diff options
| -rwxr-xr-x | postfix/postfix.sh | 105 |
1 files changed, 54 insertions, 51 deletions
diff --git a/postfix/postfix.sh b/postfix/postfix.sh index 78eed19..1160f76 100755 --- a/postfix/postfix.sh +++ b/postfix/postfix.sh @@ -29,16 +29,6 @@ exit1() { exit 1 } -# Favor specific CA for our own server and client certificates -# (comment out to trust any CA) -#cacert_smtpd="/etc/ssl/certs/cacert.org.pem" -cacert_smtp= -cacert_lmtp= - -# File containing all trusted CA certificates -# (comment out if no chroot or it contains all individual files) -cacert_default="/etc/ssl/certs/ca-certificates.crt" - realmsdir='/etc/local-REDPILL' configdirs='/etc/local /etc/local-ORG /etc/local-REDPILL /etc/local-COMMON' confdir='/etc/postfix' @@ -70,14 +60,14 @@ if [ -x /usr/sbin/dovecot ]; then else warn "Dovecot missing - (Debian package dovecot-core or dovecot)." fi -sslcert= -if [ -f /etc/ssl/certs/postfix.pem ]; then - sslcert=1 +tls_cert= +if [ -f /etc/ssl/certs/postfix.pem ] && [ -f /etc/ssl/private/postfix.pem ]; then + tls_cert=1 else - warn "No TLS encryption - requires SSL certificate at /etc/ssl/certs/postfix.pem." + warn "No TLS encryption - requires SSL certificate at /etc/ssl/certs/postfix.pem and private key at /etc/ssl/private/postfix.pem." fi sasl= -if [ -n "$sslcert" ] && [ -n "$dovecot" ]; then +if [ -n "$tls_cert" ] && [ -n "$dovecot" ]; then sasl=1 else warn "No SASL authentication - requires TLS encryption and Dovecot." @@ -272,54 +262,66 @@ else $postconf -c "$tempdir" -X mailbox_transport $postconf -c "$tempdir" -X mailbox_command fi -if [ -n "$sasl" ]; then - $postconf -c "$tempdir" -e smtpd_sasl_type=dovecot - $postconf -c "$tempdir" -e smtpd_sasl_path=private/auth -fi -if [ -n "$sslcert" ]; then + +# outbound opportunistic encryption +$postconf -c "$tempdir" -e smtp_tls_security_level=may +$postconf -c "$tempdir" -e smtp_tls_cert_file=/etc/ssl/certs/postfix.pem +$postconf -c "$tempdir" -e smtp_tls_key_file=/etc/ssl/private/postfix.pem +$postconf -c "$tempdir" -e smtp_tls_loglevel=1 + +# Force TLS towards peers +catallfilesfromotherrealms mailhost | sort | sed 's/^/[/;s/$/]:submission secure/' > "$tempdir/tls_policy" +[ ! -f "$tempdir/tls_policy.addon" ] || cat "$tempdir/tls_policy.addon" >> "$tempdir/tls_policy" +postmapfiles="$postmapfiles tls_policy" +$postconf -c "$tempdir" -e smtp_tls_policy_maps="hash:$confdir/tls_policy" + +# inbound opportunistic encryption +if [ -n "$tls_cert" ]; then + $postconf -c "$tempdir" -e smtpd_tls_security_level=may $postconf -c "$tempdir" -e 'smtpd_tls_cert_file = /etc/ssl/certs/postfix.pem' + $postconf -c "$tempdir" -e 'smtpd_tls_key_file = /etc/ssl/private/postfix.pem' $postconf -c "$tempdir" -e 'smtpd_tls_loglevel = 1' - $postconf -c "$tempdir" -e 'smtpd_use_tls = yes' - $postconf -c "$tempdir" -e 'smtp_tls_CApath = /etc/ssl/certs' - $postconf -c "$tempdir" -e 'lmtp_tls_CApath = /etc/ssl/certs' - $postconf -c "$tempdir" -e smtp_tls_CAfile="${cacert_smtp:-$cacert_default}" - $postconf -c "$tempdir" -e lmtp_tls_CAfile="${cacert_lmtp:-$cacert_default}" - $postconf -c "$tempdir" -e 'smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache' - $postconf -c "$tempdir" -e 'smtpd_tls_session_cache_timeout = 3600s' - $postconf -c "$tempdir" -e 'tls_random_exchange_name = ${data_directory}/prng_exch' $postconf -c "$tempdir" -e 'smtpd_tls_auth_only = yes' - $postconf -c "$tempdir" -e 'smtpd_sasl_auth_enable = no' # SASL is enabled explicitly with TLS transport - $postconf -c "$tempdir" -e 'smtpd_sasl_security_options = noanonymous' $postconf -c "$tempdir" -e 'smtpd_tls_received_header = yes' - $postconf -c "$tempdir" -e 'broken_sasl_auth_clients = yes' - $postconf -c "$tempdir" -e 'tls_random_source = dev:/dev/urandom' - # Accepting client certificates breaks SMTP AUTH on OutLook Express on Mac (Classic) - $postconf -c "$tempdir" -e 'smtpd_tls_ask_ccert = no' - if [ -e /etc/ssl/private/postfix.pem ]; then - $postconf -c "$tempdir" -e 'smtpd_tls_key_file = /etc/ssl/private/postfix.pem' - # Enable client side TLS only when private certificate is present - $postconf -c "$tempdir" -e 'smtp_tls_cert_file = /etc/ssl/certs/postfix.pem' - $postconf -c "$tempdir" -e 'smtp_tls_key_file = /etc/ssl/private/postfix.pem' - $postconf -c "$tempdir" -e 'smtp_tls_loglevel = 1' - $postconf -c "$tempdir" -e 'smtp_use_tls = yes' - $postconf -c "$tempdir" -e 'smtp_tls_note_starttls_offer = no' # Enable to collect info for smtp_tls_per_site option - $postconf -c "$tempdir" -e 'smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache' - # Force using TLS for peers - catallfilesfromotherrealms mailhost | sort | sed 's/^/[/;s/$/]:submission secure/' > "$tempdir/tls_policy" - [ ! -f "$tempdir/tls_policy.addon" ] || cat "$tempdir/tls_policy.addon" >> "$tempdir/tls_policy" - postmapfiles="$postmapfiles tls_policy" - $postconf -c "$tempdir" -e "smtp_tls_policy_maps = hash:$confdir/tls_policy" + if [ -n "$sasl" ]; then + $postconf -c "$tempdir" -e smtpd_sasl_type=dovecot + $postconf -c "$tempdir" -e smtpd_sasl_path=private/auth + $postconf -c "$tempdir" -e broken_sasl_auth_clients=yes else - $postconf -c "$tempdir" -e 'smtp_use_tls = no' - warn "No client-side TLS - requires private SSL certificate at /etc/ssl/private/postfix.pem." + $postconf -c "$tempdir" -X smtpd_sasl_type + $postconf -c "$tempdir" -X smtpd_sasl_path + $postconf -c "$tempdir" -X broken_sasl_auth_clients fi +else + $postconf -c "$tempdir" -e smtpd_tls_security_level=none + $postconf -c "$tempdir" -X smtpd_tls_cert_file + $postconf -c "$tempdir" -X smtpd_tls_key_file + $postconf -c "$tempdir" -X smtpd_tls_loglevel + $postconf -c "$tempdir" -X smtpd_tls_auth_only + $postconf -c "$tempdir" -X smtpd_tls_received_header fi -$postconf -c "$tempdir" -X smtpd_sasl_local_domain # Avoid smtpd_tls_CApath or smtpd_tls_CAfile to trick outlook.com # See <http://postfix.1071664.n5.nabble.com/Problems-with-incoming-mails-from-outlook-com-td78356.html> $postconf -c "$tempdir" -X smtpd_tls_CApath $postconf -c "$tempdir" -X smtpd_tls_CAfile +# obsolete TLS-related settings +$postconf -c "$tempdir" -X smtpd_use_tls +$postconf -c "$tempdir" -X smtp_tls_CApath +$postconf -c "$tempdir" -X lmtp_tls_CApath +$postconf -c "$tempdir" -X smtp_tls_CAfile +$postconf -c "$tempdir" -X lmtp_tls_CAfile +$postconf -c "$tempdir" -X smtpd_sasl_auth_enable +$postconf -c "$tempdir" -X smtpd_sasl_security_options +$postconf -c "$tempdir" -X smtpd_tls_ask_ccert +$postconf -c "$tempdir" -X smtp_tls_note_starttls_offer +$postconf -c "$tempdir" -X smtpd_sasl_local_domain +$postconf -c "$tempdir" -X smtpd_tls_session_cache_database +$postconf -c "$tempdir" -X smtpd_tls_session_cache_timeout +$postconf -c "$tempdir" -X smtp_tls_session_cache_database +$postconf -c "$tempdir" -X tls_random_exchange_name +$postconf -c "$tempdir" -X tls_random_source + if [ -n "$amavis" ]; then $postconf -c "$tempdir" -e 'max_use = 10' # Avoid too much reuse amavis_maxproc=$(getperlvarfromfile max_servers "$default_amavis_maxproc" amavisd.conf.addon amavis) @@ -454,6 +456,7 @@ fi # spam filter based on these: http://www.postfix.org/FILTER_README.html # https://www.ijs.si/software/amavisd/amavisd-new-docs.html # AUTH-SMTP based on this: http://www.postfix.org/SASL_README.html +# TLS based on this: http://www.postfix.org/TLS_README.html # Here's a convenient overview of different blackholes: # http://rbls.org/ |