smtpd (smtp + daemon) = server = Postfix receives mail from a client
smtp = client = Postfix sends mail to another mailserver

used Ports: 10023/tcp: postgrey

10024/tcp: amavisd-new
10025/tcp: policyd-weight

/etc/postfix/main.cf:

alias_maps = hash:/etc/aliases
biff = no
broken_sasl_auth_clients = yes
canonical_maps = hash:/etc/postfix/canonical
#check_sender_access = pcre:/etc/postfix/maps/sender_check
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/lib/postfix
debug_peer_level = 2
default_destination_concurrency_limit = 20
defer_transports =
disable_dns_lookups = no
disable_mime_output_conversion = no  
disable_vrfy_command = yes
freemail_gmail = check_client_access pcre:/etc/postfix/maps/freemail_gmail
freemail_gmx = check_client_access pcre:/etc/postfix/maps/freemail_gmx
freemail_hotmail = check_client_access pcre:/etc/postfix/maps/freemail_hotmail
freemail_msn = check_client_access pcre:/etc/postfix/maps/freemail_msn
freemail_webde = check_client_access pcre:/etc/postfix/maps/freemail_webde
freemail_yahoo = check_client_access pcre:/etc/postfix/maps/freemail_yahoo
html_directory = /usr/share/doc/packages/postfix/html
inet_interfaces = all
inet_protocols = ipv4
localdomains = /etc/postfix/localdomains
local_recipient_maps = 
  proxy:ldap:/etc/postfix/ldap/ldap_local-recipients.cf proxy:unix:passwd.byname $alias_maps
mail_name = MX-Server
mail_owner = postfix
mail_spool_directory = /var/mail
mailbox_command =
mailbox_size_limit = 0
mailbox_transport =
mailq_path = /usr/bin/mailq
manpage_directory = /usr/share/man
masquerade_classes = envelope_sender, header_sender, header_recipient
masquerade_domains = !groupware.$mydomain !haas.$mydomain $mydomain
masquerade_exceptions = root
message_size_limit = 30000000
mydestination = $mydomain
mydomain = example.com
myhostname = vw01.example.com
mynetworks = 172.16.0.0/16, 172.18.0.0/16, 127.0.0.0/8
mynetworks_style = subnet
myorigin = $mydomain
newaliases_path = /usr/bin/newaliases
local_recipient_maps = proxy:ldap:/etc/postfix/ldap/ldap_local-recipients.cf
proxy_read_maps = proxy:ldap:/etc/postfix/ldap/ldap_local-recipients.cf $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks  
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/packages/postfix/README_FILES
relay_domains = $mydestination
relayhost =
relocated_maps = hash:/etc/postfix/relocated
sample_directory = /usr/share/doc/packages/postfix/samples
sender_canonical_maps = hash:/etc/postfix/sender_canonical
sendmail_path = /usr/sbin/sendmail
setgid_group = maildrop
smtp_sasl_auth_enable = no
smtp_tls_loglevel = 0
smtp_tls_note_starttls_offer = yes
smtp_tls_session_cache_database = sdbm:/etc/postfix/smtp_scache
smtp_use_tls = no
smtpd_banner = $myhostname ESMTP $mail_name
smtpd_client_restrictions =
  permit_sasl_authenticated,
  permit_mynetworks,
  reject_invalid_hostname,
  check_client_access pcre:/etc/postfix/maps/header_checks,
  reject_rbl_client zen.spamhaus.org,
  permit
smtpd_data_restrictions =
  reject_unauth_pipelining
smtpd_helo_required = yes
smtpd_helo_restrictions =
  permit_sasl_authenticated,
  permit_mynetworks,
  regexp:/etc/postfix/maps/helo.regexp
  reject_invalid_hostname,
  reject_non_fqdn_hostname,
  permit
smtpd_recipient_restrictions =
  reject_sender_login_mismatch,
  permit_sasl_authenticated,
  permit_mynetworks,
  reject_unauth_destination,
  reject_invalid_hostname,
  reject_non_fqdn_sender,
  reject_unknown_sender_domain,
  reject_non_fqdn_recipient,
  reject_unknown_recipient_domain,
  check_sender_access hash:/etc/postfix/maps/freemail_check,
  check_recipient_access pcre:/etc/postfix/maps/header_checks,
  reject_rbl_client relays.ordb.org,
  reject_rbl_client cbl.abuseat.org,
  reject_rbl_client opm.blitzed.org,
  reject_rbl_client list.dsbl.org,
  reject_rbl_recipient zen.spamhaus.org,
  reject_rbl_client sbl.spamhaus.org,
  reject_rbl_client dul.dnsbl.sorbs.net,
  check_policy_service inet:127.0.0.1:10023
  permit
smtpd_restriction_classes =
  freemail_gmail
  freemail_gmx
  freemail_hotmail
  freemail_msn
  freemail_webde
  freemail_yahoo
smtpd_sasl_auth_enable = no
smtpd_sasl_security_options = noanonymous
smtpd_sender_restrictions =
  permit_sasl_authenticated,
  permit_mynetworks,
  reject_unknown_sender_domain,
  reject_non_fqdn_sender,
  permit
smtpd_tls_ask_ccert = yes
smtpd_tls_received_header = yes
smtpd_tls_session_cache_database = sdbm:/etc/postfix/smtpd_scache
smtpd_use_tls = no
strict_8bitmime = no
strict_rfc821_envelopes = yes
tls_random_source = dev:/dev/urandom
transport_maps = hash:/etc/postfix/transport
unknown_address_reject_code = 554
unknown_hostname_reject_code = 554
unknown_client_reject_code = 554
virtual_alias_domains = hash:/etc/postfix/virtual
virtual_alias_maps = hash:/etc/postfix/virtual

/etc/postfix/master.cf:

smtp      inet  n       -       n       -       -       smtpd 
  -o content_filter=lmtp-amavis:[127.0.0.1]:10024
  -o receive_override_options=no_address_mappings
#smtp-amavis unix -      -       n       -       2       smtp
#  -o smtp_data_done_timeout=1200
#  -o smtp_send_xforward_command=yes
#  -o disable_dns_lookups=yes
#  -o max_use=20
lmtp-amavis unix -      -       n       -       2       lmtp -v
  -o lmtp_data_done_timeout=1200
  -o lmtp_send_xforward_command=yes
  -o disable_dns_lookups=yes
  -o max_use=20
localhost:10025 inet	n	-	n	-	-	smtpd 
  -o content_filter=
  -o local_recipient_maps=
  -o relay_recipient_maps=
  -o smtpd_restriction_classes=
  -o smtpd_deley_reject=no
  -o smtpd_client_restrictions=permit_mynetworks,reject
  -o smtpd_helo_restrictions=
  -o smtpd_sender_restrictions=
  -o smtpd_recipient_restrictions=permit_mynetworks,reject_unauth_destination
  -o smtpd_data_restrictions=reject_unauth_pipelining
  -o smtpd_end_of_data_restrictions=
  -o mynetworks=127.0.0.0/8
  -o smtpd_error_sleep_time=0
  -o smtpd_soft_error_limit=1001
  -o smtpd_hard_error_limit=1001
  -o smtpd_client_connection_count_limit=0
  -o smtpd_client_connection_rate_limit=0
  -o receive_override_options=no_header_body_checks,no_unknown_recipient_checks
#submission inet n      -       n       -       -       smtpd
#       -o smtpd_etrn_restrictions=reject
#       -o smtpd_client_restrictions=permit_sasl_authenticated,reject
#smtps    inet  n       -       n       -       -       smtpd -o smtpd_tls_wrappermode=yes
#  -o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes
#submission   inet    n       -       n       -       -       smtpd
#  -o smtpd_etrn_restrictions=reject
#  -o smtpd_enforce_tls=yes -o smtpd_sasl_auth_enable=yes
#628      inet  n       -       n       -       -       qmqpd
pickup    fifo  n       -       n       60      1       pickup
cleanup   unix  n       -       n       -       0       cleanup
qmgr      fifo  n       -       n       300     1       qmgr
#qmgr     fifo  n       -       n       300     1       oqmgr
#tlsmgr    unix  -       -       n       1000?   1       tlsmgr
rewrite   unix  -       -       n       -       -       trivial-rewrite
bounce    unix  -       -       n       -       0       bounce
defer     unix  -       -       n       -       0       bounce
trace     unix  -       -       n       -       0       bounce
verify    unix  -       -       n       -       1       verify
flush     unix  n       -       n       1000?   0       flush
proxymap  unix  -       -       n       -       -       proxymap
smtp      unix  -       -       n       -       -       smtp
# When relaying mail as backup MX, disable fallback_relay to avoid MX loops
relay     unix  -       -       n       -       -       smtp
        -o fallback_relay=
#       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
showq     unix  n       -       n       -       -       showq
error     unix  -       -       n       -       -       error
discard   unix  -       -       n       -       -       discard
local     unix  -       n       n       -       -       local
virtual   unix  -       n       n       -       -       virtual
lmtp      unix  -       -       n       -       -       lmtp
anvil     unix  -       -       n       -       1       anvil
#localhost:10025 inet   n       -       n       -       -       smtpd -o content_filter=
scache    unix  -       -       n       -       1       scache
#
# ====================================================================
# Interfaces to non-Postfix software. Be sure to examine the manual
# pages of the non-Postfix software to find out what options it wants.
#
 # Many of the following services use the Postfix pipe(8) delivery
# agent.  See the pipe(8) man page for information about ${recipient}
# and other message envelope options.
# ====================================================================
#
maildrop  unix  -       n       n       -       -       pipe
  flags=DRhu user=vmail argv=/usr/local/bin/maildrop -d ${recipient}
cyrus     unix  -       n       n       -       -       pipe
  user=cyrus argv=/usr/lib/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
uucp      unix  -       n       n       -       -       pipe
  flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
ifmail    unix  -       n       n       -       -       pipe
  flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp     unix  -       n       n       -       -       pipe
  flags=Fq. user=foo argv=/usr/local/sbin/bsmtp -f $sender $nexthop $recipient
procmail  unix  -       n       n       -       -       pipe
  flags=R user=nobody argv=/usr/bin/procmail -t -m /etc/procmailrc ${sender} ${recipient}

/etc/postfix/localdomains.

# put in this file all the domain-names, you're accepting mails for. Each domain on a separate line:
domain1.example.com
domain2.example.com

/etc/postfix/maps/sender_check: (Adapt to your needs!)

/domain\.de$/                DUNNO
/^mail\.domain\.de$/         DUNNO
/^spammer\.de$/              REJECT

/etc/postfix/maps/freemail_check:

gmail.com			freemail_gmail
gmx.net			freemail_gmx
hotmail.com			freemail_hotmail
msn.com			freemail_msn
web.de			freemail_webde
yahoo.com			freemail_yahoo

don't forget to do a postmap /etc/postfix/maps/freemail_check !!!
/etc/postfix/maps/freemail_gmail:

/(^|\.)gmail\.com$/		DUNNO
/./				REJECT You claim to be from gmail.com but your mail didn't come from a gmail.com server.

/etc/postfix/maps/freemail_gmx:

/(^|\.)gmx\.net$/		DUNNO
/./				REJECT You claim to be from gmx.net but your mail didn't come from a gmx.net server.

/etc/postfix/maps/freemail_hotmail:

/(^|\.)hotmail\.com$/		DUNNO
/./				REJECT You claim to be from hotmail.com but your mail didn't come from a hotmail.com server.

/etc/postfix/maps/freemail_msn:

/(^|\.)msn\.com$/		DUNNO
/./				REJECT You claim to be from msn.com but your mail didn't come from a msn.com server.

/etc/postfix/maps/freemail_webde:

/(^|\.)web\.de$/		DUNNO
/./				REJECT You claim to be from web.de but your mail didn't come from a web.de server.

/etc/postfix/maps/freemail_yahoo:

/(^|\.)yahoo\.com$/		DUNNO
/./				REJECT You claim to be from yahoo.com but your mail didn't come from a yahoo.com server.

/etc/postfix/maps/header_checks: (risky!)

/(dsl|dynamic|ppp|dhcp|broadband|cable|dialin|dialup).*..*$/   REJECT  Rule #1 No mails from dynamic IPs are allowed.

/[d]{1,3}[-.][d]{1,3}[-.][d]{1,3}[-.][d]{1,3}([D]+)/ REJECT  Rule #2 No mails from dynamic IPs are allowed.

/[d]{8,}/ REJECT  Rule #3 No mails from dynamic IPs are allowed.

/etc/postfix/maps/helo.regexp :

/^.example\.com$/		550 Don't use my own hostname
/^171\.16\.68\.170$/		550 Don't use my own IP address
/^[0-9.]+$/			550 Your software is not RFC 2821 compliant
/^[0-9]+(\.[0-9]+){3}$/	550 Your software is not RFC 2821 compliant

This alone will turn away spammers trying to send the helo command and impersonating either the server receiving the mail by IP or by hostname as well as turning away some of the mail that doesn't meet RFC 2821 compliance.

/etc/postfix/ldap/ldap_local-recipients.cf: (if LDAP-tree with recipients resides on another server, e.g. station7.example.com)

server_host= station7.example.com
server_port= 389
version= 3
bind= no
timeout= 120
search_base= dc=example,dc=com
query_filter = (&(objectClass=gosaMailAccount)(gosaMailDeliveryMode=[*L*])(|(mail=%s)(gosaMailAlternateAddress=%s)))
result_attribute= uid
lookup_wildcards= no
scope= sub

← zurück