This is a warning: only do this at home, instead of don’t do this at home. On your local home network that is behind a firewall and/or gateway.
Edit: Philip Paeps sent me a few suggestions to restrict things even more. I have adapted this blog item to mention all of them.
Unfortunately there are companies that make and made printers and then don’t provide firmware upgrades for it.
You end up with a scanner/printer that works perfectly fine. Except you can’t find any SMTP servers without TLS anymore. Because rightfully so has more or less every E-mail provider turned off plain text SMTP.
Now your printer cannot send the scanned documents over E-mail anymore. Firmware upgrade of your scanner/printer? What if there is none?
What to do? Run a unencrypted postfix smtpd on some scrap computer on your local network, that relays your mails with its smtp client to a TLS enabled SMTP server.
apt-get install postfix # and select Internet site
I didn’t want fake security by having authentication on the smtpd side, as there will be no encryption between printer and our local postfix. When somebody listens on your local network they would not only have the PDFs that you scanned with your scanner/printer, they will also have those authentication tokens.
I suppose you can add authentication, but then at least don’t be silly and use usernames and passwords that you use somewhere else. Note that some really old scanners/printers also can’t do SMTP with authentication.
I used these relay_restrictions for smtpd. We will place the printer’s IP address in/within mynetworks, so we will relay for it through permit_mynetworks.
smtpd_relay_restrictions = permit_mynetworks reject_unauth_destination
The mydestination should be as restricted as possible so we’ll just empty it (no local delivery at all):
mydestination =
local_recipient_maps =
local_transport = error:local delivery is disabled
You can now also remove the local delivery agent from master.cf if you want. We restrict the mynetworks of course too. The scanner/printer is with DHCP on 192.168.0.0/24, so add that:
mydestination =
mynetworks = 127.0.0.0/8 192.168.0.0/24
Even better is to have your scanner/printer on a fixed IP address and then use that one IP address:
mynetworks = 127.0.0.0/8 192.168.0.11
In fact, when the scrap computer has a fixed IP address then you can further restrict things by using inet_interfaces of course:
inet_interfaces = 192.168.0.14, 127.0.0.1
And now we configure the relayhost, we will relay to our TLS enabled SMTP(s) server:
relayhost = [smtps.server.org]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_security_level = encrypt
header_size_limit = 4096000
message_size_limit = 524288000
Now make a file /etc/postfix/sasl_passwd to add the username / password. After that of course run postmap /etc/postfix/sasl_passwd
[smtps.server.org]:587 username:password
We now on the printer configure the scrap computer’s local network IP address or DHCP hostname as SMTP server.
Other security considerations that are possible is to place printer and scrap computer on a VLAN or let there be a crossed UTP cable between them. But if you are going to do those things then you also know how to do it yourself. Such things do make sense: your easily hackable LED lamps and even more easily hackable Smart TV don’t need to talk to your printer nor this scrap computer. VLAN everything!