Excplicitely make local services run on localhost.

4 files changed, 7 insertions, 6 deletions

diff --git a/roles/IMAP/templates/etc/postfix/main.cf.j2 b/roles/IMAP/templates/etc/postfix/main.cf.j2
index 2da85e9..df2e9fb 100644
--- a/roles/IMAP/templates/etc/postfix/main.cf.j2
+++ b/roles/IMAP/templates/etc/postfix/main.cf.j2
@@ -1,41 +1,41 @@
 ########################################################################
 # MDA configuration
 #
 # {{ ansible_managed }}
 # Do NOT edit this file directly!
 
 smtpd_banner     = $myhostname ESMTP $mail_name (Debian/GNU)
 biff             = no
 readme_directory = no
 mail_owner       = postfix
 
 delay_warning_time     = 4h
 maximal_queue_lifetime = 5d
 
 myorigin            = /etc/mailname
 myhostname          = mda{{ imapno | default('') }}.$mydomain
 mydomain            = {{ ansible_domain }}
 append_dot_mydomain = no
 
 # Turn off all TCP/IP listener ports except that necessary for the MDA.
-master_service_disable = !2526.inet inet
+master_service_disable = !127.0.0.1:2526.inet inet
 
 queue_directory       = /var/spool/postfix-{{ postfix_instance[inst].name }}
 data_directory        = /var/lib/postfix-{{ postfix_instance[inst].name }}
 multi_instance_group  = {{ postfix_instance[inst].group | default('') }}
 multi_instance_name   = postfix-{{ postfix_instance[inst].name }}
 multi_instance_enable = yes
 
 # This server is a Mail Delivery Agent
 mynetworks_style = host
 inet_interfaces  = 172.16.0.1
 {% if 'MX' in group_names %}
                    127.0.0.1
 {% endif %}
 inet_protocols   = ipv4
 
 # No local delivery
 mydestination        =
 local_transport      = error:5.1.1 Mailbox unavailable
 alias_maps           =
 alias_database       =
diff --git a/roles/common/files/etc/postfix/master.cf b/roles/common/files/etc/postfix/master.cf
index 17613b0..325af1b 100644
--- a/roles/common/files/etc/postfix/master.cf
+++ b/roles/common/files/etc/postfix/master.cf
@@ -1,53 +1,54 @@
 #
 # Postfix master process configuration file.  For details on the format
 # of the file, see the master(5) manual page (command: "man 5 master").
 #
 # Do not forget to execute "postfix reload" after editing this file.
 #
 # ==========================================================================
 # service type  private unpriv  chroot  wakeup  maxproc command + args
 #               (yes)   (yes)   (yes)   (never) (100)
 # ==========================================================================
 smtp      inet  n       -       -       -       -       smtpd
-16132     inet  n       -       -       -       -       smtpd
-2526      inet  n       -       -       -       -       smtpd
-2580      inet  n       -       -       -       -       smtpd
 submission inet n       -       -       -       -       smtpd
 pickup    fifo  n       -       -       60      1       pickup
 cleanup   unix  n       -       -       -       0       cleanup
 qmgr      fifo  n       -       n       300     1       qmgr
 tlsmgr    unix  -       -       -       1000?   1       tlsmgr
 rewrite   unix  -       -       -       -       -       trivial-rewrite
 bounce    unix  -       -       -       -       0       bounce
 defer     unix  -       -       -       -       0       bounce
 trace     unix  -       -       -       -       0       bounce
 verify    unix  -       -       -       -       1       verify
 flush     unix  n       -       -       1000?   0       flush
 proxymap  unix  -       -       n       -       -       proxymap
 proxywrite unix -       -       n       -       1       proxymap
 smtp      unix  -       -       -       -       -       smtp
 smtpl     unix  -       -       -       -       -       smtp
   -o smtp_bind_address=127.0.0.1
 smtps     unix  -       -       -       -       -       smtp
   -o smtp_bind_address=172.16.0.1
 relay     unix  -       -       -       -       -       smtp
 #       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
 showq     unix  n       -       -       -       -       showq
 error     unix  -       -       -       -       -       error
 retry     unix  -       -       -       -       -       error
 discard   unix  -       -       -       -       -       discard
 local     unix  -       n       n       -       -       local
 virtual   unix  -       n       n       -       -       virtual
 lmtp      unix  -       -       -       -       -       lmtp
 anvil     unix  -       -       -       -       1       anvil
 scache    unix  -       -       -       -       1       scache
+127.0.0.1:16132 inet n  -       -       -       -       smtpd
+127.0.0.1:2526 inet n   -       -       -       -       smtpd
+127.0.0.1:2527 inet n   -       -       -       -       smtpd
+127.0.0.1:2580 inet n   -       -       -       -       smtpd
 127.0.0.1:2599 inet n   -       -       -       -       smtpd
   -o cleanup_service_name=cleanup-catchall
 cleanup-catchall unix n -       -       -       0       cleanup
   -o virtual_alias_maps=cdb:$config_directory/virtual/reserved_alias_maps,ldap:$config_directory/virtual/alias_maps.cf,ldap:/etc/postfix-mx/virtual/catchall_maps.cf
 reserved-alias unix  -  n       n       -       -       pipe
   flags=Rhu user=nobody argv=/usr/local/sbin/reserved-alias.pl ${sender} ${original_recipient} @fripost.org
 amavisfeed unix -       -       n       -       2       lmtp
   -o lmtp_destination_recipient_limit=1000
   -o lmtp_send_xforward_command=yes
   -o lmtp_data_done_timeout=1200s
diff --git a/roles/common/templates/etc/postfix/main.cf.j2 b/roles/common/templates/etc/postfix/main.cf.j2
index 5728986..4c56cea 100644
--- a/roles/common/templates/etc/postfix/main.cf.j2
+++ b/roles/common/templates/etc/postfix/main.cf.j2
@@ -31,34 +31,34 @@ virtual_alias_maps    = cdb:/etc/aliases
 alias_database        = $virtual_alias_maps
 
 # Transform local FQDN addresses to addresses routable on the internet
 smtp_generic_maps = pcre:$config_directory/generic.pcre
 
 # Forward everything to our internal mailhub
 {% if 'MTA-out' in group_names %}
 relayhost     = [127.0.0.1]:{{ MTA_out.port }}
 {% else %}
 relayhost     = [{{ MTA_out.host }}]:{{ MTA_out.port }}
 {% endif %}
 relay_domains =
 
 # Tunnel everything through IPSec
 smtp_tls_security_level  = none
 smtp_bind_address        = 172.16.0.1
 smtpd_tls_security_level = none
 
 # Turn off all TCP/IP listener ports except that dedicated to
 # samhain(8), which sadly cannot use pickup through the sendmail binary.
-master_service_disable = !16132.inet inet
+master_service_disable = !127.0.0.1:16132.inet inet
 
 {% set multi_instance = False %}
 {%- for g in postfix_instance.keys() | sort -%}
   {%- if g in group_names -%}
     {%- if not multi_instance -%}
       {%- set multi_instance = True -%}
 ## Other postfix instances
 multi_instance_wrapper     = $command_directory/postmulti -p --
 multi_instance_enable      = yes
 multi_instance_directories =
     {%- endif %} /etc/postfix-{{ postfix_instance[g].name }}
   {%- endif %}
 {% endfor %}
diff --git a/roles/webmail/templates/etc/postfix/main.cf.j2 b/roles/webmail/templates/etc/postfix/main.cf.j2
index e9a2e7d..cb57b23 100644
--- a/roles/webmail/templates/etc/postfix/main.cf.j2
+++ b/roles/webmail/templates/etc/postfix/main.cf.j2
@@ -1,41 +1,41 @@
 ########################################################################
 # Webmail configuration
 #
 # {{ ansible_managed }}
 # Do NOT edit this file directly!
 
 smtpd_banner     = $myhostname ESMTP $mail_name (Debian/GNU)
 biff             = no
 readme_directory = no
 mail_owner       = postfix
 
 delay_warning_time     = 4h
 maximal_queue_lifetime = 5d
 
 myorigin            = /etc/mailname
 myhostname          = webmail{{ webmailno | default('') }}.$mydomain
 mydomain            = {{ ansible_domain }}
 append_dot_mydomain = no
 
 # Turn off all TCP/IP listener ports except that necessary for the webmail.
-master_service_disable = !2580.inet inet
+master_service_disable = !127.0.0.1:2580.inet inet
 
 queue_directory       = /var/spool/postfix-{{ postfix_instance[inst].name }}
 data_directory        = /var/lib/postfix-{{ postfix_instance[inst].name }}
 multi_instance_group  = {{ postfix_instance[inst].group | default('') }}
 multi_instance_name   = postfix-{{ postfix_instance[inst].name }}
 multi_instance_enable = yes
 
 # This server is a nullclient 
 mynetworks_style = host
 inet_interfaces  = loopback-only
 inet_protocols   = all
 
 # No local delivery
 mydestination        =
 local_transport      = error:5.1.1 Mailbox unavailable
 alias_maps           =
 alias_database       =
 local_recipient_maps =
 
 message_size_limit  = 67108864