etc/postfix/main.cf

   1 # DOC: http://postfix.traduc.org/index.php/TLS_README.html
   2
   3 alias_database = hash:/etc/aliases
   4         # NOTE: fichier de hash contenant une table d’alias mail.
   5         #       Celle-ci est éditable dans /etc/aliases, puis (indispensable)
   6         #       regénérée en hash grâce à la commande newaliases qui produit /etc/aliases.db
   7 alias_maps = hash:/etc/aliases
   8 append_dot_mydomain = no
   9         # NOTE: appending .domain is the MUA's job.
  10 biff = no
  11         # NOTE: pas de notification dans la console en cas de réception de nouveaux courriels.
  12 body_checks =
  13 #content_filter = amavisfeed:[127.0.0.1]:10024
  14 #debug_peer_level = 4
  15 #debug_peer_list = .$myhostname
  16 default_extra_recipient_limit = 5000
  17 #delay_warning_time = 4h
  18         # NOTE: uncomment the previous line to generate "delayed mail" warnings
  19 duplicate_filter_limit = 5000
  20 forward_path = $home/etc/mail/forward${recipient_delimiter}${extension}, $home/etc/mail/forward
  21 header_checks = regexp:/etc/postfix/$mydomain/header_checks
  22 inet_interfaces = all
  23 inet_protocols = ipv4
  24         # NOTE: "all" to activate IPv6
  25 line_length_limit = 2048
  26 #local_header_rewrite_clients =
  27 mailbox_command = /usr/bin/procmail -t -a "$SENDER" -a "$RECIPIENT" -a "$USER" -a "$EXTENSION" -a "$DOMAIN" -a "$ORIGINAL_RECIPIENT" "$HOME/etc/mail/delivery.procmailrc"
  28 mailbox_size_limit = 0
  29 maximal_queue_lifetime = 5d
  30 message_size_limit = 20480000
  31 mime_header_checks =
  32 milter_header_checks =
  33 mynetworks = 127.0.0.0/8 #, [::1]/128
  34 non_smtpd_milters =
  35 nested_header_checks =
  36 parent_domain_matches_subdomains =
  37         #debug_peer_list
  38         #fast_flush_domains
  39         #mynetworks
  40         #permit_mx_backup_networks
  41         #qmqpd_authorized_clients
  42         #smtpd_access_maps
  43 permit_mx_backup_networks =
  44 propagate_unmatched_extensions = canonical, virtual
  45 queue_minfree = 0
  46 readme_directory = no
  47 #receive_override_options = no_address_mappings
  48         # no_unknown_recipient_checks
  49         #         Do not try to reject unknown recipients (SMTP server only).
  50         #         This is typically specified AFTER an external content filter.
  51         # no_address_mappings
  52         #         Disable canonical address mapping, virtual alias map expansion,
  53         #         address masquerading, and automatic BCC (blind carbon-copy) recipients.
  54         #         This is typically specified BEFORE an external content filter (eg. amavis).
  55         # no_header_body_checks
  56         #         Disable header/body_checks. This is typically specified AFTER an external content filter.
  57         # no_milters
  58         #         Disable Milter (mail filter) applications. This is typically specified AFTER an external content filter.
  59 recipient_delimiter = +
  60         # NOTE: séparateur entre le nom d’utilisateur et les extensions d’adresse.
  61 #relayhost =
  62 relay_clientcerts = hash:/etc/postfix/$mydomain/smtpd/relay_clientcerts
  63 relay_domains = $mydestination
  64         # NOTE: ajouter les domaines pour lesquels on est backup MX ici, pas dans mydestination ou virtual_alias...
  65 smtp_body_checks =
  66 #smtp_cname_overrides_servername = no
  67 smtp_connect_timeout = 60s
  68 smtp_header_checks = regexp:/etc/postfix/$mydomain/smtp/header_checks
  69 smtp_mime_header_checks =
  70 smtp_nested_header_checks =
  71 #smtp_tls_CAfile = /etc/postfix/$mydomain/smtp/x509/ca/crt.pem
  72 #smtp_tls_CApath = /etc/postfix/$mydomain/smtp/x509/ca/
  73 #smtp_tls_cert_file = /etc/postfix/$mydomain/smtp/x509/crt.pem
  74 smtp_tls_fingerprint_digest = sha1
  75 #smtp_tls_key_file = /etc/postfix/$mydomain/smtp/x509/key.pem
  76 smtp_tls_loglevel = 1
  77 #smtp_tls_note_starttls_offer = yes
  78 smtp_tls_policy_maps = hash:/etc/postfix/$mydomain/smtp/x509/policy
  79 smtp_tls_protocols = !SSLv2, !SSLv3
  80         # NOTE: only allow TLSv*
  81 smtp_tls_scert_verifydepth = 5
  82 #smtp_tls_secure_cert_match = nexthop, dot-nexthop
  83 smtp_tls_security_level = may
  84 smtp_tls_session_cache_database = btree:/var/lib/postfix/smtp_tls_session_cache
  85 #smtp_tls_session_cache_timeout = 3600s
  86 #smtp_tls_verify_cert_match = hostname
  87 smtpd_authorized_xclient_hosts = 127.0.0.1
  88         # NOTE: utile pour tester les restrictions
  89 smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
  90 smtpd_client_connection_count_limit = 50
  91 smtpd_client_connection_rate_limit = 0
  92 smtpd_client_event_limit_exceptions = $mynetworks
  93 smtpd_client_message_rate_limit = 0
  94 smtpd_client_new_tls_session_rate_limit = 0
  95 smtpd_client_port_logging = no
  96 smtpd_client_recipient_rate_limit = 0
  97 smtpd_client_restrictions =
  98         check_client_access hash:/etc/postfix/$mydomain/smtpd/client_blacklist
  99 smtpd_data_restrictions =
 100         reject_unauth_pipelining
 101                 # NOTE: oblige le client smtp en face à attendre qu'on lui aie dit OK
 102         permit
 103 smtpd_discard_ehlo_keywords = starttls
 104         # NOTE: les clients mails tentant d'utiliser le chiffrement opportuniste se mangent une erreur en tentant un starttls
 105 #smtpd_end_of_data_restrictions =
 106 smtpd_error_sleep_time = 5
 107         # NOTE: forcer quelqu'un qui nous embête à attendre cinq secondes.
 108 smtpd_helo_required = yes
 109 smtpd_helo_restrictions =
 110         reject_invalid_helo_hostname
 111         reject_non_fqdn_helo_hostname
 112         #reject_unknown_helo_hostname
 113                 # NOTE: pourrait pourtant être utile pour lutter contre le spam
 114         permit
 115 smtpd_milters =
 116 smtpd_peername_lookup = yes
 117         # NOTE: nécessaire pour postgrey
 118 smtpd_recipient_limit = 5000
 119 smtpd_recipient_overshoot_limit = 5000
 120 smtpd_recipient_restrictions =
 121         reject_non_fqdn_recipient
 122         #reject_invalid_hostname
 123                 # NOTE: postfix < 2.3. voir reject_invalid_helo_hostname dans smtpd_helo_restrictions
 124         reject_unknown_recipient_domain
 125         #reject_non_fqdn_sender
 126                 # NOTE: dans smtpd_sender_restrictions
 127         reject_unauth_pipelining
 128                 # NOTE: dans smtpd_client_restrictions ou smtpd_data_restrictions
 129         permit_mynetworks
 130         permit_tls_clientcerts
 131         permit_sasl_authenticated
 132         reject_unauth_destination
 133                 # NOTE: ne pas passer par SPFCheck / Postgrey si le mail n'est pas pour nous ou quelqu'un pour lequel on tient lieu de backup_mx
 134         check_policy_service inet:127.0.0.1:10023
 135                 # NOTE: Postgrey (greylisting)
 136         check_policy_service unix:private/spfcheck
 137         permit_auth_destination
 138                 # NOTE: une fois Postgrey passé, on accepte ce qui nous est destiné (voir permit_auth_destination) ; sans doute redondant
 139         reject
 140         #reject_unknown_sender_domain
 141                 # NOTE: probablement mieux dans smtpd_sender_restrictions
 142         #reject_rbl_client bl.spamcop.net
 143         #reject_rbl_client list.dsbl.org
 144         #reject_rbl_client zen.spamhaus.org
 145         #reject_rbl_client dnsbl.sorbs.net
 146 #smtpd_restriction_classes =
 147 smtpd_sasl_auth_enable = yes
 148 smtpd_sasl_path = private/auth
 149 smtpd_sasl_security_options = noanonymous
 150 smtpd_sasl_type = dovecot
 151 smtpd_sender_restrictions =
 152         permit_mynetworks
 153         permit_tls_clientcerts
 154         permit_sasl_authenticated
 155         check_sender_access hash:/etc/postfix/$mydomain/smtpd/sender_access
 156         reject_unauth_pipelining
 157         reject_non_fqdn_sender
 158         #reject_unknown_sender_domain
 159         permit
 160 smtpd_starttls_timeout = 300s
 161 #smtpd_tls_always_issue_session_ids = yes
 162 smtpd_tls_CAfile = /etc/postfix/$mydomain/x509/smtpd/ca/crt.pem
 163 smtpd_tls_CApath = /etc/postfix/$mydomain/x509/smtpd/ca/
 164 smtpd_tls_ask_ccert = no
 165 smtpd_tls_auth_only = yes
 166         # NOTE: pas d'AUTH SASL sans TLS
 167 smtpd_tls_ccert_verifydepth = 5
 168 smtpd_tls_cert_file = /etc/postfix/$mydomain/x509/smtpd/crt+crl.self-signed.pem
 169 smtpd_tls_ciphers = high
 170 smtpd_tls_fingerprint_digest = sha512
 171 smtpd_tls_key_file = /etc/postfix/$mydomain/x509/smtpd/key.pem
 172 smtpd_tls_loglevel = 1
 173 smtpd_tls_mandatory_ciphers = high
 174 smtpd_tls_mandatory_protocols = TLSv1
 175 #smtpd_tls_received_header = no
 176 smtpd_tls_req_ccert = no
 177 smtpd_tls_security_level = may
 178         # Postfix 2.3 and later
 179         # encrypt
 180         #  Mandatory TLS encryption: announce STARTTLS support to SMTP clients, and require that clients use TLS
 181         #  encryption. According to [1720]RFC 2487 this MUST NOT be applied in case of a publicly-referenced
 182         #  SMTP server. Instead, this option should be used only on dedicated servers.
 183 smtpd_tls_session_cache_database = btree:/var/lib/postfix/smtpd_tls_session_cache
 184 #smtpd_tls_session_cache_timeout = 3600s
 185 strict_rfc821_envelopes = yes
 186 #tls_high_cipherlist = AES256-SHA
 187         # NOTE: postconf(5) déconseille de changer ceci
 188 #tls_random_bytes = 32
 189 #tls_random_exchange_name = ${data_directory}/prng_exch
 190         # NOTE: à ne pas mettre dans la cage chroot
 191 #tls_random_prng_update_period = 3600s
 192 #tls_random_reseed_period = 3600s
 193 #tls_random_source = dev:/dev/urandom
 194         # NOTE: non-blocking
 195 transport_maps = hash:/etc/postfix/$mydomain/transport
 196 #virtual_alias_domains =
 197 virtual_alias_maps =
 198         hash:/etc/postfix/$mydomain/virtual_alias
 199         # NOTE: do not specify virtual alias domain names in  the  main.cf
 200         #       mydestination or relay_domains configuration parameters.
 201         #
 202         # With  a  virtual  alias  domain,  the  Postfix SMTP server
 203         # accepts  mail  for  known-user@virtual-alias.domain,   and
 204         # rejects   mail  for  unknown-user@virtual-alias.domain  as
 205         # undeliverable.