Thanx a lot !
Pour toi Troumad, va jeter un oeil sur http://christian.caleca.free.fr section smtp/pop3 tu trouveras ton bonheur pour une install de base et de nombreux liens.
Courage pour ton cours (qui devient de plus en plus complet avec le temps !)
Olivier Thauvin wrote:
Le Jeudi 09 Octobre 2003 12:54, Troumad a écrit :
Je serais intéressé par un résumé en français de ton installation afin
de recommencer la même et de le mettre par écrit dans mon cours...
Ma situation est simple, il y a juste une subtilité réseau, mais sinon c'est simple:
Virgo est serveur/routeur, et il souffre un peu de dédoublement de personnalité:
D'un coté, 192.168.76.1 = virgo.nanardon, c'est mon réseau interne
De l'autre 192.168.1.2 = nanardon.homelinux.org, internet
( la subtilité viens simplement que mon ip internet est 192.168.1.2, c'est le modem ADSL qui a la vrai ip, et qui fait un gros NAT, passons, considérons que 192.168.1.2 est valide).
Donc en résumé pour ma config mail:
- il gère le domaine nanardon.homelinux.org
- il gère le domaine nanardon
- les mails apparaissent comme venant de nanardon.homelinux.org
- les machines sur le reseau interne (192.168.76.0) sont autorisé à mailer partout (il sers de relay pour elles seules).
( il y a d'autre domaines/adresses ip configurés, ce sont d'autres réseaux privés lié à des essais user mode linux, n'en tenez pas compte même si ça marche pareil).
Je joins mon main.cf
Olivier Thauvin a écrit :
Le Jeudi 09 Octobre 2003 12:15, babyblood a écrit :
Merci de ta réponse Olivier, je remarque que je n'est pas été assez précis dans ma question ...
Je possède donc une passerelle et je suis inscrit à no-ip.com
(pestis.no-ip.org). Je voudrais que depuis un compte mail type hotmail
ou autre on puisse envoyer des mails a mes utilisateurs locaux comme
[EMAIL PROTECTED] Il faut donc (enfin je crois) que postfix écoute
du coté du net (inet_interface = $mydomain, localhost, 192.168.1.1 avec
mydomain = pestis.no-ip.org) pour qu'il puisse récupérer les mails et me
les faire suivre. D'où mon inquiétude : comment savoir et empécher que
mon serveur soit utilisé par des personnes mal intentionnées ?
Facile, postfix accepte de relayer les mails si: - c'est pour lui (mydestination) - c'est son reseau (mynetworks)
Moi j'ai: mydestination = $myhostname, localhost.$mydomain, $mydomain, nanardon, nanardon.homelinux.org, .nanardon.homelinux.org, mandrake.vpn mynetworks = 192.168.76.0/24, 192.168.200.0/24, 127.0.0.0/8
le reste de la conf est restée par défaut.
Olivier Imbert wrote:------------------------------------------------------------------------
Tu peux donner la liste des interfaces sur lesquelles tu autorises ton serveur SMTP (i.e. Postfix) à écouter ... Et donc interdire ton serveur à écouter du côté du réseau. Par exemple si ton réseau local est sur 192.168.1.1, tu auras donc : inet_interfaces = localhost 192.168.1.1 Ceci permetta à ton fetchmail (i.e. sur localhost) de distribuer les mails et à tes ordinateurs locaux d'envoyer des mails via ta passerelle ... Si tu n'as pas besoin de cette fonctionnalité (i.e. tu te sers du serveur de ton FAI), tu laisseras juste : inet_interfaces = localhost C'est normalement la valeur par défaut de PostFix.
/Salut la liste,
je viens de terminer une install de postfix 5.5/ipop3/fetchmail et tout semble fonctionner correctement. Ma principale inquiétude vient du fait que je ne voudrais pas que mon serveur mail (situé sur ma passerelle) puisse servir a des spammeurs comme relais smtp par exemple. Quelles options sont à configurer dans le main.cf pour que mon serveur soit un minimum sécuriser et quenfin je puise dormir tranquille ;-)?
Merci d'avance./
- Olivier Imbert
@Poussin
@Zeitoune
http://zeitoune.homedns.org/
Vous souhaitez acquerir votre Pack ou des Services MandrakeSoft?
Rendez-vous sur "http://www.mandrakestore.com";
------------------------------------------------------------------------
# Global Postfix configuration file. This file lists only a subset
# of all 100+ parameters. See the sample-xxx.cf files for a full list.
# # The general format is lines with parameter = value pairs. Lines
# that begin with whitespace continue the previous line. A value can
# contain references to other $names or ${name}s.
#
# NOTE - CHANGE NO MORE THAN 2-3 PARAMETERS AT A TIME, AND TEST IF
# POSTFIX STILL WORKS AFTER EVERY CHANGE.
# SOFT BOUNCE # # The soft_bounce parameter provides a limited safety net for # testing. When soft_bounce is enabled, mail will remain queued that # would otherwise bounce. This parameter disables locally-generated # bounces, and prevents the SMTP server from rejecting mail permanently # (by changing 5xx replies into 4xx replies). However, soft_bounce # is no cure for address rewriting mistakes or mail routing mistakes. # #soft_bounce = no
# LOCAL PATHNAME INFORMATION # # The queue_directory specifies the location of the Postfix queue. # This is also the root directory of Postfix daemons that run chrooted. # See the files in examples/chroot-setup for setting up Postfix chroot # environments on different UNIX systems. # queue_directory = /var/spool/postfix
# The command_directory parameter specifies the location of all # postXXX commands. The default value is $program_directory. # command_directory = /usr/sbin
# The daemon_directory parameter specifies the location of all Postfix # daemon programs (i.e. programs listed in the master.cf file). The # default value is $program_directory. This directory must be owned # by root. # daemon_directory = /usr/lib/postfix
# QUEUE AND PROCESS OWNERSHIP # # The mail_owner parameter specifies the owner of the Postfix queue # and of most Postfix daemon processes. Specify the name of a user # account THAT DOES NOT SHARE A GROUP WITH OTHER ACCOUNTS AND THAT # OWNS NO OTHER FILES OR PROCESSES ON THE SYSTEM. In particular, # don't specify nobody or daemon. PLEASE USE A DEDICATED USER. # mail_owner = postfix
# The default_privs parameter specifies the default rights used by # the local delivery agent for delivery to external file or command. # These rights are used in the absence of a recipient user context. # DO NOT SPECIFY A PRIVILEGED USER OR THE POSTFIX OWNER. # default_privs = nobody
# INTERNET HOST AND DOMAIN NAMES
# # The myhostname parameter specifies the internet hostname of this
# mail system. The default is to use the fully-qualified domain name
# from gethostname(). $myhostname is used as a default value for many
# other configuration parameters.
#
#myhostname = host.domain.name
#myhostname = virtual.domain.name
#myhostname = virgo.nanardon #myhostname = nanardon myhostname = nanardon.homelinux.org
# The mydomain parameter specifies the local internet domain name. # The default is to use $myhostname minus the first component. # $mydomain is used as a default value for many other configuration # parameters. # #mydomain = domain.name #mydomain = nanardon.homelinux.org mydomain = nanardon
# SENDING MAIL
# # The myorigin parameter specifies the domain that locally-posted
# mail appears to come from. The default is to append $myhostname,
# which is fine for small sites. If you run a domain with multiple
# machines, you should (1) change this to $mydomain and (2) set up
# a domain-wide alias database that aliases each user to
# [EMAIL PROTECTED]
#
myorigin = $myhostname
# myorigin = $mydomain
# myorigin = nanardon.homelinux.org
# RECEIVING MAIL
# The inet_interfaces parameter specifies the network interface # addresses that this mail system receives mail on. By default, # the software claims all active interfaces on the machine. The # parameter also controls delivery of mail to [EMAIL PROTECTED] # #inet_interfaces = all #inet_interfaces = $myhostname #inet_interfaces = $myhostname, localhost
# The mydestination parameter specifies the list of domains that this # machine considers itself the final destination for. That does not # include domains that are hosted on this machine. Those domains are # specified elsewhere (see sample-virtual.cf, and sample-transport.cf). # # The default is $myhostname + localhost.$mydomain. On a mail domain # gateway, you should also include $mydomain. Do not specify the # names of domains that this machine is backup MX host for. Specify # those names via the relay_domains or permit_mx_backup settings for # the SMTP server (see sample-smtpd.cf. # # The local machine is always the final destination for mail addressed # to [EMAIL PROTECTED] of an interface that the mail system # receives mail on (see the inet_interfaces parameter). # # Specify a list of host or domain names, /file/name or type:table # patterns, separated by commas and/or whitespace. A /file/name # pattern is replaced by its contents; a type:table is matched when # a name matches a lookup key. Continue long lines by starting the # next line with whitespace. # #mydestination = $myhostname, localhost.$mydomain #mydestination = $myhostname, localhost.$mydomain $mydomain #mydestination = $myhostname, localhost.$mydomain, $mydomain, # mail.$mydomain, www.$mydomain, ftp.$mydomain mydestination = $myhostname, localhost.$mydomain, $mydomain, nanardon, nanardon.homelinux.org, .nanardon.homelinux.org, mandrake.vpn
# TRUST AND RELAY CONTROL
# The mynetworks parameter specifies the list of "trusted" SMTP
# clients that have more privileges than "strangers".
#
# In particular, "trusted" SMTP clients are allowed to relay mail
# through Postfix. See the smtpd_recipient_restrictions parameter
# in file sample-smtpd.cf.
#
# You can specify the list of "trusted" network addresses by hand
# or you can let Postfix do it for you (which is the default).
#
# By default (mynetworks_style = subnet), Postfix "trusts" SMTP
# clients in the same IP subnetworks as the local machine.
# On Linux, this does works correctly only with interfaces specified
# with the "ifconfig" command.
# # Specify "mynetworks_style = class" when Postfix should "trust" SMTP
# clients in the same IP class A/B/C networks as the local machine.
# Don't do this with a dialup site - it would cause Postfix to "trust"
# your entire provider's network. Instead, specify an explicit
# mynetworks list by hand, as described below.
# # Specify "mynetworks_style = host" when Postfix should "trust"
# only the local machine.
# # mynetworks_style = class
mynetworks_style = subnet
# mynetworks_style = host
# Alternatively, you can specify the mynetworks list by hand, in # which case Postfix ignores the mynetworks_style setting. # # Specify an explicit list of network/netmask patterns, where the # mask specifies the number of bits in the network part of a host # address. # # You can also specify the absolute pathname of a pattern file instead # of listing the patterns here. # #mynetworks = 168.100.189.0/28, 127.0.0.0/8 #mynetworks = $config_directory/mynetworks mynetworks = 192.168.76.0/24, 192.168.200.0/24, 127.0.0.0/8, 134.157.5.0/24,134.157.16.0/24,134.157.170.0/24
# The relay_domains parameter restricts what clients this mail system
# will relay mail from, or what destinations this system will relay
# mail to. See the smtpd_recipient_restrictions restriction in the
# file sample-smtpd.cf for detailed information.
#
# By default, Postfix relays mail
# - from "trusted" clients whose IP address matches $mynetworks, # - from "trusted" clients matching $relay_domains or subdomains thereof,
# - from untrusted clients to destinations that match $relay_domains
# or subdomains thereof, except addresses with sender-specified routing.
# The default relay_domains value is $mydestination.
# # In addition to the above, the Postfix SMTP server by default accepts mail
# that Postfix is final destination for:
# - destinations that match $inet_interfaces,
# - destinations that match $mydestination
# - destinations that match $virtual_maps.
# These destinations do not need to be listed in $relay_domains.
# # Specify a list of hosts or domains, /file/name patterns or type:name
# lookup tables, separated by commas and/or whitespace. Continue
# long lines by starting the next line with whitespace. A file name
# is replaced by its contents; a type:name table is matched when a
# (parent) domain appears as lookup key.
#
# NOTE: Postfix will not automatically forward mail for domains that
# list this system as their primary or backup MX host. See the
# permit_mx_backup restriction in the file sample-smtpd.cf.
#
relay_domains = $mydestination
# INTERNET OR INTRANET
# The relayhost parameter specifies the default host to send mail to # when no entry is matched in the optional transport(5) table. When # no relayhost is given, mail is routed directly to the destination. # # On an intranet, specify the organizational domain name. If your # internal DNS uses no MX records, specify the name of the intranet # gateway host instead. # # In the case of SMTP, specify a domain, host, host:port, [host]:port, # [address] or [address]:port; the form [host] turns off MX lookups. # If you specify multiple SMTP destinations, Postfix will try them # in the specified order. # # If you're connected via UUCP, see also the default_transport parameter. # # relayhost = $mydomain # relayhost = gateway.my.domain # relayhost = uucphost # relayhost = [an.ip.add.ress]
# relayhost = smtp.easyconnect.fr # relayhost = AReims-103-1-3-190.abo.wanadoo.fr
# REJECTING UNKNOWN LOCAL USERS # # The local_recipient_maps parameter specifies optional lookup tables # with all users that are local with respect to $mydestination and # $inet_interfaces. If this parameter is defined, then the SMTP server # will reject mail for unknown local users. # # The local_recipient_maps parameter accepts tables with bare usernames # such as unix:passwd.byname and alias maps. # # Beware: if the Postfix SMTP server runs chrooted, you may have to # copy the passwd database into the jail. This is system dependent. # # FOR THIS TO WORK, DO NOT SPECIFY VIRTUAL DOMAINS IN MYDESTINATION. # MYDESTINATION MUST LIST NON-VIRTUAL DOMAINS ONLY. # #local_recipient_maps = $alias_maps unix:passwd.byname
# ADDRESS REWRITING # # Insert text from sample-rewrite.cf if you need to do address # masquerading. # # Insert text from sample-canonical.cf if you need to do address # rewriting, or if you need username->Firstname.Lastname mapping.
# masquerade_domains = nanardon.homelinux.org # masquerade_domains = .nanardon nanardon $mydomain
# ADDRESS REDIRECTION (VIRTUAL DOMAIN) # # Insert text from sample-virtual.cf if you need virtual domain support.
# "USER HAS MOVED" BOUNCE MESSAGES # # Insert text from sample-relocated.cf if you need "user has moved" # style bounce messages. Alternatively, you can bounce recipients # with an SMTP server access table. See sample-smtpd.cf.
# TRANSPORT MAP # # Insert text from sample-transport.cf if you need explicit routing.
# ALIAS DATABASE
#
# The alias_maps parameter specifies the list of alias databases used
# by the local delivery agent. The default list is system dependent.
# On systems with NIS, the default is to search the local alias
# database, then the NIS alias database. See aliases(5) for syntax
# details.
# # If you change the alias database, run "postalias /etc/aliases" (or
# wherever your system stores the mail alias file), or simply run
# "newaliases" to build the necessary DBM or DB file.
#
# It will take a minute or so before changes become visible. Use
# "postfix reload" to eliminate the delay.
#
#alias_maps = dbm:/etc/aliases
alias_maps = hash:/etc/postfix/aliases
#alias_maps = hash:/etc/aliases, nis:mail.aliases
#alias_maps = netinfo:/aliases
transport_maps = hash:/etc/postfix/transport
# The alias_database parameter specifies the alias database(s) that # are built with "newaliases" or "sendmail -bi". This is a separate # configuration parameter, because alias_maps (see above) may specify # tables that are not necessarily all under control by Postfix. # #alias_database = dbm:/etc/aliases #alias_database = dbm:/etc/mail/aliases #alias_database = hash:/etc/aliases #alias_database = hash:/etc/aliases, hash:/opt/majordomo/aliases
# ADDRESS EXTENSIONS (e.g., user+foo) # # The recipient_delimiter parameter specifies the separator between # user names and address extensions (user+foo). See canonical(5), # local(8), relocated(5) and virtual(5) for the effects this has on # aliases, canonical, virtual, relocated and .forward file lookups. # Basically, the software tries user+foo and .forward+foo before # trying user and .forward. # # recipient_delimiter = +
# DELIVERY TO MAILBOX # # The home_mailbox parameter specifies the optional pathname of a # mailbox file relative to a user's home directory. The default # mailbox file is /var/spool/mail/user or /var/mail/user. Specify # "Maildir/" for qmail-style delivery (the / is required). # #home_mailbox = Mailbox #home_mailbox = Maildir/
# The mail_spool_directory parameter specifies the directory where # UNIX-style mailboxes are kept. The default setting depends on the # system type. # # mail_spool_directory = /var/mail mail_spool_directory = /var/spool/mail
# The mailbox_command parameter specifies the optional external # command to use instead of mailbox delivery. The command is run as # the recipient with proper HOME, SHELL and LOGNAME environment settings. # Exception: delivery for root is done as $default_user. # # Other environment variables of interest: USER (recipient username), # EXTENSION (address extension), DOMAIN (domain part of address), # and LOCAL (the address localpart). # # Unlike other Postfix configuration parameters, the mailbox_command # parameter is not subjected to $parameter substitutions. This is to # make it easier to specify shell syntax (see example below). # # Avoid shell meta characters because they will force Postfix to run # an expensive shell process. Procmail alone is expensive enough. # # IF YOU USE THIS TO DELIVER MAIL SYSTEM-WIDE, YOU MUST SET UP AN # ALIAS THAT FORWARDS MAIL FOR ROOT TO A REAL USER. # #mailbox_command = /some/where/procmail #mailbox_command = /some/where/procmail -a "$EXTENSION" mailbox_command = /usr/bin/procmail -o -a $DOMAIN -d $LOGNAME
# The mailbox_transport specifies the optional transport in master.cf # to use after processing aliases and .forward files. This parameter # has precedence over the mailbox_command, fallback_transport and # luser_relay parameters. # # Specify a string of the form transport:nexthop, where transport is # the name of a mail delivery transport defined in master.cf. The # :nexthop part is optional. For more details see the sample transport # configuration file. # #mailbox_transport = lmtp:unix:/file/name #mailbox_transport = cyrus
# The fallback_transport specifies the optional transport in master.cf # to use for recipients that are not found in the UNIX passwd database. # This parameter has precedence over the luser_relay parameter. # # Specify a string of the form transport:nexthop, where transport is # the name of a mail delivery transport defined in master.cf. The # :nexthop part is optional. For more details see the sample transport # configuration file. # #fallback_transport = lmtp:unix:/file/name #fallback_transport = cyrus #fallback_transport =
# The luser_relay parameter specifies an optional destination address
# for unknown recipients. By default, mail for unknown local recipients
# is bounced.
#
# The following expansions are done on luser_relay: $user (recipient
# username), $shell (recipient shell), $home (recipient home directory),
# $recipient (full recipient address), $extension (recipient address
# extension), $domain (recipient domain), $local (entire recipient
# localpart), $recipient_delimiter. Specify ${name?value} or
# ${name:value} to expand value only when $name does (does not) exist.
#
# luser_relay = [EMAIL PROTECTED]
# luser_relay = [EMAIL PROTECTED]
# luser_relay = admin+$local
# JUNK MAIL CONTROLS
# # The controls listed here are only a very small subset. See the file
# sample-smtpd.cf for an elaborate list of anti-UCE controls.
# The header_checks parameter restricts what may appear in message # headers. This requires that POSIX or PCRE regular expression support # is built-in. Specify "/^header-name: stuff you do not want/ REJECT" # in the pattern file. Patterns are case-insensitive by default. Note: # specify only patterns ending in REJECT (reject entire message) or # IGNORE (silently discard this header). Patterns ending in OK are # mostly a waste of cycles. # #header_checks = regexp:/etc/postfix/filename #header_checks = pcre:/etc/postfix/filename
# FAST ETRN SERVICE
#
# Postfix maintains per-destination logfiles with information about
# deferred mail, so that mail can be flushed quickly with the SMTP
# "ETRN domain.name" command, or by executing "sendmail -qRdomain.name".
# # By default, Postfix maintains deferred mail logfile information
# only for destinations that Postfix is willing to relay to (as
# specified in the relay_domains parameter). For other destinations,
# Postfix attempts to deliver ALL queued mail after receiving the
# SMTP "ETRN domain.name" command, or after execution of "sendmail
# -qRdomain.name". This can be slow when a lot of mail is queued.
# # The fast_flush_domains parameter controls what destinations are
# eligible for this "fast ETRN/sendmail -qR" service.
# #fast_flush_domains = $relay_domains
#fast_flush_domains =
# SHOW SOFTWARE VERSION OR NOT # # The smtpd_banner parameter specifies the text that follows the 220 # code in the SMTP server's greeting banner. Some people like to see # the mail version advertised. By default, Postfix shows no version. # # You MUST specify $myhostname at the start of the text. That is an # RFC requirement. Postfix itself does not care. # #smtpd_banner = $myhostname ESMTP $mail_name #smtpd_banner = $myhostname ESMTP $mail_name ($mail_version)
# smtpd_banner = $myhostname ESMTP $mail_name ($mail_version) (Linux-Mandrake) # smtpd_banner = $mydomain ESMTP $mail_name ($mail_version) (Linux-Mandrake) smtpd_banner = $mydomain ESMTP
# PARALLEL DELIVERY TO THE SAME DESTINATION
#
# How many parallel deliveries to the same user or domain? With local
# delivery, it does not make sense to do massively parallel delivery
# to the same user, because mailbox updates must happen sequentially,
# and expensive pipelines in .forward files can cause disasters when
# too many are run at the same time. With SMTP deliveries, 10
# simultaneous connections to the same domain could be sufficient to
# raise eyebrows.
# # Each message delivery transport has its XXX_destination_concurrency_limit
# parameter. The default is $default_destination_concurrency_limit for
# most delivery transports. For the local delivery agent the default is 2.
#local_destination_concurrency_limit = 2 #default_destination_concurrency_limit = 10
# DEBUGGING CONTROL # # The debug_peer_level parameter specifies the increment in verbose # logging level when an SMTP client or server host name or address # matches a pattern in the debug_peer_list parameter. # debug_peer_level = 2
# The debug_peer_list parameter specifies an optional list of domain # or network patterns, /file/name patterns or type:name tables. When # an SMTP client or server host name or address matches a pattern, # increase the verbose logging level by the amount specified in the # debug_peer_level parameter. # # debug_peer_list = 127.0.0.1 # debug_peer_list = some.domain
# The debugger_command specifies the external command that is executed # when a Postfix daemon program is run with the -D option. # # Use "command .. & sleep 5" so that the debugger can attach before # the process marches on. If you use an X-based debugger, be sure to # set up your XAUTHORITY environment variable before starting Postfix. # debugger_command = PATH=/usr/bin:/usr/X11R6/bin xxgdb $daemon_directory/$process_name $process_id & sleep 5
# The delay_warning_time specifies after how many hours a warning # is sent that mail has not yet been delivered. By default, no warning # is sent. # delay_warning_time = 24
# Other configurable parameters. readme_directory = /usr/share/doc/postfix-2.0.6/README_FILES sample_directory = /usr/share/doc/postfix-2.0.6/samples sendmail_path = /usr/sbin/sendmail setgid_group = postdrop manpage_directory = /usr/share/man newaliases_path = /usr/bin/newaliases mailq_path = /usr/bin/mailq unknown_local_recipient_reject_code = 450
------------------------------------------------------------------------
Vous souhaitez acquerir votre Pack ou des Services MandrakeSoft? Rendez-vous sur "http://www.mandrakestore.com";
--
.: B A B Y B L O O D :."Pour bousiller son Linux, vous devez travailler dessus; pour bousiller son Windows, il suffit de travailler avec !"
LinuxGamer http://www.jeuxlinux.com LinuxNetwork http://christian.caleca.free.fr
Vous souhaitez acquerir votre Pack ou des Services MandrakeSoft? Rendez-vous sur "http://www.mandrakestore.com";
