auth between postfix and dovecot?

[Shawn Heisey]

On 4/22/2022 10:35 PM, ミユナ (alice) wrote:
> my question is:
>
> when postfix talks to dovecot, does it require user's 
> username/password for authentication? or this communication just goes 
> without authentication?
>
> I asked this, b/c my webmail send mail from localhost has been going 
> without authentication to postifx. so i am not sure if postfix talks 
> to dovecot without requiring auth too.

My setup is virtual users in a postfixadmin database.  Dovecot does all 
authentication, even with posfix.  I believe the config snippets I have 
included below are the relevant things that make it possible for postfix 
to talk to dovecot for mail delivery and authentication.

Mail sent from localhost on port 25 does not require authentication on 
my system, because 127.0.0.0/8 is in postfix's mynetworks config and 
port 25's access restrictions include permit_mynetworks.  Anything sent 
via submission (port 587) does require auth, even from trusted 
networks.  If you can configure your webmail to use submission instead 
of smtp, maybe that can be authenticated.  You'll need to consult 
support resources for your webmail to see if that is possible.   I can 
say for sure that roundcube can do it ... I have roundcube configured to 
talk to port 587, which as mentioned, ALWAYS requires authentication.

When postfix sends mail to dovecot for delivery, I'm pretty sure that 
happens without authentication.  It's LMTP via unix socket, not 
something an outside client can access directly.

# In 10-master.conf
service lmtp {
   unix_listener lmtp {
     #mode = 0666
   }
}

service auth {
   unix_listener auth-userdb {
     mode = 0666
     user = vmail
     group = mail
   }

   unix_listener /var/spool/postfix/private/auth {
     mode = 0666
     user = postfix
     group = postfix
   }
}


# In 10-auth.conf
disable_plaintext_auth = yes
auth_mechanisms = plain
!include auth-sql.conf.ext


# In postfix master.cf
dovecot      unix   -        n      n       -       -   pipe
   flags=DRhu user=vmail:mail argv=/usr/lib/dovecot/dovecot-lda -d 
$(recipient)


# In postfix main.cf
# Use Dovecot to authenticate.
smtpd_sasl_type = dovecot
# Referring to /var/spool/postfix/private/auth
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
#broken_sasl_auth_clients = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain =
smtpd_sasl_authenticated_header = yes

# Tell postfix to hand off mail to the definition for dovecot in master.cf
virtual_transport = dovecot
dovecot_destination_recipient_limit = 1