postfixもだいぶ堅牢になっているようだし、設定の一覧作っておこうと思う。
間違えて壊しちゃっても「ここからコピペ」すればいいしね。
先ずはコンパイルオプション書いておかないと。
|
1 |
sudo port upgrade --enforce-variants postfix +dovecot_sasl +pcre +tls |
+dovecot_saslで認証作業はdovecotに一任しちゃう。
+pcreでPerl互換正規表現（Perl Compatible Regular Expressions）を使えるようにする。
+tlsでTLS接続可能にする。
upgrade –enforce-variantsは元々pcreが無かったpostfixに追加付きのupgradeだから。
port installならいらない呪文。
pcreを足したのは、main.cfで使っているところがあるからそっちで説明する。
次はmaster.cfなんだけれど、こっちはよく判っていない。
殆どGeminiさん任せにしちゃったから。
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 |
smtps inet n - n - - smtpd -o syslog_name=postfix/smtps -o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes -o smtpd_reject_unlisted_recipient=no -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject smtp inet n - n - 1 postscreen -o tls_preempt_cipherlist=yes smtpd pass - - n - - smtpd -o syslog_name=postfix/smtpd dnsblog unix - - n - 0 dnsblog tlsproxy unix - - n - 0 tlsproxy submission inet n - n - - smtpd -o smtpd_tls_security_level=encrypt -o smtpd_sasl_auth_enable=yes -o smtpd_sasl_type=dovecot -o smtpd_sasl_path=private/auth -o smtpd_sasl_security_options=noanonymous -o smtpd_sasl_local_domain=$myhostname -o smtpd_client_restrictions=permit_sasl_authenticated,reject -o smtpd_sender_restrictions=reject_sender_login_mismatch -o smtpd_recipient_restrictions=reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_sasl_authenticated,reject pickup unix n - n 60 1 pickup cleanup unix n - n - 0 cleanup qmgr unix n - n 300 1 qmgr tlsmgr unix - - n 1000? 1 tlsmgr rewrite unix - - n - - trivial-rewrite bounce unix - - n - 0 bounce defer unix - - n - 0 bounce trace unix - - n - 0 bounce verify unix - - n - 1 verify flush unix n - n 1000? 0 flush proxymap unix - - n - - proxymap proxywrite unix - - n - 1 proxymap smtp unix - - n - - smtp relay unix - - n - - smtp -o syslog_name=postfix/$service_name -o smtp_helo_timeout=5 -o smtp_connect_timeout=5 showq unix n - n - - showq error unix - - n - - error retry unix - - n - - error discard unix - - n - - discard local unix - n n - - local virtual unix - n n - - virtual lmtp unix - - n - - lmtp anvil unix - - n - 1 anvil scache unix - - n - 1 scache postlog unix-dgram n - n - 1 postlogd dovecot unix - n n - - pipe flags=DRhu user=vmail:vmail argv=/opt/local/libexec/dovecot/dovecot-lda -f ${sender} -d ${recipient} smtp-amavis unix - - n - 2 smtp -o smtp_tls_security_level=none -o smtp_data_done_timeout=1200 -o smtp_send_xforward_command=yes -o smtp_dns_support_level=disabled -o max_use=20 127.0.0.1:10025 inet n - n - - smtpd -o content_filter= -o smtpd_delay_reject=no -o smtp_tls_security_level=none -o smtpd_client_restrictions=permit_mynetworks,reject -o smtpd_helo_restrictions= -o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_milters -o syslog_name=postfix/smtpd:10025 |
最後の方にあるsmtp-amavisはmain.cfで定義している。
127.0.0.1:10025はsmtp-amavisが返事を送り返してくるのを待ち受けるport。
そしてmain.cf。
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 |
compatibility_level = 3.11 queue_directory = /opt/local/var/spool/postfix command_directory = /opt/local/sbin daemon_directory = /opt/local/libexec/postfix data_directory = /opt/local/var/lib/postfix mail_owner = _postfix default_privs = nobody myhostname = mail.k-in.co.jp mydomain = k-in.co.jp myorigin = $mydomain inet_interfaces = all mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain, mail.$mydomain, smtp.$mydomain, imap.$my domain unknown_local_recipient_reject_code = 550 mynetworks = 192.168.0.0/24, 127.0.0.0/8 relay_domains = relayhost = alias_maps = hash:/etc/aliases alias_database = hash:/opt/local/etc/aliases mail_spool_directory = /Volumes/Works/Library/mail/ luser_relay = unknown_user@k-in.co.jp header_checks = pcre:/opt/local/etc/postfix/header_checks mime_header_checks = pcre:/opt/local/etc/postfix/mime_header_checks nested_header_checks = pcre:/opt/local/etc/postfix/nested_header_checks milter_header_checks = pcre:/opt/local/etc/postfix/milter_header_checks sendmail_path = /opt/local/sbin/sendmail newaliases_path = /opt/local/bin/newaliases mailq_path = /opt/local/bin/mailq setgid_group = _postdrop html_directory = no manpage_directory = /opt/local/share/man sample_directory = /opt/local/share/postfix/sample readme_directory = /opt/local/share/postfix/readme inet_protocols = ipv4 mailbox_size_limit = 0 smtpd_tls_security_level = may smtpd_sasl_auth_enable = yes smtpd_sasl_local_domain = $mydomain smtpd_sasl_security_options = noanonymous, noactive, nodictionary smtpd_sasl_tls_security_options = noanonymous smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth smtpd_tls_auth_only = yes smtp_tls_security_level = may smtpd_tls_cert_file = /opt/local/etc/ssl/certs/bundle.crt smtpd_tls_key_file = /opt/local/etc/ssl/private/server.key smtpd_tls_session_cache_database = btree:$data_directory/smtpd_tls_session_cache smtp_tls_session_cache_database = btree:$data_directory/smtp_tls_session_cache lmtp_tls_session_cache_database = btree:$data_directory/lmtp_tls_session_cache postscreen_cache_map = $data_directory/postscreen_cache_map smtpd_tls_received_header = yes dns_ncache_ttl_fix_enable = yes smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 content_filter = smtp-amavis:[127.0.0.1]:10024 receive_override_options = no_address_mappings smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, check_client_access hash:/opt/local/etc/postfix/access, check_client_access cidr:/opt/local/etc/postfix/access_cidr, check_client_access cidr:/opt/local/etc/postfix/reject_cidr, reject_unauth_destination, reject_non_fqdn_sender, reject_non_fqdn_recipient, reject_unknown_sender_domain, reject_invalid_hostname, reject_unknown_reverse_client_hostname, warn_if_reject reject_unknown_client_hostname, warn_if_reject reject_unknown_helo_hostname, reject_unverified_recipient, reject_non_fqdn_helo_hostname, reject_rhsbl_helo dbl.spamhaus.org, reject_rhsbl_reverse_client dbl.spamhaus.org, reject_rhsbl_sender dbl.spamhaus.org, permit maillog_file = /opt/local/var/log/postfix/postfix_log maillog_file_permissions = 0644 maillog_file_prefixes = /opt/local/var/log, /opt/local/var/log/postfix mailbox_transport = lmtp:unix:private/dovecot-lmtp local_transport = local:$myhostname virtual_transport = lmtp:unix:private/dovecot-lmtp virtual_uid_maps = static:510 virtual_gid_maps = static:510 virtual_minimum_uid = 500 virtual_mailbox_base = /Volumes/Works/Library/mail virtual_mailbox_maps = hash:/opt/local/etc/postfix/virtual virtual_alias_maps = hash:/opt/local/etc/postfix/virtual smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated, hash:/opt/local/etc/postfix/access, cidr:/opt/local/etc/postfix/access_cidr, cidr:/opt/local/etc/postfix/reject_cidr, permit smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, reject_unknown_helo_hostname, permit smtpd_helo_required = yes smtpd_sender_restrictions = reject_unknown_sender_domain reject_non_fqdn_sender reject_unverified_sender smtpd_data_restrictions = reject_unauth_pipelining postscreen_dnsbl_allowlist_threshold = -2 postscreen_dnsbl_sites = zen.spamhaus.org*3 b.barracudacentral.org=127.0.0.[2..11]*2 bl.spameatingmonkey.net*2 bl.spamcop.net dnsbl.sorbs.net list.dnswl.org=127.[0..255].[0..255].0*-2, list.dnswl.org=127.[0..255].[0..255].1*-4, list.dnswl.org=127.[0..255].[0..255].[2..3]*-6 postscreen_non_smtp_command_enable = yes postscreen_bare_newline_enable = yes postscreen_bare_newline_action = enforce postscreen_pipelining_enable = yes postscreen_pipelining_action = enforce postscreen_dnsbl_action = drop postscreen_greet_action = drop smtp_host_lookup = native lmtp_host_lookup = native smtp_dns_support_level = dnssec smtp_discard_ehlo_keywords = pipelining CRLF.CRLF smtp_sasl_security_options = noanonymous smtp_sasl_mechanism_filter = plain, login smtpd_milters = unix:/opt/local/var/run/opendkim/opendkim.sock non_smtpd_milters = $smtpd_milters milter_default_action = accept postscreen_greet_action = drop smtp_host_lookup = native lmtp_host_lookup = native smtp_dns_support_level = dnssec smtp_discard_ehlo_keywords = pipelining CRLF.CRLF smtp_sasl_security_options = noanonymous smtp_sasl_mechanism_filter = plain, login smtpd_milters = unix:/opt/local/var/run/opendkim/opendkim.sock non_smtpd_milters = $smtpd_milters milter_default_action = accept notify_classes = resource, software smtpd_junk_command_limit = 10 |
header_checks = pcre:/opt/local/etc/postfix/header_checks
mime_header_checks = pcre:/opt/local/etc/postfix/mime_header_checks
nested_header_checks = pcre:/opt/local/etc/postfix/nested_header_checks
milter_header_checks = pcre:/opt/local/etc/postfix/milter_header_checks
postfixのコンパイル時に+pcreをつけたのは、この4行のpcre:が必要だったのでした。
何故かは、これで判ります。
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
/^Received:.*\.(site|xyz|online|top|club|cn|kr|ru)/ REJECT Spamer-sender /^Received:.*(\.sphcm\.jp|@sphcm\.jp)/ DISCARD Spamer-sender /^Received:.*\.usedtruckyard\.com/ DISCARD Spamer-sender /^Received:.*\.official-vip-aiyouxi\.com/ DISCARD Spamer-sender /^Received:.*\.m01-ahd-sys\.net/ DISCARD Spamer-sender /^Received:.*\.hubspotemail\.net/ DISCARD Spamer-sender /^Received:.*\[60\.(16[89]|17[0-5])\./ DISCARD Spamer-China-Block /^From:.*cptlst\.net/ DISCARD Spamer-BrandImpact /^From:.*wbpr\.tokyo/ DISCARD Spamer-pr-site /^From:.*mireall\.com/ DISCARD Spamer-pr-site /^X-Mailer: [A-Z]{10,}/ DISCARD Fake mailer signature detected. |
1行目の/^Received:.*\.(site|xyz|online|top|club|cn|kr|ru)/ REJECT Spamer-senderこの(site|xyz|online|top|club|cn|kr|ru)が使いたかったのでした。（+pcre付けないとできないんだわ）
master.cfでの設定はmain.cfのここでportを指定しています。
content_filter = smtp-amavis:[127.0.0.1]:10024
stmp-amavisとあるけれど、master.cfと合っていれば別のでも良いのかもしれない。
mail_spool_directory = /Volumes/Works/Library/mail/
virtual_mailbox_base = /Volumes/Works/Library/mail
この2点が外部ディスク（Volumes/だもんね）なのは、どれだけメールが膨れ上がってもsystem領域を荒らさないため。
実はweb環境も外付けに置いてある。
smtpd_milters = unix:/opt/local/var/run/opendkim/opendkim.sock
これやるためにopendkimもインストールした。
追加で書いて置くのはこのくらいかな。
そしてGeminiさん曰く「個人レベルのサーバーにしては固すぎ（過多すぎ？）」らしい。