summaryrefslogtreecommitdiff
path: root/postfix/postfix.sh
blob: a32408d6fcc55ed373c87639a405764911170909 (plain) 
    

  1. #!/bin/sh
    2. 

  2. #
    3. 

  3. # /etc/local-COMMON/postfix/postfix.sh
    4. 

  4. # Copyright 2002-2007 Jonas Smedegaard <dr@jones.dk>
    5. 

  5. #
    6. 

  6. # $Id: postfix.sh,v 1.76 2008-05-25 19:00:16 jonas Exp $
    7. 

  7. #
    8. 

  8. # Auto-tweak plain installed postfix Debian package
    9. 

  9. #
    10. 

  10. # TODO:
    11. 

  11. #  * Implement stuff from here: http://www.wsrcc.com/spam/
    12. 

  12. #  * Implement stuff from here: http://www.muine.org/~hoang/postfix.html
    13. 

  13. #  * Implement stuff from here: http://jimsun.linxnet.com/misc/postfix-anti-UCE.txt
    14. 

  14. #  * Figure out a way to use chroot jail for TLS stuff.
    15. 

  15. #  * Use https://www.dnswl.org/
    16. 

  16. 

  17. set -e
    18. 

  18. 

  19. # Let's standardize sort
    20. 

  20. export LC_ALL=C
    21. 

  21. 

  22. warn()  {
    23. 

  23.     echo >&2 "Warning: $1"
    24. 

  24. }
    25. 

  25. 

  26. exit1() {
    27. 

  27.     echo >&2 "Error: $1"
    28. 

  28.     echo >&2 "Exiting..."
    29. 

  29.     exit 1
    30. 

  30. }
    31. 

  31. 

  32. realmsdir='/etc/local-REDPILL'
    33. 

  33. configdirs='/etc/local /etc/local-ORG /etc/local-REDPILL /etc/local-COMMON'
    34. 

  34. confdir='/etc/postfix'
    35. 

  35. if ! [ -d "$realmsdir" ]; then
    36. 

  36.     warn "Realms directory \"$realmsdir\" does not exist."
    37. 

  37. fi
    38. 

  38. #postgrey=
    39. 

  39. #if [ -x /usr/sbin/postgrey ]; then
    40. 

  40. #   # FIXME: Use this somehow, and only warn below
    41. 

  41. #   postgrey=1
    42. 

  42. #else
    43. 

  43. #   exit1 "ERROR: Greylisting support (Debian package postgrey) missing."
    44. 

  44. #fi
    45. 

  45. dovecot=
    46. 

  46. dovecot_lmtp=
    47. 

  47. dovecot_deliver=
    48. 

  48. if [ -x /usr/sbin/dovecot ]; then
    49. 

  49.     dovecot=1
    50. 

  50.     if [ -x /usr/lib/dovecot/lmtp ]; then
    51. 

  51.         dovecot_lmtp=1
    52. 

  52.     elif [ -x /usr/lib/dovecot/deliver ]; then
    53. 

  53.         warn "Dovecot LMTP missing - (Debian package dovecot-lmtp)."
    54. 

  54.         dovecot_deliver=1
    55. 

  55.     else
    56. 

  56.         warn "Dovecot deliver missing."
    57. 

  57.     fi
    58. 

  58. else
    59. 

  59.     warn "Dovecot missing - (Debian package dovecot-core or dovecot)."
    60. 

  60. fi
    61. 

  61. tls_cert=
    62. 

  62. if [ -f /etc/ssl/certs/postfix.pem ] && [ -f /etc/ssl/private/postfix.pem ]; then
    63. 

  63.     tls_cert=1
    64. 

  64. else
    65. 

  65.     warn "No TLS encryption - requires SSL certificate at /etc/ssl/certs/postfix.pem and private key at /etc/ssl/private/postfix.pem."
    66. 

  66. fi
    67. 

  67. # TODO: enable only on systems with user accounts
    68. 

  68. submission=1
    69. 

  69. # TODO: check that dovecot SASL is configured
    70. 

  70. sasl_inbound=
    71. 

  71. if [ -n "$tls_cert" ] && [ -n "$dovecot" ] && [ -n "$submission" ]; then
    72. 

  72.     sasl_inbound=1
    73. 

  73. else
    74. 

  74.     warn "No inbound SASL authentication - requires TLS encryption and Dovecot."
    75. 

  75. fi
    76. 

  76. amavis=
    77. 

  77. # TODO: maybe use AMaViS default of 20 (instead tuning spamassassin)
    78. 

  78. # <https://www.ijs.si/software/amavisd/amavisd-new-docs.html#max_requests>
    79. 

  79. default_amavis_maxproc=2
    80. 

  80. if [ -x /usr/sbin/amavisd ] || [ -x /usr/sbin/amavisd-new ]; then
    81. 

  81.     amavis=1
    82. 

  82. else
    83. 

  83.     warn "AMaViS missing (Debian package amavisd-new)."
    84. 

  84. fi
    85. 

  85. dkimproxy=
    86. 

  86. #dkimproxy_maxproc_in=5
    87. 

  87. # FIXME: update actual outgoing maxproc from /etc/default/dkimproxy (and /etc/dkimproxy/dkimproxy_out.conf too?)
    88. 

  88. dkimproxy_maxproc_out=5
    89. 

  89. if [ -x /usr/sbin/dkimproxy.in ]; then
    90. 

  90.     if [ "1" = "$amavis" ]; then
    91. 

  91.         dkimproxy=1
    92. 

  92.     else
    93. 

  93.         warn "No DKIM/Domainkey - requires DKIMproxy and AMaViS."
    94. 

  94.     fi
    95. 

  95. else
    96. 

  96.     warn "DKIMproxy missing (Debian package dkimproxy)."
    97. 

  97. fi
    98. 

  98. 

  99. catfilefromownrealm() {
    100. 

  100.     set -e
    101. 

  101.     file="$1"
    102. 

  102.     [ -d "$realmsdir" ] || exit 0
    103. 

  103. 

  104.     thisrealm="$(cat /etc/local-ORG/realm || dnsdomainname | tr '[a-z]' '[A-Z]')"
    105. 

  105. 

  106.     cat "$realmsdir/$thisrealm/$file"
    107. 

  107. }
    108. 

  108. 

  109. catallfilesfromotherrealms() {
    110. 

  110.     set -e
    111. 

  111.     file="$1"
    112. 

  112.     [ -d "$realmsdir" ] || exit 0
    113. 

  113.     [ -f "$realmsdir/realms" ] || exit 0
    114. 

  114. 

  115.     realms="$(cat "$realmsdir/realms" | sed 's/#.*//')"
    116. 

  116.     thisrealm="$(cat /etc/local-ORG/realm || dnsdomainname | tr '[a-z]' '[A-Z]')"
    117. 

  117. 

  118.     for realm in $realms; do
    119. 

  119.         if [ "$thisrealm" != "$realm" ]; then
    120. 

  120.             cat "$realmsdir/$realm/$file"
    121. 

  121.         fi
    122. 

  122.     done
    123. 

  123. }
    124. 

  124. 

  125. catfirstfile() {
    126. 

  126.     set -e
    127. 

  127.     file="$1"
    128. 

  128.     context="${2:-postfix}"
    129. 

  129.     configdir=''
    130. 

  130.     for dir in $configdirs; do
    131. 

  131.         if [ -d "$dir/$context" ] && [ -f "$dir/$context/$file" ]; then
    132. 

  132.             configdir="$dir/$context"
    133. 

  133.             break
    134. 

  134.         fi
    135. 

  135.     done
    136. 

  136.     if [ -z "$configdir" ]; then
    137. 

  137.         exit1 "ERROR: file \"$file\" not found."
    138. 

  138.     fi
    139. 

  139.     cat "$configdir/$file"
    140. 

  140. }
    141. 

  141. 

  142. # TODO: support quoted string, and trailing comment.
    143. 

  143. getperlvarfromfile() {
    144. 

  144.     set -e
    145. 

  145.     export var="$1"
    146. 

  146.     export default="$2"
    147. 

  147.     file="$3"
    148. 

  148.     context="${4:-postfix}"
    149. 

  149.     catfirstfile "$file" "$context" \
    150. 

  150.         | perl -nE'/^\$$ENV{"var"}\h*=\h*(\d+)/ and $s=$1; END {print length($s) ? $s : $ENV{'default'}}'
    151. 

  151. }
    152. 

  152. 

  153. getlinesfromfile() {
    154. 

  154.     set -e
    155. 

  155.     param="$1"
    156. 

  156.     shift
    157. 

  157.     replacements=
    158. 

  158.     for subparam in $@; do
    159. 

  159.         case "$subparam" in
    160. 

  160.             *=)
    161. 

  161.             oldparam="`echo $subparam | awk -F= '{print $1}'`"
    162. 

  162.             replacements="$replacements;s/,*[^,]*$oldparam[^,]*,*/,/"
    163. 

  163.             continue
    164. 

  164.             ;;
    165. 

  165.             *=*=*)
    166. 

  166.             oldparam="`echo $subparam | awk -F= '{print $1}'`"
    167. 

  167.             newparam="`echo $subparam | awk -F= '{print $2}'`"
    168. 

  168.             newparamfile="`echo $subparam | awk -F= '{print $3}'`"
    169. 

  169.             ;;
    170. 

  170.             *)
    171. 

  171.             oldparam=$subparam
    172. 

  172.             newparam=$subparam
    173. 

  173.             newparamfile=$subparam
    174. 

  174.             ;;
    175. 

  175.         esac
    176. 

  176.         newparamvalues="`getlinesfromfile $newparamfile | sed -e 's/.*=[ ]*//' -e 's/,/ /g'`"
    177. 

  177.         newstring=
    178. 

  178.         for newparamvalue in $newparamvalues; do
    179. 

  179.             newstring="${newstring}$newparam $newparamvalue,"
    180. 

  180.         done
    181. 

  181.         replacements="$replacements;s/$oldparam/$newstring/"
    182. 

  182.     done
    183. 

  183.     echo -n "$param = "
    184. 

  184.     catfirstfile "$param" | sed 's/#.*//' | tr '\n' ',' | sed -e 's/^[,     ]*//;s/[,   ]\+/,/g' -e 's/\^/ /g' -e "s/,\$//$replacements"
    185. 

  185. }
    186. 

  186. 

  187. _postconf() {
    188. 

  188.     postconf -c "$tempdir" "$1" "$(echo "$2" | tr '\n' ' ')"
    189. 

  189. }
    190. 

  190. 

  191. postmapfiles=
    192. 

  192. 

  193. tempdir="$(mktemp -td postfix.XXXXXX)"
    194. 

  194. cp -a -t "$tempdir" "$confdir"/*
    195. 

  195. 

  196. # Inspired by D. J. Bernstein: http://cr.yp.to/smtp/greeting.html
    197. 

  197. _postconf -e 'smtpd_banner = $myhostname NO UCE ESMTP $mail_name (Debian/GNU)'
    198. 

  198. 

  199. # Some badly configured setup use hostname instead of FQDN
    200. 

  200. # Disable completely: Effective, but hurts executive type guys using windows servers... :-(
    201. 

  201. #if _postconf myhostname | grep -q '\.'; then
    202. 

  202. #   _postconf -e 'smtpd_helo_required = yes'
    203. 

  203. #fi
    204. 

  204. _postconf -e 'smtpd_helo_required = no'
    205. 

  205. _postconf -e "`getlinesfromfile permit_mx_backup_networks`"
    206. 

  206. _postconf -e "maps_rbl_domains ="
    207. 

  207. _postconf -e "`getlinesfromfile smtpd_client_restrictions reject_rhsbl_client`"
    208. 

  208. _postconf -e "`getlinesfromfile smtpd_helo_restrictions`"
    209. 

  209. _postconf -e "`getlinesfromfile smtpd_sender_restrictions reject_rhsbl_sender ${dkimproxy:-sender_access_regex=}`"
    210. 

  210. _postconf -e "`getlinesfromfile smtpd_recipient_restrictions reject_maps_rbl=reject_rbl_client=maps_rbl_domains`"
    211. 

  211. _postconf -e "`getlinesfromfile smtpd_data_restrictions`"
    212. 

  212. 

  213. # FIXME: clear only specific line (not whole file) when dkimproxy unused
    214. 

  214. if [ -f "$tempdir/sender_access_regex" ]; then
    215. 

  215.     if [ -n "$dkimproxy" ]; then
    216. 

  216.         grep -q -F '/^/  FILTER dkimsign:[127.0.0.1]:10026' "$tempdir/sender_access_regex" \
    217. 

  217.         || echo '/^/  FILTER dkimsign:[127.0.0.1]:10026' >> "$tempdir/sender_access_regex"
    218. 

  218.     else
    219. 

  219.         if grep -q -F '/^/  FILTER dkimsign:[127.0.0.1]:10026' "$tempdir/sender_access_regex"; then
    220. 

  220.             echo "echo '' > \"$confdir/sender_access_regex\"" >> "$tempdir/COMMANDS"
    221. 

  221.             rm "$tempdir/sender_access_regex"
    222. 

  222.         fi
    223. 

  223.     fi
    224. 

  224.     postmapfiles="$postmapfiles sender_access_regex"
    225. 

  225. fi
    226. 

  226. 

  227. # Support exceptions to default response
    228. 

  228. # (Day Old Bread (dob) lists need to reject only temporarily)
    229. 

  229. _postconf -e "rbl_reply_maps = hash:$confdir/rbl_reply_map"
    230. 

  230. cat /etc/local-COMMON/postfix/rbl_reply_map \
    231. 

  231.     | sed 's/#.*//' \
    232. 

  232.     > "$tempdir/rbl_reply_map"
    233. 

  233. postmapfiles="$postmapfiles rbl_reply_map"
    234. 

  234. 

  235. # Verify senders of common suspicious and known verifiable domains
    236. 

  236. # (exclude verification of postmaster@ to not verify verification probes)
    237. 

  237. # (add own domains before peers for (rare) cases of duplicates)
    238. 

  238. # FIXME: somehow do this step only if enabled in smtpd_sender_restrictions
    239. 

  239. # TODO: Properly implement exception exclusion like yahoo (which does not want to be checked any longer!)
    240. 

  240. cat /etc/local-COMMON/postfix/maildomains | grep -v yahoo | sort | sed 's/$/    reject_unverified_sender/' > "$tempdir/sender_access"
    241. 

  241. ( catfilefromownrealm maildomains | sort; catallfilesfromotherrealms maildomains | sort ) \
    242. 

  242.     | sed 's/\(.*\)$/postmaster@\1  permit\n\1  reject_unverified_sender/' >> "$tempdir/sender_access"
    243. 

  243. [ ! -f "$tempdir/sender_access.addon" ] || cat "$tempdir/sender_access.addon" >> "$tempdir/sender_access"
    244. 

  244. postmapfiles="$postmapfiles sender_access"
    245. 

  245. _postconf -e "unverified_sender_reject_code = 550"
    246. 

  246. 

  247. # Trust recipient verification too
    248. 

  248. _postconf -e "unverified_recipient_reject_code = 550"
    249. 

  249. 

  250. if [ -n "$dovecot_lmtp" ]; then
    251. 

  251.     _postconf -e mailbox_transport=lmtp:unix:private/dovecot-lmtp
    252. 

  252.     _postconf -X mailbox_command
    253. 

  253. elif [ -n "$dovecot_deliver" ]; then
    254. 

  254.     _postconf -X mailbox_transport
    255. 

  255.     _postconf -e mailbox_command=/usr/lib/dovecot/deliver
    256. 

  256. else
    257. 

  257.     _postconf -X mailbox_transport
    258. 

  258.     _postconf -X mailbox_command
    259. 

  259. fi
    260. 

  260. 

  261. # outbound opportunistic encryption
    262. 

  262. _postconf -e smtp_tls_security_level=may
    263. 

  263. _postconf -e smtp_tls_cert_file=/etc/ssl/certs/postfix.pem
    264. 

  264. _postconf -e smtp_tls_key_file=/etc/ssl/private/postfix.pem
    265. 

  265. _postconf -e smtp_tls_loglevel=1
    266. 

  266. 

  267. # Force TLS towards peers
    268. 

  268. catallfilesfromotherrealms mailhost | sort | sed 's/^/[/;s/$/]:submission   secure/' > "$tempdir/tls_policy"
    269. 

  269. [ ! -f "$tempdir/tls_policy.addon" ] || cat "$tempdir/tls_policy.addon" >> "$tempdir/tls_policy"
    270. 

  270. postmapfiles="$postmapfiles tls_policy"
    271. 

  271. _postconf -e smtp_tls_policy_maps="hash:$confdir/tls_policy"
    272. 

  272. 

  273. # inbound opportunistic encryption
    274. 

  274. if [ -n "$tls_cert" ]; then
    275. 

  275.     _postconf -e smtpd_tls_security_level=may
    276. 

  276.     _postconf -e 'smtpd_tls_cert_file = /etc/ssl/certs/postfix.pem'
    277. 

  277.     _postconf -e 'smtpd_tls_key_file = /etc/ssl/private/postfix.pem'
    278. 

  278.     _postconf -e 'smtpd_tls_loglevel = 1'
    279. 

  279.     _postconf -e 'smtpd_tls_auth_only = yes'
    280. 

  280.     _postconf -e 'smtpd_tls_received_header = yes'
    281. 

  281. else
    282. 

  282.     _postconf -e smtpd_tls_security_level=none
    283. 

  283.     _postconf -X smtpd_tls_cert_file
    284. 

  284.     _postconf -X smtpd_tls_key_file
    285. 

  285.     _postconf -X smtpd_tls_loglevel
    286. 

  286.     _postconf -X smtpd_tls_auth_only
    287. 

  287.     _postconf -X smtpd_tls_received_header
    288. 

  288. fi
    289. 

  289. # Avoid smtpd_tls_CApath or smtpd_tls_CAfile to trick outlook.com
    290. 

  290. # See <http://postfix.1071664.n5.nabble.com/Problems-with-incoming-mails-from-outlook-com-td78356.html>
    291. 

  291. _postconf -X smtpd_tls_CApath
    292. 

  292. _postconf -X smtpd_tls_CAfile
    293. 

  293. 

  294. # obsolete TLS-related settings
    295. 

  295. _postconf -X smtpd_use_tls
    296. 

  296. _postconf -X smtp_tls_CApath
    297. 

  297. _postconf -X lmtp_tls_CApath
    298. 

  298. _postconf -X smtp_tls_CAfile
    299. 

  299. _postconf -X lmtp_tls_CAfile
    300. 

  300. _postconf -X smtpd_tls_ask_ccert
    301. 

  301. _postconf -X smtp_tls_note_starttls_offer
    302. 

  302. _postconf -X smtpd_tls_session_cache_database
    303. 

  303. _postconf -X smtpd_tls_session_cache_timeout
    304. 

  304. _postconf -X smtp_tls_session_cache_database
    305. 

  305. _postconf -X tls_random_exchange_name
    306. 

  306. _postconf -X tls_random_source
    307. 

  307. 

  308. # submission
    309. 

  309. # <http://www.postfix.org/SASL_README.html>
    310. 

  310. # <https://doc.dovecot.org/configuration_manual/howto/postfix_and_dovecot_sasl/#using-sasl-with-postfix-submission-port>
    311. 

  311. if [ -n "$submission" ]; then
    312. 

  312.     _postconf -Me submission/inet='
    313. 

  313. submission inet n   -   y   -   -   smtpd
    314. 

  314.     -o syslog_name=postfix/$service_name
    315. 

  315.     -o smtpd_tls_security_level=encrypt
    316. 

  316. '
    317. 

  317.     _postconf -Me smtps/inet='
    318. 

  318. smtps inet  n   -   y   -   -   smtpd
    319. 

  319.     -o syslog_name=postfix/$service_name
    320. 

  320.     -o smtpd_tls_wrappermode=yes
    321. 

  321.     -o smtpd_sasl_auth_enable=yes
    322. 

  322. '
    323. 

  323.     if [ -n "$sasl_inbound" ]; then
    324. 

  324.         _postconf -Pe submission/inet/smtpd_sasl_auth_enable=yes
    325. 

  325.         _postconf -Pe smtps/inet/smtpd_sasl_auth_enable=yes
    326. 

  326.     else
    327. 

  327.         _postconf -PX submission/inet/smtpd_sasl_auth_enable
    328. 

  328.         _postconf -PX smtps/inet/smtpd_sasl_auth_enable
    329. 

  329.     fi
    330. 

  330. else
    331. 

  331.     _postconf -MX submission/inet
    332. 

  332.     _postconf -MX smtps/inet
    333. 

  333. fi
    334. 

  334. if [ -n "$sasl_inbound" ]; then
    335. 

  335.     _postconf -e smtpd_sasl_local_domain='$mydomain'
    336. 

  336.     _postconf -e smtpd_sasl_type=dovecot
    337. 

  337.     _postconf -e smtpd_sasl_path=private/auth
    338. 

  338.     _postconf -e broken_sasl_auth_clients=yes
    339. 

  339. else
    340. 

  340.     _postconf -X smtpd_sasl_local_domain
    341. 

  341.     _postconf -X smtpd_sasl_type
    342. 

  342.     _postconf -X smtpd_sasl_path
    343. 

  343.     _postconf -X broken_sasl_auth_clients
    344. 

  344. fi
    345. 

  345. 

  346. # obsolete SASL-related settings
    347. 

  347. _postconf -X smtpd_sasl_auth_enable
    348. 

  348. _postconf -X smtpd_sasl_security_options
    349. 

  349. 

  350. if [ -n "$amavis" ]; then
    351. 

  351.     amavis_maxproc=$(getperlvarfromfile max_servers "$default_amavis_maxproc" amavisd.conf.addon amavis)
    352. 

  352.     _postconf -Me amavisfeed/unix="
    353. 

  353. amavisfeed unix -   -   n   -   $amavis_maxproc lmtp
    354. 

  354.     -o lmtp_data_done_timeout=1200s
    355. 

  355.     -o lmtp_send_xforward_command=yes
    356. 

  356.     -o disable_dns_lookups=yes
    357. 

  357.     -o max_use=$amavis_maxproc
    358. 

  358. "
    359. 

  359.     _postconf -Me 127.0.0.1:10025/inet='
    360. 

  360. 127.0.0.1:10025 inet n  -   n   -   -   smtpd
    361. 

  361.     -o content_filter=
    362. 

  362.     -o local_recipient_maps=
    363. 

  363.     -o relay_recipient_maps=
    364. 

  364.     -o smtpd_restriction_classes=
    365. 

  365.     -o smtpd_delay_reject=no
    366. 

  366.     -o smtpd_client_restrictions=permit_mynetworks,reject
    367. 

  367.     -o smtpd_helo_restrictions=
    368. 

  368.     -o smtpd_sender_restrictions=
    369. 

  369.     -o smtpd_recipient_restrictions=permit_mynetworks,reject
    370. 

  370.     -o smtpd_data_restrictions=reject_unauth_pipelining
    371. 

  371.     -o smtpd_end_of_data_restrictions=
    372. 

  372.     -o mynetworks=127.0.0.0/8
    373. 

  373.     -o smtpd_error_sleep_time=0
    374. 

  374.     -o smtpd_soft_error_limit=1001
    375. 

  375.     -o smtpd_hard_error_limit=1000
    376. 

  376.     -o smtpd_client_connection_count_limit=0
    377. 

  377.     -o smtpd_client_connection_rate_limit=0
    378. 

  378.     -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks,no_milters
    379. 

  379. '
    380. 

  380.     _postconf -e receive_override_options=no_address_mappings
    381. 

  381.     if [ -n "$dkimproxy" ]; then
    382. 

  382.         _postconf -e 'content_filter = amavisfeed:[127.0.0.1]:10028'
    383. 

  383.         _postconf -Pe pickup/fifo/content_filter=dkimsign:127.0.0.1:10028
    384. 

  384.         if [ -n "$submission" ]; then
    385. 

  385.             _postconf -Pe submission/inet/content_filter='dkimsign:[127.0.0.1]:10028'
    386. 

  386.             _postconf -Pe smtps/inet/content_filter='dkimsign:[127.0.0.1]:10028'
    387. 

  387.         fi
    388. 

  388.         _postconf -Me dkimsign/unix="
    389. 

  389. dkimsign unix   -   -   n   -   $dkimproxy_maxproc_out  smtp
    390. 

  390.     -o smtp_send_xforward_command=yes
    391. 

  391.     -o smtp_discard_ehlo_keywords=8bitmime,starttls
    392. 

  392. "
    393. 

  393.         _postconf -Me 127.0.0.1:10029/inet='
    394. 

  394. 127.0.0.1:10029 inet n  -   n   -   -   smtpd
    395. 

  395.     -o content_filter=
    396. 

  396.     -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks,no_milters
    397. 

  397.     -o smtpd_helo_restrictions=
    398. 

  398.     -o smtpd_client_restrictions=
    399. 

  399.     -o smtpd_sender_restrictions=
    400. 

  400.     -o smtpd_recipient_restrictions=permit_mynetworks,reject
    401. 

  401.     -o mynetworks=127.0.0.0/8
    402. 

  402.     -o smtpd_authorized_xforward_hosts=127.0.0.0/8
    403. 

  403. '
    404. 

  404.     else
    405. 

  405.         _postconf -MX dkimsign/unix
    406. 

  406.         _postconf -MX 127.0.0.1:10029/inet
    407. 

  407.         _postconf -e 'content_filter = amavisfeed:[127.0.0.1]:10024'
    408. 

  408.         _postconf -PX pickup/fifo/content_filter
    409. 

  409.         if [ -n "$submission" ]; then
    410. 

  410.             _postconf -PX submission/inet/content_filter
    411. 

  411.             _postconf -PX smtps/inet/content_filter
    412. 

  412.         fi
    413. 

  413.     fi
    414. 

  414. else
    415. 

  415.     _postconf -MX amavisfeed/unix
    416. 

  416.     _postconf -MX 127.0.0.1:10025/inet
    417. 

  417.     _postconf -X content_filter
    418. 

  418.     _postconf -X receive_override_options
    419. 

  419. fi
    420. 

  420. 

  421. # obsolete settings
    422. 

  422. _postconf -X max_use
    423. 

  423. _postconf -MX smtp-amavis/unix
    424. 

  424. 

  425. diff -ruNw "$confdir" "$tempdir" || if [ $? -gt 1 ]; then exit $?; else needs_reload="1"; fi
    426. 

  426. 

  427. if [ "$force" = "1" ]; then
    428. 

  428.     do_update="y"
    429. 

  429. elif [ "1" = "$needs_reload" ]; then
    430. 

  430.     echo -n "Above is the intended changes. OK to update (y/N)? "
    431. 

  431.     read do_update
    432. 

  432. fi
    433. 

  433. case $do_update in
    434. 

  434.     y|Y)
    435. 

  435.     if [ -f "$tempdir/COMMANDS" ]; then
    436. 

  436.         cat "$tempdir/COMMANDS" | sh -s
    437. 

  437.     fi
    438. 

  438.     rm -f "$tempdir/COMMANDS"
    439. 

  439. 

  440.     diff -q "$confdir/master.cf" "$tempdir/master.cf" || if [ $? -gt 1 ]; then exit $?; else needs_restart="1"; fi
    441. 

  441. 

  442.     cp -a -f -t "$confdir" "$tempdir"/*
    443. 

  443.     rm -rf "$tempdir"
    444. 

  444. 

  445.     for file in $postmapfiles; do
    446. 

  446.         postmap "$confdir/$file"
    447. 

  447.     done
    448. 

  448. 

  449.     if [ "1" = "$needs_restart" ]; then
    450. 

  450.         service postfix restart
    451. 

  451.     else
    452. 

  452.         service postfix force-reload
    453. 

  453.     fi
    454. 

  454. 

  455.     if [ "1" = "$needs_reload" ]; then
    456. 

  456.         echo >&2 "Changes applied!"
    457. 

  457.     fi
    458. 

  458.     ;;
    459. 

  459.     *)
    460. 

  460.     if [ "1" = "$needs_reload" ]; then
    461. 

  461.         exit1 "Aborted!"
    462. 

  462.     fi
    463. 

  463.     ;;
    464. 

  464. esac
    465. 

  465. 

  466. if [ "1" != "$needs_reload" ]; then
    467. 

  467.     echo >&2 "No changes needed!"
    468. 

  468. fi
    469. 

  469. 

  470. # Based on this: http://jimsun.linxnet.com/misc/postfix-anti-UCE.txt
    471. 

  471. # Support for trusted MX backup networks added
    472. 

  472. # PCRE stuff avoided, as PCRE is only optional on newest Debian packages
    473. 

  473. # RBLs replaced with those recommended by http://www.antispews.org/
    474. 

  474. # spam filter based on these: http://www.postfix.org/FILTER_README.html
    475. 

  475. #   https://www.ijs.si/software/amavisd/amavisd-new-docs.html
    476. 

  476. # TLS based on this: http://www.postfix.org/TLS_README.html
    477. 

  477. 

  478. # Here's a convenient overview of different blackholes:
    479. 

  479. #   http://rbls.org/
    480.
generated by cgit v1.2.3 (git 2.39.1) at 2024-05-29 10:10:28 +0000