crans/crans_bcfg2
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[postfix] On fait une configuration un peu plus propre, et on ajoute postscreen.

Browse source
This commit is contained in:
Pierre-Elliott Bécue 2013-07-27 19:43:37 +02:00
parent c23d310bec
commit 171186bb04
3 changed files with 55 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

53
Python/etc/postfix/main.cf
View file

@ -203,9 +203,9 @@ tls_daemon_random_source = "dev:/dev/urandom"
if main:
@# Authentification SASL pour relayer du mail
smtpd_sasl_auth_enable = True
@smtpd_sasl_auth_enable=yes
@# Auth que si tls pour eviter des pass en clair sur le reseau
smtpd_tls_auth_only = True
@smtpd_tls_auth_only=yes
@# +--------------------------+
@# | Filtrages et limitations |
@ -213,16 +213,13 @@ if main:
if main:
@# Filtrage sur les sources de connexions
print "smtpd_client_restrictions = permit_mynetworks"
#print " reject_rbl_client dnsbl.ahbl.org"
#print " reject_rbl_client dnsbl.njabl.org"
#print " reject_rbl_client dnsbl.inps.de"
@smtpd_client_restrictions=permit_mynetworks
@
@#
@# Requiring this will stop some UCE software.
@# (UCE = Unsolicited Commercial Email = SPAM)
@#
smtpd_require_helo = "yes"
@smtpd_require_helo=yes
@
@# Reject the request when the client HELO or EHLO parameter has a bad hostname syntax.
@# reject_unknown_hostname value not recommended, because it may causes mail losting.
@ -238,20 +235,20 @@ if main:
@## Limitation des messages envoyés par minute
@# On n'ignore que les messages venant d'adresses "protégées"
smtpd_client_event_limit_exceptions = local_networks
@smtpd_client_event_limit_exceptions=local_networks
if mx:
add(adm_networks)
@# On limite à 10 messages par minute
smtpd_client_message_rate_limit = 10
@smtpd_client_message_rate_limit=10
@## Filtrage au MAIL FROM
@# Rejet si le domaine de l'envoyeur n'est pas dans un DNS
smtpd_sender_restrictions = "reject_unknown_sender_domain"
@smtpd_sender_restrictions=reject_unknown_sender_domain
@## Filtrage au RCPT TO
@# permet si le client est dans le reseau local
smtpd_recipient_restrictions = "permit_mynetworks"
@smtpd_recipient_restrictions=permit_mynetworks
@# rejette les recipients sans nom de domaine totalement qualifie
add("reject_non_fqdn_recipient")
if main:
@ -294,4 +291,36 @@ if not secondary:
relayhost = "[ovh.adm.crans.org]:25"
if has("titanic"):
@relayhost = "[ovh.adm.crans.org]:25"
@relayhost=[ovh.adm.crans.org]:25
@# PostScreen configuration
@# Access List
@postscreen_access_list = cidr:/etc/postfix/postscreen_access.cidr
@## Tu es blacklisté ? VTFF
@postscreen_blacklist_action = drop
@
@# Bannière d'accueil multi valuée
@postscreen_greet_banner = Bienvenue au crans, veuillez patienter quelques secondes.
@## On fait semblant d'aller à RCPT TO, puis poubelle
@postscreen_greet_action = enforce
@
@# RBL, le retour
@postscreen_dnsbl_sites =
@ zen.spamhaus.org*2
@ dnsbl.inps.de*2
@ dnsbl.ahbl.org
@ b.barracudacentral.org
@
@# Score >= 3 ? Bye bye
@postscreen_dnsbl_threshold = 3
@postscreen_dnsbl_action = enforce
@
@# Filtre utilisé par postfix, mis en amont via postscreen
@postscreen_non_smtp_command_enable = yes
@postscreen_non_smtp_command_action = enforce
@
@postscreen_bare_newline_enable = yes
@postscreen_bare_newline_action = enforce
@
@postscreen_pipelining_enable = yes
@postscreen_pipelining_action = enforce