Stephan Paukner :: syslog

I successfully switched my hosting from my real-hardware machine ‘daemon’ to my new virtual-hardware machine ‘gauss’ which is hosted by HostEurope.de. After turning off the services on ‘daemon’ and doing a final sync, I started the services on ‘gauss’ and activated the TCP-forwarding on ‘daemon’ with rinetd. I forwarded FTP, HTTP(S) and IMAP(S) such that users could connect to the old IP where those connections got forwarded to the new IP. With this, the new host only saw connections originating from the old IP although they actually belonged to strangers. Therefore I didn’t also forward the SMTP-port directly, because in that case the realtime blacklisting would have failed.

So I configured Postfix to keep doing RBL lookups and SPAM and virus scanning, and to forward mails destined for the local domains to the new host. I did it this way:

I finally wanted to enable my users to relay mails via my own MTA, as it’s quite comfortable to be able to use the same outgoing mail server no matter what computing device you currently use or where you currently are. About three years ago there were no solutions enabling SMTP AUTH for Postfix without recompiling packages, so I had to wait until today where such features are now officially available within Debian. I found several HOWTOs about configuring SMTP AUTH with Postfix on Debian Woody or Debian Sarge, but things have changed (or will change, as Etch hasn’t been released yet). The Postfix version in Sarge is 2.1, whereas in Etch it’s 2.3. This is how I did it:

First, note that you don’t have to patch or (re-)compile anything. Etch’s Postfix package already supports TLS! First, I cared about configuring authentication with SASL, and after that I restricted authentication to TLS only. This makes debugging easier during the process. Because encryption already happens at the TLS-layer, I don’t need MD5 authentication and can stay PLAIN.