暫無描述
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

etc_postfix_main.cf.j2 3.5KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105
  1. # See /usr/share/postfix/main.cf.dist for a commented, more complete version
  2. # Modified as per http://sealedabstract.com/code/nsa-proof-your-e-mail-in-2-hours/
  3. smtpd_banner = $myhostname ESMTP $mail_name
  4. biff = no
  5. # appending .domain is the MUA's job.
  6. append_dot_mydomain = no
  7. # Uncomment the next line to generate "delayed mail" warnings
  8. #delay_warning_time = 4h
  9. readme_directory = no
  10. # antispam
  11. smtpd_helo_required = yes
  12. smtpd_helo_restrictions = permit_mynetworks, reject_invalid_hostname
  13. smtpd_sender_restrictions = reject_unknown_address
  14. disable_vrfy_command = yes
  15. strict_rfc821_envelopes = yes
  16. invalid_hostname_reject_code = 554
  17. multi_recipient_bounce_reject_code = 554
  18. non_fqdn_reject_code = 554
  19. relay_domains_reject_code = 554
  20. unknown_address_reject_code = 554
  21. unknown_client_reject_code = 554
  22. unknown_hostname_reject_code = 554
  23. unknown_local_recipient_reject_code = 554
  24. unknown_relay_recipient_reject_code = 554
  25. unknown_virtual_alias_reject_code = 554
  26. unknown_virtual_mailbox_reject_code = 554
  27. unverified_recipient_reject_code = 554
  28. unverified_sender_reject_code = 554
  29. # TLS parameters
  30. smtpd_tls_cert_file=/etc/ssl/certs/wildcard_combined.pem
  31. smtpd_tls_key_file=/etc/ssl/private/wildcard_private.key
  32. smtpd_use_tls=yes
  33. #smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
  34. #smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
  35. smtpd_tls_auth_only = yes
  36. smtp_tls_security_level = may
  37. smtp_tls_loglevel = 2
  38. smtpd_tls_received_header = yes
  39. smtp_tls_note_starttls_offer = yes
  40. smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
  41. smtpd_sasl_type = dovecot
  42. smtpd_sasl_path = private/auth
  43. smtpd_sasl_auth_enable = yes
  44. broken_sasl_auth_clients = yes
  45. smtpd_sasl_security_options = noanonymous
  46. smtpd_recipient_restrictions =
  47. permit_sasl_authenticated,
  48. permit_mynetworks,
  49. reject_unauth_pipelining,
  50. reject_unauth_destination,
  51. reject_invalid_hostname,
  52. reject_non_fqdn_hostname,
  53. reject_non_fqdn_recipient,
  54. reject_unknown_recipient_domain,
  55. reject_rbl_client multihop.dsbl.org,
  56. reject_rbl_client zen.spamhaus.org,
  57. reject_rbl_client cbl.abuseat.org,
  58. reject_rbl_client bl.spamcop.net,
  59. reject_rbl_client dnsbl.sorbs.net,
  60. reject_rbl_client all.spamrats.com=127.0.0.36,
  61. reject_rbl_client all.spamrats.com=127.0.0.38,
  62. reject_rbl_client dnsbl.ahbl.org,
  63. check_policy_service inet:127.0.0.1:10023,
  64. permit
  65. # See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
  66. # information on enabling SSL in the smtp client.
  67. myhostname = {{ mail_server_hostname }}
  68. myorigin = $mydomain
  69. alias_maps = hash:/etc/aliases
  70. alias_database = hash:/etc/aliases
  71. mydestination = localhost
  72. relayhost =
  73. mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
  74. #mailbox_command = procmail -a "$EXTENSION"
  75. mailbox_size_limit = 0
  76. recipient_delimiter = +
  77. inet_interfaces = all
  78. # dovecot mysql
  79. virtual_transport = lmtp:unix:private/dovecot-lmtp
  80. virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual-mailbox-domains.cf
  81. virtual_mailbox_maps = mysql:/etc/postfix/mysql-virtual-mailbox-maps.cf
  82. virtual_alias_maps = mysql:/etc/postfix/mysql-virtual-alias-maps.cf
  83. local_recipient_maps = $virtual_mailbox_maps
  84. # OpenDKIM
  85. smtpd_milters = inet:127.0.0.1:8891
  86. non_smtpd_milters = $smtpd_milters
  87. milter_default_action = accept
  88. # new settings for dspam: only scan one mail at a time, localhost doesn't get scanned, everything else does
  89. dspam_destination_recipient_limit = 1
  90. smtpd_client_restrictions =
  91. permit_sasl_authenticated
  92. check_client_access pcre:/etc/postfix/dspam_filter_access