[Postfixbuch-users] Restrictions
Silvio Siefke
siefke_listen at web.de
Fr Feb 7 23:31:24 CET 2014
Hallo,
ich habe mir ein Postfix/Dovecot/amavisd Mailserver aufgesetzt. So weit
scheint alles zu funktionieren, senden, empfangen aber irgendwie scheint
der Wurm in den Restriction zu sein.
Die aktuelle Konfiguration:
ks3374456 postfix # postconf -n
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
disable_vrfy_command = yes
home_mailbox = Maildir/
html_directory = no
inet_interfaces = all
inet_protocols = all
mail_owner = postfix
mailbox_size_limit = 0
mailq_path = /usr/bin/mailq
manpage_directory = /usr/share/man
masquerade_domains =
master_service_disable =
message_size_limit = 20480000
minimal_backoff_time = 300s
mydestination = $myhostname, localhost
myhostname = ks3374456.kimsufi.com
mynetworks = 127.0.0.1
mynetworks_style = subnet
myorigin = $myhostname
newaliases_path = /usr/bin/newaliases
policyd-spf_time_limit = 3600
queue_directory = /var/spool/postfix
queue_run_delay = 300s
readme_directory = no
recipient_delimiter = +
sample_directory = /etc/postfix
sendmail_path = /usr/sbin/sendmail
setgid_group = postdrop
smtp_tls_loglevel = 1
smtp_tls_security_level = may
smtp_tls_session_cache_database = btree:/var/lib/postfix/smtp_scache
smtpd_banner = $myhostname ESMTP
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_invalid_hostname, reject_non_fqdn_hostname, reject_unknown_hostname
smtpd_recipient_restrictions = permit_sasl_authenticated, reject_unknown_recipient_domain, reject_unauth_destination, check_policy_service unix:private/policyd-spf, check_policy_service unix:private/postgrey permit
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_path = private/auth
smtpd_sasl_type = dovecot
smtpd_sender_restrictions = reject_unknown_sender_domain
smtpd_tls_ask_ccert = yes
smtpd_tls_cert_file = /etc/postfix/key/postfix.pem
smtpd_tls_key_file = /etc/postfix/key/postfix.key
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_security_level = may
smtpd_tls_session_cache_database = btree:/var/lib/postfix/smtpd_scache
strict_rfc821_envelopes = yes
virtual_gid_maps = static:5000
virtual_mailbox_base = /var/vmail
virtual_mailbox_domains = /etc/postfix/vhost
virtual_mailbox_maps = hash:/etc/postfix/vmaps
virtual_minimum_uid = 100
virtual_transport = lmtp:unix:private/dovecot-lmtp
virtual_uid_maps = static:5000
Jetzt stelle ich mir ein paar Fragen:
1.) Ist das soweit ok, oder ist etwas erkennbar was nicht sein sollte?
2.) Warum nimmt Postfix die Client Restriction nicht an?
#maps_rbl_domain = dnsbl.sorbs.net
#smtp_client_restrictions =
# permit_mynetworks,
# permit_sasl_authenticated,
# reject_maps_rbl,
# reject_unknown_client
3.) smtps ist deprecated? Was kann man sonst einstellen damit verschlüsselt
verbunden wird?
Würde mich über Tipps und Anregungen freuen.
MFG
Silvio
Anhang:
ks3374456 postfix # dovecot -n
# 2.2.9: /etc/dovecot/dovecot.conf
# OS: Linux 3.10.23-xxxx-std-ipv6-64 x86_64 Gentoo Base System release 2.2
auth_debug = yes
auth_mechanisms = plain login cram-md5
debug_log_path = /var/log/dovecot/dovecot-debug.log
info_log_path = /var/log/dovecot/dovecot-info.log
log_path = /var/log/dovecot/dovecot.log
mail_debug = yes
mail_location = maildir:~/maildir
mail_plugins = acl zlib
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave
namespace inbox {
hidden = no
inbox = yes
location =
mailbox Drafts {
auto = create
special_use = \Drafts
}
mailbox Junk {
auto = create
special_use = \Junk
}
mailbox Sent {
auto = subscribe
special_use = \Sent
}
mailbox "Sent Messages" {
auto = no
special_use = \Sent
}
mailbox Trash {
auto = create
special_use = \Trash
}
prefix =
separator = /
type = private
}
passdb {
args = username_format=%u /var/vmail/auth.d/%d/passwd
driver = passwd-file
}
plugin {
acl = vfile:/var/vmail/conf.d/%d/acls:cache_secs=300
acl_shared_dict = file:/var/vmail/conf.d/%d/acls/shared-mailboxes.db
sieve = ~/.dovecot.sieve
sieve_dir = ~/sieve
sieve_global_dir = /var/vmail/conf.d/%d/sieve
}
protocols = imap lmtp sieve
service auth-worker {
user = dovecot
}
service auth {
unix_listener /var/spool/postfix/private/auth {
group = postfix
mode = 0660
user = postfix
}
user = dovecot
}
service imap-login {
inet_listener imap {
address = *
port = 143
}
inet_listener imaps {
port = 993
}
}
service lmtp {
unix_listener /var/spool/postfix/private/dovecot-lmtp {
group = postfix
mode = 0666
user = postfix
}
}
service managesieve-login {
inet_listener sieve {
port = 4190
}
}
ssl_cert = </etc/ssl/dovecot/server.pem
ssl_key = </etc/ssl/dovecot/server.key
userdb {
args = username_format=%u /var/vmail/auth.d/%d/passwd
driver = passwd-file
}
verbose_proctitle = yes
protocol lmtp {
mail_fsync = optimized
mail_plugins = acl zlib sieve
postmaster_address = webmaster at silviosiefke.com
}
protocol lda {
mail_plugins = sieve
}
protocol imap {
imap_client_workarounds = delay-newmail tb-extra-mailbox-sep
mail_plugins = acl zlib mail_log notify imap_acl zlib
}
protocol sieve {
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date
}
smtp inet n - n - - smtpd
-o smtpd_proxy_filter=127.0.0.1:10024
amavis unix - - n - 6 smtp
-o smtp_data_done_timeout=1800
-o smtp_send_xforward_command=yes
-o disable_mime_output_conversion=yes
-o disable_dns_lookups=yes
127.0.0.1:10025 inet n - - - - smtpd
-o content_filter=
-o smtpd_proxy_filter=
-o local_recipient_maps=
-o smtpd_authorized_xforward_hosts=127.0.0.0/8
-o relay_recipient_maps=
-o smtpd_restriction_classes=
-o smtpd_client_restrictions=
-o smtpd_helo_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_data_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,reject
-o mynetworks=127.0.0.0/8
-o strict_rfc821_envelopes=yes
-o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
# -o smtpd_bind_address=127.0.0.1
submission inet n - n - - smtpd
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_sasl_type=dovecot
-o smtpd_sasl_path=private/auth
-o smtpd_client_restrictions=
-o smtpd_helo_restrictions=
-o smtpd_recipient_restrictions=reject_non_fqdn_recipient,permit_sasl_authenticated,reject
smtps inet n - n - - smtpd
-o syslog_name=postfix/smtps
-o smtpd_tls_wrappermode=yes
-o smtpd_sasl_auth_enable=yes
-o smtpd_reject_unlisted_recipient=no
-o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
pickup unix n - n 60 1 pickup
cleanup unix n - n - 0 cleanup
qmgr unix n - n 300 1 qmgr
#qmgr unix n - n 300 1 oqmgr
tlsmgr unix - - n 1000? 1 tlsmgr
rewrite unix - - n - - trivial-rewrite
bounce unix - - n - 0 bounce
defer unix - - n - 0 bounce
trace unix - - n - 0 bounce
verify unix - - n - 1 verify
flush unix n - n 1000? 0 flush
proxymap unix - - n - - proxymap
proxywrite unix - - n - 1 proxymap
smtp unix - - n - - smtp
relay unix - - n - - smtp
-o fallback_relay=
showq unix n - n - - showq
error unix - - n - - error
retry unix - - n - - error
discard unix - - n - - discard
local unix - n n - - local
virtual unix - n n - - virtual
lmtp unix - - n - - lmtp
anvil unix - - n - 1 anvil
scache unix - - n - 1 scache
policyd-spf unix - n n - 0 spawn
user=nobody argv=/usr/bin/python2 /usr/bin/policyd-spf
Mehr Informationen über die Mailingliste Postfixbuch-users