215 lines
6.8 KiB
CFEngine3
215 lines
6.8 KiB
CFEngine3
##
|
|
## Netzwerkeinstellungen
|
|
##
|
|
|
|
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
|
|
#inet_interfaces = all
|
|
inet_interfaces = 127.0.0.1, 188.68.54.208
|
|
myhostname = mail.solusar.de
|
|
|
|
|
|
##
|
|
## Mail-Queue Einstellungen
|
|
##
|
|
|
|
maximal_queue_lifetime = 1h
|
|
bounce_queue_lifetime = 1h
|
|
maximal_backoff_time = 15m
|
|
minimal_backoff_time = 5m
|
|
queue_run_delay = 5m
|
|
|
|
|
|
##
|
|
## TLS Einstellungen
|
|
###
|
|
|
|
tls_preempt_cipherlist = no
|
|
tls_ssl_options = NO_COMPRESSION
|
|
#tls_high_cipherlist = EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA
|
|
#tls_high_cipherlist = !aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!CAMELLIA:HIGH:@STRENGTH
|
|
#tls_high_cipherlist = !aNULL:!eNULL:!CAMELLIA:HIGH:@STRENGTH
|
|
|
|
### Ausgehende SMTP-Verbindungen (Postfix als Sender)
|
|
|
|
smtp_tls_security_level = may
|
|
smtp_dns_support_level = dnssec
|
|
smtp_tls_policy_maps = mysql:/etc/postfix/mysql_tls_policy.cf
|
|
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
|
|
smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
|
|
smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
|
|
smtp_tls_exclude_ciphers = MD5, DES, ADH, RC4, PSD, SRP, 3DES, eNULL, aNULL
|
|
smtp_tls_ciphers = high
|
|
smtp_tls_mandatory_ciphers = high
|
|
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
|
|
smtp_tls_loglevel = 1
|
|
|
|
### smtpd_banner
|
|
smtpd_banner = $myhostname ESMTP
|
|
|
|
|
|
### Eingehende SMTP-Verbindungen
|
|
|
|
smtpd_tls_security_level = may
|
|
smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
|
|
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
|
|
smtpd_tls_ciphers = high
|
|
smtpd_tls_mandatory_ciphers = high
|
|
smtpd_tls_mandatory_exclude_ciphers = aNULL, eNULL, EXPORT, DES, RC4, MD5, PSK, aECDH, EDH-DSS-DES-CBC3-SHA, EDH-RSA-DES-CDC3-SHA, KRB5-DE5, CBC3-SHA
|
|
smtpd_tls_dh1024_param_file = /etc/myssl/dh4096.pem
|
|
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
|
|
smtpd_tls_loglevel = 1
|
|
|
|
smtpd_tls_cert_file=/etc/letsencrypt/live/mail.solusar.de/fullchain.pem
|
|
smtpd_tls_key_file=/etc/letsencrypt/live/mail.solusar.de/privkey.pem
|
|
|
|
|
|
##
|
|
## Postfix restrictions
|
|
##
|
|
#smtpd_sender_restrictions =
|
|
# permit_mynetworks,
|
|
# reject_non_fqdn_sender,
|
|
# reject_unknown_sender_domain,
|
|
# permit
|
|
smtpd_recipient_restrictions =
|
|
permit_sasl_authenticated,
|
|
# reject_unauth_pipelining,
|
|
# reject_non_fqdn_recipient,
|
|
# reject_unknown_recipient_domain,
|
|
# permit_mynetworks,
|
|
# reject_unauth_destination,
|
|
check_sender_access
|
|
pcre:/etc/postfix/reject_domains,
|
|
# reject_rbl_client zen.spamhaus.org,
|
|
# reject_rbl_client bl.spamcop.net,
|
|
# check_policy_service unix:postgrey/socket,
|
|
permit
|
|
|
|
|
|
##
|
|
## Lokale Mailzustellung an Dovecot
|
|
##
|
|
|
|
virtual_transport = lmtp:unix:private/dovecot-lmtp
|
|
|
|
|
|
##
|
|
## Milter: DKIM-Signaturen durch OpenDKIM-Milter
|
|
## und Mail-Filter mit Amavis (via amavisd-milter)
|
|
##
|
|
|
|
################### old spamassassin config #########################
|
|
#milter_default_action = accept
|
|
#milter_protocol = 2
|
|
#smtpd_milters = unix:/var/run/amavis/amavisd-milter.sock,
|
|
# unix:/var/run/opendkim/opendkim.sock
|
|
#non_smtpd_milters = unix:/var/run/opendkim/opendkim.sock
|
|
|
|
################### new rspamd config ###############################
|
|
smtpd_milters = inet:localhost:11332
|
|
non_smtpd_milters = inet:localhost:11332
|
|
milter_protocol = 6
|
|
milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}
|
|
milter_default_action = accept
|
|
|
|
##
|
|
## Server Restrictions für Clients, Empfänger und Relaying
|
|
## (im Bezug auf S2S-Verbindungen. Mailclient-Verbindungen werden in master.cf im Submission-Bereich konfiguriert)
|
|
##
|
|
|
|
### Bedingungen, damit Postfix als Relay arbeitet (für Clients)
|
|
smtpd_relay_restrictions = reject_non_fqdn_recipient
|
|
reject_unknown_recipient_domain
|
|
permit_mynetworks
|
|
reject_unauth_destination
|
|
|
|
|
|
### Bedingungen, damit Postfix ankommende E-Mails als Empfängerserver entgegennimmt (zusätzlich zu relay-Bedingungen)
|
|
### check_recipient_access prüft, ob ein account sendonly ist
|
|
#smtpd_recipient_restrictions = check_recipient_access mysql:/etc/postfix/mysql_virtual_recipient_access.cf
|
|
|
|
|
|
### Bedingungen, die SMTP-Clients erfüllen müssen (sendende Server)
|
|
smtpd_client_restrictions = permit_mynetworks
|
|
check_client_access hash:/etc/postfix/without_ptr
|
|
reject_unknown_client_hostname
|
|
|
|
|
|
### Wenn fremde Server eine Verbindung herstellen, müssen sie einen gültigen Hostnamen im HELO haben.
|
|
smtpd_helo_required = yes
|
|
smtpd_helo_restrictions = permit_mynetworks
|
|
reject_invalid_helo_hostname
|
|
reject_non_fqdn_helo_hostname
|
|
reject_unknown_helo_hostname
|
|
|
|
# Clients blockieren, wenn sie versuchen zu früh zu senden
|
|
smtpd_data_restrictions = reject_unauth_pipelining
|
|
|
|
# Limit für Client-Verbindungen und Verbindungsversuche
|
|
#smtpd_client_auth_rate_limit = 20
|
|
smtpd_client_connection_count_limit = 20
|
|
smtpd_client_connection_rate_limit = 20
|
|
smtpd_client_message_rate_limit = 20
|
|
smtpd_client_new_tls_session_rate_limit = 20
|
|
|
|
##
|
|
## Restrictions for MUAs (Mail user agents)
|
|
##
|
|
|
|
mua_relay_restrictions = reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_mynetworks,permit_sasl_authenticated,reject
|
|
mua_sender_restrictions = permit_mynetworks,reject_non_fqdn_sender,reject_sender_login_mismatch,permit_sasl_authenticated,reject
|
|
mua_client_restrictions = permit_mynetworks,permit_sasl_authenticated,reject
|
|
|
|
##
|
|
## Postscreen Filter
|
|
##
|
|
|
|
### Postscreen Whitelist / Blocklist
|
|
postscreen_access_list = permit_mynetworks
|
|
cidr:/etc/postfix/postscreen_access
|
|
postscreen_blacklist_action = drop
|
|
|
|
|
|
# Verbindungen beenden, wenn der fremde Server es zu eilig hat
|
|
postscreen_greet_action = drop
|
|
|
|
|
|
### DNS blocklists
|
|
postscreen_dnsbl_threshold = 2
|
|
postscreen_dnsbl_sites = dnsbl.sorbs.net*1, bl.spamcop.net*1, ix.dnsbl.manitu.net*2, zen.spamhaus.org*2
|
|
postscreen_dnsbl_action = drop
|
|
|
|
|
|
##
|
|
## MySQL Abfragen
|
|
##
|
|
|
|
virtual_alias_maps = mysql:/etc/postfix/mysql_virtual_alias_maps.cf
|
|
virtual_mailbox_maps = mysql:/etc/postfix/mysql_virtual_mailbox_maps.cf
|
|
virtual_mailbox_domains = mysql:/etc/postfix/mysql_virtual_domains_maps.cf
|
|
local_recipient_maps = $virtual_mailbox_maps
|
|
|
|
|
|
##
|
|
## Sonstiges
|
|
##
|
|
|
|
### Maximale Größe der gesamten Mailbox (soll von Dovecot festgelegt werden, 0 = unbegrenzt)
|
|
mailbox_size_limit = 0
|
|
|
|
### Maximale Größe eingehender E-Mails in Bytes (50 MB)
|
|
message_size_limit = 52428800
|
|
|
|
### Keine System-Benachrichtigung für Benutzer bei neuer E-Mail
|
|
biff = no
|
|
|
|
### Nutzer müssen immer volle E-Mail Adresse angeben - nicht nur Hostname
|
|
append_dot_mydomain = no
|
|
|
|
### Trenn-Zeichen für "Address Tagging"
|
|
recipient_delimiter = +
|
|
|
|
alias_maps = hash:/etc/aliases
|
|
disable_vrfy_command = yes
|
|
|