Commit 563adbfb authored by Eric's avatar Eric

amelioration mars 2020

parent 7454585b
*/10 * * * * root /usr/local/bin/soo2-update_domains.sh 2>&1 >/var/log/soo2/dkim.log
*/10 * * * * root /usr/local/bin/soo2-update_domains.sh 2>&1 >>/var/log/soo2/dkim.log
This diff is collapsed.
/var/log/soo2/*.log {
weekly
/var/log/soo2/*.log
{
rotate 12
monthly
missingok
rotate 52
compress
delaycompress
notifempty
create 0640 debian-spamd adm
delaycompress
compress
}
......@@ -82,15 +82,22 @@ smtpd_recipient_restrictions =
reject_non_fqdn_recipient
reject_non_fqdn_helo_hostname
#remove intranet headers
#remove headers
header_checks = regexp:/etc/postfix/header_checks
#opendkim
milter_default_action = accept
milter_protocol = 6
smtpd_milters = inet:localhost:12345
# pour eviter un double lancement ... et donc une double signature
# smtpd_milters = doit etre vide
smtpd_milters =
non_smtpd_milters = inet:localhost:12345
#on ralentis quand meme pour les detecteurs de spam quand on a les newsletters
smtp_destination_concurrency_limit = 4
smtp_destination_rate_delay = 1s
smtp_extra_recipient_limit = 10
#slow smtp (orange par ex)
slowsmtp_destination_recipient_limit = 2
slowsmtp_destination_concurrency_limit = 2
......@@ -104,6 +111,7 @@ transport_maps =
message_size_limit = 52428800
#TLS support cf http://www.postfix.org/postconf.5.html#smtp_tls_security_level
smtp_tls_CApath = /etc/ssl/certs
smtp_tls_security_level = may
smtp_tls_ciphers = export
smtp_tls_protocols = !SSLv2, !SSLv3
......@@ -112,6 +120,7 @@ smtp_tls_cert_file = /var/lib/dehydrated/certs/mx-out-01.sud-ouest2.org/cert.pem
smtp_tls_key_file = /var/lib/dehydrated/certs/mx-out-01.sud-ouest2.org/privkey.pem
smtp_tls_session_cache_database = btree:/var/lib/postfix/smtp_scache
smtpd_tls_CApath = /etc/ssl/certs
smtpd_tls_security_level = may
smtpd_tls_ciphers = export
smtpd_tls_protocols = !SSLv2, !SSLv3
......@@ -123,3 +132,6 @@ smtpd_tls_session_cache_database = btree:/var/lib/postfix/smtpd_scache
#utiliser le fichier /etc/hosts
lmtp_host_lookup = native
smtp_host_lookup = native
#pas de mail local
local_transport = error:local mail delivery is disabled
......@@ -33,7 +33,9 @@ smtp inet n - n - 20 smtpd
-o smtpd_data_restrictions=
-o mynetworks=127.0.0.0/8
-o receive_override_options=no_unknown_recipient_checks
# remove sender IP in header - part 1 (part 2 below) see https://www.void.gr/kargig/blog/2013/11/24/anonymize-headers-in-postfix/
#-o cleanup_service_name=subcleanup
#smtp inet n - y - - smtpd
#smtp inet n - y - 1 postscreen
#smtpd pass - - y - - smtpd
......@@ -68,7 +70,7 @@ qmgr unix n - n 300 1 qmgr
#qmgr unix n - n 300 1 oqmgr
tlsmgr unix - - y 1000? 1 tlsmgr
rewrite unix - - y - - trivial-rewrite
bounce unix - - y - 0 bounce
bounce unix - - y - 0 discard
defer unix - - y - 0 bounce
trace unix - - y - 0 bounce
verify unix - - y - 1 verify
......@@ -82,7 +84,8 @@ showq unix n - y - - showq
error unix - - y - - error
retry unix - - y - - error
discard unix - - y - - discard
local unix - n n - - local
#erics disable local delivery
#local unix - n n - - local
virtual unix - n n - - virtual
lmtp unix - - y - - lmtp
anvil unix - - y - 1 anvil
......@@ -149,3 +152,13 @@ mailman unix - n n - - pipe
slowsmtp unix - - n - 5 smtp
-o syslog_name=postfix/slowsmtp
#spamassassin
smtp inet n - n - - smtpd -o content_filter=spamassassin
spamassassin unix - n n - - pipe user=debian-spamd argv=/usr/bin/spamc -f -e /usr/sbin/sendmail -oi -f ${sender} ${recipient}
spamcop unix - n n - - pipe user=debian-spamd argv=/usr/local/bin/soo2-spamcop.sh -f ${sender} ${recipient}
# remove IPs part 2 cf https://www.void.gr/kargig/blog/2013/11/24/anonymize-headers-in-postfix/
#subcleanup unix n - - - 0 cleanup
# -o header_checks=pcre:/etc/postfix/smtp_header_checks
......@@ -7,3 +7,4 @@ orange.com slowsmtp:
laposte.net slowsmtp:
yahoo.fr slowsmtp:
yahoo.com slowsmtp:
gmail.com slowsmtp:
......@@ -25,3 +25,10 @@ header __CRON_HEADER X-Cron-Env =~ /./
meta D_SENT_BY_CRON __CRON_FROM && __CRON_HEADER
score D_SENT_BY_CRON -5.0
describe D_SENT_BY_CRON Sent by Cron Daemon
# As documented in https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=861671,
# the bb.barracudacentral.org blacklist requires users to register, making it
# unsuitable for use in the default configuration. If you've registered your
# use of this blacklist, remove the following line in order to re-activate
# this service:
score RCVD_IN_BRBL_LASTEXT 0
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment