How To Install Postfix on Debian 12

In this tutorial, we will show you how to install Postfix on Debian 12. Postfix was initially released in 1998 by Wietse Venema, a renowned security researcher. His goal was to create a safer and more secure alternative to the widely-used Sendmail program. Postfix offers a plethora of features that make it a compelling choice for an MTA. It’s designed to be fast, handling a large volume of mail efficiently. It’s also easy to administer, with a straightforward configuration process. But perhaps its most significant selling point is its robust security. Postfix is designed with a strong emphasis on security, making it a reliable choice for protecting your email communications.

This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of Postfix mail on a Debian 12 (Bookworm).

Prerequisites

• A server running one of the following operating systems: Debian 12 (Bookworm).
• It’s recommended that you use a fresh OS install to prevent any potential issues.
• SSH access to the server (or just open Terminal if you’re on a desktop).
• An active internet connection. You’ll need an internet connection to download the necessary packages and dependencies for Postfix.
• A non-root sudo user or access to the root user. We recommend acting as a non-root sudo user, however, as you can harm your system if you’re not careful when acting as the root.

Install Postfix on Debian 12 Bookworm

Step 1. Before installing any new software, it’s always a good idea to update your system packages. This ensures that you have the latest security patches and software updates. You can update your system packages using the apt package manager with the following command:

sudo apt update
sudo apt upgrade

Step 2. Installing Necessary Dependencies.

Before installing Postfix, you’ll need to install a few dependencies. These include mailutils, which provides a collection of utilities for handling mail, and net-tools, which provides networking utilities. You can install these dependencies using the following command:

sudo apt install mailutils net-tools

Step 3. Install Postfix on Debian 12.

Now install Postfix using the apt package manager with the following command below:

sudo apt install postfix

During the installation, you’ll be prompted to choose a type of mail configuration. Choose “Internet Site”, also you’ll then be asked to enter the system mail name, which is usually the same as your domain name.

After the installation is complete, you can verify that Postfix is running correctly with the following command:

sudo systemctl status postfix

If everything is set up correctly, you should see that the Postfix service is active (running).

Step 4. Configuring Postfix.

After installing Postfix, the next step is to configure it. The main configuration file for Postfix is /etc/postfix/main.cf. This file contains various parameters that control the operation of the Postfix mail system.

The main.cf file is the primary configuration file for Postfix. It contains a series of parameters, each of which controls a specific aspect of Postfix’s behavior. Some of the key parameters you’ll need to configure include:

• myhostname: This parameter specifies the internet hostname of the mail system. It should be a fully qualified domain name (FQDN).
• mydomain: This parameter specifies the internet domain name of the mail system.
• mynetworks: This parameter specifies the IP networks that your mail system will serve.

To set up the basic Postfix settings, open the main.cf file in a text editor:

sudo nano /etc/postfix/main.cf

Then, set the myhostname, mydomain, and mynetworks parameters as needed. For example:

myhostname = mail.idroot.us
mydomain = idroot.us
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128

Save and close the file when you’re done. Then, restart Postfix for the changes to take effect:

sudo systemctl restart postfix

Step 5. Configuring SMTP and SMTP-Auth.

SMTP (Simple Mail Transfer Protocol) is the protocol used by Postfix to send and receive mail. SMTP-Auth is a mechanism that allows the mail server to authenticate the identity of the user. To configure SMTP and SMTP-Auth, you’ll need to modify the main.cf file. Open the file in a text editor:

sudo nano /etc/postfix/main.cf

Then, add the following lines to the end of the file:

smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = $myhostname
broken_sasl_auth_clients = yes

Save and close the file when you’re done. Then, restart Postfix for the changes to take effect:

sudo systemctl restart postfix

Step 6. Setting Up Mail Accounts (Virtual Users)

Postfix allows you to set up virtual users, which are email accounts that don’t correspond to system users. To set up virtual users, you’ll need to modify the main.cf file. Open the file in a text editor:

sudo nano /etc/postfix/main.cf

Then, add the following lines to the end of the file:

virtual_alias_maps = hash:/etc/postfix/virtual

Next, create the /etc/postfix/virtual file and add your virtual users. Each line should be in the format virtual_user@your_domain.com real_user, where virtual_user@your_domain.com is the email address of the virtual user, and real_user is the system user to whom the mail should be delivered.

After adding your virtual users, run the following command to create the necessary database for Postfix:

sudo postmap /etc/postfix/virtual

Finally, restart Postfix for the changes to take effect:

sudo systemctl restart postfix

Step 7. Hardening Postfix for Security and Privacy.

Security is a crucial aspect of any mail server. Postfix comes with a number of security features built-in, but there are additional steps you can take to harden your Postfix installation.

Basic Hardening Techniques

There are several basic hardening techniques you can use to improve the security of your Postfix installation:

• Disable VRFY: The VRFY command can be used by attackers to verify whether a specific email address exists on your mail server. You can disable the VRFY command by adding the following line to your main.cf file:

disable_vrfy_command = yes

• Prevent Unwanted Email Relaying: Email relaying is the process of transferring an email from one server to another. Unwanted email relaying can lead to your mail server being used for spam. You can prevent unwanted email relaying by restricting the networks that are allowed to relay mail through your server. This can be done by setting the mynetworks parameter in your main.cf file.
• Enable HELO: The HELO command is used by SMTP servers to identify themselves. You can require that all SMTP clients send a HELO command by adding the following line to your main.cf file:

smtpd_helo_required = yes

Advanced Security Configurations

In addition to the basic hardening techniques, there are several advanced security configurations you can use to further improve the security of your Postfix installation:

• Enable TLS: Transport Layer Security (TLS) is a protocol that provides secure communications over a network. You can enable TLS in Postfix by adding the following lines to your main.cf file:

smtpd_tls_security_level = may
smtpd_tls_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file = /etc/ssl/private/ssl-cert-snakeoil.key

• Enable SMTP-Auth: SMTP-Auth is a mechanism that allows the mail server to authenticate the identity of the user. You can enable SMTP-Auth in Postfix by adding the following lines to your main.cf file:

smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous

Preventing Unwanted Email Relaying

As mentioned earlier, unwanted email relaying can lead to your mail server being used for spam. You can prevent unwanted email relaying by restricting the networks that are allowed to relay mail through your server. This can be done by setting the mynetworks parameter in your main.cf file.

Enabling TLS Logging and Testing Keys

To enable TLS logging in Postfix, add the following line to your main.cf file:

smtpd_tls_loglevel = 1

This will log all TLS activity to the mail log.

Step 8. Testing the Mail Server.

To test the operation of your mail server, you can send a test email with the mail command. For example, to send a test email to user@example.com, you can use the following command:

echo "This is a test email." | mail -s "Test Email" user@example.com

Check the inbox of user@example.com to see if the test email arrives. If it doesn’t, check the mail log for any errors or warnings.

Congratulations! You have successfully installed Postfix. Thanks for using this tutorial for installing the latest version of Postfix mail on Debian 12 Bookworm. For additional help or useful information, we recommend you check the official Postfix website.