I am doing the admin work for a small group, about 30 people.
While this setup works I have the feeling that I am missing something in the Submission stanza of master.cf which might leave me vulnerable.
Another thing I wondering about is the order of the various tests in the smtpd_*_ restrictions, for example would it be better (more efficient) to put grey listing (postgrey) before the rbl checks. Are there any elements that I should avoid considering the small size of my installation.
As I am using amavis are header and body checks still worthwhile. John A -- "He who opens a school door closes a prison" - Victor Hugo Sent using Mozilla Thunderbird
append_dot_mydomain = no
biff = no
body_checks = regexp:/etc/postfix/maps/body_checks
bounce_size_limit = 65536
broken_sasl_auth_clients = yes
config_directory = /etc/postfix
content_filter = smtp-amavis:[localhost]:10024
default_process_limit = 20
delay_warning_time = 12h
disable_vrfy_command = yes
dovecot_destination_recipient_limit = 1
header_checks = regexp:/etc/postfix/maps/header_checks
header_size_limit = 32768
home_mailbox = Maildir/
mailbox_command = /usr/lib/dovecot/dovecot-lda -f ${sender} -d
${user}@${nexthop} -m ${extension}
mailbox_transport = dovecot
message_size_limit = 32768000
mydestination = localhost, localhost.localdomain, localdomain
mydomain = klam.ca
myhostname = mail.$mydomain
mynetworks = 127.0.0.0/8, 192.168.0.0/16, 74.116.186.176/28, [::1]/128,
[2001:470:b182:10::]/64, [2001:470:b182:30::/64]
myorigin = $mydomain
recipient_delimiter = +
relocated_maps = hash:/etc/postfix/maps/relocated
smtp_sasl_security_options = noanonymous
smtp_sasl_tls_security_options = noanonymous
smtp_tls_cert_file = /root/ssl/certs/KLaM_Mail_SSL.pem
smtp_tls_enforce_peername = no
smtp_tls_key_file = /root/ssl/private/KLaM_Mail_SSL.key
smtp_tls_note_starttls_offer = yes
smtp_tls_security_level = may
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtp_use_tls = yes
smtpd_banner = $myhostname ESMTP
smtpd_client_restrictions =
smtpd_data_restrictions = reject_multi_recipient_bounce,
reject_unauth_pipelining
smtpd_delay_reject = yes
smtpd_error_sleep_time = 5s
smtpd_etrn_restrictions = reject
smtpd_helo_required = yes
smtpd_helo_restrictions =
smtpd_recipient_limit = 128
smtpd_recipient_restrictions = reject_invalid_hostname,
reject_non_fqdn_hostname, reject_non_fqdn_sender, reject_non_fqdn_recipient,
reject_unknown_sender_domain, reject_unknown_recipient_domain,
permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination,
check_recipient_access pcre:/etc/postfix/maps/recipient_checks.pcre,
check_helo_access hash:/etc/postfix/maps/helo_checks, check_helo_access
pcre:/etc/postfix/maps/helo_checks.pcre, check_sender_access
hash:/etc/postfix/maps/auto_whitelist, check_sender_access
hash:/etc/postfix/maps/sender_checks, check_sender_access
pcre:/etc/postfix/maps/sender_checks.pcre, check_client_access
hash:/etc/postfix/maps/client_checks, check_client_access
pcre:/etc/postfix/maps/client_checks.pcre, reject_rbl_client zen.spamhaus.org,
reject_rbl_client bl.spamcop.net, check_policy_service inet:127.0.0.1:10023
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
smtpd_sasl_local_domain = $mydomain
smtpd_sasl_path = private/dovecot-auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_sender_restrictions =
smtpd_tls_ask_ccert = yes
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /root/ssl/certs/KLaM_Mail_SSL.pem
smtpd_tls_key_file = /root/ssl/private/KLaM_Mail_SSL.key
smtpd_tls_loglevel = 1
smtpd_tls_mandatory_ciphers = medium
smtpd_tls_mandatory_protocols = SSLv3, TLSv1
smtpd_tls_received_header = yes
smtpd_tls_req_ccert = no
smtpd_tls_security_level = may
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_tls_session_cache_timeout = 3600s
smtpd_use_tls = yes
strict_rfc821_envelopes = yes
virtual_alias_maps = hash:/etc/postfix/maps/valiases
virtual_mailbox_domains = /etc/postfix/maps/vdomains
virtual_mailbox_maps = hash:/etc/postfix/maps/vmailbox
virtual_transport = dovecot
master.cf
Description: Binary data
