roles/server/mail/postfix/files/default/main.cf

   1 #
   2 ################################################
   3 ### Managed by someone's ansible provisioner ###
   4 ################################################
   5 # Part of: https://git.somenet.org/root/pub/somesible.git
   6 # 2017-2025 by someone <someone@somenet.org>
   7 #
   8
   9 # Last time we extensively looked at our configuration.
  10 compatibility_level=3.6
  11
  12
  13 myhostname = mail.somenet.org
  14 myorigin = mail.l
  15 mydestination = mail.l, l, localhost, localhost.localdomain
  16 mynetworks = 10.0.0.0/8 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
  17
  18
  19 # incoming mail
  20 smtpd_tls_chain_files =
  21     /etc/ssl/letsencrypt/mail.somenet.org/privkey.pem,
  22     /etc/ssl/letsencrypt/mail.somenet.org/fullchain.pem,
  23     /etc/ssl/letsencrypt-rsa/mail.somenet.org/privkey.pem,
  24     /etc/ssl/letsencrypt-rsa/mail.somenet.org/fullchain.pem
  25 smtpd_tls_security_level = may
  26 smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
  27 smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
  28 smtpd_tls_ciphers = high
  29 smtpd_tls_mandatory_ciphers = high
  30 smtpd_tls_loglevel = 1
  31 smtpd_tls_received_header = yes
  32 smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
  33 smtpd_tls_auth_only = yes
  34 # we override this for the "submission" service.
  35 smtpd_sasl_auth_enable = no
  36 smtpd_sasl_path = smtpd
  37 smtpd_banner = $myhostname ESMTP $mail_name
  38 smtpd_helo_required = yes
  39 # fuck sec consult and their business "ethics".
  40 smtpd_forbid_bare_newline = yes
  41 smtpd_forbid_unauth_pipelining = yes
  42 smtpd_discard_ehlo_keywords = chunking, silent-discard
  43
  44
  45 # header cleanup + transport mapping
  46 header_checks = regexp:/etc/postfix/header_checks_in.regexp
  47 nested_header_checks =
  48 transport_maps = hash:/etc/postfix/transport.map
  49 #, hash:/var/lib/sympa/transport.map
  50
  51
  52 # outgoing mail
  53 smtp_tls_security_level = may
  54 smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
  55 smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
  56 smtp_tls_ciphers = high
  57 smtp_tls_mandatory_ciphers = high
  58 smtp_tls_loglevel = 1
  59 smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
  60 smtp_header_checks = regexp:/etc/postfix/header_checks_out.regexp
  61
  62
  63 # hosted domains
  64 virtual_alias_domains = somenet.org
  65 virtual_alias_maps = hash:/etc/postfix/virtual.map
  66 #,ldap:/etc/postfix/virtual.ldap
  67
  68
  69 # local delivery
  70 mailbox_transport = lmtp:unix:/var/lib/cyrus/socket/lmtp
  71 mailbox_size_limit = 209715200
  72
  73
  74 #sympa
  75 # todo: flip vmailbox und valias domains?
  76 #virtual_mailbox_domains = lists.somenet.org
  77 #virtual_mailbox_maps = hash:/etc/postfix/virtual.map, hash:/etc/postfix/transport.map, hash:/var/lib/sympa/transport.map
  78
  79
  80 # random settings
  81 tls_preempt_cipherlist = yes
  82 biff = no
  83 connection_cache_status_update_time = 3600
  84 inet_protocols=ipv4
  85 message_size_limit = $mailbox_size_limit
  86 recipient_delimiter = +
  87
  88
  89 # take it easy.
  90 default_destination_concurrency_limit = 2
  91
  92 # disable smtputf8 because of cyrus
  93 smtputf8_enable = no
  94
  95
  96 #########################################
  97 # DONT BE AN OPEN RELAY. RESTRICT STUFF #
  98 #########################################
  99 smtpd_restriction_classes = HOLD_OK
 100 HOLD_OK = check_client_access static:hold, permit
 101
 102
 103 # 1. check every incomming connecting.
 104 # we use master.cf to overridden this for the "submission" service to always require authentication:
 105 #   smtpd_client_restrictions = permit_sasl_authenticated, reject
 106 # we merge that into recipient and relay restrictions - no need to check everything multiple times.
 107 #smtpd_client_restrictions =
 108 #    permit_mynetworks,
 109 #    permit_sasl_authenticated,
 110 #    reject_unknown_client_hostname,
 111 #    permit
 112
 113
 114 # 2. check the helo of the incomming connection.
 115 # we merge that into recipient and relay restrictions - no need to check everything multiple times.
 116 # smtpd_helo_restrictions =
 117 #    permit_mynetworks,
 118 #    permit_sasl_authenticated,
 119 #    reject_invalid_helo_hostname,
 120 #    reject_unknown_helo_hostname,
 121 #    permit
 122
 123
 124 # 3. checks run after a connection issues "MAIL FROM"
 125 # we merge that into recipient and relay restrictions - no need to check everything multiple times.
 126 # smtpd_sender_restrictions =
 127 #    check_sender_access regexp:/etc/postfix/sender_restrictions.regexp,
 128 #    permit_mynetworks,
 129 #    permit_sasl_authenticated,
 130 #    reject_non_fqdn_sender,
 131 #    reject_unknown_sender_domain,
 132 #    permit
 133
 134
 135 # 4a. checks run after a connection issues "RCPT TO"
 136 smtpd_recipient_restrictions =
 137     check_sender_access    regexp:/etc/postfix/rcpt_sender.regexp,
 138     check_recipient_access regexp:/etc/postfix/rcpt_recipient.regexp,
 139     permit_mynetworks,
 140     permit_sasl_authenticated,
 141     reject_invalid_helo_hostname,
 142     reject_unauth_pipelining,
 143     reject_unauth_destination,
 144     reject_non_fqdn_sender,
 145     reject_non_fqdn_recipient,
 146     reject_unknown_client_hostname,
 147     reject_unknown_helo_hostname,
 148     reject_unknown_sender_domain,
 149     reject_unknown_recipient_domain,
 150     permit
 151
 152
 153 # 4b. same as smtpd_recipient_restrictions but diffrent.
 154 smtpd_relay_restrictions =
 155     check_sender_access    regexp:/etc/postfix/rel_sender.regexp,
 156     check_recipient_access regexp:/etc/postfix/rel_recipient.regexp,
 157     check_sender_access    regexp:/etc/postfix/rcpt_sender.regexp,
 158     check_recipient_access regexp:/etc/postfix/rcpt_recipient.regexp,
 159     permit_mynetworks,
 160     permit_sasl_authenticated,
 161     reject_invalid_helo_hostname,
 162     reject_unauth_pipelining,
 163     reject_unauth_destination,
 164     reject_non_fqdn_sender,
 165     reject_non_fqdn_recipient,
 166     reject_unknown_client_hostname,
 167     reject_unknown_helo_hostname,
 168     reject_unknown_sender_domain,
 169     reject_unknown_recipient_domain,
 170     permit
 171
 172
 173 # 5. checks run after a connection issues "RCPT TO"
 174 # we merge that into recipient and relay restrictions - no need to check everything multiple times.
 175 # smtpd_data_restrictions =
 176 #    permit_mynetworks,
 177 #    permit_sasl_authenticated,
 178 #    reject_unauth_pipelining,
 179 #    permit