API tools faq
paste
Advertisement
Luticus

Debian Email Server Configuration Files

Luticus
Jan 31st, 2016
884
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 34.99 KB | None | 0 0
raw download clone embed print report
  1. #!----------------Postfix Files:
  2.  
  3. #!----------------/etc/postfix/main.cf--
  4. # Debian specific: Specifying a file name will cause the first
  5. # line of that file to be used as the name. The Debian default
  6. # is /etc/mailname.
  7. #myorigin = /etc/mailname
  8.  
  9. smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
  10. biff = no
  11.  
  12. # appending .domain is the MUA's job.
  13. append_dot_mydomain = no
  14.  
  15. # Uncomment the next line to generate "delayed mail" warnings
  16. #delay_warning_time = 4h
  17.  
  18. readme_directory = no
  19.  
  20. # TLS parameters
  21. smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
  22. smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
  23. smtpd_use_tls=yes
  24. smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
  25. smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
  26.  
  27. # See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
  28. # information on enabling SSL in the smtp client.
  29.  
  30. smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
  31. myhostname = DemoMail.Domain.Local
  32. alias_maps = hash:/etc/aliases
  33. alias_database = hash:/etc/aliases
  34. myorigin = /etc/mailname
  35. mydestination = DemoMail.Domain.com, localhost.Domain.com, localhost
  36. relayhost =
  37. mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
  38. mailbox_command = procmail -a "$EXTENSION"
  39. mailbox_size_limit = 0
  40. recipient_delimiter = +
  41. inet_interfaces = all
  42.  
  43. ##!------------------------
  44. virtual_uid_maps = static:3000
  45. virtual_gid_maps = static:3000
  46. virtual_mailbox_base = /home/vmail
  47. virtual_mailbox_domains = mysql:/etc/postfix/mysql_virtual_mailbox_domains.cf
  48. virtual_mailbox_maps = mysql:/etc/postfix/mysql_virtual_mailbox_maps.cf
  49. virtual_alias_maps = mysql:/etc/postfix/mysql_virtual_alias_maps.cf
  50. relay_domains = mysql:/etc/postfix/mysql_relay_domains.cf
  51. virtual_transport = lmtp:unix:private/dovecot-lmtp
  52. smtpd_recipient_restrictions =
  53. check_policy_service unix:postgrey/socket,
  54. permit_mynetworks,
  55. permit_sasl_authenticated,
  56. reject_non_fqdn_hostname,
  57. reject_non_fqdn_sender,
  58. reject_non_fqdn_recipient,
  59. reject_unauth_destination,
  60. reject_unauth_pipelining,
  61. reject_invalid_hostname
  62. smtpd_sasl_auth_enable = yes
  63. smtpd_sasl_security_options = noanonymous
  64. smtpd_sasl_type = dovecot
  65. smtpd_sasl_path = private/auth
  66. milter_default_action = accept
  67. milter_mail_macros = i {auth_name} {auth_type}
  68. milter_connect_macros = b j _ {domain_name} {if_name} {if_addr}_
  69. smtpd_milters = unix:clamav/clamav-milter.ctl, unix:spamass/spamass.sock
  70. message_size_limit = 10240000
  71. smtp_tls_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem
  72. smtp_tls_key_file = /etc/ssl/private/ssl-cert-snakeoil.key
  73. smtpd_tls_auth_only = yes
  74. smtp_tls_security_level = may
  75. #!----------------End /etc/postfix/main.cf--
  76.  
  77. #!----------------/etc/postfix/master.cf--
  78. # Postfix master process configuration file. For details on the format
  79. # of the file, see the master(5) manual page (command: "man 5 master" or
  80. # on-line: http://www.postfix.org/master.5.html).
  81. #
  82. # Do not forget to execute "postfix reload" after editing this file.
  83. #
  84. # ==========================================================================
  85. # service type private unpriv chroot wakeup maxproc command + args
  86. # (yes) (yes) (yes) (never) (100)
  87. # ==========================================================================
  88. smtp inet n - - - - smtpd
  89. #smtp inet n - - - 1 postscreen
  90. #smtpd pass - - - - - smtpd
  91. #dnsblog unix - - - - 0 dnsblog
  92. #tlsproxy unix - - - - 0 tlsproxy
  93. submission inet n - - - - smtpd
  94. -o syslog_name=postfix/submission
  95. -o smtpd_tls_security_level=encrypt
  96. -o smtpd_sasl_auth_enable=yes
  97. # -o smtpd_reject_unlisted_recipient=no
  98. -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  99. # -o smtpd_client_restrictions=$mua_client_restrictions
  100. # -o smtpd_helo_restrictions=$mua_helo_restrictions
  101. # -o smtpd_sender_restrictions=$mua_sender_restrictions
  102. # -o smtpd_recipient_restrictions=
  103. # -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
  104. -o milter_macro_daemon_name=ORIGINATING
  105. smtps inet n - - - - smtpd
  106. -o syslog_name=postfix/smtps
  107. -o smtpd_tls_wrappermode=yes
  108. -o smtpd_sasl_auth_enable=yes
  109. # -o smtpd_reject_unlisted_recipient=no
  110. -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  111. # -o smtpd_client_restrictions=$mua_client_restrictions
  112. # -o smtpd_helo_restrictions=$mua_helo_restrictions
  113. # -o smtpd_sender_restrictions=$mua_sender_restrictions
  114. # -o smtpd_recipient_restrictions=
  115. # -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
  116. -o milter_macro_daemon_name=ORIGINATING
  117. #628 inet n - - - - qmqpd
  118. pickup unix n - - 60 1 pickup
  119. cleanup unix n - - - 0 cleanup
  120. qmgr unix n - n 300 1 qmgr
  121. #qmgr unix n - n 300 1 oqmgr
  122. tlsmgr unix - - - 1000? 1 tlsmgr
  123. rewrite unix - - - - - trivial-rewrite
  124. bounce unix - - - - 0 bounce
  125. defer unix - - - - 0 bounce
  126. trace unix - - - - 0 bounce
  127. verify unix - - - - 1 verify
  128. flush unix n - - 1000? 0 flush
  129. proxymap unix - - n - - proxymap
  130. proxywrite unix - - n - 1 proxymap
  131. smtp unix - - - - - smtp
  132. relay unix - - - - - smtp
  133. # -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
  134. showq unix n - - - - showq
  135. error unix - - - - - error
  136. retry unix - - - - - error
  137. discard unix - - - - - discard
  138. local unix - n n - - local
  139. virtual unix - n n - - virtual
  140. lmtp unix - - - - - lmtp
  141. anvil unix - - - - 1 anvil
  142. scache unix - - - - 1 scache
  143. #
  144. # ====================================================================
  145. # Interfaces to non-Postfix software. Be sure to examine the manual
  146. # pages of the non-Postfix software to find out what options it wants.
  147. #
  148. # Many of the following services use the Postfix pipe(8) delivery
  149. # agent. See the pipe(8) man page for information about ${recipient}
  150. # and other message envelope options.
  151. # ====================================================================
  152. #
  153. # maildrop. See the Postfix MAILDROP_README file for details.
  154. # Also specify in main.cf: maildrop_destination_recipient_limit=1
  155. #
  156. maildrop unix - n n - - pipe
  157. flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
  158. #
  159. # ====================================================================
  160. #
  161. # Recent Cyrus versions can use the existing "lmtp" master.cf entry.
  162. #
  163. # Specify in cyrus.conf:
  164. # lmtp cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
  165. #
  166. # Specify in main.cf one or more of the following:
  167. # mailbox_transport = lmtp:inet:localhost
  168. # virtual_transport = lmtp:inet:localhost
  169. #
  170. # ====================================================================
  171. #
  172. # Cyrus 2.1.5 (Amos Gouaux)
  173. # Also specify in main.cf: cyrus_destination_recipient_limit=1
  174. #
  175. #cyrus unix - n n - - pipe
  176. # user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
  177. #
  178. # ====================================================================
  179. # Old example of delivery via Cyrus.
  180. #
  181. #old-cyrus unix - n n - - pipe
  182. # flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
  183. #
  184. # ====================================================================
  185. #
  186. # See the Postfix UUCP_README file for configuration details.
  187. #
  188. uucp unix - n n - - pipe
  189. flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
  190. #
  191. # Other external delivery methods.
  192. #
  193. ifmail unix - n n - - pipe
  194. flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
  195. bsmtp unix - n n - - pipe
  196. flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
  197. scalemail-backend unix - n n - 2 pipe
  198. flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
  199. mailman unix - n n - - pipe
  200. flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
  201. ${nexthop} ${user}
  202. #!----------------End /etc/postfix/master.cf
  203.  
  204. #!----------------/etc/postfix/mysql_relay_domains.cf--
  205. hosts = 127.0.0.1
  206. user = postfixadmin
  207. password = #changeme
  208. dbname = postfixadmin
  209. query = SELECT domain FROM domain WHERE domain='%s' AND backupmx = 1
  210. #!----------------End /etc/postfix/mysql_relay_domains.cf--
  211.  
  212. #!----------------/etc/postfix/mysql_virtual_alias_maps.cf--
  213. hosts = 127.0.0.1
  214. user = postfixadmin
  215. password = #changeme
  216. dbname = postfixadmin
  217. query = SELECT goto FROM alias WHERE address='%s' AND active = 1
  218. #!----------------End /etc/postfix/mysql_virtual_alias_maps.cf--
  219.  
  220. #!----------------/etc/postfix/mysql_virtual_mailbox_domains.cf--
  221. hosts = 127.0.0.1
  222. user = postfixadmin
  223. password = #changeme
  224. dbname = postfixadmin
  225. query = SELECT domain FROM domain WHERE domain='%s' and backupmx = 0 and active = 1
  226. #!----------------End /etc/postfix/mysql_virtual_mailbox_domains.cf--
  227.  
  228. #!----------------/etc/postfix/mysql_virtual_mailbox_maps.cf--
  229. hosts = 127.0.0.1
  230. user = postfixadmin
  231. password = #changeme
  232. dbname = postfixadmin
  233. query = SELECT maildir FROM mailbox WHERE username='%s' AND active = 1
  234. #!----------------End /etc/postfix/mysql_virtual_mailbox_maps.cf--
  235.  
  236. #!----------------Dovecot configuration files:
  237.  
  238. #!----------------/etc/dovecot/dovecot.conf
  239. ## Dovecot configuration file
  240.  
  241. # If you're in a hurry, see http://wiki2.dovecot.org/QuickConfiguration
  242.  
  243. # "doveconf -n" command gives a clean output of the changed settings. Use it
  244. # instead of copy&pasting files when posting to the Dovecot mailing list.
  245.  
  246. # '#' character and everything after it is treated as comments. Extra spaces
  247. # and tabs are ignored. If you want to use either of these explicitly, put the
  248. # value inside quotes, eg.: key = "# char and trailing whitespace "
  249.  
  250. # Most (but not all) settings can be overridden by different protocols and/or
  251. # source/destination IPs by placing the settings inside sections, for example:
  252. # protocol imap { }, local 127.0.0.1 { }, remote 10.0.0.0/8 { }
  253.  
  254. # Default values are shown for each setting, it's not required to uncomment
  255. # those. These are exceptions to this though: No sections (e.g. namespace {})
  256. # or plugin settings are added by default, they're listed only as examples.
  257. # Paths are also just examples with the real defaults being based on configure
  258. # options. The paths listed here are for configure --prefix=/usr
  259. # --sysconfdir=/etc --localstatedir=/var
  260.  
  261. # Enable installed protocols
  262. !include_try /usr/share/dovecot/protocols.d/*.protocol
  263.  
  264. # A comma separated list of IPs or hosts where to listen in for connections.
  265. # "*" listens in all IPv4 interfaces, "::" listens in all IPv6 interfaces.
  266. # If you want to specify non-default ports or anything more complex,
  267. # edit conf.d/master.conf.
  268. #listen = *, ::
  269.  
  270. # Base directory where to store runtime data.
  271. #base_dir = /var/run/dovecot/
  272.  
  273. # Name of this instance. In multi-instance setup doveadm and other commands
  274. # can use -i <instance_name> to select which instance is used (an alternative
  275. # to -c <config_path>). The instance name is also added to Dovecot processes
  276. # in ps output.
  277. #instance_name = dovecot
  278.  
  279. # Greeting message for clients.
  280. #login_greeting = Dovecot ready.
  281.  
  282. # Space separated list of trusted network ranges. Connections from these
  283. # IPs are allowed to override their IP addresses and ports (for logging and
  284. # for authentication checks). disable_plaintext_auth is also ignored for
  285. # these networks. Typically you'd specify your IMAP proxy servers here.
  286. #login_trusted_networks =
  287.  
  288. # Space separated list of login access check sockets (e.g. tcpwrap)
  289. #login_access_sockets =
  290.  
  291. # With proxy_maybe=yes if proxy destination matches any of these IPs, don't do
  292. # proxying. This isn't necessary normally, but may be useful if the destination
  293. # IP is e.g. a load balancer's IP.
  294. #auth_proxy_self =
  295.  
  296. # Show more verbose process titles (in ps). Currently shows user name and
  297. # IP address. Useful for seeing who are actually using the IMAP processes
  298. # (eg. shared mailboxes or if same uid is used for multiple accounts).
  299. #verbose_proctitle = no
  300.  
  301. # Should all processes be killed when Dovecot master process shuts down.
  302. # Setting this to "no" means that Dovecot can be upgraded without
  303. # forcing existing client connections to close (although that could also be
  304. # a problem if the upgrade is e.g. because of a security fix).
  305. #shutdown_clients = yes
  306.  
  307. # If non-zero, run mail commands via this many connections to doveadm server,
  308. # instead of running them directly in the same process.
  309. #doveadm_worker_count = 0
  310. # UNIX socket or host:port used for connecting to doveadm server
  311. #doveadm_socket_path = doveadm-server
  312.  
  313. # Space separated list of environment variables that are preserved on Dovecot
  314. # startup and passed down to all of its child processes. You can also give
  315. # key=value pairs to always set specific settings.
  316. #import_environment = TZ
  317.  
  318. ##
  319. ## Dictionary server settings
  320. ##
  321.  
  322. # Dictionary can be used to store key=value lists. This is used by several
  323. # plugins. The dictionary can be accessed either directly or though a
  324. # dictionary server. The following dict block maps dictionary names to URIs
  325. # when the server is used. These can then be referenced using URIs in format
  326. # "proxy::<name>".
  327.  
  328. dict {
  329. #quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext
  330. #expire = sqlite:/etc/dovecot/dovecot-dict-sql.conf.ext
  331. }
  332.  
  333. # Most of the actual configuration gets included below. The filenames are
  334. # first sorted by their ASCII value and parsed in that order. The 00-prefixes
  335. # in filenames are intended to make it easier to understand the ordering.
  336. !include conf.d/*.conf
  337.  
  338. # A config file can also tried to be included without giving an error if
  339. # it's not found:
  340. !include_try local.conf
  341. #!----------------End /etc/dovecot/dovecot.conf
  342.  
  343. #!----------------/etc/dovecot/conf.d/10-auth.conf--
  344. ##
  345. ## Authentication processes
  346. ##
  347.  
  348. # Disable LOGIN command and all other plaintext authentications unless
  349. # SSL/TLS is used (LOGINDISABLED capability). Note that if the remote IP
  350. # matches the local IP (ie. you're connecting from the same computer), the
  351. # connection is considered secure and plaintext authentication is allowed.
  352. # See also ssl=required setting.
  353. disable_plaintext_auth = no
  354.  
  355. # Authentication cache size (e.g. 10M). 0 means it's disabled. Note that
  356. # bsdauth, PAM and vpopmail require cache_key to be set for caching to be used.
  357. #auth_cache_size = 0
  358. # Time to live for cached data. After TTL expires the cached record is no
  359. # longer used, *except* if the main database lookup returns internal failure.
  360. # We also try to handle password changes automatically: If user's previous
  361. # authentication was successful, but this one wasn't, the cache isn't used.
  362. # For now this works only with plaintext authentication.
  363. #auth_cache_ttl = 1 hour
  364. # TTL for negative hits (user not found, password mismatch).
  365. # 0 disables caching them completely.
  366. #auth_cache_negative_ttl = 1 hour
  367.  
  368. # Space separated list of realms for SASL authentication mechanisms that need
  369. # them. You can leave it empty if you don't want to support multiple realms.
  370. # Many clients simply use the first one listed here, so keep the default realm
  371. # first.
  372. #auth_realms =
  373.  
  374. # Default realm/domain to use if none was specified. This is used for both
  375. # SASL realms and appending @domain to username in plaintext logins.
  376. #auth_default_realm =
  377.  
  378. # List of allowed characters in username. If the user-given username contains
  379. # a character not listed in here, the login automatically fails. This is just
  380. # an extra check to make sure user can't exploit any potential quote escaping
  381. # vulnerabilities with SQL/LDAP databases. If you want to allow all characters,
  382. # set this value to empty.
  383. #auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@
  384.  
  385. # Username character translations before it's looked up from databases. The
  386. # value contains series of from -> to characters. For example "#@/@" means
  387. # that '#' and '/' characters are translated to '@'.
  388. #auth_username_translation =
  389.  
  390. # Username formatting before it's looked up from databases. You can use
  391. # the standard variables here, eg. %Lu would lowercase the username, %n would
  392. # drop away the domain if it was given, or "%n-AT-%d" would change the '@' into
  393. # "-AT-". This translation is done after auth_username_translation changes.
  394. #auth_username_format = %Lu
  395.  
  396. # If you want to allow master users to log in by specifying the master
  397. # username within the normal username string (ie. not using SASL mechanism's
  398. # support for it), you can specify the separator character here. The format
  399. # is then <username><separator><master username>. UW-IMAP uses "*" as the
  400. # separator, so that could be a good choice.
  401. #auth_master_user_separator =
  402.  
  403. # Username to use for users logging in with ANONYMOUS SASL mechanism
  404. #auth_anonymous_username = anonymous
  405.  
  406. # Maximum number of dovecot-auth worker processes. They're used to execute
  407. # blocking passdb and userdb queries (eg. MySQL and PAM). They're
  408. # automatically created and destroyed as needed.
  409. #auth_worker_max_count = 30
  410.  
  411. # Host name to use in GSSAPI principal names. The default is to use the
  412. # name returned by gethostname(). Use "$ALL" (with quotes) to allow all keytab
  413. # entries.
  414. #auth_gssapi_hostname =
  415.  
  416. # Kerberos keytab to use for the GSSAPI mechanism. Will use the system
  417. # default (usually /etc/krb5.keytab) if not specified. You may need to change
  418. # the auth service to run as root to be able to read this file.
  419. #auth_krb5_keytab =
  420.  
  421. # Do NTLM and GSS-SPNEGO authentication using Samba's winbind daemon and
  422. # ntlm_auth helper. <doc/wiki/Authentication/Mechanisms/Winbind.txt>
  423. #auth_use_winbind = no
  424.  
  425. # Path for Samba's ntlm_auth helper binary.
  426. #auth_winbind_helper_path = /usr/bin/ntlm_auth
  427.  
  428. # Time to delay before replying to failed authentications.
  429. #auth_failure_delay = 2 secs
  430.  
  431. # Require a valid SSL client certificate or the authentication fails.
  432. #auth_ssl_require_client_cert = no
  433.  
  434. # Take the username from client's SSL certificate, using
  435. # X509_NAME_get_text_by_NID() which returns the subject's DN's
  436. # CommonName.
  437. #auth_ssl_username_from_cert = no
  438.  
  439. # Space separated list of wanted authentication mechanisms:
  440. # plain login digest-md5 cram-md5 ntlm rpa apop anonymous gssapi otp skey
  441. # gss-spnego
  442. # NOTE: See also disable_plaintext_auth setting.
  443. auth_mechanisms = plain login
  444.  
  445. ##
  446. ## Password and user databases
  447. ##
  448.  
  449. #
  450. # Password database is used to verify user's password (and nothing more).
  451. # You can have multiple passdbs and userdbs. This is useful if you want to
  452. # allow both system users (/etc/passwd) and virtual users to login without
  453. # duplicating the system users into virtual database.
  454. #
  455. # <doc/wiki/PasswordDatabase.txt>
  456. #
  457. # User database specifies where mails are located and what user/group IDs
  458. # own them. For single-UID configuration use "static" userdb.
  459. #
  460. # <doc/wiki/UserDatabase.txt>
  461.  
  462. #!include auth-deny.conf.ext
  463. #!include auth-master.conf.ext
  464.  
  465. #!include auth-system.conf.ext
  466. !include auth-sql.conf.ext
  467. #!include auth-ldap.conf.ext
  468. #!include auth-passwdfile.conf.ext
  469. #!include auth-checkpassword.conf.ext
  470. #!include auth-vpopmail.conf.ext
  471. #!include auth-static.conf.ext
  472. #!----------------End /etc/dovecot/conf.d/10-auth.conf--
  473.  
  474. #!----------------/etc/dovecot/conf.d/10-master.conf--
  475. #default_process_limit = 100
  476. #default_client_limit = 1000
  477.  
  478. # Default VSZ (virtual memory size) limit for service processes. This is mainly
  479. # intended to catch and kill processes that leak memory before they eat up
  480. # everything.
  481. #default_vsz_limit = 256M
  482.  
  483. # Login user is internally used by login processes. This is the most untrusted
  484. # user in Dovecot system. It shouldn't have access to anything at all.
  485. #default_login_user = dovenull
  486.  
  487. # Internal user is used by unprivileged processes. It should be separate from
  488. # login user, so that login processes can't disturb other processes.
  489. #default_internal_user = dovecot
  490.  
  491. service imap-login {
  492. inet_listener imap {
  493. port = 143
  494. }
  495. inet_listener imaps {
  496. port = 993
  497. ssl = yes
  498. }
  499.  
  500. # Number of connections to handle before starting a new process. Typically
  501. # the only useful values are 0 (unlimited) or 1. 1 is more secure, but 0
  502. # is faster. <doc/wiki/LoginProcess.txt>
  503. service_count = 1
  504.  
  505. # Number of processes to always keep waiting for more connections.
  506. process_min_avail = 0
  507.  
  508. # If you set service_count=0, you probably need to grow this.
  509. vsz_limit = $default_vsz_limit
  510. }
  511.  
  512. service pop3-login {
  513. inet_listener pop3 {
  514. #port = 110
  515. }
  516. inet_listener pop3s {
  517. #port = 995
  518. #ssl = yes
  519. }
  520. }
  521.  
  522. service lmtp {
  523. unix_listener /var/spool/postfix/private/dovecot-lmtp {
  524. mode = 0666
  525. user = postfix
  526. group = postfix
  527. }
  528.  
  529. # Create inet listener only if you can't use the above UNIX socket
  530. #inet_listener lmtp {
  531. # Avoid making LMTP visible for the entire internet
  532. #address =
  533. #port =
  534. #}
  535. }
  536.  
  537. service imap {
  538. # Most of the memory goes to mmap()ing files. You may need to increase this
  539. # limit if you have huge mailboxes.
  540. #vsz_limit = $default_vsz_limit
  541.  
  542. # Max. number of IMAP processes (connections)
  543. #process_limit = 1024
  544. }
  545.  
  546. service pop3 {
  547. # Max. number of POP3 processes (connections)
  548. #process_limit = 1024
  549. }
  550.  
  551. service auth {
  552. # auth_socket_path points to this userdb socket by default. It's typically
  553. # used by dovecot-lda, doveadm, possibly imap process, etc. Users that have
  554. # full permissions to this socket are able to get a list of all usernames and
  555. # get the results of everyone's userdb lookups.
  556. #
  557. # The default 0666 mode allows anyone to connect to the socket, but the
  558. # userdb lookups will succeed only if the userdb returns an "uid" field that
  559. # matches the caller process's UID. Also if caller's uid or gid matches the
  560. # socket's uid or gid the lookup succeeds. Anything else causes a failure.
  561. #
  562. # To give the caller full permissions to lookup all users, set the mode to
  563. # something else than 0666 and Dovecot lets the kernel enforce the
  564. # permissions (e.g. 0777 allows everyone full permissions).
  565. unix_listener auth-userdb {
  566. #mode = 0666
  567. #user =
  568. #group =
  569. }
  570.  
  571. # Postfix smtp-auth
  572. unix_listener /var/spool/postfix/private/auth {
  573. mode = 0666
  574. }
  575.  
  576. # Auth process is run as this user.
  577. #user = $default_internal_user
  578. }
  579.  
  580. service auth-worker {
  581. # Auth worker process is run as root by default, so that it can access
  582. # /etc/shadow. If this isn't necessary, the user should be changed to
  583. # $default_internal_user.
  584. #user = root
  585. }
  586.  
  587. service dict {
  588. # If dict proxy is used, mail processes should have access to its socket.
  589. # For example: mode=0660, group=vmail and global mail_access_groups=vmail
  590. unix_listener dict {
  591. #mode = 0600
  592. #user =
  593. #group =
  594. }
  595. }
  596. #!----------------End /etc/dovecot/conf.d/10-master.conf--
  597.  
  598. #!----------------/etc/dovecot/conf.d/10-ssl.conf--
  599. ##
  600. ## SSL settings
  601. ##
  602.  
  603. # SSL/TLS support: yes, no, required. <doc/wiki/SSL.txt>
  604. ssl = yes
  605.  
  606. # PEM encoded X.509 SSL/TLS certificate and private key. They're opened before
  607. # dropping root privileges, so keep the key file unreadable by anyone but
  608. # root. Included doc/mkcert.sh can be used to easily generate self-signed
  609. # certificate, just make sure to update the domains in dovecot-openssl.cnf
  610. ssl_cert = </etc/ssl/certs/ssl-cert-snakeoil.pem
  611. ssl_key = </etc/ssl/private/ssl-cert-snakeoil.key
  612.  
  613. # If key file is password protected, give the password here. Alternatively
  614. # give it when starting dovecot with -p parameter. Since this file is often
  615. # world-readable, you may want to place this setting instead to a different
  616. # root owned 0600 file by using ssl_key_password = <path.
  617. #ssl_key_password =
  618.  
  619. # PEM encoded trusted certificate authority. Set this only if you intend to use
  620. # ssl_verify_client_cert=yes. The file should contain the CA certificate(s)
  621. # followed by the matching CRL(s). (e.g. ssl_ca = </etc/ssl/certs/ca.pem)
  622. #ssl_ca =
  623.  
  624. # Require that CRL check succeeds for client certificates.
  625. #ssl_require_crl = yes
  626.  
  627. # Directory and/or file for trusted SSL CA certificates. These are used only
  628. # when Dovecot needs to act as an SSL client (e.g. imapc backend). The
  629. # directory is usually /etc/ssl/certs in Debian-based systems and the file is
  630. # /etc/pki/tls/cert.pem in RedHat-based systems.
  631. #ssl_client_ca_dir =
  632. #ssl_client_ca_file =
  633.  
  634. # Request client to send a certificate. If you also want to require it, set
  635. # auth_ssl_require_client_cert=yes in auth section.
  636. #ssl_verify_client_cert = no
  637.  
  638. # Which field from certificate to use for username. commonName and
  639. # x500UniqueIdentifier are the usual choices. You'll also need to set
  640. # auth_ssl_username_from_cert=yes.
  641. #ssl_cert_username_field = commonName
  642.  
  643. # DH parameters length to use.
  644. #ssl_dh_parameters_length = 1024
  645.  
  646. # SSL protocols to use
  647. #ssl_protocols = !SSLv2
  648.  
  649. # SSL ciphers to use
  650. #ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL
  651.  
  652. # Prefer the server's order of ciphers over client's.
  653. #ssl_prefer_server_ciphers = no
  654.  
  655. # SSL crypto device to use, for valid values run "openssl engine"
  656. #ssl_crypto_device =
  657. #!----------------End /etc/dovecot/conf.d/10-ssl.conf--
  658.  
  659. #!----------------/etc/dovecot/dovecot-mysql.conf.ext--
  660. driver = mysql
  661. connect = host=127.0.0.1 dbname=postfixadmin user=postfixadmin password=root
  662. default_pass_scheme = MD5-CRYPT
  663. user_query = SELECT '/home/vmail/%d/%n' AS home, 3000 AS uid, 3000 AS gid FROM mailbox WHERE username = '%u'
  664. password_query = SELECT password FROM mailbox WHERE username = '%u'
  665. #!----------------End /etc/dovecot/dovecot-mysql.conf.ext--
  666.  
  667.  
  668. #!----------------Postgrey configuration files:
  669.  
  670. #!----------------/etc/default/postgrey--
  671. bash: cd: /etc/default/postgrey: Not a directory
  672. root@DemoMail:/etc/postgrey# cd /etc/default/
  673. root@DemoMail:/etc/default# cat postgrey
  674. # postgrey startup options, created for Debian
  675.  
  676. # you may want to set
  677. # --delay=N how long to greylist, seconds (default: 300)
  678. # --max-age=N delete old entries after N days (default: 35)
  679. # see also the postgrey(8) manpage
  680.  
  681. POSTGREY_OPTS="--unix=/var/spool/postfix/postgrey/socket --delay=60"
  682.  
  683. # the --greylist-text commandline argument can not be easily passed through
  684. # POSTGREY_OPTS when it contains spaces. So, insert your text here:
  685. #POSTGREY_TEXT="Your customized rejection message here"
  686. #!----------------End /etc/default/postgrey--
  687.  
  688.  
  689. #!----------------Spamassassin configuration files
  690.  
  691. #!----------------/etc/default/spamassassin--
  692. # Duncan Findlay
  693.  
  694. # WARNING: please read README.spamd before using.
  695. # There may be security risks.
  696.  
  697. # If you're using systemd (default for jessie), the ENABLED setting is
  698. # not used. Instead, enable spamd by issuing:
  699. # systemctl enable spamassassin.service
  700. # Change to "1" to enable spamd on systems using sysvinit:
  701. ENABLED=1
  702.  
  703. # Options
  704. # See man spamd for possible options. The -d option is automatically added.
  705.  
  706. # SpamAssassin uses a preforking model, so be careful! You need to
  707. # make sure --max-children is not set to anything higher than 5,
  708. # unless you know what you're doing.
  709.  
  710. OPTIONS="--create-prefs --max-children 5 --helper-home-dir=/var/lig/spamassassin -u spamd -g spamd"
  711.  
  712. # Pid file
  713. # Where should spamd write its PID to file? If you use the -u or
  714. # --username option above, this needs to be writable by that user.
  715. # Otherwise, the init script will not be able to shut spamd down.
  716. PIDFILE="/var/run/spamd.pid"
  717.  
  718. # Set nice level of spamd
  719. #NICE="--nicelevel 15"
  720.  
  721. # Cronjob
  722. # Set to anything but 0 to enable the cron job to automatically update
  723. # spamassassin's rules on a nightly basis
  724. CRON=1
  725. #!----------------End /etc/default/spamassassin--
  726.  
  727. #!----------------/etc/default/spamass-milter--
  728. # spamass-milt startup defaults
  729.  
  730. # OPTIONS are passed directly to spamass-milter.
  731. # man spamass-milter for details
  732.  
  733. # Non-standard configuration notes:
  734. # See README.Debian if you use the -x option with sendmail
  735. # You should not pass the -d option in OPTIONS; use SOCKET for that.
  736.  
  737. # Default, use the spamass-milter user as the default user, ignore
  738. # messages from localhost
  739. OPTIONS="-u spamass-milter -i 127.0.0.1"
  740.  
  741. # Reject emails with spamassassin scores > 15.
  742. OPTIONS="-r -1"
  743.  
  744. # Do not modify Subject:, Content-Type: or body.
  745. OPTIONS="-m"
  746.  
  747. ######################################
  748. # If /usr/sbin/postfix is executable, the following are set by
  749. # default. You can override them by uncommenting and changing them
  750. # here.
  751. ######################################
  752. SOCKET="/var/spool/postfix/spamass/spamass.sock"
  753. SOCKETOWNER="spamass-milter:postfix"
  754. SOCKETMODE="0660"
  755. ######################################
  756. #!----------------End /etc/default/spamass-milter--
  757.  
  758. #!----------------/etc/spamassassin/local.cf--
  759. # This is the right place to customize your installation of SpamAssassin.
  760. #
  761. # See 'perldoc Mail::SpamAssassin::Conf' for details of what can be
  762. # tweaked.
  763. #
  764. # Only a small subset of options are listed below
  765. #
  766. ###########################################################################
  767.  
  768. # Add *****SPAM***** to the Subject header of spam e-mails
  769. #
  770. rewrite_header Subject *****SPAM*****
  771.  
  772.  
  773. # Save spam messages as a message/rfc822 MIME attachment instead of
  774. # modifying the original message (0: off, 2: use text/plain instead)
  775. #
  776. report_safe 1
  777.  
  778.  
  779. # Set which networks or hosts are considered 'trusted' by your mail
  780. # server (i.e. not spammers)
  781. #
  782. # trusted_networks 212.17.35.
  783.  
  784.  
  785. # Set file-locking method (flock is not safe over NFS, but is faster)
  786. #
  787. # lock_method flock
  788.  
  789.  
  790. # Set the threshold at which a message is considered spam (default: 5.0)
  791. #
  792. required_score 5.0
  793.  
  794.  
  795. # Use Bayesian classifier (default: 1)
  796. #
  797. use_bayes 1
  798.  
  799.  
  800. # Bayesian classifier auto-learning (default: 1)
  801. #
  802. bayes_auto_learn 1
  803.  
  804.  
  805. # Set headers which may provide inappropriate cues to the Bayesian
  806. # classifier
  807. #
  808. # bayes_ignore_header X-Bogosity
  809. # bayes_ignore_header X-Spam-Flag
  810. # bayes_ignore_header X-Spam-Status
  811.  
  812.  
  813. # Some shortcircuiting, if the plugin is enabled
  814. #
  815. ifplugin Mail::SpamAssassin::Plugin::Shortcircuit
  816. #
  817. # default: strongly-whitelisted mails are *really* whitelisted now, if the
  818. # shortcircuiting plugin is active, causing early exit to save CPU load.
  819. # Uncomment to turn this on
  820. #
  821. # shortcircuit USER_IN_WHITELIST on
  822. # shortcircuit USER_IN_DEF_WHITELIST on
  823. # shortcircuit USER_IN_ALL_SPAM_TO on
  824. # shortcircuit SUBJECT_IN_WHITELIST on
  825.  
  826. # the opposite; blacklisted mails can also save CPU
  827. #
  828. # shortcircuit USER_IN_BLACKLIST on
  829. # shortcircuit USER_IN_BLACKLIST_TO on
  830. # shortcircuit SUBJECT_IN_BLACKLIST on
  831.  
  832. # if you have taken the time to correctly specify your "trusted_networks",
  833. # this is another good way to save CPU
  834. #
  835. # shortcircuit ALL_TRUSTED on
  836.  
  837. # and a well-trained bayes DB can save running rules, too
  838. #
  839. # shortcircuit BAYES_99 spam
  840. # shortcircuit BAYES_00 ham
  841.  
  842. endif # Mail::SpamAssassin::Plugin::Shortcircuit
  843. #!----------------End /etc/spamassassin/local.cf--
  844.  
  845. #!----------------/etc/spamassassin/spamc.conf--
  846. -U /var/spool/postfix/spamass/spamsass.sock
  847. -u spamass-milter
  848.  
  849. -s 350000
  850. #!----------------End /etc/spamassassin/spamc.conf--
  851.  
  852.  
  853. #!----------------Clamav configuration files:
  854.  
  855. #!----------------/etc/clamav/clamd.conf--
  856. #Automatically Generated by clamav-daemon postinst
  857. #To reconfigure clamd run #dpkg-reconfigure clamav-daemon
  858. #Please read /usr/share/doc/clamav-daemon/README.Debian.gz for details
  859. LocalSocket /var/run/clamav/clamd.ctl
  860. FixStaleSocket true
  861. LocalSocketGroup clamav
  862. LocalSocketMode 666
  863. # TemporaryDirectory is not set to its default /tmp here to make overriding
  864. # the default with environment variables TMPDIR/TMP/TEMP possible
  865. User clamav
  866. AllowSupplementaryGroups false
  867. ScanMail true
  868. ScanArchive true
  869. ArchiveBlockEncrypted false
  870. MaxDirectoryRecursion 15
  871. FollowDirectorySymlinks false
  872. FollowFileSymlinks false
  873. ReadTimeout 180
  874. MaxThreads 12
  875. MaxConnectionQueueLength 15
  876. LogSyslog false
  877. LogRotate true
  878. LogFacility LOG_LOCAL6
  879. LogClean false
  880. LogVerbose false
  881. DatabaseDirectory /var/lib/clamav
  882. OfficialDatabaseOnly false
  883. SelfCheck 3600
  884. Foreground false
  885. Debug false
  886. ScanPE true
  887. MaxEmbeddedPE 10M
  888. ScanOLE2 true
  889. ScanPDF true
  890. ScanHTML true
  891. MaxHTMLNormalize 10M
  892. MaxHTMLNoTags 2M
  893. MaxScriptNormalize 5M
  894. MaxZipTypeRcg 1M
  895. ScanSWF true
  896. DetectBrokenExecutables false
  897. ExitOnOOM false
  898. LeaveTemporaryFiles false
  899. AlgorithmicDetection true
  900. ScanELF true
  901. IdleTimeout 30
  902. CrossFilesystems true
  903. PhishingSignatures true
  904. PhishingScanURLs true
  905. PhishingAlwaysBlockSSLMismatch false
  906. PhishingAlwaysBlockCloak false
  907. PartitionIntersection false
  908. DetectPUA false
  909. ScanPartialMessages false
  910. HeuristicScanPrecedence false
  911. StructuredDataDetection false
  912. CommandReadTimeout 5
  913. SendBufTimeout 200
  914. MaxQueue 100
  915. ExtendedDetectionInfo true
  916. OLE2BlockMacros false
  917. ScanOnAccess false
  918. AllowAllMatchScan true
  919. ForceToDisk false
  920. DisableCertCheck false
  921. DisableCache false
  922. MaxScanSize 100M
  923. MaxFileSize 25M
  924. MaxRecursion 10
  925. MaxFiles 10000
  926. MaxPartitions 50
  927. MaxIconsPE 100
  928. StatsEnabled false
  929. StatsPEDisabled true
  930. StatsHostID auto
  931. StatsTimeout 10
  932. StreamMaxLength 25M
  933. LogFile /var/log/clamav/clamav.log
  934. LogTime true
  935. LogFileUnlock false
  936. LogFileMaxSize 0
  937. Bytecode true
  938. BytecodeSecurity TrustSigned
  939. BytecodeTimeout 60000
  940. #!----------------End /etc/clamav/clamd.conf--
  941.  
  942. #!----------------/etc/clamav/clamav-milter.conf--
  943. #Automatically Generated by clamav-milter postinst
  944. #To reconfigure clamav-milter run #dpkg-reconfigure clamav-milter
  945. #Please read /usr/share/doc/clamav-base/README.Debian.gz for details
  946. MilterSocket /var/spool/postfix/clamav/clamav-milter.ctl
  947. FixStaleSocket true
  948. User clamav
  949. AllowSupplementaryGroups true
  950. ReadTimeout 120
  951. Foreground false
  952. PidFile /var/run/clamav/clamav-milter.pid
  953. ClamdSocket unix:/var/run/clamav/clamd.ctl
  954. OnClean Accept
  955. OnInfected Reject
  956. OnFail Defer
  957. AddHeader Replace
  958. LogSyslog false
  959. LogFacility LOG_LOCAL6
  960. LogVerbose false
  961. LogInfected Off
  962. LogClean Off
  963. LogRotate true
  964. MaxFileSize 25M
  965. SupportMultipleRecipients false
  966. RejectMsg Rejected: %v found
  967. TemporaryDirectory /tmp
  968. LogFile /var/log/clamav/clamav-milter.log
  969. LogTime true
  970. LogFileUnlock false
  971. LogFileMaxSize 0
  972. MilterSocketGroup clamav
  973. MilterSocketMode 660
  974. #!----------------/etc/clamav/clamav-milter.conf--
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!