| Matthias Andreas Benkard | b382b10 | 2021-01-02 15:32:21 +0100 | [diff] [blame] | 1 | # inter-mx with postscreen on 25/tcp |
| 2 | smtp inet n - n - 1 postscreen |
| 3 | 10025 inet n - n - 1 postscreen |
| 4 | -o postscreen_upstream_proxy_protocol=haproxy |
| 5 | -o syslog_name=haproxy |
| 6 | smtpd pass - - n - - smtpd |
| 7 | -o smtpd_helo_restrictions=permit_mynetworks,reject_non_fqdn_helo_hostname |
| 8 | -o smtpd_sasl_auth_enable=no |
| 9 | -o smtpd_sender_restrictions=permit_mynetworks,reject_unlisted_sender,reject_unknown_sender_domain |
| 10 | |
| 11 | # smtpd tls-wrapped (smtps) on 465/tcp |
| 12 | # TLS protocol can be modified by setting smtps_smtpd_tls_mandatory_protocols in extra.cf |
| 13 | smtps inet n - n - - smtpd |
| 14 | -o smtpd_tls_wrappermode=yes |
| 15 | -o smtpd_client_restrictions=permit_mynetworks,permit_sasl_authenticated,reject |
| 16 | -o smtpd_tls_mandatory_protocols=$smtps_smtpd_tls_mandatory_protocols |
| 17 | -o tls_preempt_cipherlist=yes |
| 18 | -o cleanup_service_name=smtp_sender_cleanup |
| 19 | -o syslog_name=postfix/smtps |
| Matthias Andreas Benkard | b382b10 | 2021-01-02 15:32:21 +0100 | [diff] [blame] | 20 | 10465 inet n - n - - smtpd |
| 21 | -o smtpd_upstream_proxy_protocol=haproxy |
| 22 | -o smtpd_tls_wrappermode=yes |
| 23 | -o smtpd_client_restrictions=permit_mynetworks,permit_sasl_authenticated,reject |
| 24 | -o smtpd_tls_mandatory_protocols=$smtps_smtpd_tls_mandatory_protocols |
| 25 | -o tls_preempt_cipherlist=yes |
| 26 | -o cleanup_service_name=smtp_sender_cleanup |
| 27 | -o syslog_name=postfix/smtps-haproxy |
| Matthias Andreas Benkard | b382b10 | 2021-01-02 15:32:21 +0100 | [diff] [blame] | 28 | |
| 29 | # smtpd with starttls on 587/tcp |
| 30 | # TLS protocol can be modified by setting submission_smtpd_tls_mandatory_protocols in extra.cf |
| 31 | submission inet n - n - - smtpd |
| 32 | -o smtpd_client_restrictions=permit_mynetworks,permit_sasl_authenticated,reject |
| 33 | -o smtpd_enforce_tls=yes |
| 34 | -o smtpd_tls_security_level=encrypt |
| 35 | -o smtpd_tls_mandatory_protocols=$submission_smtpd_tls_mandatory_protocols |
| 36 | -o tls_preempt_cipherlist=yes |
| 37 | -o cleanup_service_name=smtp_sender_cleanup |
| 38 | -o syslog_name=postfix/submission |
| Matthias Andreas Benkard | b382b10 | 2021-01-02 15:32:21 +0100 | [diff] [blame] | 39 | 10587 inet n - n - - smtpd |
| 40 | -o smtpd_upstream_proxy_protocol=haproxy |
| 41 | -o smtpd_client_restrictions=permit_mynetworks,permit_sasl_authenticated,reject |
| 42 | -o smtpd_enforce_tls=yes |
| 43 | -o smtpd_tls_security_level=encrypt |
| 44 | -o smtpd_tls_mandatory_protocols=$submission_smtpd_tls_mandatory_protocols |
| 45 | -o tls_preempt_cipherlist=yes |
| 46 | -o cleanup_service_name=smtp_sender_cleanup |
| 47 | -o syslog_name=postfix/submission-haproxy |
| Matthias Andreas Benkard | b382b10 | 2021-01-02 15:32:21 +0100 | [diff] [blame] | 48 | |
| 49 | # used by SOGo |
| 50 | # smtpd_sender_restrictions should match main.cf, but with check_sasl_access prepended for login-as-mailbox-user function |
| 51 | 588 inet n - n - - smtpd |
| 52 | -o smtpd_client_restrictions=permit_mynetworks,permit_sasl_authenticated,reject |
| 53 | -o smtpd_tls_auth_only=no |
| 54 | -o smtpd_sender_restrictions=check_sasl_access,regexp:/opt/postfix/conf/allow_mailcow_local.regexp,reject_authenticated_sender_login_mismatch,permit_mynetworks,permit_sasl_authenticated,reject_unlisted_sender,reject_unknown_sender_domain |
| 55 | -o cleanup_service_name=smtp_sender_cleanup |
| 56 | -o syslog_name=postfix/sogo |
| Matthias Andreas Benkard | b382b10 | 2021-01-02 15:32:21 +0100 | [diff] [blame] | 57 | |
| 58 | # used to reinject quarantine mails |
| 59 | 590 inet n - n - - smtpd |
| 60 | -o smtpd_helo_restrictions= |
| 61 | -o smtpd_client_restrictions=permit_mynetworks,reject |
| 62 | -o smtpd_tls_auth_only=no |
| 63 | -o smtpd_milters= |
| 64 | -o non_smtpd_milters= |
| 65 | -o syslog_name=postfix/quarantine |
| Matthias Andreas Benkard | 7b2a3a1 | 2021-08-16 10:57:25 +0200 | [diff] [blame^] | 66 | |
| 67 | # used to send bcc mails |
| 68 | 591 inet n - n - - smtpd |
| 69 | -o smtpd_helo_restrictions= |
| 70 | -o smtpd_client_restrictions=permit_mynetworks,reject |
| 71 | -o smtpd_tls_auth_only=no |
| 72 | -o smtpd_milters= |
| 73 | -o non_smtpd_milters= |
| 74 | -o syslog_name=postfix/bcc |
| Matthias Andreas Benkard | b382b10 | 2021-01-02 15:32:21 +0100 | [diff] [blame] | 75 | |
| 76 | # enforced smtp connector |
| 77 | smtp_enforced_tls unix - - n - - smtp |
| 78 | -o smtp_tls_security_level=encrypt |
| 79 | -o syslog_name=enforced-tls-smtp |
| 80 | -o smtp_delivery_status_filter=pcre:/opt/postfix/conf/smtp_dsn_filter |
| 81 | |
| 82 | # smtp connector used, when a transport map matched |
| 83 | # this helps to have different sasl maps than we have with sender dependent transport maps |
| 84 | smtp_via_transport_maps unix - - n - - smtp |
| 85 | -o smtp_sasl_password_maps=proxy:mysql:/opt/postfix/conf/sql/mysql_sasl_passwd_maps_transport_maps.cf |
| 86 | |
| 87 | tlsproxy unix - - n - 0 tlsproxy |
| 88 | dnsblog unix - - n - 0 dnsblog |
| 89 | pickup fifo n - n 60 1 pickup |
| 90 | cleanup unix n - n - 0 cleanup |
| 91 | qmgr fifo n - n 300 1 qmgr |
| 92 | tlsmgr unix - - n 1000? 1 tlsmgr |
| 93 | rewrite unix - - n - - trivial-rewrite |
| 94 | bounce unix - - n - 0 bounce |
| 95 | defer unix - - n - 0 bounce |
| 96 | trace unix - - n - 0 bounce |
| 97 | verify unix - - n - 1 verify |
| 98 | flush unix n - n 1000? 0 flush |
| 99 | proxymap unix - - n - - proxymap |
| 100 | proxywrite unix - - n - 1 proxymap |
| 101 | smtp unix - - n - - smtp |
| 102 | relay unix - - n - - smtp |
| 103 | showq unix n - n - - showq |
| 104 | error unix - - n - - error |
| 105 | retry unix - - n - - error |
| 106 | discard unix - - n - - discard |
| 107 | local unix - n n - - local |
| 108 | virtual unix - n n - - virtual |
| 109 | lmtp unix - - n - - lmtp |
| 110 | anvil unix - - n - 1 anvil |
| 111 | scache unix - - n - 1 scache |
| 112 | maildrop unix - n n - - pipe flags=DRhu |
| 113 | user=vmail argv=/usr/bin/maildrop -d ${recipient} |
| 114 | |
| 115 | # used to anonymize sender IP |
| 116 | smtp_sender_cleanup unix n - y - 0 cleanup |
| 117 | -o header_checks=$smtp_header_checks |
| 118 | |
| 119 | # start whitelist_fwd |
| 120 | 127.0.0.1:10027 inet n n n - 0 spawn user=nobody argv=/usr/local/bin/whitelist_forwardinghosts.sh |
| Matthias Andreas Benkard | b382b10 | 2021-01-02 15:32:21 +0100 | [diff] [blame] | 121 | # end whitelist_fwd |
| 122 | |
| 123 | # start watchdog-specific |
| 124 | # logs to local7 (hidden) |
| 125 | 589 inet n - n - - smtpd |
| 126 | -o smtpd_client_restrictions=permit_mynetworks,reject |
| 127 | -o syslog_name=watchdog |
| 128 | -o syslog_facility=local7 |
| 129 | -o smtpd_milters= |
| 130 | -o cleanup_service_name=watchdog_cleanup |
| 131 | -o non_smtpd_milters= |
| 132 | watchdog_cleanup unix n - n - 0 cleanup |
| 133 | -o syslog_name=watchdog |
| 134 | -o syslog_facility=local7 |
| 135 | -o queue_service_name=watchdog_qmgr |
| 136 | watchdog_qmgr fifo n - n 300 1 qmgr |
| 137 | -o syslog_facility=local7 |
| 138 | -o syslog_name=watchdog |
| 139 | -o rewrite_service_name=watchdog_rewrite |
| 140 | watchdog_rewrite unix - - n - - trivial-rewrite |
| 141 | -o syslog_facility=local7 |
| 142 | -o syslog_name=watchdog |
| 143 | -o local_transport=watchdog_discard |
| 144 | watchdog_discard unix - - n - - discard |
| 145 | -o syslog_facility=local7 |
| 146 | -o syslog_name=watchdog |
| 147 | # end watchdog-specific |