leap_platform.git/puppet/modules/site_postfix/manifests/mx, branch master [leap_platform] Block ip-based helo at MTA (#8139). 2016-07-19T14:44:11+00:00 Micah micah@leap.se 2016-07-12T15:20:58+00:00 bbdc193f05cb2f1624d6c7bbffd27f8060de35c8 Numeric helo is a very strong indicator of spam. When this is blocked, a very significant amount of spam stops. Change-Id: Ieb340190faf37638950d1aa60b52268659e0b7f6 
Numeric helo is a very strong indicator of spam. When this is blocked, a
very significant amount of spam stops.

Change-Id: Ieb340190faf37638950d1aa60b52268659e0b7f6
[style] lint further more 2016-04-25T19:41:20+00:00 varac varacanero@zeromail.org 2016-04-25T16:21:48+00:00 f2f2c7391056c252523730cd76ab759db9117c9c - ignore puppet lint error about inheriting from different namespace 
- ignore puppet lint error about inheriting from different namespace
testing: adds mx delivery tests 2016-04-05T16:52:01+00:00 elijah elijah@riseup.net 2016-03-29T20:27:01+00:00 eac3056c237d523f4786593922fe8f88eb65dff7 






Set MUA required ciphers, tighten up the mandatory protocols (#4232)
2016-03-11T20:55:20+00:00

Micah
micah@leap.se

2016-03-06T14:23:34+00:00

f69f7ca97791945d0bbe61eda84e69a8ed460e04

Change-Id: I328aa37b393817e1764ea7e635fcefc801adbbf4





Change-Id: I328aa37b393817e1764ea7e635fcefc801adbbf4







Due to the smtps transport specifying a header_check, the received_anon
2016-02-11T15:35:39+00:00

Micah
micah@leap.se

2016-02-09T21:32:46+00:00

cee2702b9c66e7e303494822993f46986685d87a

replacement wasn't being done. (#7890)

This moves that replacement into its own class, clears the old value and
sets it properly in the smtps transport.

Change-Id: I27c02730597df4943761d8bcb61014aeded9dc75





replacement wasn't being done. (#7890)

This moves that replacement into its own class, clears the old value and
sets it properly in the smtps transport.

Change-Id: I27c02730597df4943761d8bcb61014aeded9dc75







[bug] Add smtpd_relay_restrictions to postfix conf
2016-02-02T22:34:48+00:00

varac
varacanero@zeromail.org

2016-02-02T13:41:17+00:00

49c8a0c2a5ff413430b4bf7cc90f39f28c936b3e

smtpd_relay_restrictions was added in postfix 2.10 (jessie
has 2.11 atm). Without this, outbound mails are rejected to
be relayed.

from http://www.postfix.org/SMTPD_ACCESS_README.html:

    NOTE: Postfix versions before 2.10 did not have
    smtpd_relay_restrictions. They combined the mail relay and spam blocking
    policies, under smtpd_recipient_restrictions. This could lead to
    unexpected results. For example, a permissive spam blocking policy could
    unexpectedly result in a permissive mail relay policy. An example of
    this is documented under "Dangerous use of
    smtpd_recipient_restrictions".

smtpd_relay_restrictions defaults to
'permit_mynetworks, permit_sasl_authenticated, defer_unauth_destination'
and is configured here to check for a valid client cert.

see http://www.postfix.org/postconf.5.html#smtpd_relay_restrictions

- Resolves: #7856





smtpd_relay_restrictions was added in postfix 2.10 (jessie
has 2.11 atm). Without this, outbound mails are rejected to
be relayed.

from http://www.postfix.org/SMTPD_ACCESS_README.html:

    NOTE: Postfix versions before 2.10 did not have
    smtpd_relay_restrictions. They combined the mail relay and spam blocking
    policies, under smtpd_recipient_restrictions. This could lead to
    unexpected results. For example, a permissive spam blocking policy could
    unexpectedly result in a permissive mail relay policy. An example of
    this is documented under "Dangerous use of
    smtpd_recipient_restrictions".

smtpd_relay_restrictions defaults to
'permit_mynetworks, permit_sasl_authenticated, defer_unauth_destination'
and is configured here to check for a valid client cert.

see http://www.postfix.org/postconf.5.html#smtpd_relay_restrictions

- Resolves: #7856







Make sure the certs are installed for all smtp tls clients, thus
2016-01-21T15:46:49+00:00

Micah
micah@leap.se

2016-01-19T17:01:34+00:00

d87a8787908fb1c82901d9611a971c9bed0a3907

ensuring the satellite hosts are setup properly (#7611)

Change-Id: I9dce57c305a6fd6a39596a941174fe1879af5e4f





ensuring the satellite hosts are setup properly (#7611)

Change-Id: I9dce57c305a6fd6a39596a941174fe1879af5e4f







Make sure machines in mynetworks are able to send mail through us,
2016-01-19T20:23:58+00:00

Micah
micah@leap.se

2016-01-19T18:24:00+00:00

ab536804b671b55d1bec2a03fd0ba1b15d887f66

without getting blocked by the rbl (#7819)

Change-Id: Ib7a00f810b6c49528e5f99a1d83296553a81e65e





without getting blocked by the rbl (#7819)

Change-Id: Ib7a00f810b6c49528e5f99a1d83296553a81e65e







Use client cert fingerprint lookup to determine if the user is allowed
2015-12-09T21:26:28+00:00

Micah
micah@leap.se

2015-12-08T19:17:11+00:00

7d5b9461958cdb795990459cd0dad29a36e59fdd

to relay mail through us (#3634)

Change-Id: I46cf3ffbef4261839c376f4c36a50d9c44eb1374





to relay mail through us (#3634)

Change-Id: I46cf3ffbef4261839c376f4c36a50d9c44eb1374







allow certain aliases, like 'abuse', to be publicly forwardable.
2015-09-24T20:29:15+00:00

elijah
elijah@riseup.net

2015-09-24T20:29:15+00:00

afd8867ba953513c6e08f957e3099f0ff3b1a3a2