summaryrefslogtreecommitdiff
path: root/puppet/modules/site_postfix
AgeCommit message (Collapse)Author
2013-08-31postfix enable submission port using starttls, so the client can transition ↵Micah Anderson
to the more restrictive TLS wrapper mode Change-Id: I2a1728788378d9a1b79155ddb9bb4b0464b16baa
2013-08-31change the master.cf_tail to pull in -o ↵Micah Anderson
smtpd_recipient_restrictions=$smtps_recipient_restrictions from main.cf, allowing us to setup specific restrictions for the smtps port move permit_tls_all_clientcerts from the smtpd_data_restrictions and smtpd_recipient_restrictions to only be in smtps_recipient_restrictions make a note about the permit_tls_all_clientcerts being something that we don't want in the future remove check_sender_access check which was doing an unnecessary lookup Change-Id: If9101512e42f7cd82c0e06543cef696d6063f8dc
2013-08-29Make TLS-required smtps (465) be port for sending SMTP. This is preferred ↵Micah Anderson
over 25 because that is typically blocked, and we cannot force TLS on that port due to other MTAs not being configured for this century. We don't use submission (568) because that uses STARTTLS, and the STARTTLS banner can easily be stripped by an adversary. (#3604) . enable smtps (port 465) for client submission over TLS, and require that TLS is enabled . add 465 to the allowed open ports in the firewall . change the smtp-service.json to use 465 instead of 25 note: I did not use the 'use_smtps' parameter that is available in the postfix class because it added some options that we do not want/need. Change-Id: I0040eb2dff6008a1c830d59df9963eb83dc9ea02
2013-08-29fix smtpd mail restrictions (Feature #3166)varac
2013-08-29Deploy postfix with an empty main.cf as beginning (Feature #3584)varac
2013-08-28SMTP checks (Feature #2304)varac
2013-08-28integrate manual postfix config changes in puppet (Feature #3538)varac
2013-08-28added site_postfix::debug for debugging (#3538)varac
2013-07-31 use smtpd_tls_security_level = may in postfix config (Bug #3348)varac
2013-07-26Merge branch 'varac/feature/mx' into feature/leap_mxMicah Anderson
Conflicts: provider_base/services/mx.json puppet/manifests/site.pp puppet/modules/site_mx/manifests/init.pp puppet/modules/site_postfix/manifests/mx.pp Change-Id: Ib2952f6cb972c40a998f20d7bbdb23bb35bef419
2013-07-25beginning of smtp_auth config with client certsvarac
2013-07-25smtpd_recipient_restrictions: +permit_tls_all_clientcertsvarac
2013-07-25smtpd_checks: smtpd_data_restrictionsvarac
2013-07-25using alias resolvervarac
2013-07-25update postfix module to new shared version for parameterized classes, and otherMicah Anderson
2.7 updates update site_postfix::mx to use parameterized classes
2013-07-25Configure Postfix for incoming mails (Feature #2269)varac
2013-07-25smtpd_checks: smtpd_delay_rejectvarac
2013-07-25smtpd_checks: smtpd_data_restrictionsvarac
2013-07-25using alias resolvervarac
2013-07-25update postfix module to new shared version for parameterized classes, and otherMicah Anderson
2.7 updates update site_postfix::mx to use parameterized classes
2013-07-25Configure Postfix for incoming mails (Feature #2269)varac
2013-07-25hiera variable mx.contact -> postfix $root_mail_recipientvarac
2013-07-25added basic site_postfix::mx configvarac
2013-07-15fix smtpd_recipient_restrictions, debug connections from localhostvarac
2013-07-10added tls support, including smtp auth via client certvarac
2013-07-09beginning of smtp_auth config with client certsvarac
2013-07-09smtpd_recipient_restrictions: +permit_tls_all_clientcertsvarac
2013-07-09smtpd_checks: smtpd_delay_rejectvarac
2013-07-09smtpd_checks: smtpd_data_restrictionsvarac
2013-07-09using alias resolvervarac
2013-07-09update postfix module to new shared version for parameterized classes, and otherMicah Anderson
2.7 updates update site_postfix::mx to use parameterized classes
2013-07-09Configure Postfix for incoming mails (Feature #2269)varac
2013-07-09hiera variable mx.contact -> postfix $root_mail_recipientvarac
2013-07-09added basic site_postfix::mx configvarac