Prinzipiell kannst Du die folgende Postfix-Konfiguration übernehmen, lediglich die Pfade und wenige Optionen musst Du noch an Dein System anpassen.
Code: Select all
mkdir -p /etc/postfix/ssl
cd /etc/postfix/ssl
/etc/ssl/misc/CA.pl -newca
openssl req -new -nodes -keyout server-key.pem -out server-req.pem -days 365
openssl ca -out server-crt.pem -infiles server-req.pem
openssl gendh -out /etc/postfix/ssl/dh_1024.pem -2 -rand /dev/urandom 1024
openssl gendh -out /etc/postfix/ssl/dh_512.pem -2 -rand /dev/urandom 512
chmod 644 /etc/postfix/ssl/server-crt.pem /etc/postfix/ssl/demoCA/cacert.pem
chmod 400 /etc/postfix/ssl/server-key.pem
cd /root
cat > /etc/postfix/main.cf << "EOF"
allow_percent_hack = no
biff = no
broken_sasl_auth_clients = yes
disable_vrfy_command = yes
home_mailbox = .maildir/
mailbox_size_limit = 102400000
masquerade_exceptions = root
message_size_limit = 20480000
mydestination = $myhostname, $mydomain, localhost
mydomain = domain.tld
myhostname = mail.domain.tld
mynetworks = 127.0.0.0/8, 98.76.543.210/32
myorigin = $mydomain
receive_override_options = no_address_mappings
smtpd_client_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
reject_unknown_client_hostname,
permit
smtpd_data_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
reject_unauth_pipelining,
permit
smtpd_delay_reject = yes
smtpd_helo_required = yes
smtpd_helo_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
reject_invalid_helo_hostname,
reject_non_fqdn_helo_hostname,
reject_unknown_helo_hostname,
permit
smtpd_recipient_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
reject_invalid_hostname,
reject_non_fqdn_hostname,
reject_non_fqdn_recipient,
reject_unknown_recipient_domain,
check_recipient_mx_access cidr:/etc/postfix/mx_access,
reject_unauth_destination,
check_recipient_access pcre:/etc/postfix/recipient_checks.pcre,
permit
smtpd_sasl_auth_enable = yes
smtpd_sasl_local_domain = $myhostname
smtpd_sender_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
reject_non_fqdn_sender,
reject_unknown_sender_domain,
permit
smtpd_tls_auth_only = yes
smtpd_tls_CAfile = /etc/postfix/ssl/demoCA/cacert.pem
smtpd_tls_cert_file = /etc/postfix/ssl/server-crt.pem
smtpd_tls_dh1024_param_file = /etc/postfix/ssl/dh_1024.pem
smtpd_tls_dh512_param_file = /etc/postfix/ssl/dh_512.pem
smtpd_tls_key_file = /etc/postfix/ssl/server-key.pem
smtpd_tls_session_cache_database = btree:/var/run/smtpd_tls_session_cache
smtpd_tls_security_level = may
smtpd_use_tls = yes
EOF
cat > /etc/postfix/recipient_checks.pcre << "EOF"
/^@/ 550 Invalid address format.
/[!%@].*@/ 550 This server disallows weird address syntax.
/^postmaster@/ OK
/^hostmaster@/ OK
/^abuse@/ OK
EOF
cat > /etc/postfix/mx_access << "EOF"
0.0.0.0/8 REJECT Domain MX in broadcast network
10.0.0.0/8 REJECT Domain MX in RFC 1918 private network
127.0.0.0/8 REJECT Domain MX in loopback network
169.254.0.0/16 REJECT Domain MX in link local network
172.16.0.0/12 REJECT Domain MX in RFC 1918 private network
192.0.2.0/24 REJECT Domain MX in TEST-NET network
192.168.0.0/16 REJECT Domain MX in RFC 1918 private network
224.0.0.0/4 REJECT Domain MX in class D multicast network
240.0.0.0/5 REJECT Domain MX in class E reserved network
248.0.0.0/5 REJECT Domain MX in reserved network
EOF
postmap /etc/postfix/mx_access
Anzupassende Optionen:
Code: Select all
home_mailbox = .maildir/
mydomain = domain.tld
myhostname = mail.domain.tld
mynetworks = 127.0.0.0/8, 98.76.543.210/32
mydomain und myhostname sollten selbsterklärend sein, home_mailbox musst Du selbst passend konfigurieren und in mynetworks ersetzt Du 98.76.543.210 durch die IP-Adresse des Servers (das /32 ist wichtig!) auf dem Postfix läuft und ergänzt die Liste bei Bedarf um <IP-Adresse>/32 der Webserver.
Damit ist obige erste Lösung bereits umgesetzt. RDNS noch passend setzen, sofern noch nicht geschehen, fertig.
HTH
