hello les linuxiens

je publie aujourdhui les fichiers main.cf et master.cf de mon postfix 2.8.2
sans plus attendre voila la sortie de postconf -n

alias_database = hash:/etc/aliases , hash:/etc/postfix/aliases
alias_maps = hash:/etc/aliases , hash:/etc/postfix/aliases
body_checks = regexp:/etc/postfix/body_checks.cf
broken_sasl_auth_clients = yes
command_directory = /usr/sbin
config_directory = /etc/postfix
content_filter = dkimproxy:[127.0.0.1]:10029
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
debug_peer_level = 2
default_privs = nobody
default_rbl_reply = $rbl_code Service unavailable; $rbl_class [$rbl_what] blocked using $rbl_domain${rbl_reason?; $rbl_reason}
double_bounce_sender = no
header_checks = regexp:/etc/postfix/header_checks.cf
home_mailbox = Maildir/
html_directory = /usr/share/doc/postfix-2.7.3-documentation/html
in_flow_delay = 10
inet_interfaces = all
inet_protocols = all
local_recipient_maps = unix:passwd.byname $alias_maps
mail_owner = postfix
mail_spool_directory = /var/spool/mail
mailbox_command = /usr/libexec/dovecot/dovecot-lda
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
message_size_limit = 20480000
milter_command_timeout = 30s
milter_connect_macros = j {daemon_name} v
milter_connect_timeout = 30s
milter_content_timeout = 300s
milter_data_macros = i
milter_default_action = accept
milter_end_of_data_macros = i
milter_end_of_header_macros = i
milter_helo_macros = {tls_version} {cipher} {cipher_bits} {cert_subject} {cert_issuer}
milter_macro_daemon_name = $myhostname
milter_macro_v = $mail_name $mail_version
milter_mail_macros = i {auth_type} {auth_authen} {auth_author} {mail_addr}
milter_protocol = 6
milter_rcpt_macros = i {rcpt_addr}
milter_unknown_command_macros =
mime_header_checks = regexp:/etc/postfix/mime_header_checks.cf
mydestination = $myhostname , localhost.$mydomain, r13151.ovh.net
mydomain = r13151.ovh.net
mynetworks = 127.0.0.0/8 ,87.98.186.232 , [::1]/128 , [2001:41D0:2:3Dd6::]/64
myorigin = $mydomain
newaliases_path = /usr/bin/newaliases.postfix
parent_domain_matches_subdomains =
postscreen_access_list = permit_mynetworks
postscreen_bare_newline_action = ignore
postscreen_bare_newline_enable = yes
postscreen_bare_newline_ttl = 30d
postscreen_blacklist_action = drop
postscreen_cache_cleanup_interval = 12h
postscreen_cache_map = btree:$data_directory/postscreen_cache
postscreen_cache_retention_time = 7d
postscreen_client_connection_count_limit = $smtpd_client_connection_count_limit
postscreen_command_count_limit = 20
postscreen_command_filter =
postscreen_command_time_limit = ${stress?10}${stress:300}s
postscreen_disable_vrfy_command = $disable_vrfy_command
postscreen_discard_ehlo_keyword_address_maps =
postscreen_discard_ehlo_keywords =
postscreen_dnsbl_action = enforce
postscreen_dnsbl_reply_map = texthash:/etc/postfix/dnsbl_reply
postscreen_dnsbl_sites = cbl.abuseat.org*2, bl.spamcop.net*1, b.barracudacentral.org*2 ,zen.spamhaus.org*3 ,sbl.spamhaus.org*2,xbl.spamhaus.org*2
postscreen_dnsbl_threshold = 2
postscreen_dnsbl_ttl = 1h
postscreen_enforce_tls = $smtpd_enforce_tls
postscreen_expansion_filter = $smtpd_expansion_filter
postscreen_forbidden_commands = $smtpd_forbidden_commands
postscreen_greet_action = enforce
postscreen_greet_banner = $smtpd_banner
postscreen_greet_ttl = 1d
postscreen_greet_wait = ${stress?2}${stress:6}s
postscreen_helo_required = $smtpd_helo_required
postscreen_non_smtp_command_action = drop
postscreen_non_smtp_command_enable = yes
postscreen_non_smtp_command_ttl = 30d
postscreen_pipelining_action = enforce
postscreen_pipelining_enable = no
postscreen_pipelining_ttl = 30d
postscreen_post_queue_limit = $default_process_limit
postscreen_pre_queue_limit = $default_process_limit
postscreen_reject_footer = $smtpd_reject_footer
postscreen_tls_security_level = $smtpd_tls_security_level
postscreen_use_tls = $smtpd_use_tls
postscreen_watchdog_timeout = 10s
queue_directory = /var/spool/postfix
queue_run_delay = 200s
readme_directory = /usr/share/doc/postfix-2.7.3-documentation/readme
recipient_delimiter = +
relay_domains =
sample_directory = /usr/share/doc/postfix-2.5.4/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtp_sasl_security_options = noanonymous
smtp_sasl_tls_security_options = noanonymous
smtp_sender_dependent_authentication = yes
smtp_tls_loglevel = 3
smtp_tls_note_starttls_offer = yes
smtp_tls_session_cache_database = btree:/var/lib/postfix/smtp_tls_session_cache
smtpd_banner = $myhostname ESMTP $mail_name ($mail_version)
smtpd_client_restrictions = permit_mynetworks reject_unknown_reverse_client_hostname reject_unauth_pipelining reject_non_fqdn_recipient check_client_access cidr:/etc/postfix/koreacidr.cidr check_client_access cidr:/etc/postfix/chinacidr.cidr check_helo_access hash:/etc/postfix/access_client check_helo_access hash:/etc/postfix/access_host check_sender_access hash:/etc/postfix/access_client check_sender_access hash:/etc/postfix/access_host check_recipient_access hash:/etc/postfix/access_client check_recipient_access hash:/etc/postfix/access_host check_client_access cidr:/etc/postfix/perso_cidr.cidr check_recipient_access cidr:/etc/postfix/perso_cidr.cidr check_helo_access cidr:/etc/postfix/perso_cidr.cidr check_client_access pcre:/etc/postfix/ptr-tld.pcre check_client_access cidr:/etc/postfix/sinokorea.cidr check_client_access cidr:/etc/postfix/taiwancidr.cidr check_client_access regexp:/etc/postfix/blacklist_clients check_client_access cidr:/etc/postfix/asian-ip.cidr check_client_access cidr:/etc/postfix/taiwanipblocksreject.cidr check_client_access cidr:/etc/postfix/CN_cidr.cidr permit
smtpd_data_restrictions = reject_unauth_pipelining reject_multi_recipient_bounce permit
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks check_helo_access cidr:/etc/postfix/koreacidr.cidr check_helo_access cidr:/etc/postfix/chinacidr.cidr check_helo_access hash:/etc/postfix/access_client check_helo_access hash:/etc/postfix/access_host check_helo_access hash:/etc/postfix/access_client check_helo_access hash:/etc/postfix/access_host check_helo_access hash:/etc/postfix/access_client check_helo_access hash:/etc/postfix/access_host check_helo_access cidr:/etc/postfix/perso_cidr.cidr check_helo_access pcre:/etc/postfix/ptr-tld.pcre check_helo_access cidr:/etc/postfix/sinokorea.cidr check_helo_access cidr:/etc/postfix/taiwancidr.cidr check_helo_access regexp:/etc/postfix/blacklist_clients check_helo_access cidr:/etc/postfix/asian-ip.cidr check_helo_access cidr:/etc/postfix/taiwanipblocksreject.cidr check_helo_access cidr:/etc/postfix/CN_cidr.cidr reject_non_fqdn_helo_hostname reject_invalid_helo_hostname reject_unknown_helo_hostname permit
smtpd_milters = inet:[127.0.0.1]:10040
smtpd_recipient_restrictions = permit_mynetworks permit_inet_interfaces permit_sasl_authenticated reject_unverified_recipient reject_non_fqdn_sender reject_non_fqdn_recipient reject_unknown_sender_domain reject_unknown_recipient_domain reject_unknown_reverse_client_hostname reject_unauth_destination reject_unauth_pipelining reject_sender_login_mismatch check_policy_service unix:postgrey/socket check_client_access hash:/etc/postfix/whitelist reject_unknown_helo_hostname reject_invalid_helo_hostname reject_non_fqdn_helo_hostname check_client_access pcre:/etc/postfix/ptr-tld.pcre check_client_access cidr:/etc/postfix/sinokorea.cidr check_client_access cidr:/etc/postfix/taiwancidr.cidr check_client_access regexp:/etc/postfix/blacklist_clients check_client_access cidr:/etc/postfix/asian-ip.cidr check_client_access cidr:/etc/postfix/CN_cidr.cidr check_client_access cidr:/etc/postfix/perso_cidr.cidr check_sender_mx_access cidr:/etc/postfix/perso_cidr.cidr check_recipient_mx_access cidr:/etc/postfix/perso_cidr.cidr check_recipient_access cidr:/etc/postfix/perso_cidr.cidr check_helo_access cidr:/etc/postfix/perso_cidr.cidr check_client_access hash:/etc/postfix/access_host check_recipient_mx_access hash:/etc/postfix/access_host check_sender_mx_access hash:/etc/postfix/access_host check_client_access hash:/etc/postfix/access_client check_recipient_access hash:/etc/postfix/access_host check_recipient_access hash:/etc/postfix/access_client check_sender_access hash:/etc/postfix/access_host check_sender_access hash:/etc/postfix/access_client check_helo_access hash:/etc/postfix/access_host check_helo_access hash:/etc/postfix/access_client check_client_access cidr:/etc/postfix/chinacidr.cidr check_client_access cidr:/etc/postfix/koreacidr.cidr check_policy_service unix:private/spfpolicy check_recipient_access pcre:/etc/postfix/recipient_checks.pcre
smtpd_reject_unlisted_sender = no
smtpd_restriction_classes = check_if_sender_exists
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
smtpd_sasl_local_domain = $myhostname
smtpd_sasl_path = private/auth
smtpd_sasl_type = dovecot
smtpd_sender_restrictions = reject_unknown_sender_domain reject_non_fqdn_sender permit
smtpd_tls_CAfile = /etc/pki/tls/certs/class3.crt
smtpd_tls_ask_ccert = yes
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /etc/pki/tls/certs/r13151.ovh.net.cert
smtpd_tls_key_file = /etc/pki/tls/private/r13151.ovh.net.key
smtpd_tls_received_header = yes
smtpd_tls_req_ccert = no
smtpd_tls_security_level = may
smtpd_tls_session_cache_database = btree:/var/lib/postfix/smtpd_tls_session_cache
smtpd_use_tls = yes
soft_bounce = no
tls_random_source = dev:/dev/urandom
unknown_local_recipient_reject_code = 550
virtual_alias_domains = renelacroute.fr , nicolaspichot.fr , fakessh.eu , roundcube.fakessh.eu , roundcube.renelacroute.fr , roundcube.nicolaspichot.fr , smtp.fakessh.eu , smtp.renelacroute.fr , smtp.nicolaspichot.fr
virtual_alias_maps = hash:/etc/postfix/virtual
virtual_transport = dovecot

et le fichier master.cf qui lui correspond

#
# Postfix master process configuration file. For details on the format
# of the file, see the master(5) manual page (command: "man 5 master").
#
# ==========================================================================
# service type private unpriv chroot wakeup maxproc command + args
# (yes) (yes) (yes) (never) (100)
# ==========================================================================
smtp inet n - n - - smtpd
-o receive_override_options=no_address_mappings
-o content_filter=amavisfeed:[127.0.0.1]:10024
-o smtpd_data_restrictions=check_sender_access,pcre:/etc/postfix/add_my_header
#-o smtpd_proxy_filter=127.0.0.1:10041
#-o smtpd_client_connection_count_limit=10
# Postfix 2.7 and later performance feature.
#-o smtpd_proxy_options=speed_adjust
-o smtpd_sasl_auth_enable=yes
-o stress=yes
amavisfeed unix - - n - 2 lmtp
-o smtp_data_done_timeout=1200
-o smtp_send_xforward_command=yes
-o disable_dns_lookups=yes
-o max_use=20
submission inet n - n - - smtpd
-o smtpd_sasl_auth_enable=yes
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_authenticated_header=yes
-o receive_override_options=no_address_mappings
-o smtpd_enforce_tls=yes
-o content_filter=amavisfeed:[127.0.0.1]:10024
-o smtpd_etrn_restrictions=reject
-o smtpd_client_restrictions=permit_mynetworks,permit_sasl_authenticated,reject
-o smtpd_data_restrictions=check_sender_access,pcre:/etc/postfix/add_my_header
-o stress=yes
-o milter_macro_daemon_name=ORIGINATING
##smtps inet n - n - - smtpd
## -o smtpd_tls_wrappermode=yes
## -o smtpd_sasl_auth_enable=yes
## -o smtpd_client_restrictions=permit_sasl_authenticated
## -o content_filter=dksign:[127.0.0.1]:10028,amavisfeed:[127.0.0.1]:10024
#628 inet n - n - - qmqpd
pickup fifo n - n 60 1 pickup
cleanup unix n - n - 0 cleanup
qmgr fifo n - n 300 1 qmgr
#qmgr fifo n - n 300 1 oqmgr
tlsmgr unix - - n 1000? 1 tlsmgr
smtp inet n - n - 1 postscreen
-o soft_bounce=yes
smtpd pass - - n - - smtpd
dnsblog unix - - n - 0 dnsblog
tlsproxy unix - - n - 0 tlsproxy
showq unix n - n - - showq
error unix - - n - - error
retry unix - - n - - error
discard unix - - n - - discard
local unix - n n - - local
virtual unix - n n - - virtual
rewrite unix - - n - - trivial-rewrite
bounce unix - - n - 0 bounce
defer unix - - n - 0 bounce
trace unix - - n - 0 bounce
verify unix - - n - 1 verify
flush unix n - n 1000? 0 flush
smtp unix - - n - - smtp
proxymap unix - - n - - proxymap
proxywrite unix - - n - 1 proxymap
# When relaying mail as backup MX, disable fallback_relay to avoid MX loops
relay unix - - n - - smtp
-o fallback_relay=
# -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
showq unix n - n - - showq
error unix - - n - - error
discard unix - - n - - discard
local unix - n n - - local
virtual unix - n n - - virtual
lmtp unix - - n - - lmtp
anvil unix - - n - 1 anvil
scache unix - - n - 1 scache
#
# ====================================================================
# Interfaces to non-Postfix software. Be sure to examine the manual
# pages of the non-Postfix software to find out what options it wants.
#
# Many of the following services use the Postfix pipe(8) delivery
# agent. See the pipe(8) man page for information about ${recipient}
# and other message envelope options.
# ====================================================================
#
# maildrop. See the Postfix MAILDROP_README file for details.
# Also specify in main.cf: maildrop_destination_recipient_limit=1
#
maildrop unix - n n - - pipe
flags=DRhu user=vmail argv=/usr/local/bin/maildrop -d ${recipient}
#
# The Cyrus deliver program has changed incompatibly, multiple times.
#
old-cyrus unix - n n - - pipe
flags=R user=cyrus argv=/usr/lib/cyrus-imapd/deliver -e -m ${extension} ${user}
# Cyrus 2.1.5 (Amos Gouaux)
# Also specify in main.cf: cyrus_destination_recipient_limit=1
cyrus unix - n n - - pipe
user=cyrus argv=/usr/lib/cyrus-imapd/deliver -e -r ${sender} -m ${extension} ${user}
#
# See the Postfix UUCP_README file for configuration details.
#
uucp unix - n n - - pipe
flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
#
# Other external delivery methods.
#
ifmail unix - n n - - pipe
flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp unix - n n - - pipe
flags=Fq. user=foo argv=/usr/local/sbin/bsmtp -f $sender $nexthop $recipient
127.0.0.1:10025 inet n - n - - smtpd
-o content_filter=dkimproxy:[127.0.0.1]:10029
-o smtpd_delay_reject=no
-o smtpd_client_restrictions=permit_mynetworks,reject
-o smtpd_helo_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,reject
-o smtpd_data_restrictions=reject_unauth_pipelining
-o smtpd_end_of_data_restrictions=
-o smtpd_restriction_classes=
-o mynetworks=127.0.0.0/8
-o smtpd_error_sleep_time=0
-o smtpd_soft_error_limit=1001
-o smtpd_hard_error_limit=1000
-o smtpd_client_connection_count_limit=0
-o smtpd_client_connection_rate_limit=0
-o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_milters,no_address_mappings
-o local_header_rewrite_clients=
-o smtpd_milters=
-o local_recipient_maps=
-o relay_recipient_maps=
dkimproxy unix - - n - 10 smtp
-o smtp_send_xforward_command=yes
-o smtp_discard_ehlo_keywords=8bitmime,starttls
# service for accepting messages FROM the DKIM signing proxy
127.0.0.1:10030 inet n - n - 10 smtpd
-o content_filter=
-o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
-o smtpd_helo_restrictions=
-o smtpd_client_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,reject
-o mynetworks=127.0.0.0/8
-o smtpd_authorized_xforward_hosts=127.0.0.0/8
retry unix - - n - - error
proxywrite unix - - n - 1 proxymap
spfpolicy unix - n n - - spawn
user=nobody argv=/usr/bin/perl /etc/postfix/postfix-policyd-spf-perl
dovecot unix - n n - - pipe
flags=DR user=mail argv=/usr/libexec/dovecot/deliver -f ${sender} -d ${user}@${nexthop} -n -m INBOX/${extension}

ils contienent peut etre des erreurs et des particularités qui proviennent de ma configuration propre à ma machine
mais c’est 2 exemples peuvent parfaitement servir de « how to » pour beaucoup de monde

bonne lecture

This article is copyright © by admin: Sat May 19 16:39:26 UTC 2012

bonjour les linuxiens

j’ai dernierement modifie les regles dans mon fichier header_ckecks.cf de postfix
dans le but de ne pas divulger les adresses IP privées des emails

cette modification se realise par l’ajout de regles REPLACE dans le fichiers headers_checks.cf

un petit example est bien plus parlant que une grande discution
donc voivi les regles ajoutées dans le fichers headers_check.cf

/^(Received: from ).*\[192\.168\.1+\..+\]\)(.*)/ REPLACE ${1}localhost([127.0.0.1] (may be forged by MTA or private))${2}
/^(Received: from ).*roundcube.fakessh.eu(.*)/ REPLACE ${1}localhost([127.0.0.1] (may be forged by MTA or private ))${2}

ces 2 regles sont suffisantes dans les cas d’une connexion directe depuis un client mail et depuis le webmail que j’utilise les adresses IP privées d’expedition sont remplacées par une ligne comme ceci
from localhost([127.0.0.1] (may be forged by MTA or private ))
(localhost.localdomain [127.0.0.1])

on ne peut plus savoir de quel IP le mail a été emis

This article is copyright © by admin: Sat May 19 16:39:26 UTC 2012