infrastructure/ansible
1
0
Fork 0
Code Pull requests 7 Activity Actions

base / smtp-auth: setup main.cf for smtp-auth host

Browse source 
This host needs to have it's own self signed certs and needs some more
config to allow the auth and allow authenticated users to relay.

Signed-off-by: Kevin Fenzi <kevin@scrye.com>
This commit is contained in:
Kevin Fenzi 2023-05-22 10:58:18 -07:00
parent 30befc3ab9
commit ffbc4a001c
1 changed files with 12 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

18
roles/base/files/postfix/main.cf/main.cf.smtp-auth
View file

@ -712,9 +712,9 @@ smtpd_tls_mandatory_exclude_ciphers = aNULL, MD5, RC4
#tls_ssl_options = no_ticket, no_compression
smtpd_tls_loglevel = 1
smtpd_tls_cert_file = /etc/pki/tls/certs/gateway.crt
smtpd_tls_key_file = /etc/pki/tls/private/gateway.key
smtpd_tls_CAfile = /etc/pki/tls/certs/ca-bundle.crt
smtpd_tls_cert_file = /etc/pki/tls/certs/smtpd.crt
smtpd_tls_key_file = /etc/pki/tls/private/smtpd.key
smtpd_tls_CAfile = /etc/pki/tls/certs/ca.crt
smtpd_tls_session_cache_timeout = 3600s
smtpd_tls_session_cache_database = btree:${queue_directory}/smtpd_scache
smtpd_tls_received_header = yes
@ -734,9 +734,15 @@ smtp_tls_mandatory_protocols = !SSLv2,!SSLv3
smtp_tls_mandatory_ciphers = high
smtp_tls_mandatory_exclude_ciphers= aNULL, MD5, RC4
smtp_tls_loglevel = 1
smtp_tls_cert_file = /etc/pki/tls/certs/gateway.crt
smtp_tls_key_file = /etc/pki/tls/private/gateway.key
smtp_tls_CAfile = /etc/pki/tls/certs/ca-bundle.crt
smtp_tls_cert_file = /etc/pki/tls/certs/smtpd.crt
smtp_tls_key_file = /etc/pki/tls/private/smtpd.key
smtp_tls_CAfile = /etc/pki/tls/certs/ca.crt
# Deny email from some domains
smtpd_sender_restrictions = regexp:/etc/postfix/sender_access
# enable sasl smtp auth here.
smtpd_sasl_auth_enable = yes
# allow authenticated users to relay
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject