main.cf 5.81 KB
Newer Older
root's avatar
root committed
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178
# This file was automatically installed on 2017-07-11T12:45:27.208235
inet_interfaces = all
inet_protocols = ipv4
myhostname = mail.sud-ouest2.org
myorigin = sud-ouest2.org
mydestination = mail.sud-ouest2.org
mynetworks = 127.0.0.0/8
smtpd_banner = $myhostname ESMTP
biff = no
unknown_local_recipient_reject_code = 550
unverified_recipient_reject_code = 550

# appending .domain is the MUA's job.
append_dot_mydomain = no

readme_directory = no

mailbox_size_limit = 0
message_size_limit = 52428800
recipient_delimiter = +

alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases

## Proxy maps
proxy_read_maps =
        proxy:unix:passwd.byname
        proxy:pgsql:/etc/postfix/sql-domains.cf
        proxy:pgsql:/etc/postfix/sql-domain-aliases.cf
        proxy:pgsql:/etc/postfix/sql-aliases.cf
        proxy:pgsql:/etc/postfix/sql-relaydomains.cf
        proxy:pgsql:/etc/postfix/sql-relaydomains-transport.cf
        proxy:pgsql:/etc/postfix/sql-relaydomain-aliases-transport.cf
        proxy:pgsql:/etc/postfix/sql-autoreplies-transport.cf
        proxy:pgsql:/etc/postfix/sql-maintain.cf
        proxy:pgsql:/etc/postfix/sql-relay-recipient-verification.cf
        proxy:pgsql:/etc/postfix/sql-sender-login-mailboxes.cf
        proxy:pgsql:/etc/postfix/sql-sender-login-aliases.cf
        proxy:pgsql:/etc/postfix/sql-sender-login-mailboxes-extra.cf
        proxy:pgsql:/etc/postfix/sql-spliteddomains-transport.cf

## TLS settings
#
smtp_tls_CApath = /etc/ssl/certs
smtpd_tls_CApath = /etc/ssl/certs
smtpd_use_tls = yes
smtpd_tls_auth_only = no

smtp_tls_CAfile     = /var/lib/dehydrated/certs/mail.sud-ouest2.org/chain.pem
smtp_tls_cert_file  = /var/lib/dehydrated/certs/mail.sud-ouest2.org/cert.pem
smtp_tls_key_file   = /var/lib/dehydrated/certs/mail.sud-ouest2.org/privkey.pem

smtpd_tls_CAfile    = /var/lib/dehydrated/certs/mail.sud-ouest2.org/chain.pem
smtpd_tls_cert_file = /var/lib/dehydrated/certs/mail.sud-ouest2.org/cert.pem
smtpd_tls_key_file  = /var/lib/dehydrated/certs/mail.sud-ouest2.org/privkey.pem

smtpd_tls_dh1024_param_file = ${config_directory}/dh2048.pem
smtpd_tls_loglevel = 1
smtpd_tls_session_cache_database = btree:$data_directory/smtpd_tls_session_cache
smtpd_tls_security_level = may
smtpd_tls_received_header = yes

# Disallow SSLv2 and SSLv3, only accept secure ciphers
smtpd_tls_protocols = !SSLv2, !SSLv3
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
smtpd_tls_mandatory_ciphers = high
smtpd_tls_mandatory_exclude_ciphers = aNULL, MD5 , DES, ADH, RC4, PSD, SRP, 3DES, eNULL
smtpd_tls_exclude_ciphers = aNULL, MD5 , DES, ADH, RC4, PSD, SRP, 3DES, eNULL

# Enable elliptic curve cryptography
smtpd_tls_eecdh_grade = strong

# Use TLS if this is supported by the remote SMTP server, otherwise use plaintext.
smtp_tls_security_level = may
smtp_tls_loglevel = 1
smtp_tls_exclude_ciphers = EXPORT, LOW

virtual_mailbox_domains = proxy:pgsql:/etc/postfix/sql-domains.cf
virtual_alias_domains = proxy:pgsql:/etc/postfix/sql-domain-aliases.cf
virtual_alias_maps =
        proxy:pgsql:/etc/postfix/sql-aliases.cf

## Relay domains
#
relay_domains =
        proxy:pgsql:/etc/postfix/sql-relaydomains.cf
	
transport_maps =
	hash:/etc/postfix/transport_dmarc
	regexp:/etc/postfix/transport_regexp_listes
        proxy:pgsql:/etc/postfix/sql-spliteddomains-transport.cf
	proxy:pgsql:/etc/postfix/sql-relaydomains-transport.cf 
        proxy:pgsql:/etc/postfix/sql-autoreplies-transport.cf

## Virtual transport settings
# modif cf https://www.owlfish.com/thoughts/dovecot-antispam-2011-03-21.html
#virtual_transport = lmtp:unix:private/dovecot-lmtp
dovecot_destination_recipient_limit = 1
virtual_transport = dovecot


## SASL authentication through Dovecot
#
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
broken_sasl_auth_clients = yes
smtpd_sasl_security_options = noanonymous

## SMTP session policies
#

# We require HELO to check it later
smtpd_helo_required = yes

# We do not let others find out which recipients are valid
disable_vrfy_command = yes

# MTA to MTA communication on Port 25. We expect (!) the other party to
# specify messages as required by RFC 821.
strict_rfc821_envelopes = yes

# Verify cache setup
address_verify_map = proxy:btree:$data_directory/verify_cache

proxy_write_maps =
    $smtp_sasl_auth_cache_name
    $lmtp_sasl_auth_cache_name
    $address_verify_map

# List of authorized senders
smtpd_sender_login_maps =
        proxy:pgsql:/etc/postfix/sql-sender-login-mailboxes.cf
        proxy:pgsql:/etc/postfix/sql-sender-login-aliases.cf
        proxy:pgsql:/etc/postfix/sql-sender-login-mailboxes-extra.cf

# Recipient restriction rules
smtpd_recipient_restrictions =
      permit_mynetworks
      permit_sasl_authenticated
      check_recipient_access
          proxy:pgsql:/etc/postfix/sql-maintain.cf
          proxy:pgsql:/etc/postfix/sql-relay-recipient-verification.cf
      reject_unverified_recipient
      reject_unauth_destination
      reject_non_fqdn_sender
      reject_non_fqdn_recipient
      reject_non_fqdn_helo_hostname

## Postcreen settings
#
postscreen_access_list =
       permit_mynetworks
postscreen_blacklist_action = enforce 

# Use some DNSBL
postscreen_dnsbl_sites = 
	zen.spamhaus.org*3 
	bl.spameatingmonkey.net*2 
	dnsbl.habl.org 
	bl.spamcop.net 
	dnsbl.sorbs.net 
postscreen_dnsbl_threshold = 3 
postscreen_dnsbl_action = enforce 

postscreen_greet_banner = Welcome, please wait... 
postscreen_greet_action = enforce

postscreen_pipelining_enable = yes
postscreen_pipelining_action = enforce

postscreen_non_smtp_command_enable = yes
postscreen_non_smtp_command_action = enforce

postscreen_bare_newline_enable = yes
postscreen_bare_newline_action = enforce

#soo2 on utilise mx-out-01 comme relayhost (permet de basculer sur mx-out-02 si le 01 est blacklisted)
179 180
relayhost = mx-out-01
#relayhost = mx-out-02
root's avatar
root committed
181 182 183 184

#utiliser le fichier /etc/hosts en priorité
lmtp_host_lookup = native
smtp_host_lookup = native