blob: 6c2004a2359bb6ae14e0c6ebbc2ed28be0226ee5 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
|
########################################################################
# MX configuration
#
# {{ ansible_managed }}
# Do NOT edit this file directly!
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
biff = no
readme_directory = no
mail_owner = postfix
delay_warning_time = 4h
maximal_queue_lifetime = 5d
myorigin = /etc/mailname
myhostname = mx{{ mxno | default('') }}.$mydomain
mydomain = {{ ansible_domain }}
append_dot_mydomain = no
# Turn off all TCP/IP listener ports except that necessary for the mail
# exchange.
master_service_disable = !smtp.inet inet
queue_directory = /var/spool/postfix-{{ postfix_instance[inst].name }}
data_directory = /var/lib/postfix-{{ postfix_instance[inst].name }}
multi_instance_group = {{ postfix_instance[inst].group | default('') }}
multi_instance_name = postfix-{{ postfix_instance[inst].name }}
multi_instance_enable = yes
# This server is a Mail eXchange
mynetworks_style = host
inet_interfaces = all
inet_protocols = all
# No local delivery
mydestination =
local_transport = error:5.1.1 Mailbox unavailable
alias_maps =
alias_database =
local_recipient_maps =
message_size_limit = 67108864
recipient_delimiter = +
# Forward everything to our internal mailhub
{% if 'MTA-out' in group_names %}
relayhost = [127.0.0.1]:{{ MTA_out.port }}
{% else %}
relayhost = [{{ MTA_out.host }}]:{{ MTA_out.port }}
{% endif %}
relay_domains =
# Virtual transport
{% if 'LDA' in group_names %}
virtual_transport = smtpl:[127.0.0.1]:{{ LDA.port }}
{% else %}
virtual_transport = smtps:[{{ LDA.host }}]:{{ LDA.port }}
{% endif %}
virtual_mailbox_domains = ldap:$config_directory/virtual/mailbox_domains.cf
virtual_alias_maps = pcre:$config_directory/virtual/reserved_alias.pcre
ldap:$config_directory/virtual/alias.cf
# stop the alias resolution (by making finding
# an A -> A alias) before searching for
# catch-alls and domain aliases
$virtual_mailbox_maps
ldap:$config_directory/virtual/alias_domains.cf
ldap:$config_directory/virtual/catchall.cf
virtual_mailbox_maps = ldap:$config_directory/virtual/mailbox.cf
ldap:$config_directory/virtual/list.cf
transport_maps = cdb:$config_directory/virtual/transport_reserved_alias
ldap:$config_directory/virtual/transport_list.cf
# Don't rewrite remote headers
local_header_rewrite_clients =
# Pass the client information along to the content filter
smtp_send_xforward_command = yes
# Avoid splitting the envelope and scanning messages multiple times
smtp_destination_recipient_limit = 1000
# Tolerate occasional high latency
smtp_data_done_timeout = 1200s
# Tunnel everything through IPSec
smtp_tls_security_level = none
{% if 'MTA-out' in group_names %}
smtp_bind_address = 127.0.0.1
{% else %}
smtp_bind_address = 172.16.0.1
{% endif %}
# TLS
smtpd_tls_security_level = may
smtpd_tls_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file = /etc/ssl/private/ssl-cert-snakeoil.key
smtpd_tls_CApath = /etc/ssl/certs/
smtpd_tls_session_cache_database= btree:$data_directory/smtpd_tls_session_cache
smtpd_tls_received_header = yes
smtpd_tls_ask_ccert = yes
smtpd_tls_fingerprint_digest = sha1
smtpd_tls_eecdh_grade = strong
tls_random_source = dev:/dev/urandom
# http://en.linuxreviews.org/HOWTO_Stop_spam_using_Postfix
# http://www.howtoforge.com/block_spam_at_mta_level_postfix
strict_rfc821_envelopes = yes
smtpd_delay_reject = yes
disable_vrfy_command = yes
# UCE control
invalid_hostname_reject_code = 554
multi_recipient_bounce_reject_code = 554
non_fqdn_reject_code = 554
relay_domains_reject_code = 554
unknown_address_reject_code = 554
unknown_client_reject_code = 554
unknown_hostname_reject_code = 554
unknown_local_recipient_reject_code = 554
unknown_relay_recipient_reject_code = 554
unknown_virtual_alias_reject_code = 554
unknown_virtual_mailbox_reject_code = 554
unverified_recipient_reject_code = 554
unverified_sender_reject_code = 554
smtpd_client_restrictions =
permit_mynetworks
reject_rbl_client zen.spamhaus.org
reject_rbl_client bl.spamcop.net
smtpd_helo_required = yes
smtpd_helo_restrictions =
permit_mynetworks
reject_non_fqdn_helo_hostname
reject_invalid_helo_hostname
smtpd_sender_restrictions =
reject_non_fqdn_sender
reject_unknown_sender_domain
smtpd_recipient_restrictions =
# RFC requirements
reject_non_fqdn_recipient
reject_unknown_recipient_domain
permit_mynetworks
reject_unauth_destination
check_policy_service unix:private/postgrey
smtpd_data_restrictions =
reject_unauth_pipelining
|
