# Smtp proxy with postfix **URL:** \ **Category:** NGINX\ **Created:** [December 18, 2015, 8:09pm UTC](https://www.ruby-forum.com/t/smtp-proxy-with-postfix/243677 "2015-12-18T20:09:41Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Sadaf\_N](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/858c86/32.png) [@Sadaf\_N](https://www.ruby-forum.com/u/Sadaf_N)\ **Post date:** [December 18, 2015, 8:09pm UTC](https://www.ruby-forum.com/t/smtp-proxy-with-postfix/243677/1 "2015-12-18T20:09:41Z")
Hello, I’d like to build a smtp Proxy with nginx (v1.8.0) and postfix (v2.9.6) on Debian7. Somehow I’m stuck with the following problem: 1. Configuration1: smtp\_auth login plain cram-md5; xclient on; everybody has to authenticate!! 1. Configuration2: smtp\_auth none; xclient on; In Postfix, I have set: smtpd\_authorized\_xclient\_hosts = xx.xxx.xx.xx What I’d like to achive is the current postfix behaviour: 1. Receive emails from every Sender 2. Only authorized users can send emails from outside the Network Help is appreciated… I found bits and pieces in the Forum and other places - but nothing seems to be consistent… Thanks, Norbert Posted at Nginx Forum: > **[smtp proxy with postfix](https://forum.nginx.org/read.php?2,263559,263559#msg-263559)** > > Hello, I'd like to build a smtp Proxy with nginx (v1.8.0) and postfix (v2.9.6) on Debian7. Somehow I'm stuck with the following problem: 1) Configuration1: smtp\_auth login plain cram-md5; xclient on; ---
**Author:** ![Cugar15](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/b4bc9f/32.png) [@Cugar15](https://www.ruby-forum.com/u/Cugar15)\ **Post date:** [December 19, 2015, 5:45pm UTC](https://www.ruby-forum.com/t/smtp-proxy-with-postfix/243677/2 "2015-12-19T17:45:19Z")
## smtp\_auth set + xclient on smtp\_auth none + xclient off ? _B. R._ ---
**Author:** ![Cugar15](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/b4bc9f/32.png) [@Cugar15](https://www.ruby-forum.com/u/Cugar15)\ **Post date:** [December 30, 2015, 6:05pm UTC](https://www.ruby-forum.com/t/smtp-proxy-with-postfix/243677/3 "2015-12-30T18:05:10Z")
Well, here we go again… somehow, I’m not getting this smtp proxy to work with nginx. I moved to haproxy, and this combination works ok. Creating a tcp connection passes over to postfix and the postfix prompt is seen using a telnet connection - and all works just fine. However, I’d like to stick with nginx if possible…actually if possible at all! Here are my findings - and maybe somebody can help to confirm or disagree: 1. Xclient = on will basically bypass sals authorithation in postfix. Postfix/Sasl will assume that the message is already authenticated. All the auth login commands are basically exectuted 2. Xclient = off will not trigger any sals authentication in postfix. Somehow, it seems, that the credentials are not forwarded to postfix Is this really the expected behaviour? IMAP behaviour is completely different. Here the authentication works just fine… Comments appreciated, Cugar15 Posted at Nginx Forum: > **[Re: smtp proxy with postfix](https://forum.nginx.org/read.php?2,263559,263783#msg-263783)** > > Hello, I'd like to build a smtp Proxy with nginx (v1.8.0) and postfix (v2.9.6) on Debian7. Somehow I'm stuck with the following problem: 1) Configuration1: smtp\_auth login plain cram-md5; xclient on; ---
**Author:** ![Cugar15](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/b4bc9f/32.png) [@Cugar15](https://www.ruby-forum.com/u/Cugar15)\ **Post date:** [December 30, 2015, 6:10pm UTC](https://www.ruby-forum.com/t/smtp-proxy-with-postfix/243677/4 "2015-12-30T18:10:26Z")
Hello! On Wed, Dec 30, 2015 at 08:20:27AM -0500, Cugar15 wrote: > Well, here we go again… somehow, I’m not getting this smtp proxy to work > with nginx. > I moved to haproxy, and this combination works ok. Creating a tcp connection > passes over to postfix > and the postfix prompt is seen using a telnet connection - and all works > just fine. > > However, I’d like to stick with nginx if possible…actually if possible at > all! If TCP proxying is enough in your case - you can consider using stream proxy module instead, see here: > **[Module ngx\_stream\_core\_module](http://nginx.org/en/docs/stream/ngx_stream_core_module.html)** > Here are my findings - and maybe somebody can help to confirm or disagree: > > 1. Xclient = on will basically bypass sals authorithation in postfix. > Postfix/Sasl will assume that the message is already authenticated. > All the auth login commands are basically exectuted Yes. All information obtained by nginx is passed via the XCLIENT command. > 1. Xclient = off will not trigger any sals authentication in postfix. > Somehow, it seems, that the credentials are not forwarded to postfix Yes. Authentication is checked by auth\_http script, and there is no need to do additional authentication to SMTP backend. As long as appropriate checks are done by auth\_http, it’s enough to allow your nginx IP to submit mail. If it’s not enough in your particular setup (e.g., you want correct “Received” headers to be added), enable XCLIENT. > Is this really the expected behaviour? > IMAP behaviour is completely different. Here the authentication works just > fine… Yes, that’s expected. – Maxim D. > **[nginx](http://nginx.org/)** ---
**Author:** ![Cugar15](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/b4bc9f/32.png) [@Cugar15](https://www.ruby-forum.com/u/Cugar15)\ **Post date:** [December 30, 2015, 6:15pm UTC](https://www.ruby-forum.com/t/smtp-proxy-with-postfix/243677/5 "2015-12-30T18:15:42Z")
HI Maxim, thanks for reply! 1. Interesting, I will look into the ngx\_stream\_core\_module 2. I still have one question for Xclient = on - since I’m banged my head against it for days now: You state: All information obtained by nginx is passed via the XCLIENT command. Is this true for all credentials?? Like username and password as optained with a ‘auth login’ sequence: Somehow, I can find: sasl\_method=XCLIENT, sasl\_username=removed\_email\_address@domain.invalid in the postfix logfile. However, I cannot find the password information… Thanks again, Cugar15 Posted at Nginx Forum: > **[Re: smtp proxy with postfix](https://forum.nginx.org/read.php?2,263559,263794#msg-263794)** > > Hello, I'd like to build a smtp Proxy with nginx (v1.8.0) and postfix (v2.9.6) on Debian7. Somehow I'm stuck with the following problem: 1) Configuration1: smtp\_auth login plain cram-md5; xclient on; ---
**Author:** ![Cugar15](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/b4bc9f/32.png) [@Cugar15](https://www.ruby-forum.com/u/Cugar15)\ **Post date:** [December 30, 2015, 6:17pm UTC](https://www.ruby-forum.com/t/smtp-proxy-with-postfix/243677/6 "2015-12-30T18:17:27Z")
Hello! On Wed, Dec 30, 2015 at 10:49:06AM -0500, Cugar15 wrote: > Is this true for all credentials?? Like username and password as optained > with a ‘auth login’ sequence: > Somehow, I can find: sasl\_method=XCLIENT, [sasl\_username=removed\_email\_address@domain.invalid](mailto:sasl_username=removed_email_address@domain.invalid) > in the postfix logfile. > However, I cannot find the password information… Passwords are not present in XCLIENT and aren’t expected to. Authentication is done by nginx and it’s nginx responsibility to check passwords, and it does so using auth\_http service. Note well that in many authentication methods passwords aren’t sent at all, appropriate hashes are used instead. – Maxim D. > **[nginx](http://nginx.org/)**