# # configure mx node # class site_postfix::mx { $domain_hash = hiera('domain') $domain = $domain_hash['full_suffix'] $host_domain = $domain_hash['full'] $cert_name = hiera('name') $mynetworks = join(hiera('mynetworks', ''), ' ') $rbls = suffix(prefix(hiera('rbls', []), 'reject_rbl_client '), ',') $root_mail_recipient = hiera('contacts') $postfix_smtp_listen = 'all' $postfix_use_postscreen = 'yes' include site_config::x509::cert include site_config::x509::key include site_config::x509::client_ca::ca include site_config::x509::client_ca::key postfix::config { 'mynetworks': value => "127.0.0.0/8 [::1]/128 [fe80::]/64 ${mynetworks}"; # Note: mydestination should not include @domain, because this is # used in virtual alias maps. 'mydestination': value => "\$myorigin, localhost, localhost.\$mydomain"; 'myhostname': value => $host_domain; 'mailbox_size_limit': value => '0'; 'home_mailbox': value => ''; 'virtual_mailbox_domains': value => 'deliver.local'; 'virtual_mailbox_base': value => '/var/mail/leap-mx'; 'virtual_mailbox_maps': value => 'static:Maildir/'; # Note: virtual-aliases map will take precedence over leap-mx # lookup (tcp:localhost) 'virtual_alias_maps': value => 'hash:/etc/postfix/virtual-aliases tcp:localhost:4242'; 'luser_relay': value => ''; # uid and gid are set to an arbitrary hard-coded value here, this # must match the 'leap-mx' user/group 'virtual_uid_maps': value => 'static:42424'; 'virtual_gid_maps': value => 'static:42424'; # the two following configs are needed for matching user's client cert # fingerprints to enable relaying (#3634). Satellites do not have # these configured. 'smtpd_tls_fingerprint_digest': value => 'sha1'; 'relay_clientcerts': value => 'tcp:localhost:2424'; # reject inbound mail to system users # see https://leap.se/code/issues/6829 # this blocks *only* mails to system users, that don't appear in the # alias map 'local_recipient_maps': value => '$alias_maps'; # setup clamav and opendkim on smtpd 'smtpd_milters': value => 'unix:/run/clamav/milter.ctl,unix:/run/opendkim/opendkim.sock'; # setup opendkim for smtp (non-smtpd) outgoing mail 'non_smtpd_milters': value => 'unix:/run/opendkim/opendkim.sock'; 'milter_default_action': value => 'accept'; # Make sure that the right values are set, these could be set to different # things on install, depending on preseed or debconf options # selected (see #7478) 'relay_transport': value => 'relay'; 'default_transport': value => 'smtp'; 'mailbox_command': value => ''; 'header_checks': value => ''; 'postscreen_access_list': value => 'permit_mynetworks'; 'postscreen_greet_action': value => 'enforce'; # Level of DNS support in the Postfix SMTP client. Enable DNS lookups # (default: empty). When empty, then the legacy "disable_dns_lookups" # (default: no) parameter is used. Setting 'smtp_dns_support_level' to # enabled sets the previous behavior with the new parameter. When set to # 'dnssec" this enables DNSSEC lookups. 'smtp_dns_support_level': value => 'dnssec'; # http://www.postfix.org/TLS_README.html#client_tls_dane The "dane" level is # a stronger form of opportunistic TLS that is resistant to man in the # middle and downgrade attacks when the destination domain uses DNSSEC to # publish DANE TLSA records for its MX hosts. If a remote SMTP server has # "usable" (see RFC 6698) DANE TLSA records, the server connection will be # authenticated. When DANE authentication fails, there is no fallback to # unauthenticated or plaintext delivery. # # If TLSA records are published for a given remote SMTP server (implying TLS # support), but are all "unusable" due to unsupported parameters or # malformed data, the Postfix SMTP client will use mandatory unauthenticated # TLS. Otherwise, when no TLSA records are published, the Postfix SMTP # client behavior is the same as with may. # # This requires postfix to be able to send its DNS queries to a recursive # DNS nameserver that is able to validate the signed records # # Note: we are setting this here, instead of in site_postfix::mx::smtp_tls # because the satellites need to have a different value 'smtp_tls_security_level': value => 'dane'; } # Make sure that the cleanup serivce is not chrooted, otherwise it cannot # access the opendkim milter socket (#8020) exec { 'unset_cleanup_chroot': command => '/usr/sbin/postconf -F "cleanup/unix/chroot=n"', onlyif => '/usr/sbin/postconf -h -F "cleanup/unix/chroot" | egrep -qv ^n', notify => Service['postfix'], require => File['/etc/postfix/master.cf'] } include ::site_postfix::mx::smtpd_checks include ::site_postfix::mx::checks include ::site_postfix::mx::smtp_tls include ::site_postfix::mx::smtpd_tls include ::site_postfix::mx::static_aliases include ::site_postfix::mx::rewrite_openpgp_header include ::site_postfix::mx::received_anon include ::clamav include ::opendkim include ::postfwd # greater verbosity for debugging, take out for production #include site_postfix::debug case $::operatingsystemrelease { /^7.*/: { $smtpd_relay_restrictions='' } default: { $smtpd_relay_restrictions=" -o smtpd_relay_restrictions=\$smtps_relay_restrictions\n" } } $mastercf_tail = " smtps inet n - - - - smtpd -o smtpd_tls_wrappermode=yes -o smtpd_tls_security_level=encrypt -o tls_preempt_cipherlist=yes ${smtpd_relay_restrictions} -o smtpd_recipient_restrictions=\$smtps_recipient_restrictions -o smtpd_helo_restrictions=\$smtps_helo_restrictions -o smtpd_client_restrictions= -o cleanup_service_name=clean_smtps clean_smtps unix n - n - 0 cleanup -o header_checks=pcre:/etc/postfix/checks/rewrite_openpgp_headers,pcre:/etc/postfix/checks/received_anon" class { 'postfix': preseed => true, root_mail_recipient => $root_mail_recipient, smtp_listen => 'all', mastercf_tail => $mastercf_tail, use_postscreen => 'yes', require => [ Class['Site_config::X509::Key'], Class['Site_config::X509::Cert'], Class['Site_config::X509::Client_ca::Key'], Class['Site_config::X509::Client_ca::Ca'], User['leap-mx'] ] } }