Hello,
I seek advice on configuring nginx as a mail proxy.
PREMISSES
The existing system is based upon postfix and dovecot.
The system delivers “n” virtual domains, say, mx.example_1.org,
mx.example_2.org, …, mx.example_n.org, all behind a single IP.
There is no “shared” (Subject Alternative Name) certificate, because
adding
or releasing a domain would require a new shared certificate, revoquing
the
old one, and taxing the other domains for the novelty.—I refer to SAN
certs
as “condocerts” (condominium certificates): feel free to use the term
yourself.—
We are not a condo, and therefore, each domain carries its own set of
TLS
certificates, managed autonomously.
Dovecot manages nicely its side of things, with
- per-domain “mail_location”,
- per-domain password database,
- per-domain TLS certificates,
- SNI [Wiki has been closed].
Client authentication is entirely delegated to dovecot;
postfix uses SASL to dovecot’s unix socket.
PROBLEM
Postfix does not support SNI.
OUR AIM
Our aim is to add SNI to port 465 (postfix) using nginx as transparent
mail
proxy.
The following is a mock-up configuration.
mail {
proxy on;
proxy_pass_error_message on;
proxy_buffer 4k; # 4k|8k
proxy_timeout 24h;
xclient on; # Postfix XCLIENT Howto
ssl_dhparam /etc/vmail/dh2048;
ssl_protocols TLSv1.2 TLSv1.1 TLSv1; # SNI supported
ssl_ciphers DHE-RSA-AES256-SHA;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:MAIL:10m;
#ssl_session_timeout =
#smtp_capabilities …; # pass through wanted
<-------
#smtp_auth …; # pass through wanted
<-------
server {
listen 465;
protocol smtp;
ssl on;
timeout 5s;
server_name mx.example_1.org;
#ssl_password_file /etc/vmail/example_1.org/passdb_keys; # to read
.key certificates
ssl_certificate /etc/vmail/example_1.org/ssl/mx.crt;
ssl_certificate_key /etc/vmail/example_1.org/ssl/mx.key;
}
server {
listen 465;
protocol smtp;
ssl on;
timeout 5s;
server_name mx.example_2.org;
#ssl_password_file /etc/vmail/example_2.org/passdb_keys;
ssl_certificate /etc/vmail/example_2.org/ssl/mx.crt;
ssl_certificate_key /etc/vmail/example_2.org/ssl/mx.key;
}
…
server {
listen 465;
protocol smtp;
ssl on;
timeout 5s;
server_name mx.example_n.org;
#ssl_password_file /etc/vmail/example_n.org/passdb_keys;
ssl_certificate /etc/vmail/example_n.com/ssl/mx.crt;
ssl_certificate_key /etc/vmail/example_n.com/ssl/mx.key;
}
}
OPEN QUESTIONS
-
It is not clear how nginx would talk to postfix. One would expect the
proxy to serve
on port, say, 4650, being the port exposed by the router, masking
postfix on
port 465,
but nginx does not seem to have a relevant configuration clause. -
Nginx refuses to start-up, demanding “auth_http”. However, we do not
need
to move
authentication to nginx. What we need is a transparent proxy: nginx
should
listen to
dovecot’s unix socket, just like postfix does.
Thank you for your advice, if any.
Posted at Nginx Forum: