2014-07-10 07:18:01 +00:00
#!/bin/bash
#
# Postfix (SMTP)
2014-09-21 17:43:21 +00:00
# --------------
2014-07-10 07:18:01 +00:00
#
# Postfix handles the transmission of email between servers
# using the SMTP protocol. It is a Mail Transfer Agent (MTA).
#
# Postfix listens on port 25 (SMTP) for incoming mail from
# other servers on the Internet. It is responsible for very
# basic email filtering such as by IP address and greylisting,
# it checks that the destination address is valid, rewrites
# destinations according to aliases, and passses email on to
# another service for local mail delivery.
#
# The first hop in local mail delivery is to Spamassassin via
# LMTP. Spamassassin then passes mail over to Dovecot for
# storage in the user's mailbox.
#
# Postfix also listens on port 587 (SMTP+STARTLS) for
# connections from users who can authenticate and then sends
# their email out to the outside world. Postfix queries Dovecot
# to authenticate users.
#
# Address validation, alias rewriting, and user authentication
# is configured in a separate setup script mail-users.sh
# because of the overlap of this part with the Dovecot
# configuration.
source setup/functions.sh # load our functions
source /etc/mailinabox.conf # load global vars
2014-09-21 17:43:21 +00:00
# ### Install packages.
2014-07-10 07:18:01 +00:00
2014-10-04 21:57:26 +00:00
# Install postfix's packages.
#
# * `postfix`: The SMTP server.
# * `postfix-pcre`: Enables header filtering.
# * `postgrey`: A mail policy service that soft-rejects mail the first time
# it is received. Spammers don't usually try agian. Legitimate mail
# always will.
# * `ca-certificates`: A trust store used to squelch postfix warnings about
# untrusted opportunistically-encrypted connections.
2015-06-03 20:28:05 +00:00
#
# postgrey is going to come in via the Mail-in-a-Box PPA, which publishes
# a modified version of postgrey that lets senders whitelisted by dnswl.org
# pass through without being greylisted. So please note [dnswl's license terms](https://www.dnswl.org/?page_id=9):
# > Every user with more than 100’ 000 queries per day on the public nameserver
# > infrastructure and every commercial vendor of dnswl.org data (eg through
# > anti-spam solutions) must register with dnswl.org and purchase a subscription.
2014-10-04 21:57:26 +00:00
2015-08-19 19:58:35 +00:00
echo "Installing Postfix (SMTP server)..."
2014-10-04 21:57:26 +00:00
apt_install postfix postfix-pcre postgrey ca-certificates
2014-07-10 07:18:01 +00:00
2014-09-21 17:43:21 +00:00
# ### Basic Settings
2014-07-10 07:18:01 +00:00
2014-10-04 21:57:26 +00:00
# Set some basic settings...
#
# * Have postfix listen on all network interfaces.
# * Set our name (the Debian default seems to be "localhost" but make it our hostname).
# * Set the name of the local machine to localhost, which means xxx@localhost is delivered locally, although we don't use it.
# * Set the SMTP banner (which must have the hostname first, then anything).
2016-02-15 23:38:55 +00:00
# * Inform users when their e-mail delivery is delayed more than 3 hours (default is not to warn).
# * Stop trying to send an undeliverable e-mail after 2 days (instead of 5), and for bounce messages just try for 1 day.
2014-07-10 07:18:01 +00:00
tools/editconf.py /etc/postfix/main.cf \
inet_interfaces = all \
2016-01-21 15:05:43 +00:00
myhostname = $PRIMARY_HOSTNAME \
2014-08-16 13:16:01 +00:00
smtpd_banner = "\$myhostname ESMTP Hi, I'm a Mail-in-a-Box (Ubuntu/Postfix; see https://mailinabox.email/)" \
2016-01-21 15:05:43 +00:00
mydestination = localhost \
delay_warning_time = 3h \
maximal_queue_lifetime = 2d \
2016-01-21 07:38:39 +00:00
bounce_queue_lifetime = 1d
2014-07-10 07:18:01 +00:00
2014-09-21 17:43:21 +00:00
# ### Outgoing Mail
2014-07-10 07:18:01 +00:00
# Enable the 'submission' port 587 smtpd server and tweak its settings.
2014-09-21 17:43:21 +00:00
#
2015-03-21 16:14:01 +00:00
# * Do not add the OpenDMAC Authentication-Results header. That should only be added
# on incoming mail. Omit the OpenDMARC milter by re-setting smtpd_milters to the
# OpenDKIM milter only. See dkim.sh.
2015-05-06 00:25:03 +00:00
# * Even though we dont allow auth over non-TLS connections (smtpd_tls_auth_only below, and without auth the client cant
# send outbound mail), don't allow non-TLS mail submission on this port anyway to prevent accidental misconfiguration.
2014-09-21 17:43:21 +00:00
# * Require the best ciphers for incoming connections per http://baldric.net/2013/12/07/tls-ciphers-in-postfix-and-dovecot/.
2014-10-13 14:00:26 +00:00
# By putting this setting here we leave opportunistic TLS on incoming mail at default cipher settings (any cipher is better than none).
2014-09-21 17:43:21 +00:00
# * Give it a different name in syslog to distinguish it from the port 25 smtpd server.
# * Add a new cleanup service specific to the submission service ('authclean')
# that filters out privacy-sensitive headers on mail being sent out by
# authenticated users.
2014-07-10 07:18:01 +00:00
tools/editconf.py /etc/postfix/master.cf -s -w \
" submission=inet n - - - - smtpd
-o syslog_name = postfix/submission
2015-03-21 16:14:01 +00:00
-o smtpd_milters = inet:127.0.0.1:8891
2015-05-06 00:25:03 +00:00
-o smtpd_tls_security_level = encrypt
2015-05-20 22:20:45 +00:00
-o smtpd_tls_ciphers = high -o smtpd_tls_exclude_ciphers = aNULL,DES,3DES,MD5,DES+MD5,RC4 -o smtpd_tls_mandatory_protocols = !SSLv2,!SSLv3
2014-07-10 07:18:01 +00:00
-o cleanup_service_name = authclean" \
" authclean=unix n - - - 0 cleanup
-o header_checks = pcre:/etc/postfix/outgoing_mail_header_filters"
# Install the `outgoing_mail_header_filters` file required by the new 'authclean' service.
cp conf/postfix_outgoing_mail_header_filters /etc/postfix/outgoing_mail_header_filters
2015-06-28 19:06:05 +00:00
# Modify the `outgoing_mail_header_filters` file to use the local machine name and ip
# on the first received header line. This may help reduce the spam score of email by
# removing the 127.0.0.1 reference.
sed -i " s/PRIMARY_HOSTNAME/ $PRIMARY_HOSTNAME / " /etc/postfix/outgoing_mail_header_filters
sed -i " s/PUBLIC_IP/ $PUBLIC_IP / " /etc/postfix/outgoing_mail_header_filters
2014-09-21 17:43:21 +00:00
# Enable TLS on these and all other connections (i.e. ports 25 *and* 587) and
2014-07-10 07:18:01 +00:00
# require TLS before a user is allowed to authenticate. This also makes
# opportunistic TLS available on *incoming* mail.
2014-10-04 21:57:26 +00:00
# Set stronger DH parameters, which via openssl tend to default to 1024 bits
# (see ssl.sh).
2014-07-10 07:18:01 +00:00
tools/editconf.py /etc/postfix/main.cf \
smtpd_tls_security_level = may\
smtpd_tls_auth_only = yes \
smtpd_tls_cert_file = $STORAGE_ROOT /ssl/ssl_certificate.pem \
smtpd_tls_key_file = $STORAGE_ROOT /ssl/ssl_private_key.pem \
2014-09-26 22:01:38 +00:00
smtpd_tls_dh1024_param_file = $STORAGE_ROOT /ssl/dh2048.pem \
2015-05-05 23:50:07 +00:00
smtpd_tls_ciphers = medium \
smtpd_tls_exclude_ciphers = aNULL \
2014-07-10 07:18:01 +00:00
smtpd_tls_received_header = yes
2014-09-21 17:43:21 +00:00
# Prevent non-authenticated users from sending mail that requires being
# relayed elsewhere. We don't want to be an "open relay". On outbound
# mail, require one of:
#
2014-10-13 14:00:26 +00:00
# * `permit_sasl_authenticated`: Authenticated users (i.e. on port 587).
# * `permit_mynetworks`: Mail that originates locally.
# * `reject_unauth_destination`: No one else. (Permits mail whose destination is local and rejects other mail.)
2014-09-21 17:43:21 +00:00
tools/editconf.py /etc/postfix/main.cf \
smtpd_relay_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination
# ### DANE
2014-10-04 21:57:26 +00:00
2014-07-10 07:18:01 +00:00
# When connecting to remote SMTP servers, prefer TLS and use DANE if available.
2014-08-02 15:39:47 +00:00
#
2014-10-04 21:57:26 +00:00
# Prefering ("opportunistic") TLS means Postfix will use TLS if the remote end
# offers it, otherwise it will transmit the message in the clear. Postfix will
# accept whatever SSL certificate the remote end provides. Opportunistic TLS
# protects against passive easvesdropping (but not man-in-the-middle attacks).
# DANE takes this a step further:
2014-08-02 15:39:47 +00:00
#
# Postfix queries DNS for the TLSA record on the destination MX host. If no TLSA records are found,
2014-07-10 07:18:01 +00:00
# then opportunistic TLS is used. Otherwise the server certificate must match the TLSA records
# or else the mail bounces. TLSA also requires DNSSEC on the MX host. Postfix doesn't do DNSSEC
# itself but assumes the system's nameserver does and reports DNSSEC status. Thus this also
2014-10-04 21:57:26 +00:00
# relies on our local bind9 server being present and `smtp_dns_support_level=dnssec`.
2014-08-02 15:39:47 +00:00
#
2014-10-04 21:57:26 +00:00
# The `smtp_tls_CAfile` is superflous, but it eliminates warnings in the logs about untrusted certs,
# which we don't care about seeing because Postfix is doing opportunistic TLS anyway. Better to encrypt,
# even if we don't know if it's to the right party, than to not encrypt at all. Instead we'll
# now see notices about trusted certs. The CA file is provided by the package `ca-certificates`.
2014-07-10 07:18:01 +00:00
tools/editconf.py /etc/postfix/main.cf \
smtp_tls_security_level = dane \
smtp_dns_support_level = dnssec \
2014-08-02 15:39:47 +00:00
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt \
2014-07-10 07:18:01 +00:00
smtp_tls_loglevel = 2
2014-09-21 17:43:21 +00:00
# ### Incoming Mail
2014-07-10 07:18:01 +00:00
# Pass any incoming mail over to a local delivery agent. Spamassassin
# will act as the LDA agent at first. It is listening on port 10025
# with LMTP. Spamassassin will pass the mail over to Dovecot after.
#
2014-09-21 17:43:21 +00:00
# In a basic setup we would pass mail directly to Dovecot by setting
# virtual_transport to `lmtp:unix:private/dovecot-lmtp`.
2014-07-10 07:18:01 +00:00
#
tools/editconf.py /etc/postfix/main.cf virtual_transport = lmtp:[ 127.0.0.1] :10025
# Who can send mail to us? Some basic filters.
#
2014-10-13 14:00:26 +00:00
# * `reject_non_fqdn_sender`: Reject not-nice-looking return paths.
# * `reject_unknown_sender_domain`: Reject return paths with invalid domains.
2015-06-20 10:27:18 +00:00
# * `reject_authenticated_sender_login_mismatch`: Reject if mail FROM address does not match the client SASL login
2014-10-13 14:00:26 +00:00
# * `reject_rhsbl_sender`: Reject return paths that use blacklisted domains.
# * `permit_sasl_authenticated`: Authenticated users (i.e. on port 587) can skip further checks.
# * `permit_mynetworks`: Mail that originates locally can skip further checks.
# * `reject_rbl_client`: Reject connections from IP addresses blacklisted in zen.spamhaus.org
# * `reject_unlisted_recipient`: Although Postfix will reject mail to unknown recipients, it's nicer to reject such mail ahead of greylisting rather than after.
# * `check_policy_service`: Apply greylisting using postgrey.
#
# Notes: #NODOC
# permit_dnswl_client can pass through mail from whitelisted IP addresses, which would be good to put before greylisting #NODOC
# so these IPs get mail delivered quickly. But when an IP is not listed in the permit_dnswl_client list (i.e. it is not #NODOC
# whitelisted) then postfix does a DEFER_IF_REJECT, which results in all "unknown user" sorts of messages turning into #NODOC
# "450 4.7.1 Client host rejected: Service unavailable". This is a retry code, so the mail doesn't properly bounce. #NODOC
2014-07-10 07:18:01 +00:00
tools/editconf.py /etc/postfix/main.cf \
2015-06-20 10:27:18 +00:00
smtpd_sender_restrictions = "reject_non_fqdn_sender,reject_unknown_sender_domain,reject_authenticated_sender_login_mismatch,reject_rhsbl_sender dbl.spamhaus.org" \
2014-08-03 00:06:54 +00:00
smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,"reject_rbl_client zen.spamhaus.org" ,reject_unlisted_recipient,"check_policy_service inet:127.0.0.1:10023"
2014-07-10 07:18:01 +00:00
2015-01-02 23:37:14 +00:00
# Postfix connects to Postgrey on the 127.0.0.1 interface specifically. Ensure that
# Postgrey listens on the same interface (and not IPv6, for instance).
2015-05-19 09:53:10 +00:00
# A lot of legit mail servers try to resend before 300 seconds.
# As a matter of fact RFC is not strict about retry timer so postfix and
# other MTA have their own intervals. To fix the problem of receiving
# e-mails really latter, delay of greylisting has been set to
# 180 seconds (default is 300 seconds).
2015-01-02 23:37:14 +00:00
tools/editconf.py /etc/default/postgrey \
2015-05-19 09:53:10 +00:00
POSTGREY_OPTS = \" '--inet=127.0.0.1:10023 --delay=180' \"
2015-01-02 23:37:14 +00:00
2014-07-10 07:18:01 +00:00
# Increase the message size limit from 10MB to 128MB.
2014-10-16 21:49:28 +00:00
# The same limit is specified in nginx.conf for mail submitted via webmail and Z-Push.
2014-07-10 07:18:01 +00:00
tools/editconf.py /etc/postfix/main.cf \
message_size_limit = 134217728
# Allow the two SMTP ports in the firewall.
ufw_allow smtp
ufw_allow submission
# Restart services
2014-08-02 15:39:47 +00:00
restart_service postfix
2015-05-29 12:59:24 +00:00
restart_service postgrey