설명 없음
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

etc_postfix_main.cf.j2 4.0KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127
  1. # See /usr/share/postfix/main.cf.dist for a commented, more complete version
  2. # Modified as per http://sealedabstract.com/code/nsa-proof-your-e-mail-in-2-hours/
  3. smtpd_banner = $myhostname ESMTP $mail_name
  4. biff = no
  5. # Accept messages up to 50MB
  6. message_size_limit = 51200000
  7. # appending .domain is the MUA's job.
  8. append_dot_mydomain = no
  9. # Uncomment the next line to generate "delayed mail" warnings
  10. #delay_warning_time = 4h
  11. readme_directory = no
  12. # antispam
  13. smtpd_helo_required = yes
  14. smtpd_helo_restrictions = permit_mynetworks, reject_invalid_hostname
  15. smtpd_sender_restrictions = reject_unknown_address
  16. disable_vrfy_command = yes
  17. strict_rfc821_envelopes = yes
  18. invalid_hostname_reject_code = 554
  19. multi_recipient_bounce_reject_code = 554
  20. non_fqdn_reject_code = 554
  21. relay_domains_reject_code = 554
  22. unknown_address_reject_code = 554
  23. unknown_client_reject_code = 554
  24. unknown_hostname_reject_code = 554
  25. unknown_local_recipient_reject_code = 554
  26. unknown_relay_recipient_reject_code = 554
  27. unknown_virtual_alias_reject_code = 554
  28. unknown_virtual_mailbox_reject_code = 554
  29. unverified_recipient_reject_code = 554
  30. unverified_sender_reject_code = 554
  31. # TLS parameters
  32. smtpd_tls_mandatory_protocols=!SSLv2,!SSLv3
  33. smtp_tls_mandatory_protocols=!SSLv2,!SSLv3
  34. smtp_tls_protocols = !SSLv2,!SSLv3
  35. smtpd_tls_protocols = !SSLv2,!SSLv3
  36. smtpd_tls_cert_file=/etc/letsencrypt/live/{{ domain }}/fullchain.pem
  37. smtpd_tls_key_file=/etc/letsencrypt/live/{{ domain }}/privkey.pem
  38. smtpd_use_tls=yes
  39. smtpd_tls_auth_only = yes
  40. smtp_tls_security_level = may
  41. smtp_tls_loglevel = 2
  42. smtpd_tls_received_header = yes
  43. smtp_tls_note_starttls_offer = yes
  44. smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
  45. # http://www.postfix.org/FORWARD_SECRECY_README.html
  46. smtp_tls_ciphers = medium
  47. smtpd_tls_dh1024_param_file = /etc/ssl/private/dhparam2048.pem
  48. smtpd_sasl_type = dovecot
  49. smtpd_sasl_path = private/auth
  50. smtpd_sasl_auth_enable = yes
  51. broken_sasl_auth_clients = yes
  52. smtpd_sasl_security_options = noanonymous
  53. # set to empty value for backwards compatibility
  54. # as per http://www.postfix.org/postconf.5.html#smtpd_relay_restrictions
  55. smtpd_relay_restrictions =
  56. smtpd_recipient_restrictions =
  57. permit_sasl_authenticated,
  58. permit_mynetworks,
  59. reject_unauth_pipelining,
  60. reject_unauth_destination,
  61. reject_invalid_hostname,
  62. reject_non_fqdn_hostname,
  63. reject_non_fqdn_recipient,
  64. reject_unknown_recipient_domain,
  65. check_policy_service inet:127.0.0.1:10023,
  66. permit
  67. # See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
  68. # information on enabling SSL in the smtp client.
  69. myhostname = {{ mail_server_hostname }}
  70. myorigin = $mydomain
  71. alias_maps = hash:/etc/aliases
  72. alias_database = hash:/etc/aliases
  73. mydestination = localhost
  74. relayhost =
  75. mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 {{ ' '.join(friendly_networks) }}
  76. #mailbox_command = procmail -a "$EXTENSION"
  77. mailbox_size_limit = 0
  78. recipient_delimiter = +
  79. inet_interfaces = all
  80. # dovecot db
  81. virtual_transport = lmtp:unix:private/dovecot-lmtp
  82. mailbox_transport = lmtp:unix:private/dovecot-lmtp
  83. dovecot_destination_recipient_limit = 1
  84. virtual_mailbox_domains = pgsql:/etc/postfix/pgsql-virtual-mailbox-domains.cf
  85. virtual_mailbox_maps = pgsql:/etc/postfix/pgsql-virtual-mailbox-maps.cf
  86. virtual_alias_maps = pgsql:/etc/postfix/pgsql-virtual-alias-maps.cf
  87. local_recipient_maps = $virtual_mailbox_maps
  88. # Milters: OpenDKIM, OpenDMARC, Rspamd
  89. smtpd_milters = inet:127.0.0.1:8891,inet:127.0.0.1:54321,inet:127.0.0.1:9900
  90. non_smtpd_milters = $smtpd_milters
  91. milter_protocol = 6
  92. milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen} {auth_type}
  93. milter_default_action = accept
  94. smtpd_client_restrictions = permit_sasl_authenticated
  95. # Postscreen
  96. postscreen_access_list = permit_mynetworks
  97. postscreen_dnsbl_sites =
  98. sbl-xbl.spamhaus.org*2
  99. cbl.abuseat.org*2
  100. bl.spamcop.net*2
  101. dnsbl.sorbs.net*1
  102. spam.spamrats.com*2
  103. postscreen_dnsbl_threshold = 3
  104. postscreen_dnsbl_action = enforce
  105. postscreen_greet_action = enforce
  106. {% if mail_header_privacy == 1 %}
  107. # Remove local client IP from headers
  108. smtp_header_checks = pcre:/etc/postfix/maps/smtp_header_checks.pcre
  109. {% endif %}