fripost-ansible/roles/MSA/files/usr/local, branch master Fripost ansible scripts postfix-sender-login: Better hardening. 2020-05-21T01:40:53+00:00 Guilhem Moulin guilhem@fripost.org 2020-05-20T13:46:27+00:00 6d1daa0424c168eae4bfa9f6772add3f77ec506f Run as a dedicated user, not ‘postfix’. 
Run as a dedicated user, not ‘postfix’.
postfix-sender-login: strip extension before lookup. 2017-06-13T16:39:25+00:00 Guilhem Moulin guilhem@fripost.org 2017-06-13T16:27:55+00:00 402799906a53aeb3c6feff9b3e98d750acd559e0 Users can add an extension (following postconf(5)'s $recipient_delimiter) to the local part of any envelope sender address already allowed. 
Users can add an extension (following postconf(5)'s
$recipient_delimiter) to the local part of any envelope sender address
already allowed.
postfix-sender-login: wibble 2017-06-05T14:46:54+00:00 Guilhem Moulin guilhem@fripost.org 2017-06-05T14:46:54+00:00 9fc349a989f536b3ccb688db4bcf1ea36774a393 






postfix-sender-login: terminate the worker after 32*$nProc connections to release ressources.
2017-06-01T09:00:58+00:00

Guilhem Moulin
guilhem@fripost.org

2017-06-01T09:00:58+00:00

8cfd584400a9852c4bd7c4b3d50ff0cacc8ec019












postfix-sender-login: handle EINTR in read(2) and write(2) calls.
2017-06-01T08:43:59+00:00

Guilhem Moulin
guilhem@fripost.org

2017-06-01T08:43:59+00:00

63bca29310bc899ce6c7068f376cbfb426da3571












postfix-sender-login: pre-fork 2 servers.
2017-06-01T08:40:28+00:00

Guilhem Moulin
guilhem@fripost.org

2017-06-01T08:08:16+00:00

acd15ca11a510d3c5cb31f25e173de86fa570300

On Linux perl's allow multiple children to block in a call to accept(2)
so we don't need to place a lock around the call.





On Linux perl's allow multiple children to block in a call to accept(2)
so we don't need to place a lock around the call.







Don't let authenticated client use arbitrary sender addresses.
2017-05-31T23:09:00+00:00

Guilhem Moulin
guilhem@fripost.org

2017-05-31T19:42:32+00:00

6e39bad3fbe75b88fca4c2e2aad8eb51af14b1be

The following policy is now implemented:

    * users can use their SASL login name as sender address;
    * alias and/or list owners can use the address as envelope sender;
    * domain postmasters can use arbitrary sender addresses under their
      domains;
    * domain owners can use arbitrary sender addresses under their domains,
      unless it is also an existing account name;
    * for known domains without owner or postmasters, other sender addresses
      are not allowed; and
    * arbitrary sender addresses under unknown domains are allowed.





The following policy is now implemented:

    * users can use their SASL login name as sender address;
    * alias and/or list owners can use the address as envelope sender;
    * domain postmasters can use arbitrary sender addresses under their
      domains;
    * domain owners can use arbitrary sender addresses under their domains,
      unless it is also an existing account name;
    * for known domains without owner or postmasters, other sender addresses
      are not allowed; and
    * arbitrary sender addresses under unknown domains are allowed.