infra/ansible-role-postfix
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

WIP: configure postfix to use SASL to auth senders

Browse source
This commit is contained in:
Morre 2020-07-05 16:44:54 +02:00
parent 1ce9ef9640
commit c08931882a
No known key found for this signature in database
GPG key ID: 5D9B9B1B8F424BBC
12 changed files with 147 additions and 39 deletions
Download patch file Download diff file Expand all files Collapse all files

61
templates/main.cf.j2
View file

@ -47,8 +47,6 @@ relayhost = {{ postfix.relayhost }}
relay_domains = {{ postfix.relay_domains|join(', ') }}
relay_transport = {{ postfix.relay_transport }}
sender_dependent_relayhost_maps = {{ postfix.sender_dependent_relayhost_maps }}
virtual_alias_maps = {{ postfix.virtual_alias_maps }}
virtual_mailbox_domains = {{ postfix.virtual_mailbox_domains|join(' ') }}
mailbox_size_limit = 0
recipient_delimiter = +
@ -69,11 +67,64 @@ dovecot_destination_recipient_limit = 1
virtual_transport = dovecot
{% endif %}
# Virtual maps
virtual_alias_maps = {{ postfix.virtual_alias_maps }}
virtual_mailbox_domains = {{ postfix.virtual_mailbox_domains|join(' ') }}
{% if postfix.ldap.enable %}
# LDAP config
smtpd_sender_login_maps = ldap:/etc/postfix/virtual-senders.cf
virtual_mailbox_maps = ldap:/etc/postfix/virtual-recipients.cf
local_recipient_maps = $virtual_mailbox_maps
## Virtual maps
# virtual_mailbox_maps = ldap:/etc/postfix/ldap/virtual_mailboxes.cf
# virtual_mailbox_base = /home/vmail
# virtual_uid_maps = ldap:/etc/postfix/ldap/virtual_uid.cf # TODO: Do we need this?
# virtual_gid_maps = ldap:/etc/postfix/ldap/virtual_gid.cf # TODO: Do we need this?
# virtual_uid_maps = static:{{ vmail_user.uid }}
# virtual_gid_maps = static:{{ vmail_user.group }}
## Transport maps
### None so far
# TLS
# TODO: This is already enabled when using dovecot as transport
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
# Restrictions
smtpd_helo_required = yes
strict_rfc821_envelopes = yes
disable_vrfy_command = yes
smtpd_helo_restrictions = permit_mynetworks,
permit_sasl_authenticated,
reject_invalid_hostname,
reject_invalid_helo_hostname,
reject_non_fqdn_helo_hostname
# TODO: This is already enabled when using dovecot as transport
smtpd_sender_restrictions = reject_non_fqdn_sender,
reject_unknown_sender_domain,
permit_mynetworks,
permit_sasl_authenticated
# TODO: This is already enabled when using dovecot as transport
smtpd_recipient_restrictions = permit_mynetworks,
permit_sasl_authenticated,
reject_unlisted_sender,
reject_unlisted_recipient,
reject_unknown_sender_domain,
reject_unknown_recipient_domain,
reject_invalid_hostname,
reject_unauth_destination,
reject_non_fqdn_hostname,
reject_non_fqdn_sender,
reject_non_fqdn_recipient,
permit
smtpd_client_restrictions = permit_mynetworks,
permit_sasl_authenticated,
permit
{% endif %}
# opendkim

10
templates/saslauthd.conf.j2 Normal file
View file

@ -0,0 +1,10 @@
{% if postfix.ldap.enable %}
ldap_servers: {{ postfix.ldap.server.host }}
ldap_version: 3
ldap_search_base: {{ postfix.ldap.search_base }}
ldap_scope: sub
ldap_filter: mail=%u
ldap_auth_method: bind
{% else %}
# LDAP is not configured for this server.
{% endif %}

9
templates/virtual-aliases.cf.j2 Normal file
View file

@ -0,0 +1,9 @@
{% if postfix.ldap.enable %}
server_host = {{ postfix.ldap.server.host }}
server_port = {{ postfix.ldap.server.port }}
search_base = {{ postfix.ldap.search_base }}
query_filter = {{ postfix.ldap.query_filter }}
result_attribute = {{ postfix.ldap.result_attributes.aliases }}
{% else %}
# LDAP is not configured for this server.
{% endif %}

9
templates/virtual-mailboxes.cf.j2 Normal file
View file

@ -0,0 +1,9 @@
{% if postfix.ldap.enable %}
server_host = {{ postfix.ldap.server.host }}
server_port = {{ postfix.ldap.server.port }}
search_base = {{ postfix.ldap.search_base }}
query_filter = {{ postfix.ldap.query_filter }}
result_attribute = {{ postfix.ldap.result_attributes.mailboxes }}
{% else %}
# LDAP is not configured for this server.
{% endif %}

12
templates/virtual-recipients.cf.j2
View file

@ -1,12 +0,0 @@
{% if postfix.ldap.enable %}
bind = yes
# bind_dn =
# bind_pw =
server_host = {{ postfix.ldap.server_host }}
search_base = {{ postfix.ldap.recipients.search_base }}
query_filter = {{ postfix.ldap.recipients.query_filter }}
result_attribute = cn
result_format =%s
{% else %}
# LDAP is not configured for this server.
{% endif %}

11
templates/virtual-senders.cf.j2
View file

@ -1,11 +0,0 @@
{% if postfix.ldap.enable %}
bind = yes
# bind_dn =
# bind_pw =
server_host = {{ postfix.ldap.server_host }}
search_base = {{ postfix.ldap.senders.search_base }}
query_filter = {{ postfix.ldap.senders.query_filter }}
result_attribute = uid
{% else %}
# LDAP is not configured for this server.
{% endif %}