linux:email:postfix:relayhost [hackerbruecke.net]

Diese Seite ist nicht editierbar. Sie können den Quelltext sehen, jedoch nicht verändern. Kontaktieren Sie den Administrator, wenn Sie glauben, dass hier ein Fehler vorliegt.
{{:suse.png}}
==== Postfix configuration for a relayhost (MX) / Anti-SPAM-/UCE-settings ====
smtp**d** (smtp + daemon) = server = **Postfix receives mail** from a client \\ 
smtp = client = **Postfix sends mail** to another mailserver \\ 

** used Ports:** 
  10023/tcp: postgrey
  10024/tcp: amavisd-new
  10025/tcp: policyd-weight
\\ 
**/etc/postfix/main.cf:**
  alias_maps = hash:/etc/aliases
  biff = no
  broken_sasl_auth_clients = yes
  canonical_maps = hash:/etc/postfix/canonical
  #check_sender_access = pcre:/etc/postfix/maps/sender_check
  command_directory = /usr/sbin
  config_directory = /etc/postfix
  daemon_directory = /usr/lib/postfix
  debug_peer_level = 2
  default_destination_concurrency_limit = 20
  defer_transports =
  disable_dns_lookups = no
  disable_mime_output_conversion = no  
  disable_vrfy_command = yes
  freemail_gmail = check_client_access pcre:/etc/postfix/maps/freemail_gmail
  freemail_gmx = check_client_access pcre:/etc/postfix/maps/freemail_gmx
  freemail_hotmail = check_client_access pcre:/etc/postfix/maps/freemail_hotmail
  freemail_msn = check_client_access pcre:/etc/postfix/maps/freemail_msn
  freemail_webde = check_client_access pcre:/etc/postfix/maps/freemail_webde
  freemail_yahoo = check_client_access pcre:/etc/postfix/maps/freemail_yahoo
  html_directory = /usr/share/doc/packages/postfix/html
  inet_interfaces = all
  inet_protocols = ipv4
  localdomains = /etc/postfix/localdomains
  local_recipient_maps = 
    proxy:ldap:/etc/postfix/ldap/ldap_local-recipients.cf proxy:unix:passwd.byname $alias_maps
  mail_name = MX-Server
  mail_owner = postfix
  mail_spool_directory = /var/mail
  mailbox_command =
  mailbox_size_limit = 0
  mailbox_transport =
  mailq_path = /usr/bin/mailq
  manpage_directory = /usr/share/man
  masquerade_classes = envelope_sender, header_sender, header_recipient
  masquerade_domains = !groupware.$mydomain !haas.$mydomain $mydomain
  masquerade_exceptions = root
  message_size_limit = 30000000
  mydestination = $mydomain
  mydomain = example.com
  myhostname = vw01.example.com
  mynetworks = 172.16.0.0/16, 172.18.0.0/16, 127.0.0.0/8
  mynetworks_style = subnet
  myorigin = $mydomain
  newaliases_path = /usr/bin/newaliases
  local_recipient_maps = proxy:ldap:/etc/postfix/ldap/ldap_local-recipients.cf
  proxy_read_maps = proxy:ldap:/etc/postfix/ldap/ldap_local-recipients.cf $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks  
  queue_directory = /var/spool/postfix
  readme_directory = /usr/share/doc/packages/postfix/README_FILES
  relay_domains = $mydestination
  relayhost =
  relocated_maps = hash:/etc/postfix/relocated
  sample_directory = /usr/share/doc/packages/postfix/samples
  sender_canonical_maps = hash:/etc/postfix/sender_canonical
  sendmail_path = /usr/sbin/sendmail
  setgid_group = maildrop
  smtp_sasl_auth_enable = no
  smtp_tls_loglevel = 0
  smtp_tls_note_starttls_offer = yes
  smtp_tls_session_cache_database = sdbm:/etc/postfix/smtp_scache
  smtp_use_tls = no
  smtpd_banner = $myhostname ESMTP $mail_name
  smtpd_client_restrictions =
    permit_sasl_authenticated,
    permit_mynetworks,
    reject_invalid_hostname,
    check_client_access pcre:/etc/postfix/maps/header_checks,
    reject_rbl_client zen.spamhaus.org,
    permit
  smtpd_data_restrictions =
    reject_unauth_pipelining
  smtpd_helo_required = yes
  smtpd_helo_restrictions =
    permit_sasl_authenticated,
    permit_mynetworks,
    regexp:/etc/postfix/maps/helo.regexp
    reject_invalid_hostname,
    reject_non_fqdn_hostname,
    permit
  smtpd_recipient_restrictions =
    reject_sender_login_mismatch,
    permit_sasl_authenticated,
    permit_mynetworks,
    reject_unauth_destination,
    reject_invalid_hostname,
    reject_non_fqdn_sender,
    reject_unknown_sender_domain,
    reject_non_fqdn_recipient,
    reject_unknown_recipient_domain,
    check_sender_access hash:/etc/postfix/maps/freemail_check,
    check_recipient_access pcre:/etc/postfix/maps/header_checks,
    reject_rbl_client relays.ordb.org,
    reject_rbl_client cbl.abuseat.org,
    reject_rbl_client opm.blitzed.org,
    reject_rbl_client list.dsbl.org,
    reject_rbl_recipient zen.spamhaus.org,
    reject_rbl_client sbl.spamhaus.org,
    reject_rbl_client dul.dnsbl.sorbs.net,
    check_policy_service inet:127.0.0.1:10023
    permit
  smtpd_restriction_classes =
    freemail_gmail
    freemail_gmx
    freemail_hotmail
    freemail_msn
    freemail_webde
    freemail_yahoo
  smtpd_sasl_auth_enable = no
  smtpd_sasl_security_options = noanonymous
  smtpd_sender_restrictions =
    permit_sasl_authenticated,
    permit_mynetworks,
    reject_unknown_sender_domain,
    reject_non_fqdn_sender,
    permit
  smtpd_tls_ask_ccert = yes
  smtpd_tls_received_header = yes
  smtpd_tls_session_cache_database = sdbm:/etc/postfix/smtpd_scache
  smtpd_use_tls = no
  strict_8bitmime = no
  strict_rfc821_envelopes = yes
  tls_random_source = dev:/dev/urandom
  transport_maps = hash:/etc/postfix/transport
  unknown_address_reject_code = 554
  unknown_hostname_reject_code = 554
  unknown_client_reject_code = 554
  virtual_alias_domains = hash:/etc/postfix/virtual
  virtual_alias_maps = hash:/etc/postfix/virtual

**/etc/postfix/master.cf:**
  smtp      inet  n       -       n       -       -       smtpd 
    -o content_filter=lmtp-amavis:[127.0.0.1]:10024
    -o receive_override_options=no_address_mappings
  #smtp-amavis unix -      -       n       -       2       smtp
  #  -o smtp_data_done_timeout=1200
  #  -o smtp_send_xforward_command=yes
  #  -o disable_dns_lookups=yes
  #  -o max_use=20
  lmtp-amavis unix -      -       n       -       2       lmtp -v
    -o lmtp_data_done_timeout=1200
    -o lmtp_send_xforward_command=yes
    -o disable_dns_lookups=yes
    -o max_use=20
  localhost:10025 inet	n	-	n	-	-	smtpd 
    -o content_filter=
    -o local_recipient_maps=
    -o relay_recipient_maps=
    -o smtpd_restriction_classes=
    -o smtpd_deley_reject=no
    -o smtpd_client_restrictions=permit_mynetworks,reject
    -o smtpd_helo_restrictions=
    -o smtpd_sender_restrictions=
    -o smtpd_recipient_restrictions=permit_mynetworks,reject_unauth_destination
    -o smtpd_data_restrictions=reject_unauth_pipelining
    -o smtpd_end_of_data_restrictions=
    -o mynetworks=127.0.0.0/8
    -o smtpd_error_sleep_time=0
    -o smtpd_soft_error_limit=1001
    -o smtpd_hard_error_limit=1001
    -o smtpd_client_connection_count_limit=0
    -o smtpd_client_connection_rate_limit=0
    -o receive_override_options=no_header_body_checks,no_unknown_recipient_checks
  #submission inet n      -       n       -       -       smtpd
  #       -o smtpd_etrn_restrictions=reject
  #       -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  #smtps    inet  n       -       n       -       -       smtpd -o smtpd_tls_wrappermode=yes
  #  -o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes
  #submission   inet    n       -       n       -       -       smtpd
  #  -o smtpd_etrn_restrictions=reject
  #  -o smtpd_enforce_tls=yes -o smtpd_sasl_auth_enable=yes
  #628      inet  n       -       n       -       -       qmqpd
  pickup    fifo  n       -       n       60      1       pickup
  cleanup   unix  n       -       n       -       0       cleanup
  qmgr      fifo  n       -       n       300     1       qmgr
  #qmgr     fifo  n       -       n       300     1       oqmgr
  #tlsmgr    unix  -       -       n       1000?   1       tlsmgr
  rewrite   unix  -       -       n       -       -       trivial-rewrite
  bounce    unix  -       -       n       -       0       bounce
  defer     unix  -       -       n       -       0       bounce
  trace     unix  -       -       n       -       0       bounce
  verify    unix  -       -       n       -       1       verify
  flush     unix  n       -       n       1000?   0       flush
  proxymap  unix  -       -       n       -       -       proxymap
  smtp      unix  -       -       n       -       -       smtp
  # When relaying mail as backup MX, disable fallback_relay to avoid MX loops
  relay     unix  -       -       n       -       -       smtp
          -o fallback_relay=
  #       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
  showq     unix  n       -       n       -       -       showq
  error     unix  -       -       n       -       -       error
  discard   unix  -       -       n       -       -       discard
  local     unix  -       n       n       -       -       local
  virtual   unix  -       n       n       -       -       virtual
  lmtp      unix  -       -       n       -       -       lmtp
  anvil     unix  -       -       n       -       1       anvil
  #localhost:10025 inet   n       -       n       -       -       smtpd -o content_filter=
  scache    unix  -       -       n       -       1       scache
  #
  # ====================================================================
  # Interfaces to non-Postfix software. Be sure to examine the manual
  # pages of the non-Postfix software to find out what options it wants.
  #
   # Many of the following services use the Postfix pipe(8) delivery
  # agent.  See the pipe(8) man page for information about ${recipient}
  # and other message envelope options.
  # ====================================================================
  #
  maildrop  unix  -       n       n       -       -       pipe
    flags=DRhu user=vmail argv=/usr/local/bin/maildrop -d ${recipient}
  cyrus     unix  -       n       n       -       -       pipe
    user=cyrus argv=/usr/lib/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
  uucp      unix  -       n       n       -       -       pipe
    flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
  ifmail    unix  -       n       n       -       -       pipe
    flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
  bsmtp     unix  -       n       n       -       -       pipe
    flags=Fq. user=foo argv=/usr/local/sbin/bsmtp -f $sender $nexthop $recipient
  procmail  unix  -       n       n       -       -       pipe
    flags=R user=nobody argv=/usr/bin/procmail -t -m /etc/procmailrc ${sender} ${recipient}

\\ 
**/etc/postfix/localdomains.**
  # put in this file all the domain-names, you're accepting mails for. Each domain on a separate line:
  domain1.example.com
  domain2.example.com
\\ 

**/etc/postfix/maps/sender_check: (Adapt to your needs!)**
  /domain\.de$/                DUNNO
  /^mail\.domain\.de$/         DUNNO
  /^spammer\.de$/              REJECT
\\ 
**/etc/postfix/maps/freemail_check:**
  gmail.com			freemail_gmail
  gmx.net			freemail_gmx
  hotmail.com			freemail_hotmail
  msn.com			freemail_msn
  web.de			freemail_webde
  yahoo.com			freemail_yahoo
\\ 
** don't forget to do a postmap /etc/postfix/maps/freemail_check !!!**
\\ 
**/etc/postfix/maps/freemail_gmail:**
  /(^|\.)gmail\.com$/		DUNNO
  /./				REJECT You claim to be from gmail.com but your mail didn't come from a gmail.com server.
\\ 
**/etc/postfix/maps/freemail_gmx:**
  /(^|\.)gmx\.net$/		DUNNO
  /./				REJECT You claim to be from gmx.net but your mail didn't come from a gmx.net server.
\\ 
**/etc/postfix/maps/freemail_hotmail:**
  /(^|\.)hotmail\.com$/		DUNNO
  /./				REJECT You claim to be from hotmail.com but your mail didn't come from a hotmail.com server.
\\ 
**/etc/postfix/maps/freemail_msn:**
  /(^|\.)msn\.com$/		DUNNO
  /./				REJECT You claim to be from msn.com but your mail didn't come from a msn.com server.
\\ 
**/etc/postfix/maps/freemail_webde:**
  /(^|\.)web\.de$/		DUNNO
  /./				REJECT You claim to be from web.de but your mail didn't come from a web.de server.
\\ 
**/etc/postfix/maps/freemail_yahoo:**
  /(^|\.)yahoo\.com$/		DUNNO
  /./				REJECT You claim to be from yahoo.com but your mail didn't come from a yahoo.com server.
\\ 
**/etc/postfix/maps/header_checks: (risky!)**
  /(dsl|dynamic|ppp|dhcp|broadband|cable|dialin|dialup).*..*$/   REJECT  Rule #1 No mails from dynamic IPs are allowed.
  
  /[d]{1,3}[-.][d]{1,3}[-.][d]{1,3}[-.][d]{1,3}([D]+)/ REJECT  Rule #2 No mails from dynamic IPs are allowed.
  
  /[d]{8,}/ REJECT  Rule #3 No mails from dynamic IPs are allowed.
\\ 
**/etc/postfix/maps/helo.regexp :**
  /^.example\.com$/		550 Don't use my own hostname
  /^171\.16\.68\.170$/		550 Don't use my own IP address
  /^[0-9.]+$/			550 Your software is not RFC 2821 compliant
  /^[0-9]+(\.[0-9]+){3}$/	550 Your software is not RFC 2821 compliant
\\ 
This alone will turn away spammers trying to send the helo command and impersonating either the server receiving the mail by IP or by hostname as well as turning away some of the mail that doesn't meet RFC 2821 compliance.\\ 
\\ 
**/etc/postfix/ldap/ldap_local-recipients.cf:** (if LDAP-tree with recipients resides on another server, e.g. station7.example.com)
  server_host= station7.example.com
  server_port= 389
  version= 3
  bind= no
  timeout= 120
  search_base= dc=example,dc=com
  query_filter = (&(objectClass=gosaMailAccount)(gosaMailDeliveryMode=[*L*])(|(mail=%s)(gosaMailAlternateAddress=%s)))
  result_attribute= uid
  lookup_wildcards= no
  scope= sub
\\ 

\\ 
<- [[linux:email:email|zurück]]