Dividing postfix in two instances [UPDATED 2007/11/25]

[UPDATE 2007/11/25]: IP on /etc/postfix/main.cf was wrong. It has been changed from 88.88.88.3 to 88.88.88.2. This ip refers to first instance server.

This article is based on this article

Postfix has a problem when you need to know if mails are inbound or outbound. The only way to differentiate them is by separating traffic in two different servers. Someone could think “why should I separate traffic inbound and outbound?”.

My reason to separate postfix traffic was to avoid outgoing mails to be scanned by the anti-spam filter. This can be done in two ways: cheap or expensive. The way I’m gonna show is the cheapest one. That is by separating traffic in to instances in the same server which is cheaper than doing it on a separate server machines.

I’m gonna use Debian Etch System as example.

PREPARING NETWORK

First of all we need two IP address, one for inbound mails and the other for outbound mails, that is one IP for each postfix instance.

There are two ways of doing it. Configuring a virtual interface or a new real interface.

This configuration can be found in /etc/network/interfaces. Be careful if you manage this configuration remotely, if you apply an incorrect configuration your machine can be disconnected and you cannot access.

Here is an hypothetic example of virtual way:

This is real way:

If you’ve got a DNS server add new entry for the second instance or to /etc/hosts file for example:

CREATING A SECOND INSTANCE FOR OUTBOUND MAILS

When we’ve got networking configuration done then we gonna create the second postfix instance. I supose you already have one instance running. If there’s no one running yet then I recommend you to read this article before.

Copy your existing postfix configuration folder:

Modify or add the following line to /etc/postfix-out/main.cf:

Create this new spool folder and verify your configuration:

If your postfix is chrooted then you must copy the following folders:

CONFIGURING INSTANCES

Now we gonna tell first instance that there’s another one, edit /etc/postfix/main.cf and add the following line:

At this point we need to separate postfix instances so they don’t collide:

Edit /etc/postfix/main.cf and /etc/postfix-out/main.cf and add or edit the following lines:

Replace all mentions to “instance1.domain.com”, you may set before reading this manual, for new instance name “instance2.domain.com”. Remove lines refering to mail fiters like “content_filter = amavis:[127.0.0.1]:10024″ in the following file:

After that modify /etc/postfix*/master.cf on both instance:

The first one (/etc/postfix/master.cf) may look something like that at the begining:

Edit it so it looks like that:

The second one(/etc/postfix-out/master.cf) looks the same but we must remove anti-spam part, because we are doing it to avoid outgoing mail to be scanned:

SMTP AUTHENTICATION

In my case I authenticate users using saslauth, if it’s your case you must change some files:

First stop this daemon

Edit /etc/default/saslauthd. This file may contain a line like that:

We replace for:

Edit /etc/init.d/saslauthd file and find this line:

Replace for:

We are telling saslauthd to authenticate users using the second instance

Finally start it again

STARTING POSTFIX INSTANCES AND TESTING THEM

To test if it works as it’s expected try this:

You can also see if instances are running by typing this:

INSTALLING POSTFIX STARTUP SCRIPT

I prepared a startup script to control both instances at the same time. You should place it in /etc/init.d. I recommend you do a backup of the original before installing the new one.

Download the startup script compressed in BZIP2 or GZIP

Download one of them

Extract, backup the old one and install new.

Your system is ready to run.

There is a little issue I can’t solve. That is separate logs on each instance. In the guide I linked at the beginning says “syslog_facility” directive should be changed. If anyone know how it works his contribution will be wellcome.