I am setting up a new VPS server with LEMP. The only piece missing now is the mail server. Do I need to do something special to make it secure? or it is already secured when the installation is completed?

I think the right term is hardening postfix, does it make sense?

1 Answer 1


There are a lot of guides online regarding the config and steps for 'hardening' postfix.

This one courtesy of http://security-24-7.com/hardening-guide-for-postfix-2-x/

Hardening guide for Postfix 2.x

Make sure the Postfix is running with non-root account:

ps aux | grep postfix | grep -v '^root'

Change permissions and ownership on the destinations below:

chmod 755 /etc/postfix
chmod 644 /etc/postfix/*.cf
chmod 755 /etc/postfix/postfix-script*
chmod 755 /var/spool/postfix
chown root:root /var/log/mail*
chmod 600 /var/log/mail*

Edit using nano or vi, the file /etc/postfix/main.cf and add make the following changes: Modify the myhostname value to correspond to the external fully qualified domain name (FQDN) of the Postfix server, for example:

myhostname = myserver.example.com

Configure network interface addresses that the Postfix service should listen on, for example:

inet_interfaces =

Configure Trusted Networks, for example:

mynetworks =,,

Configure the SMTP server to masquerade outgoing emails as coming from your DNS domain, for example:

myorigin = example.com

Configure the SMTP domain destination, for example:

mydomain = example.com

Configure to which SMTP domains to relay messages to, for example:

relay_domains = example.com

Configure SMTP Greeting Banner:

smtpd_banner = $myhostname

Limit Denial of Service Attacks:

default_process_limit = 100
smtpd_client_connection_count_limit = 10
smtpd_client_connection_rate_limit = 30
queue_minfree = 20971520
header_size_limit = 51200
message_size_limit = 10485760
smtpd_recipient_limit = 100

Restart the Postfix daemon:

service postfix restart
  • 1
    very impressive, tks
    – Timmy
    Feb 8, 2014 at 23:59
  • 6
    I also think that you should include disabling the VRFY command so that usernames cannot be easily enumerated. postconf -ev disable_vrfy_command=yes
    – Mark S.
    Jan 29, 2015 at 17:28
  • 2
    Note that /usr/lib/postfix/sbin/master process can run as root and that's ok - see security.stackexchange.com/questions/71922 Jun 19, 2017 at 7:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.