View source for SMTP authentication and Postfix

=Introduction=

The original idea of this page was a quick and dirty howto on how to setup SMTP authentication on Postfix. However, it turned out that there was no quick way to achieve what I wanted (encrypted passwords over an unencrypted link, using Courier IMAP as the password database). It also turned out that I was running a non-standard Postfix (it wasn't chrooted). Therefore, as SMTP AUTH and SASL have always been something of a black art to me, I have written a few things down that I have discovered, as well as a quick and dirty howto on setting up a basic SASL database.

The first thing I should recommend is that one of the easiest way to achieve SMTP authentication is to authenticate against an IMAP server, and that Dovecot (or so I have read) is the easiest way to get up and running. As it is, I am running Courier, and didn't have the time to migrate, although I will certainly consider it in the future.

If you can't do the above, read on!

SASL comes in 2 flavours: an authentication daemon (saslauthd) that can authenticate against a variety of sources (including IMAP and a passwd file) and a library that can be used to authenticate against a single file database. My aim was to setup the daemon to authenticate against my IMAP server (which was easy to set up, see below), but it transpired that saslauthd does not support either CRAM-MD5 or DIGEST-MD5, meaning that the authentication from a client would be done in near-as plain text over the internet, which is far from ideal. I therefore opted for the sasldb2 database, which again was fairly easy to setup, but requires its own set of users to be created.