iRedMail   //  Document Index

Enable SMTPS service (SMTP over SSL, port 465)

How to enable SMTPS

To enable SMTPS, you should configure Postfix to listen on port 465 first, then open port 465 in iptables.

Please append below lines in Postfix config file /etc/postfix/master.cf (Linux/OpenBSD) or /usr/local/etc/postfix/master.cf (FreeBSD):

465     inet  n       -       n       -       -       smtpd
  -o syslog_name=postfix/smtps
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  -o content_filter=smtp-amavis:[127.0.0.1]:10026

Restart Postfix service to enable SMTPS.

WARNING: Please make sure you have Amavisd listening on port 10026 (and 10024, 9998).

Open port 465 in firewall

On RHEL/CentOS

• on RHEL/CentOS 6, please update iptables rule file /etc/sysconfig/iptables, add one rule (third line in below code) for port 465, then restart iptables service.

# Part of file: /etc/sysconfig/iptables
-A INPUT -p tcp --dport 25 -j ACCEPT
-A INPUT -p tcp --dport 587 -j ACCEPT
-A INPUT -p tcp --dport 465 -j ACCEPT

• on RHEL/CentOS 7, please add file /etc/firewalld/services/smtps.xml, with content below

<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>Enable SMTPS</short>
  <description>Enable SMTPS.</description>
  <port protocol="tcp" port="465"/>
</service>

Update file /etc/firewalld/zones/iredmail.xml, enable smtps service by inserting line <service name="smtps"/> inside <zone></zone> block like below:

<zone>
    ...
    <service name="smtps"/>
</zone>

Restart firewalld service:

# firewall-cmd --complete-reload

On Debian/Ubuntu

nftables

Latest iRedMail releases use nftables on Debian/Ubuntu, you can find its config file /etc/nftables.conf, add port 465 under the line for submission (port 587, 3rd line in example below) like below:

        # smtp/submission
        tcp dport 25 accept
        tcp dport 587 accept
        tcp dport 465 accept

Restart nftables service is required.

iptables

Old iRedMail releases use iptables on Debian/Ubuntu, you can find iptables rule file /etc/default/iptables, please add one rule (third line in below code) for port 465, then restart iptables service.

# Part of file: /etc/default/iptables
-A INPUT -p tcp --dport 25 -j ACCEPT
-A INPUT -p tcp --dport 587 -j ACCEPT
-A INPUT -p tcp --dport 465 -j ACCEPT

Restart iptables service is required.

on OpenBSD

On OpenBSD, please append service smtps in /etc/pf.conf, parameter mail_services=:

# Part of file: /etc/pf.conf
mail_services="{www, https, submission, imap, imaps, pop3, pop3s, ssh, smtps}"

Reload PF rule file:

# pfctl -f /etc/pf.conf