">11 - To chroot or not to chroot</a></h2> 1078 1.1 tron 1079 1.1 tron <p> Postfix daemon processes can be configured (via master.cf) to 1080 1.1 tron run in a chroot jail. The processes run at a fixed low privilege 1081 1.1 tron and with access only to the Postfix queue directories (/var/spool/postfix). 1082 1.1 tron This provides a significant barrier against intrusion. The barrier 1083 1.1 tron is not impenetrable, but every little bit helps. </p> 1084 1.1 tron 1085 1.1 tron <p> With the exception of Postfix daemons that deliver mail locally 1086 1.1 tron and/or that execute non-Postfix commands, every Postfix daemon can 1087 1.1 tron run chrooted. </p> 1088 1.1 tron 1089 1.1 tron <p> Sites with high security requirements should consider to chroot 1090 1.1 tron all daemons that talk to the network: the smtp(8) and smtpd(8) 1091 1.1 tron processes, and perhaps also the lmtp(8) client. The author's own 1092 1.1 tron porcupine.org mail server runs all daemons chrooted that can be 1093 1.1 tron chrooted. </p> 1094 1.1 tron 1095 1.1 tron <p> The default /etc/postfix/master.cf file specifies that no 1096 1.1 tron Postfix daemon runs chrooted. In order to enable chroot operation, 1097 1.1 tron edit the file /etc/postfix/master.cf. Instructions are in the file. 1098 1.1 tron </p> 1099 1.1 tron 1100 1.1 tron <p> Note that a chrooted daemon resolves all filenames relative to 1101 1.1 tron the Postfix queue directory (/var/spool/postfix). For successful 1102 1.1 tron use of a chroot jail, most UNIX systems require you to bring in 1103 1.1 tron some files or device nodes. The examples/chroot-setup directory 1104 1.1 tron in the source code distribution has a collection of scripts that 1105 1.1 tron help you set up Postfix chroot environments on different operating 1106 1.1 tron systems. </p> 1107 1.1 tron 1108 1.1 tron <p> Additionally, you almost certainly need to configure syslogd 1109 1.1 tron so that it listens on a socket inside the Postfix queue directory. 1110 1.1 tron Examples for specific systems: </p> 1111 1.1 tron 1112 1.1 tron <dl> 1113 1.1 tron 1114 1.1 tron <dt> FreeBSD: </dt> 1115 1.1 tron 1116 1.1 tron <dd> <pre> 1117 1.1 tron # mkdir -p /var/spool/postfix/var/run 1118 1.1 tron # syslogd -l /var/spool/postfix/var/run/log 1119 1.1 tron </pre> </dd> 1120 1.1 tron 1121 1.1 tron <dt> Linux, OpenBSD: </dt> 1122 1.1 tron 1123 1.1 tron <dd> <pre> 1124 1.1 tron # mkdir -p /var/spool/postfix/dev 1125 1.1 tron # syslogd -a /var/spool/postfix/dev/log 1126 1.1 tron </pre> </dd> 1127 1.1 tron 1128 1.1 tron </dl> 1129 1.1 tron 1130 1.1 tron <h2><a name="care">12 - Care and feeding of the Postfix system</a></h2> 1131 1.1 tron 1132 1.1 tron <p> Postfix daemon processes run in the background, and log problems 1133 1.1 tron and normal activity to the syslog daemon. The names of logfiles 1134 1.1 tron are specified in /etc/syslog.conf. At the very least you need 1135 1.1 tron something like: </p> 1136 1.1 tron 1137 1.1 tron <blockquote> 1138 1.1 tron <pre> 1139 1.1 tron /etc/syslog.conf: 1140 1.1 tron mail.err /dev/console 1141 1.1 tron mail.debug /var/log/maillog 1142 1.1 tron </pre> 1143 1.1 tron </blockquote> 1144 1.1 tron 1145 1.1 tron <p> IMPORTANT: the syslogd will not create files. You must create 1146 1.1 tron them before (re)starting syslogd. </p> 1147 1.1 tron 1148 1.1 tron <p> IMPORTANT: on Linux you need to put a "-" character before 1149 1.1 tron the pathname, e.g., -/var/log/maillog, otherwise the syslogd 1150 1.1 tron will use more system resources than Postfix does. </p> 1151 1.1 tron 1152 1.1 tron <p> Hopefully, the number of problems will be small, but it is a good 1153 1.1 tron idea to run every night before the syslog files are rotated: </p> 1154 1.1 tron 1155 1.1 tron <blockquote> 1156 1.1 tron <pre> 1157 1.1 tron # postfix check 1158 1.1 tron # egrep '(reject|warning|error|fatal|panic):' /some/log/file 1159 1.1 tron </pre> 1160 1.1 tron </blockquote> 1161 1.1 tron 1162 1.1 tron <ul> 1163 1.1 tron 1164 1.1 tron <li> <p> The first line (postfix check) causes Postfix to report 1165 1.1 tron file permission/ownership discrepancies. </p> 1166 1.1 tron 1167 1.1 tron <li> <p> The second line looks for problem reports from the mail 1168 1.1 tron software, and reports how effective the relay and junk mail access 1169 1.1 tron blocks are. This may produce a lot of output. You will want to 1170 1.1 tron apply some postprocessing to eliminate uninteresting information. 1171 1.1 tron </p> 1172 1.1 tron 1173 1.1 tron </ul> 1174 1.1 tron 1175 1.1 tron <p> The <a href="DEBUG_README.html#logging"> DEBUG_README </a> 1176 1.1 tron document describes the meaning of the "warning" etc. labels in 1177 1.1 tron Postfix logging. </p> 1178 1.1 tron 1179 1.1 tron </body> 1180 1.1 tron 1181 1.1 tron </html> 1182
Indexes created Fri Jun 26 00:24:39 UTC 2026