Add mail roles
This commit is contained in:
parent
fe3b41e057
commit
d01e99c3da
|
|
@ -0,0 +1,37 @@
|
|||
---
|
||||
# Default configurations
|
||||
# I populate these from external configs; I indicate what they are as inline comments
|
||||
|
||||
domain: "{{ blsedomains_admindomain }}" # Base domain name
|
||||
postmaster: "root@{{ blsedomains_rootdomain }}" # Postmaster email address
|
||||
|
||||
# Roundcube
|
||||
smtp_host: "{{ blsecluster_smtphost }}" # The hostname for SMTP access, usually the public name of your mail server
|
||||
support_url: "https://www.{{ blsedomains_webdomain }}" # Some website address for Roundcube support
|
||||
logo_filename: "bl-logo-roundcube.png" # The Roundcube logo under files/
|
||||
roundcube_deskey: "{{ passwd_roundcube_deskey }}" # The Roundcube DES key
|
||||
|
||||
# Postfix
|
||||
banner_hostname: "{{ ansible_hostname }}.{{ domain }}" # Public hostname of *this* mail host
|
||||
myhostname: "{{ banner_hostname }}" # Hostname for Postfix myhostame
|
||||
mydomain: "{{ domain }}" # Domain for Postfix mydomain
|
||||
mynetworks: "{{ blsecluster_remote1v4 }} {{ blsecluster_remote2v4 }} {{ blsecluster_remote3v4 }} {{ blsecluster_hostsubnetv4 }}" # IP addresses for Postfix mynetworks
|
||||
|
||||
# Dovecot
|
||||
# Note: SSL listeners aren't provided; HAProxy is expected to do SSL termination for us
|
||||
trusted_networks: "{{ blsecluster_hostsubnetv4 }} {{ blsecluster_hostsubnetv6 }}" # Trusted network ranges for Dovecot
|
||||
haproxy: yes # Enable HAProxy-specific (Proxy protocol) listeners on ports 10143 and 10110
|
||||
|
||||
# LDAP integration (Postfix, Dovecot, Roundcube)
|
||||
ldap_host: "{{ blsecluster_ldaphost }}" # The hostname for LDAP access
|
||||
ldap_port: 389 # The LDAP port (always non-SSL)
|
||||
ldap_basedn: "o=domains,dc=bonilan,dc=net" # The LDAP base DN
|
||||
ldap_bind_username: "{{ username_ldap_admin }}" # The LDAP bind user name (usually cn=admin)
|
||||
ldap_bind_password: "{{ passwd_ldap_admin }}" # The LDAP bind user password
|
||||
|
||||
# MySQL integration (Roundcube)
|
||||
mysql_host: "{{ blsecluster_sqlhost }}" # The hostname for MySQL access
|
||||
mysql_port: "{{ mysql_client['mail'].port }}" # The port for MySQL access
|
||||
mysql_database: "{{ mysql_client['mail'].database }}" # The database name
|
||||
mysql_username: "{{ mysql_client['mail'].username }}" # The database user
|
||||
mysql_password: "{{ mysql_client['mail'].passwd }}" # The database password
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 6.4 KiB |
|
|
@ -0,0 +1,23 @@
|
|||
---
|
||||
- name: postmap transport
|
||||
command: "postmap /etc/postfix/transport"
|
||||
- name: restart amavis
|
||||
service:
|
||||
name: "amavis"
|
||||
state: "restarted"
|
||||
- name: restart saslauthd
|
||||
service:
|
||||
name: "saslauthd"
|
||||
state: "restarted"
|
||||
- name: restart postfix
|
||||
service:
|
||||
name: "postfix"
|
||||
state: "restarted"
|
||||
- name: restart dovecot
|
||||
service:
|
||||
name: "dovecot"
|
||||
state: "restarted"
|
||||
- name: restart apache2
|
||||
service:
|
||||
name: "apache2"
|
||||
state: "restarted"
|
||||
|
|
@ -0,0 +1,222 @@
|
|||
---
|
||||
- name: install filtering packages and monitoring components
|
||||
apt:
|
||||
name:
|
||||
- postfix
|
||||
- postfix-ldap
|
||||
- postfix-pcre
|
||||
- dovecot-core
|
||||
- dovecot-imapd
|
||||
- dovecot-pop3d
|
||||
- dovecot-lmtpd
|
||||
- dovecot-sieve
|
||||
- dovecot-managesieved
|
||||
- dovecot-ldap
|
||||
- dovecot-mysql
|
||||
- apache2
|
||||
- libapache2-mod-php
|
||||
- roundcube
|
||||
- roundcube-plugins
|
||||
- php-ldap
|
||||
- php-net-sieve
|
||||
- mailgraph
|
||||
- amavis
|
||||
- spamassassin
|
||||
- clamav-daemon
|
||||
- libnet-dns-perl
|
||||
- libmail-spf-perl
|
||||
- pyzor
|
||||
- razor
|
||||
- pfqueue
|
||||
state: latest
|
||||
|
||||
- name: install compression algorithms for scanning
|
||||
apt:
|
||||
name:
|
||||
- p7zip-full
|
||||
- arj
|
||||
- bzip2
|
||||
- cabextract
|
||||
- cpio
|
||||
- file
|
||||
- gzip
|
||||
- lhasa
|
||||
- liblz4-tool
|
||||
- lrzip
|
||||
- lzop
|
||||
- nomarch
|
||||
- pax
|
||||
- rar
|
||||
- rpm
|
||||
- unrar-free
|
||||
- unzip
|
||||
- xz-utils
|
||||
- zip
|
||||
state: latest
|
||||
|
||||
# ClamAV
|
||||
- name: ensure clamav is in amavis group
|
||||
user:
|
||||
name: "clamav"
|
||||
append: "yes"
|
||||
groups: "amavis"
|
||||
|
||||
- name: ensure amavis is in clamav group
|
||||
user:
|
||||
name: "amavis"
|
||||
append: "yes"
|
||||
groups: "clamav"
|
||||
|
||||
# Amavis
|
||||
- name: install Amavis configs
|
||||
template:
|
||||
src: "{{ item }}.j2"
|
||||
dest: "/etc/amavis/conf.d/{{ item }}"
|
||||
notify:
|
||||
- restart amavis
|
||||
with_items:
|
||||
- 15-content_filter_mode
|
||||
- 50-user
|
||||
|
||||
# Postfix
|
||||
- name: install Postfix main configs
|
||||
template:
|
||||
src: "{{ item }}.j2"
|
||||
dest: "/etc/postfix/{{ item }}"
|
||||
notify:
|
||||
- restart postfix
|
||||
with_items:
|
||||
- main.cf
|
||||
- master.cf
|
||||
- helo_access.pcre
|
||||
- transport
|
||||
|
||||
- name: map transport
|
||||
command: postmap /etc/postfix/transport
|
||||
|
||||
- name: create LDAP config dir
|
||||
file:
|
||||
name: "/etc/postfix/ldap"
|
||||
state: "directory"
|
||||
|
||||
- name: install Postfix LDAP configs
|
||||
template:
|
||||
src: "postfix-ldap/{{ item }}.j2"
|
||||
dest: "/etc/postfix/ldap/{{ item }}"
|
||||
mode: "640"
|
||||
group: "postfix"
|
||||
notify:
|
||||
- restart postfix
|
||||
with_items:
|
||||
- catchall_maps.cf
|
||||
- recipient_bcc_maps_domain.cf
|
||||
- recipient_bcc_maps_user.cf
|
||||
- relay_domains.cf
|
||||
- sender_bcc_maps_domain.cf
|
||||
- sender_bcc_maps_user.cf
|
||||
- sender_login_maps.cf
|
||||
- transport_maps_domain.cf
|
||||
- transport_maps_user.cf
|
||||
- virtual_alias_maps.cf
|
||||
- virtual_group_maps.cf
|
||||
- virtual_group_members_maps.cf
|
||||
- virtual_mailbox_domains.cf
|
||||
- virtual_mailbox_maps.cf
|
||||
|
||||
- name: link /etc/mailname to /etc/hostname
|
||||
file:
|
||||
dest: "/etc/mailname"
|
||||
src: "/etc/hostname"
|
||||
state: "link"
|
||||
force: "yes"
|
||||
|
||||
# Dovecot
|
||||
- name: install Dovecot main configs
|
||||
template:
|
||||
src: "{{ item }}.j2"
|
||||
dest: "/etc/dovecot/{{ item }}"
|
||||
notify:
|
||||
- restart dovecot
|
||||
with_items:
|
||||
- dovecot.conf
|
||||
- dovecot-ldap.conf
|
||||
|
||||
- name: add vmail group
|
||||
group:
|
||||
name: "vmail"
|
||||
gid: "2000"
|
||||
state: "present"
|
||||
|
||||
- name: add vmail user
|
||||
user:
|
||||
name: "vmail"
|
||||
home: "/srv/vmail"
|
||||
shell: "/bin/false"
|
||||
uid: "2000"
|
||||
group: "vmail"
|
||||
state: "present"
|
||||
|
||||
- name: ensure log ownership
|
||||
file:
|
||||
dest: "/var/log/{{ item }}"
|
||||
owner: "vmail"
|
||||
group: "adm"
|
||||
mode: "644"
|
||||
state: "touch"
|
||||
with_items:
|
||||
- dovecot.log
|
||||
- dovecot-lmtp.log
|
||||
|
||||
# Roundcube
|
||||
- name: Install roundcube PHP configs
|
||||
template:
|
||||
src: "{{ item }}.j2"
|
||||
dest: "/etc/roundcube/{{ item }}"
|
||||
mode: "640"
|
||||
group: "www-data"
|
||||
with_items:
|
||||
- debian-db.php
|
||||
- config.inc.php
|
||||
|
||||
- name: Remove default apache2 config
|
||||
file:
|
||||
name: "/etc/apache2/sites-enabled/000-default.conf"
|
||||
state: "absent"
|
||||
notify:
|
||||
- restart apache2
|
||||
|
||||
- name: Install roundcube ports config
|
||||
template:
|
||||
src: "ports.conf.j2"
|
||||
dest: "/etc/apache2/ports.conf"
|
||||
notify:
|
||||
- restart apache2
|
||||
|
||||
- name: Install roundcube apache2 config
|
||||
template:
|
||||
src: "roundcube.conf.j2"
|
||||
dest: "/etc/roundcube/apache.conf"
|
||||
notify:
|
||||
- restart apache2
|
||||
|
||||
- name: create logo dir
|
||||
file:
|
||||
dest: "/var/lib/roundcube/images"
|
||||
state: "directory"
|
||||
|
||||
- name: install Roundcube logo
|
||||
copy:
|
||||
src: "{{ logo_filename }}"
|
||||
dest: "/var/lib/roundcube/images/{{ logo_filename }}"
|
||||
|
||||
# General
|
||||
- name: ensure services are running (and enabled at boot)
|
||||
service:
|
||||
name: "{{ item }}"
|
||||
state: "started"
|
||||
enabled: "yes"
|
||||
with_items:
|
||||
- postfix
|
||||
- amavis
|
||||
- clamav-daemon
|
||||
- dovecot
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
use strict;
|
||||
|
||||
# Amavis filter configuration
|
||||
# {{ ansible_managed }}
|
||||
|
||||
@bypass_virus_checks_maps = (
|
||||
\%bypass_virus_checks, \@bypass_virus_checks_acl, \$bypass_virus_checks_re);
|
||||
|
||||
@bypass_spam_checks_maps = (
|
||||
\%bypass_spam_checks, \@bypass_spam_checks_acl, \$bypass_spam_checks_re);
|
||||
|
||||
1; # ensure a defined return
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
use strict;
|
||||
|
||||
@local_domains_acl = ( "." );
|
||||
$sa_tag_level_deflt = -9999;
|
||||
$sa_tag2_level_deflt = 4.5;
|
||||
$sa_kill_level_deflt = 4.5;
|
||||
$sa_spam_subject_tag = '*** SPAM *** ';
|
||||
|
||||
$forward_method = 'smtp:[::1]:10025';
|
||||
|
||||
#------------ Do not modify anything below this line -------------
|
||||
1; # ensure a defined return
|
||||
|
|
@ -0,0 +1,111 @@
|
|||
<?php
|
||||
|
||||
/* Local configuration for Roundcube Webmail */
|
||||
/* {{ ansible_managed }} */
|
||||
|
||||
$config['imap_auth_type'] = 'LOGIN';
|
||||
$config['imap_delimiter'] = '/';
|
||||
|
||||
// ----------------------------------
|
||||
// SMTP
|
||||
// ----------------------------------
|
||||
$config['smtp_server'] = '{{ smtp_host }}';
|
||||
$config['smtp_auth_type'] = 'LOGIN';
|
||||
|
||||
$config['support_url'] = '{{ support_url }}';
|
||||
|
||||
array(
|
||||
"elastic:login[small]" => "/images/logo_login_small.png",
|
||||
"elastic:login" => "/images/logo_login.png",
|
||||
"elastic:*[small]" => "/images/logo_small.png",
|
||||
"larry:*" => "/images/larry.png",
|
||||
"login" => "/images/logo_login.png",
|
||||
"[print]" => "/images/logo_print.png",
|
||||
);
|
||||
$config['skin_logo'] = 'images/{{ logo_filename }}';
|
||||
|
||||
$config['des_key'] = '{{ roundcube_deskey }}';
|
||||
|
||||
// ----------------------------------
|
||||
// PLUGINS
|
||||
// ----------------------------------
|
||||
$config['plugins'] = array('managesieve');
|
||||
$config['create_default_folders'] = true;
|
||||
$config['quota_zero_as_unlimited'] = true;
|
||||
$config['ldap_public'] = array (
|
||||
'global_ldap_abook' =>
|
||||
array (
|
||||
'name' => 'Global LDAP Address Book',
|
||||
'hosts' =>
|
||||
array (
|
||||
0 => '{{ ldap_host }}',
|
||||
),
|
||||
'port' => {{ ldap_port }},
|
||||
'use_tls' => false,
|
||||
'ldap_version' => '3',
|
||||
'network_timeout' => 10,
|
||||
'user_specific' => true,
|
||||
'base_dn' => '{{ ldap_basedn }}',
|
||||
'bind_dn' => 'mail=%u@%d,ou=Users,domainName=%d,{{ ldap_basedn }}',
|
||||
'hidden' => false,
|
||||
'searchonly' => false,
|
||||
'writable' => false,
|
||||
'search_fields' =>
|
||||
array (
|
||||
0 => 'mail',
|
||||
1 => 'cn',
|
||||
2 => 'sn',
|
||||
3 => 'givenName',
|
||||
4 => 'street',
|
||||
5 => 'telephoneNumber',
|
||||
6 => 'mobile',
|
||||
7 => 'stree',
|
||||
8 => 'postalCode',
|
||||
),
|
||||
'fieldmap' =>
|
||||
array (
|
||||
'name' => 'cn',
|
||||
'surname' => 'sn',
|
||||
'firstname' => 'givenName',
|
||||
'title' => 'title',
|
||||
'email' => 'mail:*',
|
||||
'phone:work' => 'telephoneNumber',
|
||||
'phone:mobile' => 'mobile',
|
||||
'street' => 'street',
|
||||
'zipcode' => 'postalCode',
|
||||
'locality' => 'l',
|
||||
'department' => 'departmentNumber',
|
||||
'notes' => 'description',
|
||||
'phone:workfax' => 'facsimileTelephoneNumber',
|
||||
'photo' => 'jpegPhoto',
|
||||
),
|
||||
'sort' => 'cn',
|
||||
'scope' => 'sub',
|
||||
'filter' => '(&(enabledService=mail)(enabledService=deliver)(enabledService=displayedInGlobalAddressBook)(|(objectClass=mailList)(objectClass=mailAlias)(objectClass=mailUser)))',
|
||||
'fuzzy_search' => true,
|
||||
'vlv' => false,
|
||||
'sizelimit' => '0',
|
||||
'timelimit' => '0',
|
||||
'referrals' => false,
|
||||
'group_filters' =>
|
||||
array (
|
||||
'departments' =>
|
||||
array (
|
||||
'name' => 'Mailing Lists',
|
||||
'scope' => 'sub',
|
||||
'base_dn' => '{{ ldap_basedn }}',
|
||||
'filter' => '(&(objectclass=mailList)(accountStatus=active)(enabledService=displayedInGlobalAddressBook))',
|
||||
'name_attr' => 'cn',
|
||||
'email' => 'mail',
|
||||
),
|
||||
),
|
||||
),
|
||||
);
|
||||
$config['autocomplete_addressbooks'] = array('sql', 'global_ldap_abook');
|
||||
$config['skin'] = 'elastic';
|
||||
$config['addressbook_sort_col'] = 'name';
|
||||
$config['draft_autosave'] = 60;
|
||||
$config['check_all_folders'] = true;
|
||||
$config['autoexpand_threads'] = 2;
|
||||
|
||||
include_once("/etc/roundcube/debian-db-roundcube.php");
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
<?php
|
||||
/* {{ ansible_managed }} */
|
||||
$dbuser='{{ mysql_username }}';
|
||||
$dbpass='{{ mysql_password }}';
|
||||
$basepath='';
|
||||
$dbname='{{ mysql_database }}';
|
||||
$dbserver='{{ mysql_host }}';
|
||||
$dbport='{{ mysql_port }}';
|
||||
$dbtype='mysql';
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
# Dovecot LDAP interface configuration
|
||||
# {{ ansible_managed }}
|
||||
|
||||
hosts = {{ ldap_host }}:{{ ldap_port }}
|
||||
ldap_version = 3
|
||||
auth_bind = yes
|
||||
dn = {{ ldap_bind_username }}
|
||||
dnpass = {{ ldap_bind_password }}
|
||||
base = {{ ldap_basedn }}
|
||||
scope = subtree
|
||||
deref = never
|
||||
|
||||
# Below two are required by command 'doveadm mailbox ...'
|
||||
iterate_attrs = mail=user
|
||||
iterate_filter = (&(objectClass=mailUser)(accountStatus=active)(enabledService=mail))
|
||||
|
||||
user_filter = (&(objectClass=mailUser)(accountStatus=active)(enabledService=mail)(enabledService=%Ls%Lc)(|(mail=%u)(&(enabledService=shadowaddress)(shadowAddress=%u))))
|
||||
user_attrs = mail=user,homeDirectory=home,=mail=maildir:~/Maildir/,mailQuota=quota_rule=*:bytes=%$
|
||||
pass_filter = (&(objectClass=mailUser)(accountStatus=active)(enabledService=mail)(enabledService=%Ls%Lc)(|(mail=%u)(&(enabledService=shadowaddress)(shadowAddress=%u))))
|
||||
pass_attrs = mail=user,userPassword=password
|
||||
default_pass_scheme = SSHA
|
||||
|
|
@ -0,0 +1,177 @@
|
|||
# Dovecot main configuration
|
||||
# {{ ansible_managed }}
|
||||
|
||||
listen = *, [::]
|
||||
mail_plugins = quota
|
||||
protocols = pop3 imap sieve lmtp
|
||||
mail_uid = 2000
|
||||
mail_gid = 2000
|
||||
first_valid_uid = 2000
|
||||
last_valid_uid = 2000
|
||||
log_path = /var/log/dovecot.log
|
||||
mail_debug = no
|
||||
auth_verbose = no
|
||||
auth_debug = no
|
||||
auth_debug_passwords = no
|
||||
auth_verbose_passwords = no
|
||||
ssl = no
|
||||
mailbox_list_index = yes
|
||||
disable_plaintext_auth = no
|
||||
mail_location = maildir:/%Lh/Maildir/:INDEX=/%Lh/Maildir/:VOLATILEDIR=/tmp/dovecot-volatile/%d/%u
|
||||
auth_default_realm = {{ domain }}
|
||||
auth_mechanisms = PLAIN LOGIN
|
||||
haproxy_trusted_networks = {{ trusted_networks }}
|
||||
haproxy_timeout = 5s
|
||||
service auth {
|
||||
unix_listener /var/spool/postfix/private/dovecot-auth {
|
||||
user = postfix
|
||||
group = postfix
|
||||
mode = 0666
|
||||
}
|
||||
unix_listener auth-master {
|
||||
user = vmail
|
||||
group = vmail
|
||||
mode = 0666
|
||||
}
|
||||
unix_listener auth-userdb {
|
||||
user = vmail
|
||||
group = vmail
|
||||
mode = 0660
|
||||
}
|
||||
}
|
||||
service lmtp {
|
||||
user = vmail
|
||||
process_min_avail = 5
|
||||
executable = lmtp -L
|
||||
unix_listener /var/spool/postfix/private/dovecot-lmtp {
|
||||
user = postfix
|
||||
group = postfix
|
||||
mode = 0600
|
||||
}
|
||||
inet_listener lmtp {
|
||||
port = 24
|
||||
}
|
||||
}
|
||||
service stats {
|
||||
unix_listener stats-reader {
|
||||
user = dovecot
|
||||
group = postfix
|
||||
mode = 0660
|
||||
}
|
||||
unix_listener stats-writer {
|
||||
user = dovecot
|
||||
group = postfix
|
||||
mode = 0660
|
||||
}
|
||||
}
|
||||
userdb {
|
||||
args = /etc/dovecot/dovecot-ldap.conf
|
||||
driver = ldap
|
||||
}
|
||||
passdb {
|
||||
args = /etc/dovecot/dovecot-ldap.conf
|
||||
driver = ldap
|
||||
}
|
||||
plugin {
|
||||
auth_socket_path = /var/run/dovecot/auth-master
|
||||
acl = vfile
|
||||
acl_shared_dict = proxy::acl
|
||||
sieve_dir = /%Lh/sieve
|
||||
sieve = /%Lh/sieve/dovecot.sieve
|
||||
sieve_global_dir = /srv/vmail/sieve
|
||||
sieve_default = /srv/vmail/sieve/dovecot.sieve
|
||||
}
|
||||
service dict {
|
||||
unix_listener dict {
|
||||
mode = 0660
|
||||
user = vmail
|
||||
group = vmail
|
||||
}
|
||||
}
|
||||
protocol lda {
|
||||
mail_plugins = $mail_plugins sieve
|
||||
auth_socket_path = /run/dovecot/auth-master
|
||||
log_path = /var/log/dovecot.log
|
||||
lda_mailbox_autocreate = yes
|
||||
postmaster_address = {{ postmaster }}
|
||||
}
|
||||
protocol lmtp {
|
||||
info_log_path = /var/log/dovecot-lmtp.log
|
||||
mail_plugins = quota sieve
|
||||
postmaster_address = {{ postmaster }}
|
||||
lmtp_save_to_detail_mailbox = yes
|
||||
recipient_delimiter = +
|
||||
}
|
||||
protocol imap {
|
||||
mail_plugins = $mail_plugins imap_quota
|
||||
imap_client_workarounds = tb-extra-mailbox-sep
|
||||
}
|
||||
protocol pop3 {
|
||||
mail_plugins = $mail_plugins
|
||||
pop3_client_workarounds = outlook-no-nuls oe-ns-eoh
|
||||
pop3_uidl_format = %08Xu%08Xv
|
||||
}
|
||||
service imap-login {
|
||||
service_count = 1
|
||||
process_limit = 500
|
||||
inet_listener imap {
|
||||
port = 143
|
||||
}
|
||||
{% if haproxy %}
|
||||
inet_listener imap-haproxy {
|
||||
port = 10143
|
||||
haproxy = yes
|
||||
}
|
||||
{% endif %}
|
||||
}
|
||||
service pop3-login {
|
||||
service_count = 1
|
||||
process_limit = 500
|
||||
inet_listener pop3 {
|
||||
port = 110
|
||||
}
|
||||
{% if haproxy %}
|
||||
inet_listener pop3-haproxy {
|
||||
port = 10110
|
||||
haproxy = yes
|
||||
}
|
||||
{% endif %}
|
||||
}
|
||||
namespace {
|
||||
type = private
|
||||
separator = /
|
||||
prefix =
|
||||
inbox = yes
|
||||
mailbox Sent {
|
||||
auto = subscribe
|
||||
special_use = \Sent
|
||||
}
|
||||
mailbox "Sent Messages" {
|
||||
auto = no
|
||||
special_use = \Sent
|
||||
}
|
||||
mailbox Drafts {
|
||||
auto = subscribe
|
||||
special_use = \Drafts
|
||||
}
|
||||
mailbox Trash {
|
||||
auto = subscribe
|
||||
special_use = \Trash
|
||||
}
|
||||
mailbox Junk {
|
||||
auto = subscribe
|
||||
special_use = \Junk
|
||||
}
|
||||
mailbox Spam {
|
||||
auto = no
|
||||
special_use = \Junk
|
||||
}
|
||||
}
|
||||
namespace {
|
||||
type = shared
|
||||
separator = /
|
||||
prefix = Shared/%%u/
|
||||
location = maildir:/%%Lh/Maildir/:INDEX=/%%Lh/Maildir/Shared/%%u:VOLATILEDIR=/tmp/dovecot-volatile/Shared/%%u
|
||||
subscriptions = yes
|
||||
list = children
|
||||
}
|
||||
|
|
@ -0,0 +1,143 @@
|
|||
# Main Postfix configuration
|
||||
# {{ ansible_managed }}
|
||||
|
||||
# No one will use these in helo command.
|
||||
/^(localhost)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/^(localhost.localdomain)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(\.local)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
|
||||
# Reject who use IP address as helo.
|
||||
# Correct: [xxx.xxx.xxx.xxx]
|
||||
# Incorrect: xxx.xxx.xxx.xxx
|
||||
/^([0-9\.]+)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server sent non RFC compliant HELO identity (${1})
|
||||
|
||||
#
|
||||
# This is the real HELO identify of these ISPs:
|
||||
# sohu.com websmtp.sohu.com relay2nd.mail.sohu.com
|
||||
# 126.com m15-78.126.com
|
||||
# 163.com m31-189.vip.163.com m13-49.163.com
|
||||
# sina.com mail2-209.sinamail.sina.com.cn
|
||||
# gmail.com xx-out-NNNN.google.com
|
||||
/^(126\.com)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server seems to be impersonating another mail server (${1})
|
||||
/^(163\.com)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server seems to be impersonating another mail server (${1})
|
||||
/^(163\.net)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server seems to be impersonating another mail server (${1})
|
||||
/^(sohu\.com)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server seems to be impersonating another mail server (${1})
|
||||
/(gmail\.com)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server seems to be impersonating another mail server (${1})
|
||||
/^(google\.com)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server seems to be impersonating another mail server (${1})
|
||||
/^(yahoo\.com\.cn)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server seems to be impersonating another mail server (${1})
|
||||
/^(yahoo\.co\.jp)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server seems to be impersonating another mail server (${1})
|
||||
|
||||
#
|
||||
# Spammers.
|
||||
#
|
||||
/^(728154EA470B4AA\.com)$/ REJECT ACCESS DENIED. Your email was rejected because it appears to come from a known spamming mail server (${1})
|
||||
/^(taj-co\.com)$/ REJECT ACCESS DENIED. Your email was rejected because it appears to come from a known spamming mail server (${1})
|
||||
/^(CF8D3DB045C1455\.net)$/ REJECT ACCESS DENIED. Your email was rejected because it appears to come from a known spamming mail server (${1})
|
||||
/^(dsgsfdg\.com)$/ REJECT ACCESS DENIED. Your email was rejected because it appears to come from a known spamming mail server (${1})
|
||||
/^(se\.nit7-ngbo\.com)$/ REJECT ACCESS DENIED. Your email was rejected because it appears to come from a known spamming mail server (${1})
|
||||
/^(mail\.goo\.ne\.jp)$/ REJECT ACCESS DENIED. Your email was rejected because it appears to come from a known spamming mail server (${1})
|
||||
/^(n-ong_an\.com)$/ REJECT ACCESS DENIED. Your email was rejected because it appears to come from a known spamming mail server (${1})
|
||||
/^(meqail\.teamefs-ine5tl\.com)$/ REJECT ACCESS DENIED. Your email was rejected because it appears to come from a known spamming mail server (${1})
|
||||
/^(zzg\.jhf-sp\.com)$/ REJECT ACCESS DENIED. Your email was rejected because it appears to come from a known spamming mail server (${1})
|
||||
/^(din_glo-ng\.net)$/ REJECT ACCESS DENIED. Your email was rejected because it appears to come from a known spamming mail server (${1})
|
||||
/^(fda-cnc\.ie\.com)$/ REJECT ACCESS DENIED. Your email was rejected because it appears to come from a known spamming mail server (${1})
|
||||
/^(yrtaj-yrco\.com)$/ REJECT ACCESS DENIED. Your email was rejected because it appears to come from a known spamming mail server (${1})
|
||||
/^(m\.am\.biz\.cn)$/ REJECT ACCESS DENIED. Your email was rejected because it appears to come from a known spamming mail server (${1})
|
||||
/^(xr_haig\.roup\.com)$/ REJECT ACCESS DENIED. Your email was rejected because it appears to come from a known spamming mail server (${1})
|
||||
/^(hjn\.cn)$/ REJECT ACCESS DENIED. Your email was rejected because it appears to come from a known spamming mail server (${1})
|
||||
/^(we_blf\.com\.cn)$/ REJECT ACCESS DENIED. Your email was rejected because it appears to come from a known spamming mail server (${1})
|
||||
/^(netvigator\.com)$/ REJECT ACCESS DENIED. Your email was rejected because it appears to come from a known spamming mail server (${1})
|
||||
/^(mysam\.biz)$/ REJECT ACCESS DENIED. Your email was rejected because it appears to come from a known spamming mail server (${1})
|
||||
/^(mail\.teams-intl\.com)$/ REJECT ACCESS DENIED. Your email was rejected because it appears to come from a known spamming mail server (${1})
|
||||
/^(seningbo\.com)$/ REJECT ACCESS DENIED. Your email was rejected because it appears to come from a known spamming mail server (${1})
|
||||
/^(nblf\.com\.cn)$/ REJECT ACCESS DENIED. Your email was rejected because it appears to come from a known spamming mail server (${1})
|
||||
/^(kdn\.ktguide\.com)$/ REJECT ACCESS DENIED. Your email was rejected because it appears to come from a known spamming mail server (${1})
|
||||
/^(zzsp\.com)$/ REJECT ACCESS DENIED. Your email was rejected because it appears to come from a known spamming mail server (${1})
|
||||
/^(nblongan\.com)$/ REJECT ACCESS DENIED. Your email was rejected because it appears to come from a known spamming mail server (${1})
|
||||
/^(dpu\.cn)$/ REJECT ACCESS DENIED. Your email was rejected because it appears to come from a known spamming mail server (${1})
|
||||
/^(nbalton\.com)$/ REJECT ACCESS DENIED. Your email was rejected because it appears to come from a known spamming mail server (${1})
|
||||
/^(cncie\.com)$/ REJECT ACCESS DENIED. Your email was rejected because it appears to come from a known spamming mail server (${1})
|
||||
/^(xinhaigroup\.com)$/ REJECT ACCESS DENIED. Your email was rejected because it appears to come from a known spamming mail server (${1})
|
||||
/^(wz\.com)$/ REJECT ACCESS DENIED. Your email was rejected because it appears to come from a known spamming mail server (${1})
|
||||
/(\.zj\.cn)$/ REJECT ACCESS DENIED. Your email was rejected because it appears to come from a known spamming mail server (${1})
|
||||
/(\.kornet)$/ REJECT ACCESS DENIED. Your email was rejected because it appears to come from a known spamming mail server (${1})
|
||||
|
||||
/^(dsldevice\.lan)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/^(system\.mail)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/^(speedtouch\.lan)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/^(dsldevice\.lan)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
|
||||
#
|
||||
# Reject adsl spammers.
|
||||
#
|
||||
/(adsl)/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server appears to be on a dynamic IP address that should not be doing direct mail delivery (${1})
|
||||
/(dynamic)/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server appears to be on a dynamic IP address that should not be doing direct mail delivery (${1})
|
||||
/(\d{1,3}-\d{1,3}-\d{1,3}-\d{1,3})/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server appears to be on a dynamic IP address that should not be doing direct mail delivery (${1})
|
||||
/(pppoe)/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server appears to be on a dynamic IP address that should not be doing direct mail delivery (${1})
|
||||
/(dsl\.brasiltelecom\.net\.br)/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server appears to be on a dynamic IP address that should not be doing direct mail delivery (${1})
|
||||
/(dsl\.optinet\.hr)/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server appears to be on a dynamic IP address that should not be doing direct mail delivery (${1})
|
||||
/(dsl\.telesp\.net\.br)/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server appears to be on a dynamic IP address that should not be doing direct mail delivery (${1})
|
||||
/(dialup)/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server appears to be on a dynamic IP address that should not be doing direct mail delivery (${1})
|
||||
/(dhcp)/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server appears to be on a dynamic IP address that should not be doing direct mail delivery (${1})
|
||||
/(pool-)/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server appears to be on a dynamic IP address that should not be doing direct mail delivery (${1})
|
||||
/^(cpe-)/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server appears to be on a dynamic IP address that should not be doing direct mail delivery (${1})
|
||||
/(\.cpe\.)/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server appears to be on a dynamic IP address that should not be doing direct mail delivery (${1})
|
||||
|
||||
/(speedy\.com\.ar)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server appears to be on a dynamic IP address that should not be doing direct mail delivery (${1})
|
||||
/(speedyterra\.com\.br)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server appears to be on a dynamic IP address that should not be doing direct mail delivery (${1})
|
||||
/(static\.sbb\.rs)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server appears to be on a dynamic IP address that should not be doing direct mail delivery (${1})
|
||||
/(static\.vsnl\.net\.in)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server appears to be on a dynamic IP address that should not be doing direct mail delivery (${1})
|
||||
|
||||
/(advance\.com\.ar)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(airtelbroadband\.in)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(bb\.netvision\.net\.il)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(bezeqint\.net)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(broadband3\.iol\.cz)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(cable\.net\.co)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(catv\.broadband\.hu)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(chello\.nl)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(chello\.sk)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(client\.mchsi\.com)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(comunitel\.net)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(coprosys\.cz)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(dclient\.hispeed\.ch)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(dip0\.t-ipconnect\.de)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(domain\.invalid)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(dyn\.centurytel\.net)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(embarqhsd\.net)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(emcali\.net\.co)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(epm\.net\.co)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(eutelia\.it)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(fastwebnet\.it)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(fibertel\.com\.ar)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(freedom2surf\.net)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(hgcbroadband\.com)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(HINET-IP\.hinet\.net)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(infonet\.by)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(is74\.ru)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(kievnet\.com\.ua)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(metrotel\.net\.co)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(nw\.nuvox\.net)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(pldt\.net)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(pool\.invitel\.hu)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(pool\.ukrtel\.net)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(pools\.arcor-ip\.net)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(pppoe\.avangarddsl\.ru)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(retail\.telecomitalia\.it)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(revip2\.asianet\.co\.th)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(tim\.ro)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(tsi\.tychy\.pl)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(ttnet\.net\.tr)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(tttmaxnet\.com)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(user\.veloxzone\.com\.br)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(utk\.ru)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(veloxzone\.com\.br)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(virtua\.com\.br)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(wanamaroc\.com)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(wbt\.ru)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(wireless\.iaw\.on\.ca)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(business\.telecomitalia\.it)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(cotas\.com\.bo)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(marunouchi\.tokyo\.ocn\.ne\.jp)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(amedex\.com)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
/(aageneva\.com)$/ REJECT ACCESS DENIED. Your email was rejected because the sending mail server does not identify itself correctly (${1})
|
||||
|
|
@ -0,0 +1,89 @@
|
|||
# Main Postfix configuration
|
||||
# {{ ansible_managed }}
|
||||
|
||||
smtpd_banner = {{ banner_hostname }} ESMTP $mail_name (Debian/GNU)
|
||||
biff = no
|
||||
append_dot_mydomain = no
|
||||
delay_warning_time = 48h
|
||||
maximal_queue_lifetime = 14d
|
||||
bounce_queue_lifetime = 14d
|
||||
readme_directory = no
|
||||
compatibility_level = 2
|
||||
|
||||
smtp_use_tls=yes
|
||||
smtp_tls_cert_file=/etc/ssl/{{ banner_hostname }}.crt
|
||||
smtp_tls_key_file=/etc/ssl/{{ banner_hostname }}.key
|
||||
smtpd_tls_cert_file=/etc/ssl/letsencrypt/infrastructure.pem
|
||||
smtpd_tls_key_file=/etc/ssl/letsencrypt/infrastructure.pem
|
||||
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
|
||||
|
||||
myhostname = {{ myhostname }}
|
||||
mydomain = {{ mydomain }}
|
||||
alias_maps = hash:/etc/aliases
|
||||
alias_database = hash:/etc/aliases
|
||||
myorigin = /etc/mailname
|
||||
mydestination = localhost
|
||||
|
||||
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 {{ mynetworks }}
|
||||
mailbox_size_limit = 0
|
||||
recipient_delimiter = +
|
||||
inet_interfaces = all
|
||||
inet_protocols = all
|
||||
|
||||
swap_bangpath = no
|
||||
mynetworks_style = host
|
||||
smtpd_data_restrictions = reject_unauth_pipelining
|
||||
smtpd_reject_unlisted_recipient = yes
|
||||
smtpd_reject_unlisted_sender = yes
|
||||
smtp_tls_security_level = may
|
||||
smtp_tls_CAfile = $smtpd_tls_CAfile
|
||||
smtp_tls_loglevel = 0
|
||||
smtp_tls_note_starttls_offer = yes
|
||||
proxy_read_maps = $canonical_maps $lmtp_generic_maps $local_recipient_maps $mydestination $mynetworks $recipient_bcc_maps $recipient_canonical_maps $relay_domains $relay_recipient_maps $relocated_maps $sender_bcc_maps $sender_canonical_maps $smtp_generic_maps $smtpd_sender_login_maps $transport_maps $virtual_alias_domains $virtual_alias_maps $virtual_mailbox_domains $virtual_mailbox_maps $smtpd_sender_restrictions
|
||||
smtp_data_init_timeout = 240s
|
||||
smtp_data_xfer_timeout = 600s
|
||||
smtpd_helo_required = yes
|
||||
smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, check_helo_access pcre:/etc/postfix/helo_access.pcre
|
||||
queue_run_delay = 300s
|
||||
minimal_backoff_time = 300s
|
||||
maximal_backoff_time = 4000s
|
||||
enable_original_recipient = no
|
||||
disable_vrfy_command = yes
|
||||
home_mailbox = Maildir/
|
||||
allow_min_user = no
|
||||
message_size_limit = 52428800
|
||||
virtual_minimum_uid = 2000
|
||||
virtual_uid_maps = static:2000
|
||||
virtual_gid_maps = static:2000
|
||||
virtual_mailbox_base = /srv/vmail
|
||||
|
||||
transport_maps = proxy:ldap:/etc/postfix/ldap/transport_maps_user.cf, proxy:ldap:/etc/postfix/ldap/transport_maps_domain.cf, hash:/etc/postfix/transport
|
||||
virtual_alias_maps = proxy:ldap:/etc/postfix/ldap/virtual_alias_maps.cf, proxy:ldap:/etc/postfix/ldap/virtual_group_maps.cf, proxy:ldap:/etc/postfix/ldap/virtual_group_members_maps.cf, proxy:ldap:/etc/postfix/ldap/catchall_maps.cf
|
||||
virtual_mailbox_domains = proxy:ldap:/etc/postfix/ldap/virtual_mailbox_domains.cf
|
||||
virtual_mailbox_maps = proxy:ldap:/etc/postfix/ldap/virtual_mailbox_maps.cf
|
||||
sender_bcc_maps = proxy:ldap:/etc/postfix/ldap/sender_bcc_maps_user.cf, proxy:ldap:/etc/postfix/ldap/sender_bcc_maps_domain.cf
|
||||
recipient_bcc_maps = proxy:ldap:/etc/postfix/ldap/recipient_bcc_maps_user.cf, proxy:ldap:/etc/postfix/ldap/recipient_bcc_maps_domain.cf
|
||||
|
||||
smtpd_sender_login_maps = proxy:ldap:/etc/postfix/ldap/sender_login_maps.cf
|
||||
smtpd_sasl_auth_enable = yes
|
||||
smtpd_sasl_local_domain =
|
||||
broken_sasl_auth_clients = yes
|
||||
smtpd_sasl_security_options = noanonymous
|
||||
smtpd_tls_auth_only = no
|
||||
smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination
|
||||
smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination
|
||||
smtpd_relay_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination
|
||||
smtpd_tls_security_level = may
|
||||
smtpd_tls_loglevel = 0
|
||||
tls_random_source = dev:/dev/urandom
|
||||
|
||||
command_time_limit = 12h
|
||||
ipc_timeout = 12h
|
||||
|
||||
mailbox_command = /usr/lib/dovecot/deliver
|
||||
virtual_transport = dovecot
|
||||
dovecot_destination_recipient_limit = 1
|
||||
smtpd_sasl_type = dovecot
|
||||
smtpd_sasl_path = private/dovecot-auth
|
||||
smtp-amavis_destination_recipient_limit = 1
|
||||
virtual_alias_domains =
|
||||
|
|
@ -0,0 +1,73 @@
|
|||
# Postfix master process configuration file
|
||||
# {{ ansible_managed }}
|
||||
|
||||
# ==========================================================================
|
||||
# service type private unpriv chroot wakeup maxproc command + args
|
||||
# (yes) (yes) (yes) (never) (100)
|
||||
# ==========================================================================
|
||||
smtp inet n - y - - smtpd
|
||||
pickup unix n - y 60 1 pickup
|
||||
-o content_filter=
|
||||
-o receive_override_options=no_header_body_checks
|
||||
cleanup unix n - y - 0 cleanup
|
||||
qmgr unix n - n 300 1 qmgr
|
||||
tlsmgr unix - - y 1000? 1 tlsmgr
|
||||
rewrite unix - - y - - trivial-rewrite
|
||||
bounce unix - - y - 0 bounce
|
||||
defer unix - - y - 0 bounce
|
||||
trace unix - - y - 0 bounce
|
||||
verify unix - - y - 1 verify
|
||||
flush unix n - y 1000? 0 flush
|
||||
proxymap unix - - n - - proxymap
|
||||
proxywrite unix - - n - 1 proxymap
|
||||
smtp unix - - y - - smtp
|
||||
smtp-ipv4 unix - - y - - smtp
|
||||
-o inet_protocols=ipv4
|
||||
relay unix - - y - - smtp
|
||||
showq unix n - y - - showq
|
||||
error unix - - y - - error
|
||||
retry unix - - y - - error
|
||||
discard unix - - y - - discard
|
||||
local unix - n n - - local
|
||||
virtual unix - n n - - virtual
|
||||
lmtp unix - - y - - lmtp
|
||||
anvil unix - - y - 1 anvil
|
||||
scache unix - - y - 1 scache
|
||||
|
||||
submission inet n - n - - smtpd
|
||||
-o smtpd_enforce_tls=no
|
||||
-o smtpd_sasl_auth_enable=yes
|
||||
-o smtpd_upstream_proxy_protocol=haproxy
|
||||
-o smtpd_client_restrictions=permit_mynetworks,permit_sasl_authenticated,reject
|
||||
-o content_filter=smtp-amavis:[::1]:10024
|
||||
|
||||
dovecot unix - n n - - pipe
|
||||
-o soft_bounce=yes
|
||||
flags=DRhu user=vmail:vmail argv=/usr/lib/dovecot/deliver -f ${sender} -d ${user}@${domain} -m ${extension}
|
||||
|
||||
smtp-amavis unix - - y - 2 smtp
|
||||
-o smtp_data_done_timeout=1200
|
||||
-o smtp_send_xforward_command=yes
|
||||
-o disable_dns_lookups=yes
|
||||
-o max_use=20
|
||||
|
||||
[::1]:10025 inet n - y - - smtpd
|
||||
-o inet_protocols=ipv6
|
||||
-o content_filter=
|
||||
-o local_recipient_maps=
|
||||
-o relay_recipient_maps=
|
||||
-o smtpd_restriction_classes=
|
||||
-o smtpd_delay_reject=no
|
||||
-o smtpd_client_restrictions=permit_mynetworks,reject
|
||||
-o smtpd_helo_restrictions=
|
||||
-o smtpd_sender_restrictions=
|
||||
-o smtpd_recipient_restrictions=permit_mynetworks,reject
|
||||
-o smtpd_data_restrictions=reject_unauth_pipelining
|
||||
-o smtpd_end_of_data_restrictions=
|
||||
-o mynetworks=127.0.0.0/8,[::1]/128
|
||||
-o smtpd_error_sleep_time=0
|
||||
-o smtpd_soft_error_limit=1001
|
||||
-o smtpd_hard_error_limit=1000
|
||||
-o smtpd_client_connection_count_limit=0
|
||||
-o smtpd_client_connection_rate_limit=0
|
||||
-o receive_override_options=no_header_body_checks,no_unknown_recipient_checks
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
# Roundcube custom port configuration
|
||||
# {{ ansible_managed }}
|
||||
|
||||
Listen 81
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
# {{ ansible_managed }}
|
||||
server_host = {{ ldap_host }}
|
||||
server_port = {{ ldap_port }}
|
||||
version = 3
|
||||
bind = yes
|
||||
start_tls = no
|
||||
bind_dn = {{ username_ldap_admin }}
|
||||
bind_pw = {{ passwd_ldap_admin }}
|
||||
search_base = {{ ldap_basedn }}
|
||||
scope = sub
|
||||
query_filter = (&(objectClass=mailUser)(accountStatus=active)(|(mail=@%d)(shadowAddress=@%d)))
|
||||
result_attribute= mailForwardingAddress
|
||||
debuglevel = 0
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
# {{ ansible_managed }}
|
||||
server_host = {{ ldap_host }}
|
||||
server_port = {{ ldap_port }}
|
||||
version = 3
|
||||
bind = yes
|
||||
start_tls = no
|
||||
bind_dn = {{ username_ldap_admin }}
|
||||
bind_pw = {{ passwd_ldap_admin }}
|
||||
search_base = {{ ldap_basedn }}
|
||||
scope = one
|
||||
query_filter = (&(objectClass=mailDomain)(|(domainName=%d)(domainAliasName=%d))(accountStatus=active)(enabledService=mail)(enabledService=recipientbcc))
|
||||
result_attribute= domainRecipientBccAddress
|
||||
debuglevel = 0
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
# {{ ansible_managed }}
|
||||
server_host = {{ ldap_host }}
|
||||
server_port = {{ ldap_port }}
|
||||
version = 3
|
||||
bind = yes
|
||||
start_tls = no
|
||||
bind_dn = {{ username_ldap_admin }}
|
||||
bind_pw = {{ passwd_ldap_admin }}
|
||||
search_base = ou=Users,domainName=%d,{{ ldap_basedn }}
|
||||
scope = one
|
||||
query_filter = (&(|(mail=%s)(&(enabledService=shadowaddress)(shadowAddress=%s)))(objectClass=mailUser)(accountStatus=active)(enabledService=mail)(enabledService=recipientbcc))
|
||||
result_attribute= userRecipientBccAddress
|
||||
debuglevel = 0
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
# {{ ansible_managed }}
|
||||
server_host = {{ ldap_host }}
|
||||
server_port = {{ ldap_port }}
|
||||
bind = yes
|
||||
start_tls = no
|
||||
version = 3
|
||||
bind_dn = {{ username_ldap_admin }}
|
||||
bind_pw = {{ passwd_ldap_admin }}
|
||||
search_base = {{ ldap_basedn }}
|
||||
scope = one
|
||||
query_filter = (&(objectClass=mailDomain)(|(domainName=%s)(&(enabledService=domainalias)(domainAliasName=%s)))(domainBackupMX=yes)(accountStatus=active)(enabledService=mail))
|
||||
result_attribute= domainName
|
||||
debuglevel = 0
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
# {{ ansible_managed }}
|
||||
server_host = {{ ldap_host }}
|
||||
server_port = {{ ldap_port }}
|
||||
version = 3
|
||||
bind = yes
|
||||
start_tls = no
|
||||
bind_dn = {{ username_ldap_admin }}
|
||||
bind_pw = {{ passwd_ldap_admin }}
|
||||
search_base = {{ ldap_basedn }}
|
||||
scope = one
|
||||
query_filter = (&(objectClass=mailDomain)(|(domainName=%d)(domainAliasName=%d))(accountStatus=active)(enabledService=mail)(enabledService=senderbcc))
|
||||
result_attribute= domainSenderBccAddress
|
||||
debuglevel = 0
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
# {{ ansible_managed }}
|
||||
server_host = {{ ldap_host }}
|
||||
server_port = {{ ldap_port }}
|
||||
version = 3
|
||||
bind = yes
|
||||
start_tls = no
|
||||
bind_dn = {{ username_ldap_admin }}
|
||||
bind_pw = {{ passwd_ldap_admin }}
|
||||
search_base = ou=Users,domainName=%d,{{ ldap_basedn }}
|
||||
scope = one
|
||||
query_filter = (&(|(mail=%s)(&(enabledService=shadowaddress)(shadowAddress=%s)))(objectClass=mailUser)(accountStatus=active)(enabledService=mail)(enabledService=senderbcc))
|
||||
result_attribute= userSenderBccAddress
|
||||
debuglevel = 0
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
# {{ ansible_managed }}
|
||||
server_host = {{ ldap_host }}
|
||||
server_port = {{ ldap_port }}
|
||||
version = 3
|
||||
bind = yes
|
||||
start_tls = no
|
||||
bind_dn = {{ username_ldap_admin }}
|
||||
bind_pw = {{ passwd_ldap_admin }}
|
||||
search_base = {{ ldap_basedn }}
|
||||
scope = sub
|
||||
query_filter = (&(objectClass=mailUser)(accountStatus=active)(enabledService=mail)(enabledService=smtp)(|(mail=%s)(&(enabledService=shadowaddress)(shadowAddress=%s))))
|
||||
result_attribute= mail
|
||||
debuglevel = 0
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
# {{ ansible_managed }}
|
||||
server_host = {{ ldap_host }}
|
||||
server_port = {{ ldap_port }}
|
||||
version = 3
|
||||
bind = yes
|
||||
start_tls = no
|
||||
bind_dn = {{ username_ldap_admin }}
|
||||
bind_pw = {{ passwd_ldap_admin }}
|
||||
search_base = {{ ldap_basedn }}
|
||||
scope = one
|
||||
query_filter = (&(objectClass=mailDomain)(accountStatus=active)(enabledService=mail)(|(domainName=%s)(domainAliasName=%s)))
|
||||
result_attribute= mtaTransport
|
||||
debuglevel = 0
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
# {{ ansible_managed }}
|
||||
server_host = {{ ldap_host }}
|
||||
server_port = {{ ldap_port }}
|
||||
version = 3
|
||||
bind = yes
|
||||
start_tls = no
|
||||
bind_dn = {{ username_ldap_admin }}
|
||||
bind_pw = {{ passwd_ldap_admin }}
|
||||
search_base = ou=Users,domainName=%d,{{ ldap_basedn }}
|
||||
scope = one
|
||||
query_filter = (&(objectClass=mailUser)(mail=%s)(accountStatus=active)(enabledService=mail))
|
||||
result_attribute= mtaTransport
|
||||
debuglevel = 0
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
# {{ ansible_managed }}
|
||||
server_host = {{ ldap_host }}
|
||||
server_port = {{ ldap_port }}
|
||||
version = 3
|
||||
bind = yes
|
||||
start_tls = no
|
||||
bind_dn = {{ username_ldap_admin }}
|
||||
bind_pw = {{ passwd_ldap_admin }}
|
||||
search_base = {{ ldap_basedn }}
|
||||
scope = sub
|
||||
query_filter = (&(|(mail=%s)(shadowAddress=%s))(accountStatus=active)(enabledService=mail)(enabledService=deliver)(|(objectClass=mailAlias)(&(objectClass=mailUser)(enabledService=forward))))
|
||||
result_attribute= mailForwardingAddress
|
||||
debuglevel = 0
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
# {{ ansible_managed }}
|
||||
server_host = {{ ldap_host }}
|
||||
server_port = {{ ldap_port }}
|
||||
version = 3
|
||||
bind = yes
|
||||
start_tls = no
|
||||
bind_dn = {{ username_ldap_admin }}
|
||||
bind_pw = {{ passwd_ldap_admin }}
|
||||
search_base = {{ ldap_basedn }}
|
||||
scope = sub
|
||||
query_filter = (&(accountStatus=active)(enabledService=mail)(enabledService=deliver)(|(&(|(memberOfGroup=%s)(shadowAddress=%s))(objectClass=mailUser))(&(memberOfGroup=%s)(!(shadowAddress=%s))(|(objectClass=mailExternalUser)(objectClass=mailList)(objectClass=mailAlias)))))
|
||||
result_attribute= mail
|
||||
debuglevel = 0
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
# {{ ansible_managed }}
|
||||
server_host = {{ ldap_host }}
|
||||
server_port = {{ ldap_port }}
|
||||
version = 3
|
||||
bind = yes
|
||||
start_tls = no
|
||||
bind_dn = {{ username_ldap_admin }}
|
||||
bind_pw = {{ passwd_ldap_admin }}
|
||||
search_base = {{ ldap_basedn }}
|
||||
scope = sub
|
||||
query_filter = (&(objectClass=mailUser)(accountStatus=active)(enabledService=mail)(enabledService=deliver)(|(mail=%s)(&(enabledService=shadowaddress)(shadowAddress=%s))))
|
||||
result_attribute= mail
|
||||
debuglevel = 0
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
# {{ ansible_managed }}
|
||||
server_host = {{ ldap_host }}
|
||||
server_port = {{ ldap_port }}
|
||||
bind = yes
|
||||
start_tls = no
|
||||
version = 3
|
||||
bind_dn = {{ username_ldap_admin }}
|
||||
bind_pw = {{ passwd_ldap_admin }}
|
||||
search_base = {{ ldap_basedn }}
|
||||
scope = one
|
||||
query_filter = (&(objectClass=mailDomain)(|(domainName=%s)(&(enabledService=domainalias)(domainAliasName=%s)))(!(domainBackupMX=yes))(accountStatus=active)(enabledService=mail))
|
||||
result_attribute= domainName
|
||||
debuglevel = 0
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
# {{ ansible_managed }}
|
||||
server_host = {{ ldap_host }}
|
||||
server_port = {{ ldap_port }}
|
||||
version = 3
|
||||
bind = yes
|
||||
start_tls = no
|
||||
bind_dn = {{ username_ldap_admin }}
|
||||
bind_pw = {{ passwd_ldap_admin }}
|
||||
search_base = {{ ldap_basedn }}
|
||||
scope = sub
|
||||
query_filter = (&(objectClass=mailUser)(|(mail=%s)(&(enabledService=shadowaddress)(shadowAddress=%s)))(accountStatus=active)(enabledService=mail)(enabledService=deliver))
|
||||
result_attribute= mailMessageStore
|
||||
result_format = %s/Maildir/
|
||||
debuglevel = 0
|
||||
|
|
@ -0,0 +1,47 @@
|
|||
DocumentRoot /var/lib/roundcube
|
||||
Alias /mail /var/lib/roundcube
|
||||
|
||||
<Directory /var/lib/roundcube/>
|
||||
Options +FollowSymLinks
|
||||
# This is needed to parse /var/lib/roundcube/.htaccess. See its
|
||||
# content before setting AllowOverride to None.
|
||||
AllowOverride All
|
||||
<IfVersion >= 2.3>
|
||||
Require all granted
|
||||
</IfVersion>
|
||||
<IfVersion < 2.3>
|
||||
Order allow,deny
|
||||
Allow from all
|
||||
</IfVersion>
|
||||
</Directory>
|
||||
|
||||
# Protecting basic directories:
|
||||
<Directory /var/lib/roundcube/config>
|
||||
Options -FollowSymLinks
|
||||
AllowOverride None
|
||||
</Directory>
|
||||
|
||||
<Directory /var/lib/roundcube/temp>
|
||||
Options -FollowSymLinks
|
||||
AllowOverride None
|
||||
<IfVersion >= 2.3>
|
||||
Require all denied
|
||||
</IfVersion>
|
||||
<IfVersion < 2.3>
|
||||
Order allow,deny
|
||||
Deny from all
|
||||
</IfVersion>
|
||||
</Directory>
|
||||
|
||||
<Directory /var/lib/roundcube/logs>
|
||||
Options -FollowSymLinks
|
||||
AllowOverride None
|
||||
<IfVersion >= 2.3>
|
||||
Require all denied
|
||||
</IfVersion>
|
||||
<IfVersion < 2.3>
|
||||
Order allow,deny
|
||||
Deny from all
|
||||
</IfVersion>
|
||||
</Directory>
|
||||
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
# Gmail-specific transfer policy
|
||||
# {{ ansible_managed }}
|
||||
gmail.com smtp-ipv4:
|
||||
|
|
@ -0,0 +1,35 @@
|
|||
---
|
||||
# Default configurations
|
||||
# I populate these from external configs; I indicate what the are as inline comments
|
||||
|
||||
# Postfix
|
||||
|
||||
# A list of relay domains and their target (square-bracked hostname/IP + port); examples follow
|
||||
relay_domains: "{{ blse_relaydomains }}"
|
||||
# - domain: "some.domain.tld"
|
||||
# relay: "[mail.domain.tld]"
|
||||
# - domain: "other.domain.tld"
|
||||
# relay: "[secure.domain.tld]:465"
|
||||
|
||||
# A list of RBLs to check for rejecting incoming mail
|
||||
remote_block_lists:
|
||||
- bl.spamcop.net
|
||||
- zen.spamhaus.org
|
||||
- cbl.abuseat.org
|
||||
|
||||
# Enable TLS (literal yes/no only) and, if yes, the cert and key files
|
||||
tls_enabled: yes
|
||||
tls_cert: "/etc/ssl/{{ ansible_fqdn }}.crt"
|
||||
tls_key: "/etc/ssl/{{ ansible_fqdn }}.key"
|
||||
|
||||
# Virtual address maps
|
||||
virtual_maps:
|
||||
- regex: "/^postmaster@/"
|
||||
map: "root@{{ blsedomains_admindomain }}"
|
||||
|
||||
# SpamAssassin
|
||||
notify_admin: "joshua@boniface.me" # Administrative address to notify
|
||||
notify_method: "smtp:{{ blsecluster_smtphost }}:25"
|
||||
custom_sender_scores:
|
||||
- [qr'^(offers)@'i => 1.0]
|
||||
- [qr'^.*@pizzanova.com'i => 1.0]
|
||||
|
|
@ -0,0 +1,2 @@
|
|||
Populate me with spam-tagged legit emails.
|
||||
Then `tar -cvJf ham-sample.txz ham-sample/` in the parent directory.
|
||||
|
|
@ -0,0 +1,2 @@
|
|||
Populate me with spam-tagged legit emails.
|
||||
Then `tar -cvJf ham-sample.txz ham-sample/` in the parent directory.
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
---
|
||||
- name: postmap transport
|
||||
command: "postmap /etc/postfix/transport"
|
||||
- name: restart amavis
|
||||
service:
|
||||
name: "amavis"
|
||||
state: "restarted"
|
||||
- name: restart saslauthd
|
||||
service:
|
||||
name: "saslauthd"
|
||||
state: "restarted"
|
||||
- name: restart postfix
|
||||
service:
|
||||
name: "postfix"
|
||||
state: "restarted"
|
||||
- name: restart spamassassin
|
||||
service:
|
||||
name: "spamassassin"
|
||||
state: "restarted"
|
||||
|
|
@ -0,0 +1,220 @@
|
|||
---
|
||||
#
|
||||
# Install role packages
|
||||
#
|
||||
|
||||
- name: install filtering packages and monitoring components
|
||||
apt:
|
||||
name:
|
||||
- postfix
|
||||
- postfix-pcre
|
||||
- mailgraph
|
||||
- amavis
|
||||
- spamassassin
|
||||
- clamav-daemon
|
||||
- libnet-dns-perl
|
||||
- libmail-spf-perl
|
||||
- postfix-policyd-spf-python
|
||||
- pfqueue
|
||||
state: latest
|
||||
|
||||
- name: install compression algorithms for scanning
|
||||
apt:
|
||||
name:
|
||||
- p7zip-full
|
||||
- arj
|
||||
- bzip2
|
||||
- cabextract
|
||||
- cpio
|
||||
- file
|
||||
- gzip
|
||||
- lhasa
|
||||
- liblz4-tool
|
||||
- lrzip
|
||||
- lzop
|
||||
- nomarch
|
||||
- pax
|
||||
- rar
|
||||
- rpm
|
||||
- unrar-free
|
||||
- unzip
|
||||
- xz-utils
|
||||
- zip
|
||||
state: latest
|
||||
|
||||
#
|
||||
# ClamAV
|
||||
#
|
||||
|
||||
- name: ensure clamav is in amavis group
|
||||
user:
|
||||
name: "clamav"
|
||||
append: "yes"
|
||||
groups: "amavis"
|
||||
|
||||
- name: ensure amavis is in clamav group
|
||||
user:
|
||||
name: "amavis"
|
||||
append: "yes"
|
||||
groups: "clamav"
|
||||
|
||||
#
|
||||
# policyd SPF
|
||||
#
|
||||
|
||||
- name: install policyd-spf config
|
||||
template:
|
||||
src: "{{ item }}.j2"
|
||||
dest: "/etc/postfix-policyd-spf-python/{{ item }}"
|
||||
notify:
|
||||
- restart postfix
|
||||
with_items:
|
||||
- "policyd-spf.conf"
|
||||
|
||||
#
|
||||
# SpamAssassin
|
||||
#
|
||||
|
||||
- name: install SpamAssassin config
|
||||
template:
|
||||
src: "{{ item }}.j2"
|
||||
dest: "/etc/spamassassin/{{ item }}"
|
||||
notify:
|
||||
- restart spamassassin
|
||||
- restart amavis
|
||||
with_items:
|
||||
- "local.cf"
|
||||
- "90_customrules.cf"
|
||||
|
||||
#
|
||||
# Amavis
|
||||
#
|
||||
|
||||
- name: install Amavis configs
|
||||
template:
|
||||
src: "{{ item }}.j2"
|
||||
dest: "/etc/amavis/conf.d/{{ item }}"
|
||||
notify:
|
||||
- restart amavis
|
||||
with_items:
|
||||
- "15-content_filter_mode"
|
||||
- "50-user"
|
||||
|
||||
#
|
||||
# Postfix
|
||||
#
|
||||
|
||||
- name: create the Postfix local config dir
|
||||
file:
|
||||
state: directory
|
||||
dest: "/etc/postfix/local"
|
||||
|
||||
- name: install the Postfix main configs
|
||||
template:
|
||||
src: "{{ item }}.j2"
|
||||
dest: "/etc/postfix/{{ item }}"
|
||||
notify:
|
||||
- restart postfix
|
||||
with_items:
|
||||
- "main.cf"
|
||||
- "master.cf"
|
||||
|
||||
- name: install the Postfix local configs
|
||||
template:
|
||||
src: "{{ item }}.j2"
|
||||
dest: "/etc/postfix/local/{{ item }}"
|
||||
notify:
|
||||
- restart postfix
|
||||
with_items:
|
||||
- helo_access
|
||||
- recipient_access
|
||||
- relay_domains
|
||||
- transport
|
||||
- virtual
|
||||
|
||||
- name: link /etc/mailname to /etc/hostname
|
||||
file:
|
||||
dest: "/etc/mailname"
|
||||
src: "/etc/hostname"
|
||||
state: "link"
|
||||
force: "yes"
|
||||
|
||||
#
|
||||
# Verify and enable services
|
||||
#
|
||||
|
||||
- name: verify and enable services
|
||||
service:
|
||||
name: "{{ item }}"
|
||||
state: "started"
|
||||
enabled: "yes"
|
||||
with_items:
|
||||
- "postfix"
|
||||
- "amavis"
|
||||
- "clamav-daemon"
|
||||
|
||||
#
|
||||
# SpamAssassin training
|
||||
#
|
||||
|
||||
- name: download spam sample archive
|
||||
copy:
|
||||
src: "spam-sample.txz"
|
||||
dest: "/var/cache/spam-sample.txz"
|
||||
owner: "root"
|
||||
group: "root"
|
||||
mode: "400"
|
||||
register: spamsample
|
||||
|
||||
- name: make temporary directory
|
||||
command: "mktemp -d"
|
||||
register: tempdirspam
|
||||
when: spamsample.changed
|
||||
|
||||
- name: extract spam sample archive to temporary directory
|
||||
unarchive:
|
||||
remote_src: "yes"
|
||||
src: "/var/cache/spam-sample.txz"
|
||||
dest: "{{ tempdirspam.stdout }}/"
|
||||
when: spamsample.changed
|
||||
|
||||
- name: sa-learn from the spam sample
|
||||
command: "sa-learn --spam {{ tempdirspam.stdout }}/spam-sample/"
|
||||
when: spamsample.changed
|
||||
|
||||
- name: remove temporary directory
|
||||
file:
|
||||
dest: "{{ tempdirspam.stdout }}"
|
||||
state: "absent"
|
||||
when: spamsample.changed
|
||||
|
||||
- name: download ham sample archive
|
||||
copy:
|
||||
src: "ham-sample.txz"
|
||||
dest: "/var/cache/ham-sample.txz"
|
||||
owner: "root"
|
||||
group: "root"
|
||||
mode: "400"
|
||||
register: hamsample
|
||||
|
||||
- name: make temporary directory
|
||||
command: "mktemp -d"
|
||||
register: tempdirham
|
||||
when: hamsample.changed
|
||||
|
||||
- name: extract ham sample archive to temporary directory
|
||||
unarchive:
|
||||
remote_src: "yes"
|
||||
src: "/var/cache/ham-sample.txz"
|
||||
dest: "{{ tempdirham.stdout }}/"
|
||||
when: hamsample.changed
|
||||
|
||||
- name: sa-learn from the ham sample
|
||||
command: "sa-learn --ham {{ tempdirham.stdout }}/ham-sample/"
|
||||
when: hamsample.changed
|
||||
|
||||
- name: remove temporary directory
|
||||
file:
|
||||
dest: "{{ tempdirham.stdout }}"
|
||||
state: "absent"
|
||||
when: hamsample.changed
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
use strict;
|
||||
|
||||
# Amavis filter configuration
|
||||
# {{ ansible_managed }}
|
||||
|
||||
@bypass_virus_checks_maps = (
|
||||
\%bypass_virus_checks, \@bypass_virus_checks_acl, \$bypass_virus_checks_re);
|
||||
|
||||
@bypass_spam_checks_maps = (
|
||||
\%bypass_spam_checks, \@bypass_spam_checks_acl, \$bypass_spam_checks_re);
|
||||
|
||||
1; # ensure a defined return
|
||||
|
|
@ -0,0 +1,40 @@
|
|||
use strict;
|
||||
|
||||
@local_domains_acl = ( "." );
|
||||
$sa_tag_level_deflt = -9999;
|
||||
$sa_tag2_level_deflt = 5;
|
||||
$sa_kill_level_deflt = 9999;
|
||||
$sa_spam_subject_tag = '*** SPAM *** ';
|
||||
$final_spam_destiny = 'D_PASS';
|
||||
|
||||
$bad_header_quarantine_method = undef;
|
||||
|
||||
$notify_method = '{{ notify_method }}';
|
||||
|
||||
$newvirus_admin = '{{ notify_admin }}';
|
||||
$virus_admin = '{{ notify_admin }}';
|
||||
$spam_admin = '{{ notify_admin }}';
|
||||
|
||||
$banned_admin = \@virus_admin_maps; # for compatibility with pre-2.2.1
|
||||
$bad_header_admin = \@virus_admin_maps; # for compatibility with pre-2.2.1
|
||||
@newvirus_admin_maps = (\$newvirus_admin);
|
||||
@virus_admin_maps = (\%virus_admin, \$virus_admin);
|
||||
@spam_admin_maps = (\%spam_admin, \$spam_admin);
|
||||
@banned_admin_maps = (\$banned_admin);
|
||||
@bad_header_admin_maps= (\$bad_header_admin);
|
||||
|
||||
{% if custom_sender_scores is defined %}
|
||||
# Custom sender_map scores
|
||||
@score_sender_maps = ({
|
||||
'.' => [
|
||||
new_RE(
|
||||
{% for score in custom_sender_scores %}
|
||||
{{ score }},
|
||||
{% endfor %}
|
||||
),
|
||||
],
|
||||
});
|
||||
{% endif %}
|
||||
|
||||
#------------ Do not modify anything below this line -------------
|
||||
1; # ensure a defined return
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
# Adjustments to default SpamAssassin scoring
|
||||
# {{ ansible_managed }}
|
||||
score RCVD_IN_PSBL 3.5 # Increase default score significantly
|
||||
score URIBL_BLACK 3.5 # Increase default score significantly
|
||||
score LOTS_OF_MONEY 2 # Increase default score a little
|
||||
score ADVANCE_FEE_4_NEW 2 # Increase default score a little
|
||||
score RDNS_NONE 0.5 # Decrease default score a little
|
||||
|
|
@ -0,0 +1,2 @@
|
|||
/^\[[0-9]{1,3}(\.[0-9]{1,3}){3}\]$/ DUNNO announced self using an address literal
|
||||
/^[0-9]{1,3}(\.[0-9]{1,3}){3}$/ REJECT announced self with an IP address instead of a domain name
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
# SpamAssassin local config
|
||||
# {{ ansible_managed }}
|
||||
|
||||
report_safe 1
|
||||
required_score 4.5
|
||||
|
||||
use_bayes 1
|
||||
bayes_auto_learn 1
|
||||
bayes_auto_learn_threshold_nonspam -0.1
|
||||
bayes_auto_learn_threshold_spam 9.0
|
||||
|
||||
score BAYES_00 -4
|
||||
score BAYES_05 -2
|
||||
score BAYES_80 2
|
||||
score BAYES_95 6
|
||||
score BAYES_99 8
|
||||
|
||||
bayes_ignore_header X-Bogosity
|
||||
bayes_ignore_header X-Spam-Flag
|
||||
bayes_ignore_header X-Spam-Status
|
||||
|
||||
bayes_path /var/spamassassin/bayes_db/bayes
|
||||
bayes_file_mode 0777
|
||||
|
||||
skip_rbl_checks 0
|
||||
ok_languages all
|
||||
ok_locales all
|
||||
|
|
@ -0,0 +1,91 @@
|
|||
# Main Postfix configuration
|
||||
# {{ ansible_managed }}
|
||||
|
||||
myorigin = /etc/mailname
|
||||
myhostname = {{ ansible_fqdn }}
|
||||
|
||||
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
|
||||
message_size_limit = 26214400
|
||||
mailbox_size_limit = 0
|
||||
default_process_limit = 1000
|
||||
recipient_delimiter = +
|
||||
inet_interfaces = all
|
||||
|
||||
smtpd_banner = {{ ansible_fqdn }} ESMTP $mail_name (Debian/GNU)
|
||||
biff = no
|
||||
append_dot_mydomain = no
|
||||
delay_warning_time = 48h
|
||||
maximal_queue_lifetime = 14d
|
||||
bounce_queue_lifetime = 14d
|
||||
readme_directory = no
|
||||
compatibility_level = 2
|
||||
|
||||
smtpd_use_tls={{ tls_enabled }}
|
||||
smtpd_tls_dh1024_param_file = /etc/ssl/dhparams.pem
|
||||
smtpd_tls_cert_file={{ tls_cert }}
|
||||
smtpd_tls_key_file={{ tls_key }}
|
||||
smtpd_tls_ask_ccert = yes
|
||||
smtpd_tls_received_header = yes
|
||||
smtpd_tls_loglevel = 1
|
||||
smtpd_tls_session_cache_database = btree:$data_directory/smtpd_scache
|
||||
smtpd_tls_security_level = may
|
||||
smtpd_tls_protocols = !SSLv2,!SSLv3
|
||||
smtpd_tls_ciphers = medium
|
||||
smtpd_tls_exclude_ciphers = RC4, CAMELLIA, SEED, 3DES
|
||||
|
||||
smtp_use_tls={{ tls_enabled }}
|
||||
smtp_tls_cert_file={{ tls_cert }}
|
||||
smtp_tls_key_file={{ tls_key }}
|
||||
smtp_tls_session_cache_database = btree:$data_directory/smtp_scache
|
||||
smtp_tls_loglevel = 1
|
||||
smtp_tls_security_level = may
|
||||
smtp_tls_protocols = $smtpd_tls_protocols
|
||||
smtp_tls_ciphers = $smtpd_tls_ciphers
|
||||
smtp_tls_exclude_ciphers = $smtpd_tls_exclude_ciphers
|
||||
|
||||
mydestination =
|
||||
local_recipient_maps =
|
||||
alias_maps =
|
||||
alias_database =
|
||||
virtual_alias_maps = pcre:$config_directory/local/virtual
|
||||
local_transport = error:local mail delivery is disabled
|
||||
transport_maps = pcre:$config_directory/local/transport
|
||||
relay_domains = $config_directory/local/relay_domains
|
||||
|
||||
content_filter = smtp-amavis:[127.0.0.1]:10024
|
||||
smtpd_client_recipient_rate_limit = 250
|
||||
strict_rfc821_envelopes = yes
|
||||
receive_override_options = no_address_mappings
|
||||
policyd-spf_time_limit = 3600
|
||||
smtpd_relay_restrictions =
|
||||
permit_mynetworks
|
||||
reject_unauth_destination
|
||||
check_policy_service unix:private/policyd-spf
|
||||
{% for rbl in remote_block_lists %}
|
||||
reject_rbl_client {{ rbl }}
|
||||
{% endfor %}
|
||||
warn_if_reject reject_unknown_client
|
||||
|
||||
smtpd_helo_required = yes
|
||||
smtpd_helo_restrictions =
|
||||
check_helo_access pcre:$config_directory/local/helo_access
|
||||
reject_invalid_hostname
|
||||
|
||||
smtpd_sender_restrictions =
|
||||
check_sender_mx_access cidr:$config_directory/local/mx_access
|
||||
reject_unknown_sender_domain
|
||||
reject_non_fqdn_sender
|
||||
check_sender_access pcre:$config_directory/local/sender_access
|
||||
|
||||
smtpd_recipient_restrictions =
|
||||
reject_unknown_recipient_domain
|
||||
reject_non_fqdn_recipient
|
||||
reject_unauth_pipelining
|
||||
reject_unauth_destination
|
||||
check_policy_service unix:private/policyd-spf
|
||||
check_recipient_access pcre:$config_directory/local/recipient_access
|
||||
reject_unverified_recipient
|
||||
|
||||
smtpd_data_restrictions =
|
||||
reject_multi_recipient_bounce
|
||||
reject_unauth_pipelining
|
||||
|
|
@ -0,0 +1,62 @@
|
|||
# Postfix master process configuration file
|
||||
# {{ ansible_managed }}
|
||||
|
||||
# ==========================================================================
|
||||
# service type private unpriv chroot wakeup maxproc command + args
|
||||
# (yes) (yes) (yes) (never) (100)
|
||||
# ==========================================================================
|
||||
smtp inet n - y - - smtpd
|
||||
pickup unix n - y 60 1 pickup
|
||||
-o content_filter=
|
||||
-o receive_override_options=no_header_body_checks
|
||||
cleanup unix n - y - 0 cleanup
|
||||
qmgr unix n - n 300 1 qmgr
|
||||
tlsmgr unix - - y 1000? 1 tlsmgr
|
||||
rewrite unix - - y - - trivial-rewrite
|
||||
bounce unix - - y - 0 bounce
|
||||
defer unix - - y - 0 bounce
|
||||
trace unix - - y - 0 bounce
|
||||
verify unix - - y - 1 verify
|
||||
flush unix n - y 1000? 0 flush
|
||||
proxymap unix - - n - - proxymap
|
||||
proxywrite unix - - n - 1 proxymap
|
||||
smtp unix - - y - - smtp
|
||||
relay unix - - y - - smtp
|
||||
showq unix n - y - - showq
|
||||
error unix - - y - - error
|
||||
retry unix - - y - - error
|
||||
discard unix - - y - - discard
|
||||
local unix - n n - - local
|
||||
virtual unix - n n - - virtual
|
||||
lmtp unix - - y - - lmtp
|
||||
anvil unix - - y - 1 anvil
|
||||
scache unix - - y - 1 scache
|
||||
|
||||
policyd-spf unix - n n - 0 spawn
|
||||
user=policyd-spf argv=/usr/bin/policyd-spf
|
||||
|
||||
smtp-amavis unix - - y - 2 smtp
|
||||
-o smtp_data_done_timeout=1200
|
||||
-o smtp_send_xforward_command=yes
|
||||
-o disable_dns_lookups=yes
|
||||
-o max_use=20
|
||||
|
||||
127.0.0.1:10025 inet n - y - - smtpd
|
||||
-o content_filter=
|
||||
-o local_recipient_maps=
|
||||
-o relay_recipient_maps=
|
||||
-o smtpd_restriction_classes=
|
||||
-o smtpd_delay_reject=no
|
||||
-o smtpd_client_restrictions=permit_mynetworks,reject
|
||||
-o smtpd_helo_restrictions=
|
||||
-o smtpd_sender_restrictions=
|
||||
-o smtpd_recipient_restrictions=permit_mynetworks,reject
|
||||
-o smtpd_data_restrictions=reject_unauth_pipelining
|
||||
-o smtpd_end_of_data_restrictions=
|
||||
-o mynetworks=127.0.0.0/8
|
||||
-o smtpd_error_sleep_time=0
|
||||
-o smtpd_soft_error_limit=1001
|
||||
-o smtpd_hard_error_limit=1000
|
||||
-o smtpd_client_connection_count_limit=0
|
||||
-o smtpd_client_connection_rate_limit=0
|
||||
-o receive_override_options=no_header_body_checks,no_unknown_recipient_checks
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
# policyd SPF config
|
||||
# {{ ansible_managed }}
|
||||
|
||||
debugLevel = 1
|
||||
|
||||
HELO_reject = False
|
||||
Mail_From_reject = False
|
||||
|
||||
PermError_reject = False
|
||||
TempError_Defer = False
|
||||
|
||||
skip_addresses = 127.0.0.0/8,::ffff:127.0.0.0/104,::1
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
/[%!@].*[%!@]/ REJECT sender-specified routing in recipient address
|
||||
/&.*@/ REJECT invalid user
|
||||
/^(daemon|bin|sys|sync|games|man|lp|news|uucp|proxy|www-data|backup|list|irc|gnats|nobody)@/ REJECT reserved system user
|
||||
/^(ntp|sshd|munin|postfix|clamav|sqlgrey|policyd-spf|bind|statd|freerad|mysql|smokeping|systemd-.+|)@/ REJECT reserved system user
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
{% for domain in relay_domains %}
|
||||
{{ domain.domain }}
|
||||
{% endfor %}
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
{% for domain in relay_domains %}
|
||||
/@{{ domain.domain }}$/ relay:{{ domain.relay }}
|
||||
{% endfor %}
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
{% for map in virtual_maps %}
|
||||
{{ map.regex }} {{ map.map }}
|
||||
{% endfor %}
|
||||
Loading…
Reference in New Issue