From 43f39850ffd9e658b4d783106ea32d9f5430e633 Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Tue, 20 Sep 2016 16:55:58 +0200 Subject: Postscreen: Give temporary whitelist status to primary MX addresses only. --- roles/MX/templates/etc/postfix/main.cf.j2 | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) (limited to 'roles/MX/templates/etc/postfix/main.cf.j2') diff --git a/roles/MX/templates/etc/postfix/main.cf.j2 b/roles/MX/templates/etc/postfix/main.cf.j2 index 718be00..86c20cd 100644 --- a/roles/MX/templates/etc/postfix/main.cf.j2 +++ b/roles/MX/templates/etc/postfix/main.cf.j2 @@ -115,8 +115,15 @@ postscreen_dnsbl_sites = list.dnswl.org=127.[0..255].[0..255].1*-3 list.dnswl.org=127.[0..255].[0..255].[2..255]*-4 -postscreen_greet_action = enforce -postscreen_whitelist_interfaces = !88.80.11.28 ![2a00:16b0:242:13::de30] static:all +postscreen_greet_action = enforce +postscreen_whitelist_interfaces = +{%- for ip in lookup('pipe', 'dig +short '+ postfix_instance.MX.backup +' A').splitlines() %} + !{{ ip }} +{%- endfor %} +{%- for ip in lookup('pipe', 'dig +short '+ postfix_instance.MX.backup +' AAAA').splitlines() %} + ![{{ ip }}] +{%- endfor %} + static:all smtpd_client_restrictions = permit_mynetworks -- cgit v1.2.3