Changes between Version 4 and Version 5 of configure_new_server

Timestamp:

Aug 25, 2007, 3:37:53 AM (18 years ago)

Author:

Jamie McClelland

Comment:

--

configure_new_server

@@ -298 +298 @@
 }}}
 
- * Add the following to the bottom of the /etc/postfix/main.cf file:
+ * Add the following to the bottom of the /etc/postfix/main.cf file (change SERVER to the server name)
 
 {{{
 # May First custom config
 # file based virtual hosting configuration
-
 # List of virtual domain names
 virtual_alias_domains = hash:/etc/postfix/virtual_alias_domains
@@ -318 +317 @@
 
 # Added by jamie 6/10/04 to try to stem the tide of spam
-smtpd_sender_restrictions ==
-hash:/etc/postfix/access,
-reject_non_fqdn_sender,
-reject_unknown_sender_domain,
-permit
+smtpd_sender_restrictions =
+  hash:/etc/postfix/access,
+  reject_non_fqdn_sender,
+  reject_unknown_sender_domain,
+  permit
 
 # Added for amavisd-new
-content_filter = smtp-amavis:[127.0.0.1]:10024
-}}}
-
- * Copy the /etc/postfix/master.cf file from chavez to get the amavis settings.
+content_filter=smtp-amavis:[127.0.0.1]:10024
+
+# to enable authentication for sending email
+# and postgrey (policy port 6000 line)
+smtpd_sasl_auth_enable = yes
+smtpd_sasl_security_options = noanonymous
+smtpd_sasl_local_domain = $myhostname
+broken_sasl_auth_clients = yes
+smtpd_recipient_restrictions =
+  permit_sasl_authenticated,
+  permit_mynetworks,
+  reject_unauth_pipelining,
+  reject_non_fqdn_recipient,
+  reject_invalid_hostname,
+  reject_unknown_recipient_domain,
+  reject_unauth_destination,
+  check_policy_service inet:127.0.0.1:60000
+
+# TLS Stuff here:
+tls_random_source = dev:/dev/urandom
+tls_daemon_random_source = dev:/dev/urandom
+
+# sever side tls - offer tls encryption when an smtp client
+# (either user email program or sending smtp server) can use it
+smtpd_tls_security_level = may
+smtpd_tls_CApath = /etc/ssl/certs
+smtpd_tls_loglevel = 1
+smtpd_tls_session_cache_database = sdbm:/var/lib/postfix/smtpd_scache
+# force people who want to authenticate to use tls - you can't authenticate
+# otherwise. This is important because passwords are sent in the clear
+smtpd_tls_auth_only = yes
+smtpd_tls_key_file = /etc/postfix/ssl/SERVER.mayfirst.org.pem
+smtpd_tls_cert_file = /etc/postfix/ssl/SERVER.mayfirst.org.pem
+smtpd_tls_received_header = yes
+smtpd_tls_session_cache_timeout = 3600s
+
+# client side - when we send to a server that offers tls, we should
+# accept
+smtp_tls_security_level = may
+smtp_tls_CApath = /etc/ssl/certs
+smtp_tls_session_cache_database = sdbm:/var/lib/postfix/smtp_scache
+smtp_tls_loglevel = 1
+# http://www.postfix.org/TLS_README.html recommends leaving these
+# lines commented out so we don't present a client certificate.
+# It is rare to be required to have a client certificate and presenting
+# one sometimes causes problems
+#smtp_tls_key_file = /etc/postfix/ssl/SERVER.mayfirst.org.pem
+#smtp_tls_cert_file = /etc/postfix/ssl/SERVER.mayfirst.org.pem
+
+}}}
+
+ * Copy the /etc/postfix/master.cf file from chavez to get the amavis settings (and for chroot to be turned off)
 
  * Postfix as secure mail relay setup