Differences
This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision | ||
postfix:optimized-configuration [2009/03/25 10:04] greebo |
postfix:optimized-configuration [2013/09/12 15:40] (current) zagi |
||
---|---|---|---|
Line 1: | Line 1: | ||
- | soft_bounce = yes\\ | + | **main.cf** |
- | \\ | + | < |
- | smtpd_banner = $myhostname ESMTP (NO UCE)(NO UBE) http:// | + | #soft_bounce = yes |
- | \\ | + | smtpd_banner = $myhostname ESMTP (NO UCE)(NO UBE) http:// |
- | biff = no\\ | + | biff = no |
- | \\ | + | |
- | # appending .domain is the MUA's job.\\ | + | # appending .domain is the MUA's job. |
- | append_dot_mydomain = no\\ | + | append_dot_mydomain = no |
- | \\ | + | |
- | # Uncomment the next line to generate " | + | # Uncomment the next line to generate " |
- | delay_warning_time = 3h\\ | + | #delay_warning_time = 3h |
- | \\ | + | |
- | readme_directory = no\\ | + | readme_directory = no |
- | # | + | html_directory = no |
- | \\ | + | |
- | myorigin = $myhostname\\ | + | myorigin = $myhostname |
# mta MUST accept mail for localhost, localhost.$mydomain | # mta MUST accept mail for localhost, localhost.$mydomain | ||
- | mydestination = $myhostname, | + | mydestination = $myhostname, |
- | \\ | + | |
- | myhostname = host.domain.tld\\ | + | myhostname = host.domain.tld |
- | \\ | + | |
# Yes...please exchange it :-) | # Yes...please exchange it :-) | ||
- | mail_name = Exchange Microsoft\\ | + | mail_name = Exchange Microsoft |
- | \\ | + | |
- | # Use only if you have trouble sending mail. It breaks " | + | # Use only if you have trouble sending mail. It breaks " |
- | # | + | # |
- | \\ | + | |
- | alias_maps = hash:/ | + | alias_maps = hash:/ |
- | alias_database = hash:/ | + | alias_database = hash:/ |
- | \\ | + | |
- | virtual_maps = hash:/ | + | sender_canonical_maps = hash:/ |
- | \\ | + | recipient_canonical_maps = hash:/ |
- | local_recipient_maps = proxy: | + | |
- | \\ | + | allow_percent_hack = no |
- | # | + | swap_bangpath = no |
- | slow_destination-concurrency_limit = 3\\ | + | |
- | \\ | + | virtual_maps = hash:/ |
- | # TLS parameters\\ | + | |
- | tls_random_source | + | local_recipient_maps = proxy: |
- | \\ | + | |
- | smtpd_tls_cert_file=/ | + | # |
- | smtpd_tls_key_file=/ | + | slow_destination-concurrency_limit = 3 |
- | \\ | + | </ |
- | smtpd_tls_session_cache_database | + | |
- | smtp_tls_session_cache_database = btree: | + | **TLS Sections** |
- | \\ | + | < |
- | ### | + | # TLS parameters |
- | smtp_tls_security_level = may\\ | + | smtp_tls_security_level=may |
- | smtpd_tls_security_level = may\\ | + | #obsoletes smtp_use_tls smtp_enforce_tls |
- | \\ | + | smtp_tls_note_starttls_offer=yes |
- | ### | + | |
- | \\ | + | smtp_tls_CApath |
- | ### | + | |
- | \\ | + | smtpd_tls_security_level=may |
+ | # | ||
+ | |||
+ | smtp_tls_cert_file=/ | ||
+ | smtp_tls_key_file=/ | ||
+ | |||
+ | smtpd_tls_cert_file=/etc/ssl/ | ||
+ | smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key | ||
# debuging tls | # debuging tls | ||
- | # smtpd_tls_loglevel = 3\\ | + | smtp_tls_loglevel = 0 |
- | \\ | + | smtpd_tls_loglevel = 0 |
- | #obsolete#smtpd_use_tls=yes\\ | + | |
- | \\ | + | smtpd_tls_auth_only=yes |
- | smtp_tls_note_starttls_offer = yes\\ | + | smtpd_tls_received_header=yes |
- | # | + | |
- | \\ | + | smtpd_tls_session_cache_database = btree: |
- | smtpd_sasl_local_domain = $myhostname\\ | + | smtp_tls_session_cache_database = btree: |
- | smtpd_sasl_application_name = smtpd\\ | + | |
- | smtpd_sasl_auth_enable = yes\\ | + | tls_random_source = dev:/ |
- | smtpd_sasl_security_options = noanonymous\\ | + | |
- | broken_sasl_auth_clients = yes\\ | + | ### |
- | smtpd_sasl_exceptions_networks = $mynetworks\\ | + | ### |
- | \\ | + | ### |
- | smtpd_tls_auth_only = yes\\ | + | |
- | smtpd_tls_received_header | + | smtp_tls_note_starttls_offer = yes |
- | \\ | + | # |
- | # | + | |
- | \\ | + | smtpd_sasl_local_domain = $myhostname |
- | relayhost =\\ | + | smtpd_sasl_application_name = smtpd |
- | mynetworks = 127.0.0.0/8 192.168.10.0/ | + | smtpd_sasl_auth_enable = yes |
- | mailbox_size_limit = 0\\ | + | smtpd_sasl_security_options = noanonymous |
- | recipient_delimiter = +\\ | + | broken_sasl_auth_clients = yes |
- | inet_interfaces = all\\ | + | smtpd_sasl_exceptions_networks = $mynetworks |
- | inet_protocols = ipv4\\ | + | |
- | \\ | + | |
- | smtpd_restriction_classes = permissive, rblcheck, greylisting, | + | smtpd_sasl_authenticated_header |
- | \\ | + | </ |
- | permissive = permit\\ | + | |
- | \\ | + | < |
- | rblcheck =\\ | + | # |
+ | |||
+ | relayhost = | ||
+ | mynetworks = 127.0.0.0/8 192.168.10.0/ | ||
+ | mailbox_size_limit = 0 | ||
+ | recipient_delimiter = + | ||
+ | inet_interfaces = all | ||
+ | inet_protocols = all | ||
+ | |||
+ | smtpd_restriction_classes = permissive, rblcheck, greylisting, | ||
+ | |||
+ | permissive = permit | ||
+ | |||
+ | rblcheck = | ||
check_recipient_access hash:/ | check_recipient_access hash:/ | ||
reject_rbl_client zen.spamhaus.org, | reject_rbl_client zen.spamhaus.org, | ||
Line 90: | Line 111: | ||
reject_rbl_client psbl.surriel.com, | reject_rbl_client psbl.surriel.com, | ||
reject_rhsbl_sender bogusmx.rfc-ignorant.org | reject_rhsbl_sender bogusmx.rfc-ignorant.org | ||
- | \\ | + | |
- | greylisting =\\ | + | greylisting = |
+ | permit_mynetworks, | ||
+ | permit_sasl_authenticated, | ||
check_recipient_access hash:/ | check_recipient_access hash:/ | ||
check_policy_service inet: | check_policy_service inet: | ||
- | \\ | + | |
- | nodynamic_client =\\ | + | nodynamic_client = |
warn_if_reject reject_unknown_client_hostname, | warn_if_reject reject_unknown_client_hostname, | ||
check_client_access pcre:/ | check_client_access pcre:/ | ||
- | \\ | + | |
- | check_policyd_weight =\\ | + | check_policyd_weight = |
+ | check_client_access hash:/ | ||
check_recipient_access hash:/ | check_recipient_access hash:/ | ||
check_policy_service inet: | check_policy_service inet: | ||
- | \\ | + | |
- | verify_sender =\\ | + | verify_sender = |
check_sender_access hash:/ | check_sender_access hash:/ | ||
check_recipient_access hash:/ | check_recipient_access hash:/ | ||
reject_unverified_sender | reject_unverified_sender | ||
- | \\ | + | |
# Don't offer ETRN nor VRFY | # Don't offer ETRN nor VRFY | ||
- | smtpd_discard_ehlo_keywords = silent-discard, | + | smtpd_discard_ehlo_keywords = silent-discard, |
- | \\ | + | |
- | smtpd_helo_restrictions =\\ | + | smtpd_discard_ehlo_keyword_address_maps = |
+ | hash:/ | ||
+ | |||
+ | smtpd_helo_restrictions = | ||
+ | check_client_access hash:/ | ||
hash:/ | hash:/ | ||
- | \\ | + | permit_sasl_authenticated |
- | smtpd_etrn_restrictions=\\ | + | permit_mynetworks |
+ | warn_if_reject reject_invalid_hostname | ||
+ | warn_if_reject reject_non_fqdn_hostname | ||
+ | warn_if_reject reject_unknown_hostname | ||
+ | |||
+ | smtpd_etrn_restrictions= | ||
permit_mynetworks, | permit_mynetworks, | ||
reject | reject | ||
- | \\ | + | |
- | smtpd_sender_restrictions =\\ | + | # |
- | \\ | + | |
- | smtpd_recipient_restrictions =\\ | + | #smtpd_sender_restrictions = reject_sender_login_mismatch |
+ | |||
+ | smtpd_recipient_restrictions = | ||
greylisting, | greylisting, | ||
reject_unlisted_recipient, | reject_unlisted_recipient, | ||
Line 136: | Line 171: | ||
verify_sender | verify_sender | ||
# | # | ||
- | \\ | + | |
- | smtpd_data_restrictions =\\ | + | smtpd_data_restrictions = |
reject_multi_recipient_bounce | reject_multi_recipient_bounce | ||
reject_unauth_pipelining | reject_unauth_pipelining | ||
permit | permit | ||
- | \\ | + | |
- | content_filter = smtp-amavis: | + | content_filter = smtp-amavis: |
- | \\ | + | |
- | lmtp_send_xforward_command = yes\\ | + | #already in master.cf: |
- | smtp_send_xforward_command = yes\\ | + | #lmtp_send_xforward_command = yes |
- | \\ | + | #smtp_send_xforward_command = yes |
- | hash_queue_depth = 1\\ | + | |
- | \\ | + | hash_queue_depth = 1 |
- | # / | + | |
- | address_verify_sender = postar\\ | + | # / |
- | address_verify_map = btree: | + | address_verify_sender = postar |
- | \\ | + | address_verify_map = btree: |
- | home_mailbox = Maildir/\\ | + | |
- | message_size_limit = 70480000\\ | + | |
- | \\ | + | home_mailbox = Maildir/ |
- | # ABKO\\ | + | message_size_limit = 70480000 |
- | disable_vrfy_command = yes\\ | + | |
- | smtpd_helo_required = yes\\ | + | # ABKO |
- | strict_rfc821_envelopes = yes\\ | + | disable_vrfy_command = yes |
- | \\ | + | smtpd_helo_required = yes |
- | unverified_recipient_reject_code = 550\\ | + | strict_rfc821_envelopes = yes |
- | unverified_sender_reject_code = 550\\ | + | |
- | \\ | + | unverified_recipient_reject_code = 550 |
- | smtpd_error_sleep_time = 0s\\ | + | unverified_sender_reject_code = 550 |
- | smtpd_soft_error_limit = 5\\ | + | |
- | smtpd_hard_error_limit = 10\\ | + | smtpd_error_sleep_time = 3s |
- | \\ | + | smtpd_soft_error_limit = 5 |
+ | smtpd_hard_error_limit = 10 | ||
# Mailman feature | # Mailman feature | ||
- | owner_request_special = yes\\ | + | owner_request_special = yes |
- | show_user_unknown_table_name = no\\ | + | show_user_unknown_table_name = no |
- | \\ | + | |
# testing purposed | # testing purposed | ||
- | # smtpd_delay_reject = no\\ | + | # smtpd_delay_reject = no |
- | \\ | + | |
- | # DEBUG\\ | + | # DEBUG |
- | # debug_peer_level = 1\\ | + | # debug_peer_level = 1 |
- | # | + | # |
- | remote_header_rewrite_domain = domain.invalid\\ | + | remote_header_rewrite_domain = domain.invalid |
+ | </ | ||
+ | |||
+ | |||
+ | **/ | ||
+ | < | ||
+ | < | ||
+ | < | ||
+ | [< | ||
+ | </ | ||
+ | |||
**/ | **/ | ||
Line 206: | Line 254: | ||
**/ | **/ | ||
+ | FIXME | ||
**/ | **/ | ||
Line 223: | Line 271: | ||
**/ | **/ | ||
- | 0.0.0.0/8 | + | < |
- | 1.0.0.0/ | + | # http://www.cymru.com/ |
- | 2.0.0.0/ | + | 0.0.0.0/ |
- | 5.0.0.0/ | + | 5.0.0.0/ |
- | 10.0.0.0/ | + | 10.0.0.0/ |
- | 14.0.0.0/ | + | 14.0.0.0/ |
- | 23.0.0.0/ | + | 23.0.0.0/ |
- | | + | 31.0.0.0/ |
- | | + | 36.0.0.0/7 |
- | 36.0.0.0/8 | + | 39.0.0.0/ |
- | | + | 42.0.0.0/ |
- | | + | 49.0.0.0/ |
- | 42.0.0.0/ | + | 100.0.0.0/6 REJECT IP address of MX host is a bogus address |
- | | + | 104.0.0.0/7 REJECT IP address of MX host is a bogus address |
- | | + | 106.0.0.0/ |
- | | + | 127.0.0.0/ |
- | | + | 169.254.0.0/16 |
- | 101.0.0.0/8 REJECT IP address of MX host is a bogus address | + | 172.16.0.0/12 REJECT IP address of MX host is a bogus address |
- | 102.0.0.0/ | + | 176.0.0.0/7 REJECT IP address of MX host is a bogus address |
- | 103.0.0.0/ | + | 179.0.0.0/ |
- | 104.0.0.0/8 | + | 181.0.0.0/ |
- | 105.0.0.0/ | + | 185.0.0.0/ |
- | 106.0.0.0/8 REJECT IP address of MX host is a bogus address | + | 192.0.2.0/24 |
- | 107.0.0.0/8 REJECT IP address of MX host is a bogus address | + | 192.168.0.0/ |
- | 108.0.0.0/ | + | 198.18.0.0/15 REJECT IP address of MX host is a bogus address |
- | 109.0.0.0/ | + | 198.51.100.0/24 REJECT IP address of MX host is a bogus address |
- | 110.0.0.0/ | + | 203.0.113.0/24 |
- | 111.0.0.0/8 REJECT IP address of MX host is a bogus address | + | 223.0.0.0/ |
- | 127.0.0.0/ | + | 224.0.0.0/3 REJECT IP address of MX host is a bogus address |
- | 169.254.0.0/ | + | </code> |
- | 172.16.0.0/12 REJECT IP address of MX host is a bogus address | + | |
- | 175.0.0.0/8 REJECT IP address of MX host is a bogus address | + | **/etc/ |
- | 176.0.0.0/8 REJECT IP address of MX host is a bogus address | + | |
- | 177.0.0.0/ | + | |
- | 178.0.0.0/8 REJECT IP address of MX host is a bogus address | + | |
- | | + | **/etc/ |
- | | + | |
- | | + | |
- | | + | |
- | | + | **/etc/ |
- | | + | 127.0.0.1 |
- | 185.0.0.0/8 | + | localhost |
- | 192.0.2.0/24 REJECT IP address of MX host is a bogus address | + | host.domain.tld OK\\ |
- | | + | |
- | | + | |
- | | + | **/ |
- | | + | submission inet n |
- | | + | |
- | | + | -o smtpd_sasl_auth_enable=yes\\ |
- | | + | |
+ | | ||
+ | ** -o syslog_name=postfix-submission**\\ | ||
+ | smtps | ||
+ | | ||
+ | | ||
+ | | ||
+ | -o milter_macro_daemon_name=ORIGINATING\\ | ||