ansible-role-postfix/templates/postfix/main.cf.j2

369 lines
12 KiB
Text
Raw Normal View History

{{ ansible_managed | comment }}
{{ template_path | comment }}
2023-03-20 20:01:04 +01:00
{% if postfix_smtp_banner is defined %}
2023-03-20 20:01:04 +01:00
smtpd_banner = {{ postfix_smtpd_banner }}
{% endif %}
2023-03-20 20:01:04 +01:00
2023-06-19 21:17:59 +02:00
### Logging
respectful_logging = yes
{% if postfix_debug_peer_list is defined %}
debug_peer_list = {{ postfix_debug_peer_list | join(', ') }}
{% endif %}
2023-03-20 20:01:04 +01:00
### Protocols and destinations
inet_interfaces = all
inet_protocols = ipv4
myhostname = {{ postfix_myhostname }}
{% if postfix_myorigin is defined %}
2023-03-20 20:01:04 +01:00
myorigin = {{ postfix_myorigin }}
{% endif %}
{% if postfix_mydestination is defined %}
2023-03-20 20:01:04 +01:00
mydestination = {{ postfix_mydestination | join(', ') }}
{% endif %}
{% if postfix_mynetworks is defined %}
2023-03-20 20:01:04 +01:00
mynetworks = {{ postfix_mynetworks | join(', ') }}
{% endif %}
2023-03-20 20:01:04 +01:00
{% if postfix_type == "internet" %}
2023-03-20 20:01:04 +01:00
### TLS settings
tls_ssl_options = NO_COMPRESSION, NO_RENEGOTIATION
tls_preempt_cipherlist = no
tls_medium_cipherlist = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
2023-03-20 20:01:04 +01:00
tls_high_cipherlist=EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA
### TLS settings for SMTP server
smtpd_tls_security_level = may
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = {{ postfix_smtpd_tls_cert_file }}
smtpd_tls_key_file = {{ postfix_smtpd_tls_key_file }}
{% if postfix_smtpd_tls_eccert_file is defined %}
smtpd_tls_eccert_file = {{ postfix_smtpd_tls_eccert_file }}
{% endif %}
{% if postfix_smtpd_tls_eckey_file is defined %}
smtpd_tls_eckey_file = {{ postfix_smtpd_tls_eckey_file }}
{% endif %}
2023-03-20 20:01:04 +01:00
smtpd_tls_ciphers = medium
smtpd_tls_mandatory_ciphers = medium
smtpd_tls_exclude_ciphers = aNULL, eNULL, MD5, DES, 3DES, DES-CBC3-SHA, RC4-SHA, AES256-SHA, AES128-SHA, DHE-RSA-AES256-SHA
smtpd_tls_mandatory_protocols = >=TLSv1
smtpd_tls_protocols = >=TLSv1
2023-03-20 20:01:04 +01:00
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_tls_session_cache_timeout = 7200s
smtpd_tls_loglevel = 1
smtpd_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
smtpd_tls_dh1024_param_file = {{ postfix_dhparam_file }}
smtpd_tls_eecdh_grade = strong
{% endif %}
2023-03-20 20:01:04 +01:00
{% if postfix_type == "internet" or postfix_smtp_sasl_auth_enabled is defined and postfix_smtp_sasl_auth_enabled %}
2023-03-20 20:01:04 +01:00
### TLS settings for SMTP client
smtp_tls_security_level = dane
smtp_dns_support_level = dnssec
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtp_tls_session_cache_timeout = 7200s
smtp_tls_protocols = >=TLSv1
2023-03-20 20:01:04 +01:00
{% if postfix_smtp_tls_policy_maps is defined %}
smtp_tls_policy_maps =
{% for map in postfix_smtp_tls_policy_maps %}
{{ map.type }}:{{ map.path }}
{% endfor %}
{% endif %}
smtp_tls_ciphers = medium
smtp_tls_fingerprint_digest = sha1
smtp_tls_loglevel = 1
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
smtp_pix_workarounds = disable_esmtp
{% endif %}
2023-03-20 20:01:04 +01:00
### Domains and recipients
{% if postfix_virtual_mailbox_domains is defined %}
virtual_mailbox_domains =
{% for map in postfix_virtual_mailbox_domains %}
{{ map.type }}:{{ map.path }}
{% endfor %}
{% endif %}
{% if postfix_virtual_mailbox_maps is defined %}
virtual_mailbox_maps =
{% for map in postfix_virtual_mailbox_maps %}
{{ map.type }}:{{ map.path }}
{% endfor %}
{% endif %}
{% if postfix_virtual_alias_maps is defined %}
virtual_alias_maps =
{% for map in postfix_virtual_alias_maps %}
{{ map.type }}:{{ map.path}}
{% endfor %}
{% endif %}
{% if postfix_virtual_transport is defined %}
virtual_transport =
{% for map in postfix_virtual_transport %}
{{ map.type }}:{{ map.address }}
{% endfor %}
{% endif %}
2023-03-24 16:12:58 +01:00
{% if postfix_relay_domains is defined %}
2023-03-20 20:01:04 +01:00
# Relay mails without recipient check
2023-03-24 16:12:58 +01:00
relay_domains =
{% for map in postfix_relay_domains %}
{{ map.type}}:{{ map.path }}
{% endfor %}
2023-03-20 20:01:04 +01:00
{% endif %}
{% if postfix_sender_dependent_relayhost_maps is defined %}
sender_dependent_relayhost_maps =
{% for map in postfix_sender_dependent_relayhost_maps %}
{{ map.type }}:{{ map.path }}
{% endfor %}
{% endif %}
{% if postfix_transport_maps is defined %}
transport_maps =
{% for map in postfix_transport_maps %}
{{ map.type }}:{{ map.path }}
{% endfor %}
{% endif %}
{% if postfix_relayhost is defined %}
2023-04-19 12:56:49 +02:00
relayhost = {{ postfix_relayhost}}
{% endif %}
2023-04-19 12:47:39 +02:00
2023-06-15 07:43:39 +02:00
{% if postfix_smtp_fallback_relay is defined %}
smtp_fallback_relay = {{ postfix_smtp_fallback_relay }}
{% endif %}
2023-04-19 12:47:39 +02:00
{% if postfix_canonical_maps is defined %}
canonical_maps =
{% for map in postfix_canonical_maps %}
{{ map.type}}:{{ map.path }}
{% endfor %}
{% endif %}
{% if postfix_sender_canonical_maps is defined %}
sender_canonical_maps =
{% for map in postfix_sender_canonical_maps %}
{{ map.type}}:{{ map.path }}
{% endfor %}
{% endif %}
{% if postfix_type == "internet" %}
# Postfix-default: alias_maps = hash:/etc/mail/aliases nis:mail.aliases
# Prevents delays caused by NIS queries
{% endif %}
alias_maps =
2023-04-19 12:56:49 +02:00
{% for map in postfix_alias_maps %}
2023-04-19 12:47:39 +02:00
{{ map.type }}:{{ map.path }}
{% endfor %}
2023-03-20 20:01:04 +01:00
{% if postfix_smtpd_sasl_type is defined %}
### SMTP Auth, server side
broken_sasl_auth_clients = yes
smtpd_sasl_type = {{ postfix_smtpd_sasl_type }}
smtpd_sasl_path = {{ postfix_smtpd_sasl_path }}
smtpd_sasl_auth_enable = no
{% if postfix_smtpd_sasl_exceptions_networks is defined %}
# Some clients demand SASL Auth if the server offers it
smtpd_sasl_exceptions_networks = {{ postfix_smtpd_sasl_exceptions_networks | join(', ') }}
{% endif %}
{% endif %}
2023-06-14 16:14:29 +02:00
{% if postfix_smtp_sasl_auth_enabled is defined and postfix_smtp_sasl_auth_enabled %}
2023-03-20 20:01:04 +01:00
### SMTP Auth client side
smtp_sasl_auth_enable = yes
smtp_sasl_auth_soft_bounce = no
2023-06-14 17:03:55 +02:00
smtp_sasl_password_maps = cdb:{{ postfix_conf_dir }}/smtp_sasl_auth_password
2023-03-20 20:01:04 +01:00
smtp_sasl_security_options = noanonymous
{% endif %}
{% if postfix_type == "internet" %}
2023-03-20 20:01:04 +01:00
#### Postscreen
postscreen_access_list =
permit_mynetworks
2023-04-17 23:17:22 +02:00
cidr:{{ postfix_conf_dir }}/postscreen_access
2023-03-20 20:01:04 +01:00
postscreen_blacklist_action = drop
# Pregreeting
postscreen_greet_action = drop
# DNS block lists
postscreen_dnsbl_threshold = 2
{% if postfix_postscreen_dnsbl_sites is defined %}
2023-03-20 20:01:04 +01:00
postscreen_dnsbl_sites =
2023-03-24 21:04:31 +01:00
{% for site in postfix_postscreen_dnsbl_sites %}
{{ site.name }}*{{ site.multiplier }}
{% endfor %}
{% endif %}
2023-03-20 20:01:04 +01:00
postscreen_dnsbl_action = drop
{% endif %}
2023-03-20 20:01:04 +01:00
{% if postfix_type == "internet" %}
2023-03-20 20:01:04 +01:00
# Postfix runs restrictions with the following order
# - smtpd_client_restriction
# - smtpd_helo_restriction
# - smtpd_sender_restrition
# - smtpd_relay_restrictions
# - smtpd_recipient_restrictions
# - smtpd_data_restriction
# - smtpd_end_of_data_restriction
# - smtpd_etrn_restriction
smtpd_restriction_classes = permit_login_mismatch
smtpd_client_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
check_client_access cdb:{{ postfix_conf_dir }}/client_checks,
2023-03-20 20:01:04 +01:00
reject_unknown_client_hostname,
permit
# Reject only after RCPT-TO
smtpd_delay_reject = yes
# Enforce helo to apply restrictions
smtpd_helo_required = yes
smtpd_helo_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
check_helo_access pcre:{{ postfix_conf_dir }}/helo_checks,
2023-03-20 20:01:04 +01:00
reject_non_fqdn_helo_hostname,
reject_invalid_helo_hostname,
permit
smtpd_sender_restrictions =
permit_mynetworks,
check_sender_access cdb:{{ postfix_conf_dir }}/sender_checks,
2023-03-20 20:01:04 +01:00
reject_non_fqdn_sender,
reject_unknown_sender_domain,
check_sender_mx_access cidr:{{ postfix_conf_dir }}/bogus_mx,
2023-03-20 20:01:04 +01:00
#Uncomment the next two lines to block mails from other servers with our domain as MAIL FROM
#permit_sasl_authenticated,
#check_sender_access hash:{{ postfix_conf_dir }}/sender_checks_domain,
2023-03-20 20:01:04 +01:00
permit
{% if postfix_submission is defined and postfix_submission %}
2023-03-20 20:01:04 +01:00
# Restrictions for submission port
mua_sender_restrictions =
check_sasl_access cdb:{{ postfix_conf_dir }}/permit_sasl_login_mismatch,
2023-03-20 20:01:04 +01:00
permit_mynetworks,
check_sender_access cdb:{{ postfix_conf_dir }}/sender_checks,
2023-03-20 20:01:04 +01:00
reject_non_fqdn_sender,
reject_unknown_sender_domain,
reject_sender_login_mismatch,
permit_sasl_authenticated
{% endif %}
2023-03-20 20:01:04 +01:00
permit_login_mismatch =
permit_mynetworks,
reject_non_fqdn_sender,
reject_unknown_sender_domain,
permit_sasl_authenticated
{% if postfix_submission is defined and postfix_submission %}
2023-03-20 20:01:04 +01:00
submission_bad_smtp_user_check =
check_sasl_access cdb:{{ postfix_conf_dir }}/bad_smtp_auth_users
{% endif %}
2023-03-20 20:01:04 +01:00
smtpd_relay_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
check_client_access cdb:{{ postfix_conf_dir }}/relay_checks,
2023-03-20 20:01:04 +01:00
reject_unauth_destination
smtpd_recipient_restrictions =
reject_unauth_pipelining,
reject_non_fqdn_recipient,
reject_unknown_recipient_domain,
permit_mynetworks,
permit_sasl_authenticated,
reject_unverified_recipient
{% endif %}
2023-03-20 20:01:04 +01:00
# Configuration for reject_unverified_recipient
unverified_recipient_reject_reason = User unknown / Nutzer unbekannt
unverified_recipient_reject_code = 550
smtpd_data_restrictions =
reject_multi_recipient_bounce,
check_recipient_access pcre:{{ postfix_conf_dir }}/header_add,
2023-03-20 20:01:04 +01:00
### Connection limits
smtpd_client_connection_rate_limit = 100
2023-04-17 23:17:22 +02:00
{% if postfix_smtpd_client_event_limit_exceptions is defined %}
2023-03-20 20:01:04 +01:00
smtpd_client_event_limit_exceptions = {{ postfix_smtpd_client_event_limit_exceptions | join(', ') }}
2023-04-17 23:17:22 +02:00
{% endif %}
2023-03-20 20:01:04 +01:00
smtpd_client_message_rate_limit = 25
smtpd_client_new_tls_session_rate_limit = 100
smtpd_client_auth_rate_limit = 100
default_destination_rate_delay = 60s
default_destination_recipient_limit = 1
default_destination_concurrency_failed_cohort_limit = 10
{% if postfix_type == "internet" %}
2023-03-20 20:01:04 +01:00
### Spam and DKIM
{% if postfix_smtpd_milters is defined %}
smtpd_milters =
{% for map in postfix_smtpd_milters %}
{{ map.type }}:{{ map.address }}
{% endfor %}
{% endif %}
{% if postfix_non_smtpd_milters is defined %}
non_smtpd_milters =
{% for map in postfix_non_smtpd_milters %}
{{ map.type }}:{{ map.address }}
{% endfor %}
{% endif %}
milter_default_action = accept
milter_connect_macros = i j {daemon_name} v {if_name} _
milter_mail_macros = i {auth_type} {auth_authen} {auth_author} {mail_addr} {mail_host} {mail_mailer} {client_addr} {client_name}
milter_rcpt_macros = i j _ {auth_type} {rcpt_addr} {rcpt_host} {rcpt_mailer}
milter_connect_timeout = 20s
# Prevent DKIM signatures (don't allow spam header to change the signature)
disable_mime_output_conversion = yes
{% endif %}
2023-03-20 20:01:04 +01:00
### Misc
disable_vrfy_command = yes
recipient_delimiter = +
# Error notifications
# http://www.postfix.org/postconf.5.html#notify_classes
notify_classes = data, delay, resource, software
minimal_backoff_time = 1000s
maximal_backoff_time = 4h
compatibility_level = 2
biff = no
append_dot_mydomain = no
2023-04-19 15:55:40 +02:00
# Header treatment
2023-03-20 20:01:04 +01:00
always_add_missing_headers = yes
local_header_rewrite_clients = permit_mynetworks
2023-04-19 15:55:40 +02:00
header_checks = pcre:{{ postfix_conf_dir }}/header_checks
2023-03-20 20:01:04 +01:00
mailbox_size_limit = 0
message_size_limit = {{ postfix_message_size_limit }}
2023-04-19 15:47:27 +02:00
{% if postfix_type == "internet" %}
2023-03-20 20:01:04 +01:00
### Destination limits
# Some mail server limit concurrent connections
# Solves: Maximum parallel connections for your IP-Address
dlimit_destination_concurrency_limit = 4
dlimit_destination_recipient_limit = 3
dlimit_destination_rate_delay = 5s
2023-04-19 15:47:27 +02:00
{% endif %}
2023-03-20 20:01:04 +01:00
{% if postfix_proxy_read_maps is defined %}
### Proxy maps
proxy_read_maps =
{% for map in postfix_proxy_read_maps %}
{{ map }}
{% endfor %}
{% endif %}
2023-04-19 12:47:39 +02:00
{% if postfix_authorized_submit_users is defined %}
# Allow/ prevent sendmail delivery for specific users
2023-04-19 17:19:18 +02:00
authorized_submit_users = {{ postfix_authorized_submit_users | join(', ') }}
2023-04-19 12:47:39 +02:00
{% endif %}