#include <cb.wml>

<title>Installing Postfix/SASL on Debian/Sarge</title>

<i>Note: this document is mainly meant to be a reminder for myself for how to
set up things. YMMV.</i>

<h2>Client</h2>

Install:
<ul>
<li>postfix, postfix-tls
<li><b>libsasl2-modules</b>
</ul>

Append to /etc/postfix/main.cf:

<pre>
relayhost = [meitner.df7cb.de]
...
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_use_tls = no
smtp_enforce_tls = yes
smtp_tls_cert_file = /etc/postfix/planck.pem
smtp_tls_key_file = $smtp_tls_cert_file
smtp_tls_CAfile = /etc/postfix/cacert.pem
</pre>

/etc/postfix/sasl_passwd: ("postmap sasl_passwd")

<pre>
meitner.df7cb.de        hostname:Xxxxxx
</pre>

/etc/postfix/tls_per_site: (1 entry is probably enough; "postmap tls_per_site")

<pre>
meitner.df7cb.de        MUST_NOPEERMATCH
[meitner.df7cb.de]      MUST_NOPEERMATCH
*       MUST_NOPEERMATCH
</pre>

/etc/postfix/cacert.pem:
<pre>
-----BEGIN CERTIFICATE-----
Xxxxx
-----END CERTIFICATE-----
</pre>

/etc/postfix/planck.pem:
<pre>
-----BEGIN CERTIFICATE-----
Xxxxx
-----END CERTIFICATE-----
-----BEGIN RSA PRIVATE KEY-----
Xxxxx
-----END RSA PRIVATE KEY-----
</pre>


<h2>Server</h2>

New client: saslpasswd2 hostname@df7cb.de

<p>
TODO: how to set up the server itself.

<pre>
--- postfix.dpkg-dist   2005-01-04 21:05:59.000000000 +0100
+++ postfix     2004-12-15 21:06:02.370265961 +0100
@@ -41,12 +41,13 @@
            fi
 
            FILES="etc/localtime etc/services etc/resolv.conf etc/hosts \
-               etc/nsswitch.conf"
+               etc/nsswitch.conf etc/sasldb2"
            for file in $FILES; do 
                [ -d ${file%/*} ] || mkdir -p ${file%/*}
                if [ -f /${file} ]; then rm -f ${file} && cp /${file} ${file}; fi
-               if [ -f  ${file} ]; then chmod a+rX ${file}; fi
+               #if [ -f  ${file} ]; then chmod a+rX ${file}; fi
            done
+           [ -f etc/sasldb2 ] && chgrp postfix etc/sasldb2
            rm -f usr/lib/zoneinfo/localtime
            ln -sf /etc/localtime usr/lib/zoneinfo/localtime
            rm -f lib/libnss_*so*
</pre>