summaryrefslogtreecommitdiffstats
path: root/roles/MX/templates/etc/postfix/main.cf.j2
blob: 6c2004a2359bb6ae14e0c6ebbc2ed28be0226ee5 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
########################################################################
# MX configuration
#
# {{ ansible_managed }}
# Do NOT edit this file directly!

smtpd_banner     = $myhostname ESMTP $mail_name (Debian/GNU)
biff             = no
readme_directory = no
mail_owner       = postfix

delay_warning_time     = 4h
maximal_queue_lifetime = 5d

myorigin            = /etc/mailname
myhostname          = mx{{ mxno | default('') }}.$mydomain
mydomain            = {{ ansible_domain }}
append_dot_mydomain = no

# Turn off all TCP/IP listener ports except that necessary for the mail
# exchange.
master_service_disable = !smtp.inet inet

queue_directory       = /var/spool/postfix-{{ postfix_instance[inst].name }}
data_directory        = /var/lib/postfix-{{ postfix_instance[inst].name }}
multi_instance_group  = {{ postfix_instance[inst].group | default('') }}
multi_instance_name   = postfix-{{ postfix_instance[inst].name }}
multi_instance_enable = yes

# This server is a Mail eXchange
mynetworks_style = host
inet_interfaces  = all
inet_protocols   = all

# No local delivery
mydestination        =
local_transport      = error:5.1.1 Mailbox unavailable
alias_maps           =
alias_database       =
local_recipient_maps =

message_size_limit  = 67108864
recipient_delimiter = +

# Forward everything to our internal mailhub
{% if 'MTA-out' in group_names %}
relayhost     = [127.0.0.1]:{{ MTA_out.port }}
{% else %}
relayhost     = [{{ MTA_out.host }}]:{{ MTA_out.port }}
{% endif %}
relay_domains =

# Virtual transport
{% if 'LDA' in group_names %}
virtual_transport = smtpl:[127.0.0.1]:{{ LDA.port }}
{% else %}
virtual_transport = smtps:[{{ LDA.host }}]:{{ LDA.port }}
{% endif %}

virtual_mailbox_domains = ldap:$config_directory/virtual/mailbox_domains.cf
virtual_alias_maps      = pcre:$config_directory/virtual/reserved_alias.pcre
                          ldap:$config_directory/virtual/alias.cf
                          # stop the alias resolution (by making finding
                          # an A -> A alias) before searching for
                          # catch-alls and domain aliases
                          $virtual_mailbox_maps
                          ldap:$config_directory/virtual/alias_domains.cf
                          ldap:$config_directory/virtual/catchall.cf
virtual_mailbox_maps    = ldap:$config_directory/virtual/mailbox.cf
                          ldap:$config_directory/virtual/list.cf
transport_maps          = cdb:$config_directory/virtual/transport_reserved_alias
                          ldap:$config_directory/virtual/transport_list.cf

# Don't rewrite remote headers
local_header_rewrite_clients     =
# Pass the client information along to the content filter
smtp_send_xforward_command       = yes
# Avoid splitting the envelope and scanning messages multiple times
smtp_destination_recipient_limit = 1000
# Tolerate occasional high latency
smtp_data_done_timeout           = 1200s

# Tunnel everything through IPSec
smtp_tls_security_level = none
{% if 'MTA-out' in group_names %}
smtp_bind_address       = 127.0.0.1
{% else %}
smtp_bind_address       = 172.16.0.1
{% endif %}

# TLS
smtpd_tls_security_level        = may
smtpd_tls_cert_file             = /etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file              = /etc/ssl/private/ssl-cert-snakeoil.key
smtpd_tls_CApath                = /etc/ssl/certs/
smtpd_tls_session_cache_database= btree:$data_directory/smtpd_tls_session_cache
smtpd_tls_received_header       = yes
smtpd_tls_ask_ccert             = yes
smtpd_tls_fingerprint_digest    = sha1
smtpd_tls_eecdh_grade           = strong
tls_random_source               = dev:/dev/urandom


# http://en.linuxreviews.org/HOWTO_Stop_spam_using_Postfix
# http://www.howtoforge.com/block_spam_at_mta_level_postfix

strict_rfc821_envelopes = yes
smtpd_delay_reject      = yes
disable_vrfy_command    = yes

# UCE control
invalid_hostname_reject_code        = 554
multi_recipient_bounce_reject_code  = 554
non_fqdn_reject_code                = 554
relay_domains_reject_code           = 554
unknown_address_reject_code         = 554
unknown_client_reject_code          = 554
unknown_hostname_reject_code        = 554
unknown_local_recipient_reject_code = 554
unknown_relay_recipient_reject_code = 554
unknown_virtual_alias_reject_code   = 554
unknown_virtual_mailbox_reject_code = 554
unverified_recipient_reject_code    = 554
unverified_sender_reject_code       = 554


smtpd_client_restrictions =
    permit_mynetworks
    reject_rbl_client zen.spamhaus.org
    reject_rbl_client bl.spamcop.net

smtpd_helo_required     = yes
smtpd_helo_restrictions =
    permit_mynetworks
    reject_non_fqdn_helo_hostname
    reject_invalid_helo_hostname

smtpd_sender_restrictions =
    reject_non_fqdn_sender
    reject_unknown_sender_domain

smtpd_recipient_restrictions =
    # RFC requirements
    reject_non_fqdn_recipient
    reject_unknown_recipient_domain
    permit_mynetworks
    reject_unauth_destination
    check_policy_service unix:private/postgrey

smtpd_data_restrictions =
    reject_unauth_pipelining