Quelques fonctionnalités du plugin vont disparaître, donc on adapte main.cf
This commit is contained in:
Pierre-Elliott Bécue
parent
a26eb6ed05
commit
10d42f96dd
1 changed files with 199 additions and 209 deletions
|
|
@ -36,14 +36,12 @@ def db_file(suffix):
|
||||||
'''Nom des fichiers de conf pour la base de donnees'''
|
'''Nom des fichiers de conf pour la base de donnees'''
|
||||||
return "%(db)s:/etc/postfix/%(db)s-%(suffix)s.cf" % {"db": db, "suffix": suffix}
|
return "%(db)s:/etc/postfix/%(db)s-%(suffix)s.cf" % {"db": db, "suffix": suffix}
|
||||||
|
|
||||||
|
# Pour les lignes commençant par un %
|
||||||
keysep = " = "
|
keysep = " = "
|
||||||
def add(*values):
|
|
||||||
'''Continue une ligne logique (voif postconf(5))'''
|
|
||||||
out((len(last_definition)+len(keysep)) * " " + ", ".join([tostring(v) for v in values]) + "\n")
|
|
||||||
|
|
||||||
# La liste des variables de configuration de postfix
|
######################################
|
||||||
import commands
|
# Début effectif du fichier #
|
||||||
exports = [s.split(' ', 2)[0] for s in commands.getoutput("/usr/sbin/postconf -d").split("\n")]
|
######################################
|
||||||
|
|
||||||
# Les différents réseaux
|
# Les différents réseaux
|
||||||
local_networks = ["127.0.0.0/8", '[::1]/128']
|
local_networks = ["127.0.0.0/8", '[::1]/128']
|
||||||
|
|
@ -56,278 +54,270 @@ client_networks = ["138.231.136.0/21", "138.231.144.0/21", "138.231.148.0/22", "
|
||||||
|
|
||||||
@# Definition par securite (sinon il utilise gethostname)
|
@# Definition par securite (sinon il utilise gethostname)
|
||||||
if nonadherent:
|
if nonadherent:
|
||||||
myhostname = admhostname
|
%myhostname admhostname
|
||||||
else:
|
else:
|
||||||
myhostname = pubhostname
|
%myhostname pubhostname
|
||||||
mydomain = "crans.org"
|
@mydomain = crans.org
|
||||||
|
|
||||||
@# Origine des mails
|
@# Origine des mails
|
||||||
myorigin = "crans.org"
|
@myorigin = crans.org
|
||||||
|
|
||||||
@# Reseaux locaux
|
@# Reseaux locaux
|
||||||
mynetworks = local_networks
|
%mynetworks local_networks
|
||||||
if mx and not users:
|
if mx and not users:
|
||||||
add(client_networks + adm_networks)
|
out(" " + tostring(client_networks + adm_networks) + "\n")
|
||||||
elif users:
|
elif users:
|
||||||
add(adm_networks)
|
out(" " + tostring(adm_networks) + "\n")
|
||||||
elif tracker:
|
elif tracker:
|
||||||
add(adm_networks)
|
out(" " + tostring(adm_networks) + "\n")
|
||||||
|
|
||||||
if not mx:
|
if not mx:
|
||||||
if tracker or corbeau:
|
if tracker or corbeau:
|
||||||
@# Ecoute en local et sur adm (récupération des mails @tracker.adm.crans.org
|
@# Ecoute en local et sur adm (récupération des mails @tracker.adm.crans.org
|
||||||
inet_interfaces = ["127.0.0.1", admip()]
|
%inet_interfaces ["127.0.0.1", admip()]
|
||||||
else:
|
else:
|
||||||
@# Ecoute en local uniquement
|
@# Ecoute en local uniquement
|
||||||
inet_interfaces = "loopback-only"
|
@inet_interfaces = loopback-only
|
||||||
|
|
||||||
if mx:
|
if mx:
|
||||||
@# Destinations acceptees
|
@# Destinations acceptees
|
||||||
mydestination = [hostname, "$myhostname",
|
%mydestination [hostname, "$myhostname", "localhost", "localhost.$mydomain"]
|
||||||
"localhost", "localhost.$mydomain"]
|
|
||||||
if main or users:
|
if main or users:
|
||||||
add(["$mydomain",
|
out(" " + tostring(["$mydomain", "crans.ens-cachan.fr", "clubs.ens-cachan.fr", "install-party.ens-cachan.fr"]) + "\n")
|
||||||
"crans.ens-cachan.fr",
|
|
||||||
"clubs.ens-cachan.fr",
|
|
||||||
"install-party.ens-cachan.fr"])
|
|
||||||
if manage_ml:
|
if manage_ml:
|
||||||
add(["lists.$mydomain"])
|
out(" " + tostring(["lists.$mydomain"]) + "\n")
|
||||||
|
|
||||||
@# Domaine relaye par ce MX
|
@# Domaine relaye par ce MX
|
||||||
relay_domains = ["$mydestination"]
|
@relay_domains = $mydestination
|
||||||
if secondary:
|
if secondary:
|
||||||
add(["$mydomain",
|
out(" " + tostring(["$mydomain", "crans.ens-cachan.fr", "clubs.ens-cachan.fr", "install-party.ens-cachan.fr"]) + "\n")
|
||||||
"crans.ens-cachan.fr",
|
|
||||||
"clubs.ens-cachan.fr",
|
|
||||||
"install-party.ens-cachan.fr"])
|
|
||||||
if public and not manage_ml:
|
if public and not manage_ml:
|
||||||
add(["lists.$mydomain"])
|
out(" " + tostring(["lists.$mydomain"]) + "\n")
|
||||||
|
|
||||||
if not mx:
|
if not mx:
|
||||||
if tracker:
|
if tracker:
|
||||||
@# On accepte les mails destinés au tracker
|
@# On accepte les mails destinés au tracker
|
||||||
mydestination = "tracker.adm.crans.org",
|
@mydestination = tracker.adm.crans.org
|
||||||
if corbeau:
|
if corbeau:
|
||||||
@# On accepte les mails destinés au corbeau
|
@# On accepte les mails destinés au corbeau
|
||||||
mydestination = "crans.org"
|
@mydestination = crans.org
|
||||||
@# Les mails sont envoyes au MX principal
|
@# Les mails sont envoyes au MX principal
|
||||||
relayhost = "smtp.adm.crans.org",
|
@relayhost = smtp.adm.crans.org
|
||||||
|
|
||||||
@# Etre notifie ou non de l'arrive de nouveaux mails
|
@# Etre notifie ou non de l'arrive de nouveaux mails
|
||||||
biff = users
|
%biff users
|
||||||
|
|
||||||
if mx:
|
if mx:
|
||||||
@# Pour pouvoir tester sans tout casser, on active les soft bounces.
|
@# Pour pouvoir tester sans tout casser, on active les soft bounces.
|
||||||
@# Ca permet aux mails de ne pas etre bounces en cas d'erreur, mais
|
@# Ca permet aux mails de ne pas etre bounces en cas d'erreur, mais
|
||||||
@# a la place, de renvoyer une erreur non permanente. En production
|
@# a la place, de renvoyer une erreur non permanente. En production
|
||||||
@# il faut enlever ca.
|
@# il faut enlever ca.
|
||||||
soft_bounce = False
|
@soft_bounce = no
|
||||||
|
|
||||||
if users:
|
if users:
|
||||||
@# On delivre dans des maildir
|
@# On delivre dans des maildir
|
||||||
mail_spool_directory = "/home/mail/"
|
@mail_spool_directory = /home/mail/
|
||||||
|
|
||||||
@# +--------+
|
@# +--------+
|
||||||
@# | Divers |
|
@# | Divers |
|
||||||
@# +--------+
|
@# +--------+
|
||||||
|
|
||||||
@# Delais pour les warnings
|
@# Delais pour les warnings
|
||||||
delay_warning_time = "24h"
|
@delay_warning_time = 24h
|
||||||
|
|
||||||
@# Esthetisme
|
@# Esthetisme
|
||||||
smtpd_banner = "$myhostname ESMTP $mail_name (Debian/GNU)"
|
@smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
|
||||||
|
|
||||||
if not mx:
|
if not mx:
|
||||||
@# Reecriture des entetes: @host.crans.org -> @crans.org
|
@# Reecriture des entetes: @host.crans.org -> @crans.org
|
||||||
canonical_maps = "regexp:/etc/postfix/canonical"
|
@canonical_maps = regexp:/etc/postfix/canonical
|
||||||
|
|
||||||
if has("postfix.transport"):
|
if has("postfix.transport"):
|
||||||
@# Par ou passer (notement pour la distrtibution des adresse
|
@# Par ou passer (notement pour la distrtibution des adresse
|
||||||
@# locales par le serveur des adherents)
|
@# locales par le serveur des adherents)
|
||||||
transport_maps = "hash:/etc/postfix/transport"
|
@transport_maps = hash:/etc/postfix/transport
|
||||||
|
|
||||||
@# Une infinite d'adresses mail par personne
|
@# Une infinite d'adresses mail par personne
|
||||||
recipient_delimiter = "+"
|
@recipient_delimiter = +
|
||||||
|
|
||||||
@# +-----------------+
|
@# +-----------------+
|
||||||
@# | Bases d'adresse |
|
@# | Bases d'adresse |
|
||||||
@# +-----------------+
|
@# +-----------------+
|
||||||
|
|
||||||
@# Les fichiers d'alias (pour newaliases)
|
@# Les fichiers d'alias (pour newaliases)
|
||||||
alias_database = "hash:/etc/postfix/aliases"
|
@alias_database = hash:/etc/postfix/aliases
|
||||||
if manage_ml:
|
if manage_ml:
|
||||||
add("hash:/var/lib/mailman/data/aliases")
|
@ hash:/var/lib/mailman/data/aliases
|
||||||
|
|
||||||
alias_maps = "$alias_database"
|
@alias_maps = $alias_database
|
||||||
if mx:
|
|
||||||
@# Plus les alias dans la base de donnees
|
|
||||||
add(db_file("search"))
|
|
||||||
|
|
||||||
if mx:
|
|
||||||
@# On prend aussi en compte les utilisateurs de /etc/passwd
|
|
||||||
local_recipient_maps = "$alias_maps unix:passwd.byname"
|
|
||||||
|
|
||||||
if mx:
|
|
||||||
@# Les anciennes ML @crans.org, @crans.ens-cachan.fr -> @lists.crans.org
|
|
||||||
virtual_alias_maps = "hash:/etc/postfix/virtual"
|
|
||||||
|
|
||||||
# Pour les non-mx il n'y a plus rien d'interessant
|
# Pour les non-mx il n'y a plus rien d'interessant
|
||||||
if not mx:
|
|
||||||
done()
|
|
||||||
@
|
|
||||||
@# +-------------+
|
|
||||||
@# | TLS et SASL |
|
|
||||||
@# +-------------+
|
|
||||||
@
|
|
||||||
@# TLS pour la reception
|
|
||||||
@smtpd_use_tls=yes
|
|
||||||
@smtpd_tls_security_level=may
|
|
||||||
@smtpd_tls_cert_file=/etc/ssl/certs/smtp.pem
|
|
||||||
@smtpd_tls_key_file=/etc/ssl/private/smtp.pem
|
|
||||||
@smtpd_tls_CAfile=/etc/ssl/certs/cacert.org.pem
|
|
||||||
@smtpd_tls_loglevel=0
|
|
||||||
@smtpd_tls_received_header=yes
|
|
||||||
@
|
|
||||||
@# On utilise aussi TLS pour envoyer les mails
|
|
||||||
@smtp_use_tls=yes
|
|
||||||
@smtp_tls_security_level=may
|
|
||||||
@smtp_tls_loglevel=1
|
|
||||||
@smtp_tls_cert_file=
|
|
||||||
@smtp_tls_key_file=
|
|
||||||
@smtp_tls_CAfile=/etc/ssl/certs/cacert.org.pem
|
|
||||||
@
|
|
||||||
@
|
|
||||||
@# On cache les sessions TLS car elles sont couteuses. Il parait que btree est mieux que sdbm,
|
|
||||||
@# a essayer quand on aura postfix > 2.2
|
|
||||||
@smtpd_tls_session_cache_database=btree:/var/lib/postfix/smtpd_tls_session_cache
|
|
||||||
@smtp_tls_session_cache_database=btree:/var/lib/postfix/smtp_tls_session_cache
|
|
||||||
@
|
|
||||||
@tls_random_source=dev:/dev/urandom
|
|
||||||
@
|
|
||||||
if main:
|
|
||||||
@# Auth que si tls pour eviter des pass en clair sur le reseau
|
|
||||||
@smtpd_tls_auth_only=yes
|
|
||||||
@# Authentification SASL pour relayer du mail
|
|
||||||
@smtpd_sasl_auth_enable=yes
|
|
||||||
@
|
|
||||||
@# +--------------------------+
|
|
||||||
@# | Filtrages et limitations |
|
|
||||||
@# +--------------------------+
|
|
||||||
@
|
|
||||||
if main:
|
|
||||||
@# Filtrage sur les sources de connexions
|
|
||||||
@smtpd_client_restrictions=permit_mynetworks
|
|
||||||
@
|
|
||||||
@# Reject the request when the client HELO or EHLO parameter has a bad hostname syntax.
|
|
||||||
@# reject_unknown_hostname value not recommended, because it may causes mail losting.
|
|
||||||
@# (for example: after paypal.com registration you don't receive activation mail! I've tried it.)
|
|
||||||
@#
|
|
||||||
smtpd_helo_restrictions = "permit_mynetworks, reject_invalid_hostname"
|
|
||||||
|
|
||||||
@## Limitation des messages envoyés par minute
|
|
||||||
@# On n'ignore que les messages venant d'adresses "protégées"
|
|
||||||
@smtpd_client_event_limit_exceptions=local_networks
|
|
||||||
if mx:
|
if mx:
|
||||||
add(adm_networks)
|
@# Plus les alias dans la base de donnees
|
||||||
@
|
out(" " + tostring(db_file("search")) + "\n")
|
||||||
@# On limite à 10 messages par minute
|
@# On prend aussi en compte les utilisateurs de /etc/passwd
|
||||||
@smtpd_client_message_rate_limit=10
|
@local_recipient_maps = $alias_maps unix:passwd.byname
|
||||||
@
|
@# Les anciennes ML @crans.org, @crans.ens-cachan.fr -> @lists.crans.org
|
||||||
@## Filtrage au MAIL FROM
|
@virtual_alias_maps = hash:/etc/postfix/virtual
|
||||||
@# Rejet si le domaine de l'envoyeur n'est pas dans un DNS
|
|
||||||
@smtpd_sender_restrictions=reject_unknown_sender_domain
|
|
||||||
@
|
|
||||||
@## Filtrage au RCPT TO
|
|
||||||
@# permet si le client est dans le reseau local
|
|
||||||
@smtpd_recipient_restrictions=permit_mynetworks
|
|
||||||
if main:
|
|
||||||
@# test contre cluebringer pour les quota / rate par utilisateur sasl
|
|
||||||
@# check_policy_service inet:127.0.0.1:10031
|
|
||||||
@# rejette les recipients sans nom de domaine totalement qualifie
|
|
||||||
add("reject_non_fqdn_recipient")
|
|
||||||
if main:
|
|
||||||
@# permet si le client est authentifie
|
|
||||||
add("permit_sasl_authenticated")
|
|
||||||
@# rejette les destinations non locales
|
|
||||||
add("reject_unauth_destination")
|
|
||||||
if public:
|
|
||||||
@# accepte si le champ contourneGreylist de la base est a OK
|
|
||||||
add("check_recipient_access " + db_file("sqlgrey"))
|
|
||||||
@# accepte si la greylist est d'accord
|
|
||||||
add("check_policy_service inet:127.0.0.1:2501")
|
|
||||||
@# jette le reste
|
|
||||||
@
|
|
||||||
if main:
|
|
||||||
@#smtpd_end_of_data_restrictions=check_policy_service inet:127.0.0.1:10031
|
|
||||||
@# Tailles maximales : 20Mo pour les msgs et 75 pour les mbox
|
|
||||||
message_size_limit = 20971520
|
|
||||||
mailbox_size_limit = 78643000
|
|
||||||
|
|
||||||
@# Obligation de specifier le nom de domaine complet
|
|
||||||
append_dot_mydomain = secondary
|
|
||||||
|
|
||||||
if main:
|
|
||||||
@#Ajout de cyrus pour l'authentification SMTP
|
|
||||||
smtpd_sasl_type = "cyrus"
|
|
||||||
|
|
||||||
@# Pieces jointes
|
|
||||||
mime_header_checks = "regexp:/etc/postfix/mime_header_checks"
|
|
||||||
|
|
||||||
@# Transport slow
|
|
||||||
@slow_destination_recipient_limit = 20
|
|
||||||
@slow_destination_concurrency_limit = 2
|
|
||||||
|
|
||||||
if not secondary:
|
|
||||||
@# +----------------------+
|
|
||||||
@# | Connexion de secours |
|
|
||||||
@# +----------------------+
|
|
||||||
@#POUR SECOURS
|
|
||||||
if not has("rescue-mode"):
|
|
||||||
out("#")
|
|
||||||
relayhost = "[ovh.adm.crans.org]:25"
|
|
||||||
|
|
||||||
if has("titanic"):
|
|
||||||
@relayhost=[ovh.adm.crans.org]:25
|
|
||||||
|
|
||||||
if main or secondary:
|
|
||||||
@# PostScreen configuration
|
|
||||||
@# Access List
|
|
||||||
@postscreen_access_list = cidr:/etc/postfix/postscreen_access.cidr
|
|
||||||
@## Tu es blacklisté ? VTFF
|
|
||||||
@postscreen_blacklist_action = drop
|
|
||||||
@
|
@
|
||||||
@# Bannière d'accueil multi valuée
|
@# +-------------+
|
||||||
@postscreen_greet_banner = Bienvenue au crans, veuillez patienter quelques secondes.
|
@# | TLS et SASL |
|
||||||
@## On droppe.
|
@# +-------------+
|
||||||
@postscreen_greet_action = drop
|
|
||||||
@# RBL, le retour
|
|
||||||
@postscreen_dnsbl_sites =
|
|
||||||
@ zen.spamhaus.org*2
|
|
||||||
@ dnsbl.inps.de*2
|
|
||||||
@ b.barracudacentral.org*2
|
|
||||||
@ dnsbl-2.uceprotect.net*2
|
|
||||||
@ bl.spameatingmonkey.net
|
|
||||||
@ bl.spamcop.net
|
|
||||||
@ dnsbl.sorbs.net
|
|
||||||
@ psbl.surriel.com
|
|
||||||
@ bl.mailspike.net
|
|
||||||
@ swl.spamhaus.org*-2
|
|
||||||
@ list.dnswl.org=127.[0..255].[0..255].0*-1
|
|
||||||
@ list.dnswl.org=127.[0..255].[0..255].1*-2
|
|
||||||
@ list.dnswl.org=127.[0..255].[0..255].[2..255]*-3
|
|
||||||
@
|
@
|
||||||
@# Score >= 4 ? Bye bye
|
@# TLS pour la reception
|
||||||
@postscreen_dnsbl_threshold = 4
|
@smtpd_use_tls=yes
|
||||||
@postscreen_dnsbl_action = enforce
|
@smtpd_tls_security_level=may
|
||||||
|
@smtpd_tls_cert_file=/etc/ssl/certs/smtp.pem
|
||||||
|
@smtpd_tls_key_file=/etc/ssl/private/smtp.pem
|
||||||
|
@smtpd_tls_CAfile=/etc/ssl/certs/cacert.org.pem
|
||||||
|
@smtpd_tls_loglevel=0
|
||||||
|
@smtpd_tls_received_header=yes
|
||||||
@
|
@
|
||||||
@## Désactivé, pour éviter le fake greylisting de postscreen.
|
@# On utilise aussi TLS pour envoyer les mails
|
||||||
@## Décommenter en cas de spam trop important.
|
@smtp_use_tls=yes
|
||||||
@## Filtre utilisé par postfix, mis en amont via postscreen
|
@smtp_tls_security_level=may
|
||||||
@#postscreen_non_smtp_command_enable = yes
|
@smtp_tls_loglevel=1
|
||||||
@#postscreen_non_smtp_command_action = enforce
|
@smtp_tls_cert_file=
|
||||||
@#
|
@smtp_tls_key_file=
|
||||||
@#postscreen_bare_newline_enable = yes
|
@smtp_tls_CAfile=/etc/ssl/certs/cacert.org.pem
|
||||||
@#postscreen_bare_newline_action = enforce
|
@
|
||||||
@#
|
@
|
||||||
@#postscreen_pipelining_enable = yes
|
@# On cache les sessions TLS car elles sont couteuses. Il parait que btree est mieux que sdbm,
|
||||||
@#postscreen_pipelining_action = enforce
|
@# a essayer quand on aura postfix > 2.2
|
||||||
|
@smtpd_tls_session_cache_database=btree:/var/lib/postfix/smtpd_tls_session_cache
|
||||||
|
@smtp_tls_session_cache_database=btree:/var/lib/postfix/smtp_tls_session_cache
|
||||||
|
@
|
||||||
|
@tls_random_source=dev:/dev/urandom
|
||||||
|
@
|
||||||
|
if main:
|
||||||
|
@# Auth que si tls pour eviter des pass en clair sur le reseau
|
||||||
|
@smtpd_tls_auth_only=yes
|
||||||
|
@# Authentification SASL pour relayer du mail
|
||||||
|
@smtpd_sasl_auth_enable=yes
|
||||||
|
@
|
||||||
|
@# +--------------------------+
|
||||||
|
@# | Filtrages et limitations |
|
||||||
|
@# +--------------------------+
|
||||||
|
@
|
||||||
|
if main:
|
||||||
|
@# Filtrage sur les sources de connexions
|
||||||
|
@smtpd_client_restrictions=permit_mynetworks
|
||||||
|
@
|
||||||
|
@# Reject the request when the client HELO or EHLO parameter has a bad hostname syntax.
|
||||||
|
@# reject_unknown_hostname value not recommended, because it may causes mail losting.
|
||||||
|
@# (for example: after paypal.com registration you don't receive activation mail! I've tried it.)
|
||||||
|
@#
|
||||||
|
@smtpd_helo_restrictions = permit_mynetworks, reject_invalid_hostname
|
||||||
|
|
||||||
|
@## Limitation des messages envoyés par minute
|
||||||
|
@# On n'ignore que les messages venant d'adresses "protégées"
|
||||||
|
@smtpd_client_event_limit_exceptions = local_networks
|
||||||
|
if mx:
|
||||||
|
out(" " + tostring(adm_networks) + "\n")
|
||||||
|
@
|
||||||
|
@# On limite à 10 messages par minute
|
||||||
|
@smtpd_client_message_rate_limit = 10
|
||||||
|
@
|
||||||
|
@## Filtrage au MAIL FROM
|
||||||
|
@# Rejet si le domaine de l'envoyeur n'est pas dans un DNS
|
||||||
|
@smtpd_sender_restrictions = reject_unknown_sender_domain
|
||||||
|
@
|
||||||
|
@## Filtrage au RCPT TO
|
||||||
|
@# permet si le client est dans le reseau local
|
||||||
|
@smtpd_recipient_restrictions = permit_mynetworks
|
||||||
|
if main:
|
||||||
|
@# test contre cluebringer pour les quota / rate par utilisateur sasl
|
||||||
|
@# check_policy_service inet:127.0.0.1:10031
|
||||||
|
@# rejette les recipients sans nom de domaine totalement qualifie
|
||||||
|
@ reject_non_fqdn_recipient
|
||||||
|
|
||||||
|
if main:
|
||||||
|
@# permet si le client est authentifie
|
||||||
|
@ permit_sasl_authenticated
|
||||||
|
|
||||||
|
@# rejette les destinations non locales
|
||||||
|
@ reject_unauth_destination
|
||||||
|
|
||||||
|
if public:
|
||||||
|
@# accepte si le champ contourneGreylist de la base est a OK
|
||||||
|
@ permit_sasl_authenticated
|
||||||
|
out(" check_recipient_access " + tostring(db_file("sqlgrey")) + "\n")
|
||||||
|
@# accepte si la greylist est d'accord
|
||||||
|
@ check_policy_service inet:127.0.0.1:2501
|
||||||
|
@# jette le reste
|
||||||
|
@
|
||||||
|
|
||||||
|
if main:
|
||||||
|
@#smtpd_end_of_data_restrictions=check_policy_service inet:127.0.0.1:10031
|
||||||
|
@# Tailles maximales : 20Mo pour les msgs et 75 pour les mbox
|
||||||
|
@message_size_limit = 20971520
|
||||||
|
@mailbox_size_limit = 78643000
|
||||||
|
|
||||||
|
@# Obligation de specifier le nom de domaine complet
|
||||||
|
%append_dot_mydomain secondary
|
||||||
|
|
||||||
|
if main:
|
||||||
|
@#Ajout de cyrus pour l'authentification SMTP
|
||||||
|
@smtpd_sasl_type = cyrus
|
||||||
|
|
||||||
|
@# Pieces jointes
|
||||||
|
@mime_header_checks = regexp:/etc/postfix/mime_header_checks
|
||||||
|
|
||||||
|
@# Transport slow
|
||||||
|
@slow_destination_recipient_limit = 20
|
||||||
|
@slow_destination_concurrency_limit = 2
|
||||||
|
|
||||||
|
if not secondary:
|
||||||
|
@# +----------------------+
|
||||||
|
@# | Connexion de secours |
|
||||||
|
@# +----------------------+
|
||||||
|
@#POUR SECOURS
|
||||||
|
if not has("rescue-mode"):
|
||||||
|
out("#")
|
||||||
|
@relayhost = [ovh.adm.crans.org]:25
|
||||||
|
|
||||||
|
if has("titanic"):
|
||||||
|
@relayhost = [ovh.adm.crans.org]:25
|
||||||
|
|
||||||
|
if main or secondary:
|
||||||
|
@# PostScreen configuration
|
||||||
|
@# Access List
|
||||||
|
@postscreen_access_list = cidr:/etc/postfix/postscreen_access.cidr
|
||||||
|
@## Tu es blacklisté ? VTFF
|
||||||
|
@postscreen_blacklist_action = drop
|
||||||
|
@
|
||||||
|
@# Bannière d'accueil multi valuée
|
||||||
|
@postscreen_greet_banner = Bienvenue au crans, veuillez patienter quelques secondes.
|
||||||
|
@## On droppe.
|
||||||
|
@postscreen_greet_action = drop
|
||||||
|
@# RBL, le retour
|
||||||
|
@postscreen_dnsbl_sites =
|
||||||
|
@ zen.spamhaus.org*2
|
||||||
|
@ dnsbl.inps.de*2
|
||||||
|
@ b.barracudacentral.org*2
|
||||||
|
@ dnsbl-2.uceprotect.net*2
|
||||||
|
@ bl.spameatingmonkey.net
|
||||||
|
@ bl.spamcop.net
|
||||||
|
@ dnsbl.sorbs.net
|
||||||
|
@ psbl.surriel.com
|
||||||
|
@ bl.mailspike.net
|
||||||
|
@ swl.spamhaus.org*-2
|
||||||
|
@ list.dnswl.org=127.[0..255].[0..255].0*-1
|
||||||
|
@ list.dnswl.org=127.[0..255].[0..255].1*-2
|
||||||
|
@ list.dnswl.org=127.[0..255].[0..255].[2..255]*-3
|
||||||
|
@
|
||||||
|
@# Score >= 4 ? Bye bye
|
||||||
|
@postscreen_dnsbl_threshold = 4
|
||||||
|
@postscreen_dnsbl_action = enforce
|
||||||
|
@
|
||||||
|
@## Désactivé, pour éviter le fake greylisting de postscreen.
|
||||||
|
@## Décommenter en cas de spam trop important.
|
||||||
|
@## Filtre utilisé par postfix, mis en amont via postscreen
|
||||||
|
@#postscreen_non_smtp_command_enable = yes
|
||||||
|
@#postscreen_non_smtp_command_action = enforce
|
||||||
|
@#
|
||||||
|
@#postscreen_bare_newline_enable = yes
|
||||||
|
@#postscreen_bare_newline_action = enforce
|
||||||
|
@#
|
||||||
|
@#postscreen_pipelining_enable = yes
|
||||||
|
@#postscreen_pipelining_action = enforce
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue