2

I'm trying to set up postfix to send mail through Gmail's SMTP server on port 587. Here's what I've put in my /etc/postfix/main.cf:

relayhost = [smtp.gmail.com]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_sasl_mechanism_filter = plain
smtp_tls_CAfile = /etc/postfix/cacert.pem
smtp_use_tls = yes

However, I'm running into TLS problem since /etc/postfix/cacert.pem, which seems to be suggested everywhere online, doesn't really exist on my system (OS X 10.9.3).

Therefore, what is the right CAfile to use? Any help is greatly appreciated.

On a side note, for now I'm using the workaround

smtp_tls_security_level = may

which works. However, I suppose this is a cheap fix, and I'm worried about the security.

Improve this question

2 Answers 2

Reset to default
3

The option specifies where the root certificates of the trusted issuers are located.

On OS X they are stored in the Keychain.

You can extract them with

$ sudo security find-certificate -a -p /System/Library/Keychains/SystemRootCertificates.keychain > /etc/pki/tls/certs/ca-bundle.crt

And then

smtpd_tls_CAfile = /etc/pki/tls/certs/ca-bundle.crt

Edit Keep in mind that when Apple updates the root certificates in the Keychain you will have to export them again.

Improve this answer
4
  • Thank you for the solution and clarification. It worked.
    – 4ae1e1
    Commented Jun 13, 2014 at 7:53
  • Hmm, do you know how often Apple updates root certificates? I'll run a cron job for that.
    – 4ae1e1
    Commented Jun 13, 2014 at 7:55
  • Also note that Google publishes a .pem file of root CA certs you should trust when connecting to Google. It's available from their PKI FAQ here: pki.google.com/faq.html. The PEM file itself is here: pki.google.com/roots.pem
    – Spiff
    Commented Jun 13, 2014 at 7:58
  • @KevinSayHi Actually I don't really know (I never checked)
    – Matteo
    Commented Jun 13, 2014 at 7:59
0

You can set up Postfix to send email through your Google account on modern OS Xs by adding the following lines to /etc/postfix/main.cf (eg. by sudo sh -c 'cat >> /etc/postfix/main.cf'):

relayhost=smtp.gmail.com:587
smtp_sasl_auth_enable=yes
smtp_sasl_password_maps=hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options=noanonymous
smtp_sasl_mechanism_filter=plain
smtp_use_tls=yes
smtp_tls_security_level=encrypt
tls_random_source=dev:/dev/urandom

Then generate an application-specific password and use it to create the contents of /etc/postfix/sasl_passwd (eg. by sudo sh -c 'cat > /etc/postfix/sasl_passwd):

smtp.gmail.com:587 [email protected]:my_app_spec_password

(Remember to fix permissions, eg. sudo chmod 440 /etc/postfix/sasl_passwd).

Start the postfix server (if it is not already started)

$ sudo launchctl start org.postfix.master

or (if postfix is already started) reload the configuration

$ sudo postfix reload

Now your can send email from the command line:

$ mailx -s 'Test email 1' [email protected]
Testing, testing...^D

The mail server stops again at some point, so you might need to start it again the next time you need to use it:

$ sudo launchctl start org.postfix.master
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .