mirror of
https://github.com/YunoHost/yunohost.git
synced 2024-09-03 20:06:10 +02:00
7ccd6e1348
Hi, Postfix has this very peculiar behavior where the target of some config keys changes depending on the value. Here, if `smtp_destination_concurrency_limit` is set to 1, then according to http://www.postfix.org/postconf.5.html#default_destination_concurrency_limit it doesn't mean "1 concurrent mail per domain, but per recipiend address". So, if set to 1, it means we can send any volume of e-mails concurrently (with a 5s delay) if all recipient addresses are different. In order to avoid this, we should increase the value to restore the expected behavior (concurrency per domain, not per recipient).
180 lines
6.2 KiB
CFEngine3
180 lines
6.2 KiB
CFEngine3
# See /usr/share/postfix/main.cf.dist for a commented, more complete version
|
|
|
|
|
|
# Debian specific: Specifying a file name will cause the first
|
|
# line of that file to be used as the name. The Debian default
|
|
# is /etc/mailname.
|
|
#myorigin = /etc/mailname
|
|
|
|
smtpd_banner = $myhostname Service ready
|
|
biff = no
|
|
|
|
# appending .domain is the MUA's job.
|
|
append_dot_mydomain = no
|
|
|
|
# Uncomment the next line to generate "delayed mail" warnings
|
|
#delay_warning_time = 4h
|
|
|
|
readme_directory = no
|
|
|
|
# -- TLS for incoming connections
|
|
###############################################################################
|
|
# generated 2020-04-03, Mozilla Guideline v5.4, Postfix 3.1.14, OpenSSL 1.1.0l, intermediate configuration
|
|
# https://ssl-config.mozilla.org/#server=postfix&version=3.1.14&config=intermediate&openssl=1.1.0l&guideline=5.4
|
|
|
|
# (No modern conf support until we're on buster...)
|
|
# {% if compatibility == "intermediate" %} {% else %} {% endif %}
|
|
|
|
smtpd_use_tls = yes
|
|
|
|
smtpd_tls_security_level = may
|
|
smtpd_tls_auth_only = yes
|
|
smtpd_tls_cert_file = /etc/yunohost/certs/{{ main_domain }}/crt.pem
|
|
smtpd_tls_key_file = /etc/yunohost/certs/{{ main_domain }}/key.pem
|
|
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
|
|
smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
|
|
# smtpd_tls_mandatory_ciphers = medium # (c.f. below)
|
|
|
|
# curl https://ssl-config.mozilla.org/ffdhe2048.txt > /path/to/dhparam.pem
|
|
# not actually 1024 bits, this applies to all DHE >= 1024 bits
|
|
# smtpd_tls_dh1024_param_file = /path/to/dhparam.pem
|
|
|
|
# This custom medium cipherlist recommendation only works if we have a DH ... which we don't, c.f. https://github.com/YunoHost/issues/issues/93
|
|
# On the other hand, the postfix doc strongly discourage tweaking this list ... So whatever, let's keep the mandatory_ciphers to high like we did before applying the Mozilla recommendation ...
|
|
#tls_medium_cipherlist = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
|
|
tls_preempt_cipherlist = no
|
|
|
|
# Custom Yunohost stuff ... because we can't use the recommendation about medium cipher list ...
|
|
smtpd_tls_mandatory_ciphers=high
|
|
smtpd_tls_eecdh_grade = ultra
|
|
###############################################################################
|
|
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
|
|
smtpd_tls_loglevel=1
|
|
|
|
# -- TLS for outgoing connections
|
|
# Use TLS if this is supported by the remote SMTP server, otherwise use plaintext.
|
|
smtp_tls_security_level=may
|
|
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
|
|
smtp_tls_exclude_ciphers = aNULL, MD5, DES, ADH, RC4, 3DES
|
|
smtp_tls_mandatory_ciphers= high
|
|
smtp_tls_loglevel=1
|
|
|
|
# Configure Root CA certificates
|
|
# (for example, avoids getting "Untrusted TLS connection established to" messages in logs)
|
|
smtpd_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
|
|
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
|
|
|
|
# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
|
|
# information on enabling SSL in the smtp client.
|
|
|
|
myhostname = {{ main_domain }}
|
|
alias_maps = hash:/etc/aliases
|
|
alias_database = hash:/etc/aliases
|
|
mydomain = {{ main_domain }}
|
|
mydestination = localhost
|
|
relayhost =
|
|
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
|
|
mailbox_command = procmail -a "$EXTENSION"
|
|
mailbox_size_limit = 0
|
|
recipient_delimiter = +
|
|
inet_interfaces = all
|
|
|
|
#### Fit to the maximum message size to 30mb, more than allowed by GMail or Yahoo ####
|
|
message_size_limit = 31457280
|
|
|
|
# Virtual Domains Control
|
|
virtual_mailbox_domains = ldap:/etc/postfix/ldap-domains.cf
|
|
virtual_mailbox_maps = ldap:/etc/postfix/ldap-accounts.cf
|
|
virtual_mailbox_base =
|
|
virtual_alias_maps = ldap:/etc/postfix/ldap-aliases.cf
|
|
virtual_alias_domains =
|
|
virtual_minimum_uid = 100
|
|
virtual_uid_maps = static:vmail
|
|
virtual_gid_maps = static:mail
|
|
smtpd_sender_login_maps= ldap:/etc/postfix/ldap-accounts.cf
|
|
|
|
# Dovecot LDA
|
|
virtual_transport = dovecot
|
|
dovecot_destination_recipient_limit = 1
|
|
|
|
# Enable SASL authentication for the smtpd daemon
|
|
smtpd_sasl_auth_enable = yes
|
|
smtpd_sasl_type = dovecot
|
|
smtpd_sasl_path = private/auth
|
|
# Fix some outlook's bugs
|
|
broken_sasl_auth_clients = yes
|
|
# Reject anonymous connections
|
|
smtpd_sasl_security_options = noanonymous
|
|
smtpd_sasl_local_domain =
|
|
|
|
|
|
# Wait until the RCPT TO command before evaluating restrictions
|
|
smtpd_delay_reject = yes
|
|
|
|
# Basics Restrictions
|
|
smtpd_helo_required = yes
|
|
strict_rfc821_envelopes = yes
|
|
|
|
# Requirements for the connecting server
|
|
smtpd_client_restrictions =
|
|
permit_mynetworks,
|
|
permit_sasl_authenticated,
|
|
reject_rbl_client bl.spamcop.net,
|
|
reject_rbl_client cbl.abuseat.org,
|
|
reject_rbl_client zen.spamhaus.org,
|
|
permit
|
|
|
|
# Requirements for the HELO statement
|
|
smtpd_helo_restrictions =
|
|
permit_mynetworks,
|
|
permit_sasl_authenticated,
|
|
reject_non_fqdn_hostname,
|
|
reject_invalid_hostname,
|
|
permit
|
|
|
|
# Requirements for the sender address
|
|
smtpd_sender_restrictions =
|
|
reject_sender_login_mismatch,
|
|
permit_mynetworks,
|
|
permit_sasl_authenticated,
|
|
reject_non_fqdn_sender,
|
|
reject_unknown_sender_domain,
|
|
permit
|
|
|
|
# Requirement for the recipient address
|
|
smtpd_recipient_restrictions =
|
|
permit_mynetworks,
|
|
permit_sasl_authenticated,
|
|
reject_non_fqdn_recipient,
|
|
reject_unknown_recipient_domain,
|
|
reject_unauth_destination,
|
|
permit
|
|
|
|
# SRS
|
|
sender_canonical_maps = tcp:localhost:10001
|
|
sender_canonical_classes = envelope_sender
|
|
recipient_canonical_maps = tcp:localhost:10002
|
|
recipient_canonical_classes= envelope_recipient,header_recipient
|
|
|
|
# Ignore some headers
|
|
smtp_header_checks = regexp:/etc/postfix/header_checks
|
|
|
|
smtp_reply_filter = pcre:/etc/postfix/smtp_reply_filter
|
|
|
|
# Rmilter
|
|
milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}
|
|
milter_protocol = 6
|
|
smtpd_milters = inet:localhost:11332
|
|
|
|
# Skip email without checking if milter has died
|
|
milter_default_action = accept
|
|
|
|
# Avoid to send simultaneously too many emails
|
|
smtp_destination_concurrency_limit = 2
|
|
default_destination_rate_delay = 5s
|
|
|
|
# Avoid email adress scanning
|
|
# By default it's possible to detect if the email adress exist
|
|
# So it's easly possible to scan a server to know which email adress is valid
|
|
# and after to send spam
|
|
disable_vrfy_command = yes
|