#5121 Sensible postfix sasl security options can't be set from GUI
I've been going through security settings for postfix and it doesn't seem to be possible to set good ones for smtpd sasl security using Webmin.
According to http://www.postfix.org/SASL_README.html :
A more sophisticated policy allows plaintext mechanisms, but only over a TLS-encrypted connection:
/etc/postfix/main.cf:
smtpd_sasl_security_options = noanonymous, noplaintext
smtpd_sasl_tls_security_options = noanonymous
These settings are indeed sensible and work well, and can be set by directly editing main.cf but not using the webmin GUI. (OK, technically main.cf can be edited from the GUI but I mean using Webmin > Servers > Postfix Mail Server > SMTP Authentication And Encryption).
To be honest, I'm not sure which exact settings in the GUI correspond to these variables without looking at the code. It would be helpful if this correspondence was easier to find. But that's a "nice to have" feature whereas the inability to set good secure options is in my view fairly serious.
Update: I think I've found a way to do it! Under SMTP Client Options there's an option SASL security options at the bottom and if you enter "noanonymous, noplaintext" in there it achieves the result. I'm not sure I would have ever discovered this without reading the postfix docs though.
Update: Isn't this a server setting rather than a client setting? It may be in the wrong place anyway. Or I may be confused. It wouldn't be the first time.