I am setting up a new VPS server with LEMP. The only piece missing now is the mail server. Do I need to do something special to make it secure? or it is already secured when the installation is completed?

I think the right term is hardening postfix, does it make sense?

1 Answer 1


There are a lot of guides online regarding the config and steps for 'hardening' postfix.

This one courtesy of http://security-24-7.com/hardening-guide-for-postfix-2-x/

Hardening guide for Postfix 2.x

Make sure the Postfix is running with non-root account:

ps aux | grep postfix | grep -v '^root'

Change permissions and ownership on the destinations below:

chmod 755 /etc/postfix
chmod 644 /etc/postfix/*.cf
chmod 755 /etc/postfix/postfix-script*
chmod 755 /var/spool/postfix
chown root:root /var/log/mail*
chmod 600 /var/log/mail*

Edit using nano or vi, the file /etc/postfix/main.cf and add make the following changes: Modify the myhostname value to correspond to the external fully qualified domain name (FQDN) of the Postfix server, for example:

myhostname = myserver.example.com

Configure network interface addresses that the Postfix service should listen on, for example:

inet_interfaces =

Configure Trusted Networks, for example:

mynetworks =,,

Configure the SMTP server to masquerade outgoing emails as coming from your DNS domain, for example:

myorigin = example.com

Configure the SMTP domain destination, for example:

mydomain = example.com

Configure to which SMTP domains to relay messages to, for example:

relay_domains = example.com

Configure SMTP Greeting Banner:

smtpd_banner = $myhostname

Limit Denial of Service Attacks:

default_process_limit = 100
smtpd_client_connection_count_limit = 10
smtpd_client_connection_rate_limit = 30
queue_minfree = 20971520
header_size_limit = 51200
message_size_limit = 10485760
smtpd_recipient_limit = 100

Restart the Postfix daemon:

service postfix restart
  • 1
    very impressive, tks
    – Timmy
    Feb 8, 2014 at 23:59
  • 6
    I also think that you should include disabling the VRFY command so that usernames cannot be easily enumerated. postconf -ev disable_vrfy_command=yes
    – Mark S.
    Jan 29, 2015 at 17:28
  • 2
    Note that /usr/lib/postfix/sbin/master process can run as root and that's ok - see security.stackexchange.com/questions/71922 Jun 19, 2017 at 7:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .