etc/postfix/main.cf

   1 # DOC: http://postfix.traduc.org/index.php/TLS_README.html
   2
   3 alias_database =
   4         hash:/etc/postfix/aliases
   5         hash:/etc/mail/sympa/aliases
   6 alias_maps =
   7         hash:/etc/postfix/aliases
   8         hash:/etc/mail/sympa/aliases
   9 append_dot_mydomain = no
  10         # NOTE: appending .domain is the MUA's job.
  11 biff = no
  12         # NOTE: pas de notification dans la console en cas de réception de nouveaux courriels.
  13 body_checks =
  14 #content_filter = amavisfeed:[127.0.0.1]:10024
  15 #debug_peer_level = 4
  16 #debug_peer_list = .$myhostname
  17 default_extra_recipient_limit = 5000
  18 #delay_warning_time = 4h
  19         # NOTE: uncomment the previous line to generate "delayed mail" warnings
  20 duplicate_filter_limit = 5000
  21 forward_path = $home/etc/mail/forward${recipient_delimiter}${extension}, $home/etc/mail/forward
  22 header_checks = regexp:/etc/postfix/$mydomain/header_checks
  23 inet_interfaces = all
  24 inet_protocols = ipv4
  25         # NOTE: "all" to activate IPv6
  26 line_length_limit = 2048
  27 #local_header_rewrite_clients =
  28 mailbox_command = /usr/bin/procmail -t -a "$SENDER" -a "$RECIPIENT" -a "$USER" -a "$EXTENSION" -a "$DOMAIN" -a "$ORIGINAL_RECIPIENT" "$HOME/etc/mail/delivery.procmailrc"
  29 mailbox_size_limit = 0
  30 maximal_queue_lifetime = 5d
  31 message_size_limit = 20480000
  32 mime_header_checks =
  33 milter_header_checks =
  34 mynetworks = 127.0.0.0/8 #, [::1]/128
  35 nested_header_checks =
  36 non_smtpd_milters =
  37 parent_domain_matches_subdomains =
  38         #debug_peer_list
  39         #fast_flush_domains
  40         #mynetworks
  41         #permit_mx_backup_networks
  42         #qmqpd_authorized_clients
  43         #smtpd_access_maps
  44 permit_mx_backup_networks =
  45 propagate_unmatched_extensions = canonical, virtual
  46 queue_minfree = 0
  47 readme_directory = no
  48 #receive_override_options = no_address_mappings
  49         # no_unknown_recipient_checks
  50         #         Do not try to reject unknown recipients (SMTP server only).
  51         #         This is typically specified AFTER an external content filter.
  52         # no_address_mappings
  53         #         Disable canonical address mapping, virtual alias map expansion,
  54         #         address masquerading, and automatic BCC (blind carbon-copy) recipients.
  55         #         This is typically specified BEFORE an external content filter (eg. amavis).
  56         # no_header_body_checks
  57         #         Disable header/body_checks. This is typically specified AFTER an external content filter.
  58         # no_milters
  59         #         Disable Milter (mail filter) applications. This is typically specified AFTER an external content filter.
  60 recipient_delimiter = +
  61         # NOTE: séparateur entre le nom d’utilisateur et les extensions d’adresse.
  62 #relayhost =
  63 relay_clientcerts = hash:/etc/postfix/$mydomain/smtpd/relay_clientcerts
  64 relay_domains =
  65         $mydestination
  66         # NOTE: ajouter les domaines pour lesquels on est backup MX ici, pas dans mydestination ou virtual_alias...
  67 smtp_body_checks =
  68 #smtp_cname_overrides_servername = no
  69 smtp_connect_timeout = 60s
  70 smtp_header_checks = regexp:/etc/postfix/$mydomain/smtp/header_checks
  71 smtp_mime_header_checks =
  72 smtp_nested_header_checks =
  73 #smtp_tls_CAfile = /etc/postfix/$mydomain/smtp/x509/ca/crt.pem
  74 #smtp_tls_CApath = /etc/postfix/$mydomain/smtp/x509/ca/
  75 #smtp_tls_cert_file = /etc/postfix/$mydomain/smtp/x509/crt.pem
  76 smtp_tls_fingerprint_digest = sha1
  77 #smtp_tls_key_file = /etc/postfix/$mydomain/smtp/x509/key.pem
  78 smtp_tls_loglevel = 1
  79 #smtp_tls_note_starttls_offer = yes
  80 smtp_tls_policy_maps = hash:/etc/postfix/$mydomain/smtp/x509/policy
  81 smtp_tls_protocols = !SSLv2, !SSLv3
  82         # NOTE: only allow TLSv*
  83 smtp_tls_scert_verifydepth = 5
  84 #smtp_tls_secure_cert_match = nexthop, dot-nexthop
  85 smtp_tls_security_level = may
  86 smtp_tls_session_cache_database = btree:/var/lib/postfix/smtp_tls_session_cache
  87 #smtp_tls_session_cache_timeout = 3600s
  88 #smtp_tls_verify_cert_match = hostname
  89 smtpd_authorized_xclient_hosts = 127.0.0.1
  90         # NOTE: utile pour tester les restrictions
  91 smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
  92 smtpd_client_connection_count_limit = 50
  93 smtpd_client_connection_rate_limit = 0
  94 smtpd_client_event_limit_exceptions = $mynetworks
  95 smtpd_client_message_rate_limit = 0
  96 smtpd_client_new_tls_session_rate_limit = 0
  97 smtpd_client_port_logging = no
  98 smtpd_client_recipient_rate_limit = 0
  99 smtpd_client_restrictions =
 100         check_client_access hash:/etc/postfix/$mydomain/smtpd/client_blacklist
 101 smtpd_data_restrictions =
 102         reject_unauth_pipelining
 103                 # NOTE: oblige le client smtp en face à attendre qu'on lui aie dit OK
 104         permit
 105 smtpd_discard_ehlo_keywords = starttls
 106         # NOTE: les clients mails tentant d'utiliser le chiffrement opportuniste se mangent une erreur en tentant un starttls
 107 #smtpd_end_of_data_restrictions =
 108 smtpd_error_sleep_time = 5
 109         # NOTE: forcer quelqu'un qui nous embête à attendre cinq secondes.
 110 smtpd_helo_required = yes
 111 smtpd_helo_restrictions =
 112         reject_invalid_helo_hostname
 113         reject_non_fqdn_helo_hostname
 114         #reject_unknown_helo_hostname
 115                 # NOTE: pourrait pourtant être utile pour lutter contre le spam
 116         permit
 117 smtpd_milters =
 118 smtpd_peername_lookup = yes
 119         # NOTE: nécessaire pour postgrey
 120 smtpd_recipient_limit = 5000
 121 smtpd_recipient_overshoot_limit = 5000
 122 smtpd_recipient_restrictions =
 123         reject_non_fqdn_recipient
 124         #reject_invalid_hostname
 125                 # NOTE: postfix < 2.3. voir reject_invalid_helo_hostname dans smtpd_helo_restrictions
 126         reject_unknown_recipient_domain
 127         #reject_non_fqdn_sender
 128                 # NOTE: dans smtpd_sender_restrictions
 129         reject_unauth_pipelining
 130                 # NOTE: dans smtpd_client_restrictions ou smtpd_data_restrictions
 131         permit_mynetworks
 132         permit_tls_clientcerts
 133         permit_sasl_authenticated
 134         reject_unauth_destination
 135                 # NOTE: ne pas passer par SPFCheck / Postgrey si le mail n'est pas pour nous ou quelqu'un pour lequel on tient lieu de backup_mx
 136         check_policy_service unix:/run/postgrey/socket
 137                 # NOTE: Postgrey (greylisting)
 138         check_policy_service unix:private/spfcheck
 139         permit_auth_destination
 140                 # NOTE: une fois Postgrey passé, on accepte ce qui nous est destiné (voir permit_auth_destination) ; sans doute redondant
 141         reject
 142         #reject_unknown_sender_domain
 143                 # NOTE: probablement mieux dans smtpd_sender_restrictions
 144         #reject_rbl_client bl.spamcop.net
 145         #reject_rbl_client list.dsbl.org
 146         #reject_rbl_client zen.spamhaus.org
 147         #reject_rbl_client dnsbl.sorbs.net
 148 #smtpd_restriction_classes =
 149 smtpd_sasl_auth_enable = yes
 150 smtpd_sasl_path = private/auth
 151 smtpd_sasl_security_options = noanonymous
 152 smtpd_sasl_type = dovecot
 153 smtpd_sender_restrictions =
 154         permit_mynetworks
 155         permit_tls_clientcerts
 156         permit_sasl_authenticated
 157         check_sender_access hash:/etc/postfix/$mydomain/smtpd/sender_access
 158         reject_unauth_pipelining
 159         reject_non_fqdn_sender
 160         #reject_unknown_sender_domain
 161         reject
 162 smtpd_starttls_timeout = 300s
 163 #smtpd_tls_always_issue_session_ids = yes
 164 smtpd_tls_CAfile = /etc/postfix/$mydomain/smtpd/x509/ca/crt.pem
 165 smtpd_tls_CApath = /etc/postfix/$mydomain/smtpd/x509/ca/
 166 smtpd_tls_ask_ccert = no
 167 smtpd_tls_auth_only = yes
 168         # NOTE: pas d'AUTH SASL sans TLS
 169 smtpd_tls_ccert_verifydepth = 5
 170 smtpd_tls_cert_file = /etc/postfix/$mydomain/smtpd/x509/crt+crl.self-signed.pem
 171 smtpd_tls_ciphers = high
 172 smtpd_tls_fingerprint_digest = sha512
 173 smtpd_tls_key_file = /etc/postfix/$mydomain/smtpd/x509/key.pem
 174 smtpd_tls_loglevel = 1
 175 smtpd_tls_mandatory_ciphers = high
 176 smtpd_tls_mandatory_protocols = TLSv1
 177 #smtpd_tls_received_header = no
 178 smtpd_tls_req_ccert = no
 179 smtpd_tls_security_level = may
 180         # Postfix 2.3 and later
 181         # encrypt
 182         #  Mandatory TLS encryption: announce STARTTLS support to SMTP clients, and require that clients use TLS
 183         #  encryption. According to [1720]RFC 2487 this MUST NOT be applied in case of a publicly-referenced
 184         #  SMTP server. Instead, this option should be used only on dedicated servers.
 185 smtpd_tls_session_cache_database = btree:/var/lib/postfix/smtpd_tls_session_cache
 186 #smtpd_tls_session_cache_timeout = 3600s
 187 strict_rfc821_envelopes = yes
 188 sympa_destination_recipient_limit = 1
 189 sympabounce_destination_recipient_limit = 1
 190 #tls_high_cipherlist = AES256-SHA
 191         # NOTE: postconf(5) déconseille de changer ceci
 192 #tls_random_bytes = 32
 193 #tls_random_exchange_name = ${data_directory}/prng_exch
 194         # NOTE: à ne pas mettre dans la cage chroot
 195 #tls_random_prng_update_period = 3600s
 196 #tls_random_reseed_period = 3600s
 197 #tls_random_source = dev:/dev/urandom
 198         # NOTE: non-blocking
 199 transport_maps =
 200         hash:/etc/postfix/$mydomain/transport
 201         hash:/etc/postfix/$mydomain/transport-pending-transition-from-lautrenet
 202         regexp:/etc/sympa/transport
 203 #virtual_alias_domains =
 204 virtual_alias_maps =
 205         hash:/etc/postfix/$mydomain/virtual_alias
 206         hash:/etc/postfix/$mydomain/virtual_alias-pending-transition-from-lautrenet
 207         hash:/etc/postfix/cyclocoop.org/virtual_alias
 208         regexp:/etc/sympa/virtual_alias
 209         # NOTE: do not specify virtual alias domain names in  the  main.cf
 210         #       mydestination or relay_domains configuration parameters.
 211         #
 212         # With  a  virtual  alias  domain,  the  Postfix SMTP server
 213         # accepts  mail  for  known-user@virtual-alias.domain,   and
 214         # rejects   mail  for  unknown-user@virtual-alias.domain  as
 215         # undeliverable.