Configure Postfix server (4/7)

Configure Postfix server (4/7)

# Create a backup file of main.cf and master.cf files.

[root@mailserver ~]# cd /etc/postfix

[root@mailserver postfix]# cat main.cf > main.cf.org

[root@mailserver postfix]# cat master.cf > master.cf.org

# Create new file main.cf

[root@mailserver sql]# vim /etc/postfix/main.cf

[root@mailserver sql]# cat /etc/postfix/main.cf

myhostname = mailserver.example.com

mydomain = example.com

myorigin = $mydomain

inet_interfaces = all

inet_protocols = ipv4

mynetworks_style = host

mynetworks = $config_directory/mynetworks

smtpd_banner = $myhostname ESMTP $mail_name

# ---------------------- VIRTUAL DOMAINS START ----------------------

virtual_alias_maps = proxy:mysql:$config_directory/sql/virtual_alias_maps.cf

virtual_mailbox_domains = proxy:mysql:$config_directory/sql/virtual_domains_maps.cf

virtual_mailbox_maps = proxy:mysql:$config_directory/sql/virtual_mailbox_maps.cf

#virtual_mailbox_limit_maps = proxy:mysql:$config_directory/sql/virtual_mailbox_limit_maps.cf

virtual_mailbox_base = /home/mail

virtual_uid_maps = static:8

virtual_gid_maps = static:12

mailbox_size_limit = 104857600

message_size_limit = 104857600

relay_domains = proxy:mysql:$config_directory/sql/relay_domains.cf

relay_recipient_maps = proxy:mysql:$config_directory/sql/relay_recipient_maps.cf

transport_maps = proxy:mysql:$config_directory/sql/transport_maps.cf

#transport_maps = hash:$config_directory/transport

#virtual_transport = dovecot

dovecot_destination_recipient_limit = 1

# ----------------------- VIRTUAL DOMAINS END -----------------------

# ------------------------- SASL PART START -------------------------

broken_sasl_auth_clients = yes

smtpd_helo_required = yes

smtpd_client_restrictions = permit_sasl_authenticated

smtpd_sender_restrictions = permit_sasl_authenticated

smtpd_sasl_auth_enable = yes

smtpd_sasl_security_options = noanonymous

smtpd_sasl_tls_security_options = $smtpd_sasl_security_options

smtpd_sasl_type = dovecot

# Can be an absolute path, or relative to $queue_directory

smtpd_sasl_path = private/auth

# -------------------------- SASL PART END --------------------------

# -------------------------- TLS PART START -------------------------

smtpd_use_tls = yes

smtpd_tls_auth_only = yes

smtpd_tls_cert_file = /etc/pki/tls/certs/mailserver.example.com.crt

smtpd_tls_key_file = /etc/pki/tls/certs/mailserver.example.com.key

smtpd_tls_received_header = yes

smtpd_tls_loglevel = 1

tls_random_source = dev:/dev/urandom

# --------------------------- TLS PART END --------------------------

# ------------------ SMTPD RESTRICTIONS PART START ------------------

disable_vrfy_command = yes

non_fqdn_reject_code = 450

invalid_hostname_reject_code = 450

maps_rbl_reject_code = 450

unverified_sender_reject_code = 550

#header_checks = pcre:$config_directory/header_checks

#body_checks = pcre:$config_directory/body_checks

#warning: the restrictions reject_unknown_(sender|recipient)_domain

#will trigger if your DNS becomes unavailable

smtpd_recipient_restrictions =

permit_mynetworks

permit_sasl_authenticated

reject_unauth_destination

reject_invalid_helo_hostname

warn_if_reject reject_non_fqdn_helo_hostname

warn_if_reject reject_unknown_helo_hostname

warn_if_reject reject_unknown_client

reject_non_fqdn_sender

reject_non_fqdn_recipient

reject_unknown_sender_domain

reject_unknown_recipient_domain

check_client_access hash:$config_directory/rbl_override

reject_rbl_client zen.spamhaus.org

reject_rbl_client bl.spamcop.net

reject_rbl_client dnsbl.sorbs.net=127.0.0.2

reject_rbl_client dnsbl.sorbs.net=127.0.0.3

reject_rbl_client dnsbl.sorbs.net=127.0.0.4

reject_rbl_client dnsbl.sorbs.net=127.0.0.5

reject_rbl_client dnsbl.sorbs.net=127.0.0.7

reject_rbl_client dnsbl.sorbs.net=127.0.0.9

reject_rbl_client dnsbl.sorbs.net=127.0.0.11

reject_rbl_client dnsbl.sorbs.net=127.0.0.12

permit

smtpd_data_restrictions =

permit_mynetworks,

reject_unauth_pipelining,

reject_multi_recipient_bounce,

permit

# ------------------- SMTPD RESTRICTIONS PART END --------------------

Create below line in master.cf file

[root@mailserver sql]# vim /etc/postfix/master.cf

[root@mailserver sql]# cat /etc/postfix/master.cf

#

# Postfix master process configuration file. For details on the format

# of the file, see the master(5) manual page (command: "man 5 master").

#

# Do not forget to execute "postfix reload" after editing this file.

#

# ==========================================================================

# service type private unpriv chroot wakeup maxproc command + args

# (yes) (yes) (yes) (never) (100)

# ==========================================================================

smtp inet n - n - - smtpd

#smtp inet n - n - 1 postscreen

#smtpd pass - - n - - smtpd

#dnsblog unix - - n - 0 dnsblog

#tlsproxy unix - - n - 0 tlsproxy

#submission inet n - n - - smtpd

# -o syslog_name=postfix/submission

# -o smtpd_tls_security_level=encrypt

# -o smtpd_sasl_auth_enable=yes

# -o smtpd_reject_unlisted_recipient=no

# -o smtpd_client_restrictions=$mua_client_restrictions

# -o smtpd_helo_restrictions=$mua_helo_restrictions

# -o smtpd_sender_restrictions=$mua_sender_restrictions

# -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject

# -o milter_macro_daemon_name=ORIGINATING

smtps inet n - n - - smtpd

-o syslog_name=postfix/smtps

-o smtpd_tls_wrappermode=yes

-o smtpd_sasl_auth_enable=yes

# -o smtpd_reject_unlisted_recipient=no

# -o smtpd_client_restrictions=$mua_client_restrictions

# -o smtpd_helo_restrictions=$mua_helo_restrictions

# -o smtpd_sender_restrictions=$mua_sender_restrictions

-o smtpd_recipient_restrictions=permit_sasl_authenticated,reject

# -o milter_macro_daemon_name=ORIGINATING

#628 inet n - n - - qmqpd

pickup unix n - n 60 1 pickup

cleanup unix n - n - 0 cleanup

qmgr unix n - n 300 1 qmgr

#qmgr unix n - n 300 1 oqmgr

tlsmgr unix - - n 1000? 1 tlsmgr

rewrite unix - - n - - trivial-rewrite

bounce unix - - n - 0 bounce

defer unix - - n - 0 bounce

trace unix - - n - 0 bounce

verify unix - - n - 1 verify

flush unix n - n 1000? 0 flush

proxymap unix - - n - - proxymap

proxywrite unix - - n - 1 proxymap

smtp unix - - n - - smtp

relay unix - - n - - smtp

# -o smtp_helo_timeout=5 -o smtp_connect_timeout=5

showq unix n - n - - showq

error unix - - n - - error

retry unix - - n - - error

discard unix - - n - - discard

local unix - n n - - local

virtual unix - n n - - virtual

lmtp unix - - n - - lmtp

anvil unix - - n - 1 anvil

scache unix - - n - 1 scache

#

# ====================================================================

# Interfaces to non-Postfix software. Be sure to examine the manual

# pages of the non-Postfix software to find out what options it wants.

#

# Many of the following services use the Postfix pipe(8) delivery

# agent. See the pipe(8) man page for information about ${recipient}

# and other message envelope options.

# ====================================================================

#

# maildrop. See the Postfix MAILDROP_README file for details.

# Also specify in main.cf: maildrop_destination_recipient_limit=1

#

#maildrop unix - n n - - pipe

# flags=DRhu user=vmail argv=/usr/local/bin/maildrop -d ${recipient}

#

# ====================================================================

#

# Recent Cyrus versions can use the existing "lmtp" master.cf entry.

#

# Specify in cyrus.conf:

# lmtp cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4

#

# Specify in main.cf one or more of the following:

# mailbox_transport = lmtp:inet:localhost

# virtual_transport = lmtp:inet:localhost

#

# ====================================================================

#

# Cyrus 2.1.5 (Amos Gouaux)

# Also specify in main.cf: cyrus_destination_recipient_limit=1

#

#cyrus unix - n n - - pipe

# user=cyrus argv=/usr/lib/cyrus-imapd/deliver -e -r ${sender} -m ${extension} ${user}

#

# ====================================================================

#

# Old example of delivery via Cyrus.

#

#old-cyrus unix - n n - - pipe

# flags=R user=cyrus argv=/usr/lib/cyrus-imapd/deliver -e -m ${extension} ${user}

#

# ====================================================================

#

# See the Postfix UUCP_README file for configuration details.

#

#uucp unix - n n - - pipe

# flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)

#

# ====================================================================

#

# Other external delivery methods.

#

#ifmail unix - n n - - pipe

# flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)

#

#bsmtp unix - n n - - pipe

# flags=Fq. user=bsmtp argv=/usr/local/sbin/bsmtp -f $sender $nexthop $recipient

#

#scalemail-backend unix - n n - 2 pipe

# flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store

# ${nexthop} ${user} ${extension}

#

#mailman unix - n n - - pipe

# flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py

# ${nexthop} ${user}

#

# add line for dovecot

dovecot unix - n n - - pipe

flags=DRhu user=mail:mail argv=/usr/libexec/dovecot/deliver -d ${recipient}

[root@mailserver postfix]#

[root@mailserver ~]# vim /etc/postfix/mynetworks

[root@mailserver ~]# cat /etc/postfix/mynetworks

# This specifies the list of subnets that Postfix considers as

# "trusted" SMTP clients that have more privileges than "strangers".

#

# In particular, "trusted" SMTP clients are allowed to relay mail

# through Postfix.

#

# Be sure to add your public ip address block if needed.

#

127.0.0.0/8

192.168.10.0/24

[root@mailserver ~]#

[root@mailserver ~]# vim /etc/postfix/rbl_override

[root@mailserver ~]# cat /etc/postfix/rbl_override

mailserver.example.com OK

192.168.10.0/24 OK

[root@mailserver ~]# postmap /etc/postfix/rbl_override

Create new folder in /etc/postfix/sql

[root@mailserver postfix]# mkdir sql

[root@mailserver postfix]# cd /etc/postfix/sql

[root@mailserver sql]#

[root@mailserver sql]# vim /etc/postfix/sql/virtual_alias_maps.cf

[root@mailserver sql]# cat /etc/postfix/sql/virtual_alias_maps.cf

hosts = localhost

dbname = maildb

user = mailuser

password = redhat

table = alias

select_field = goto

where_field = address

additional_conditions = AND active = '1'

[root@mailserver sql]#

[root@mailserver sql]# vim /etc/postfix/sql/virtual_domains_maps.cf

[root@mailserver sql]# cat /etc/postfix/sql/virtual_domains_maps.cf

hosts = localhost

dbname = maildb

user = mailuser

password = redhat

table = domain

select_field = description

where_field = domain

additional_conditions = AND backupmx = '0' AND active = '1'

[root@mailserver sql]#

[root@mailserver sql]# vim /etc/postfix/sql/virtual_mailbox_maps.cf

[root@mailserver sql]# cat /etc/postfix/sql/virtual_mailbox_maps.cf

hosts = localhost

dbname = maildb

user = mailuser

password = redhat

table = mailbox

select_field = maildir

where_field = username

additional_conditions = AND active = '1'

[root@mailserver sql]#

[root@mailserver sql]# vim /etc/postfix/sql/virtual_mailbox_limit_maps.cf

[root@mailserver sql]# cat /etc/postfix/sql/virtual_mailbox_limit_maps.cf

hosts = localhost

dbname = maildb

user = mailuser

password = redhat

table = mailbox

select_field = quota

where_field = username

additional_conditions = AND active = '1'

[root@mailserver sql]#

[root@mailserver sql]# vim /etc/postfix/sql/relay_domains.cf

[root@mailserver sql]# cat /etc/postfix/sql/relay_domains.cf

hosts = localhost

dbname = maildb

user = mailuser

password = redhat

table = domain

select_field = domain

where_field = domain

additional_conditions = AND backupmx = '1' AND active = '1'

[root@mailserver sql]#

[root@mailserver sql]# vim /etc/postfix/sql/relay_recipient_maps.cf

[root@mailserver sql]# cat /etc/postfix/sql/relay_recipient_maps.cf

hosts = localhost

dbname = maildb

user = mailuser

password = redhat

table = alias

select_field = goto

where_field = address

additional_conditions = AND active = '1'

[root@mailserver sql]#

[root@mailserver sql]# vim /etc/postfix/sql/transport_maps.cf

[root@mailserver sql]# cat /etc/postfix/sql/transport_maps.cf

hosts = localhost

dbname = maildb

user = mailuser

password = redhat

table = domain

select_field = transport

where_field = domain

additional_conditions = AND active = '1'

[root@mailserver sql]#

[root@mailserver sql]# chown root:postfix /etc/postfix/sql/ -R

[root@mailserver sql]# chcon -u system_u /etc/postfix/sql -R

[root@mailserver sql]# chmod 0640 /etc/postfix/sql/*.cf

[root@mailserver sql]# chmod 0750 /etc/postfix/sql/

[root@mailserver sql]# newaliases