The RIGHT way to have a mail and spamfilter gateway and relay

classic Classic list List threaded Threaded
1 message Options
Reply | Threaded
Open this post in threaded view
|

The RIGHT way to have a mail and spamfilter gateway and relay

James Lay
The RIGHT way to have a mail and spamfilter gateway and relay Hey all!

Been running this for quite some time....I want to make sure it’s setup correctly (just because it’s working doesn’t mean I set it up right ;)

I have just a relay machine that snags incoming port 25, forward it to itself, spam/av checks, then forwards along to the actually mail host.  I have a feeling I’m not doing this the right way, so I thought I’d fire out an email here.  I’ve been using check_recipient_access under smtpd_restrictions, but I don’t think that’s really the right way to do it.  Please critique if you can.  Thank you.

Postconf –n:

alias_database = hash:/etc/postfix/aliases
alias_maps = hash:/etc/postfix/aliases
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
debug_peer_level = 2
default_privs = nobody
header_checks = regexp:/etc/postfix/header_checks
html_directory = no
inet_interfaces = $myhostname, localhost
luser_relay = 192.168.0.2
mail_owner = postfix
mailbox_size_limit = 110240000
mailq_path = /usr/bin/mailq
manpage_directory = /usr/local/man
message_size_limit = 110000000
mydestination = mail.$mydomain
mydomain = slave-tothe-box.net
myhostname = myshield.slave-tothe-box.net
mynetworks = 192.168.0.0/24
myorigin = $mydomain
newaliases_path = /usr/bin/newaliases
queue_directory = /var/spool/postfix
readme_directory = no
relay_domains = $mydestination
relayhost = mail.slave-tothe-box.net
sample_directory = /etc/postfix
sendmail_path = /usr/sbin/sendmail
setgid_group = postdrop
smtp_host_lookup = native
smtp_tls_cert_file = /etc/postfix/certs/mail_signed_cert.pem
smtp_tls_key_file = /etc/postfix/certs/mailkey.pem
smtp_tls_loglevel = 1
smtp_tls_note_starttls_offer = yes
smtp_use_tls = no
smtpd_banner = mail.slave-tothe-box.net ESMTP
smtpd_delay_reject = yes
smtpd_helo_required = yes
smtpd_recipient_restrictions = permit_mynetworks,        check_recipient_access regexp:/etc/postfix/reject-users,    check_sender_access pcre:/etc/postfix/sender_access,    check_client_access regexp:/etc/postfix/client_access,    reject_invalid_hostname,        reject_non_fqdn_sender,    reject_unauth_destination
smtpd_tls_ask_ccert = no
smtpd_tls_cert_file = /etc/postfix/certs/mail_signed_cert.pem
smtpd_tls_key_file = /etc/postfix/certs/mailkey.pem
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
smtpd_use_tls = yes
strict_rfc821_envelopes = yes
tls_random_source = dev:/dev/urandom
transport_maps = hash:/etc/postfix/transport
unknown_local_recipient_reject_code = 450

Transport:

slave-tothe-box.net       smtp:[mail.slave-tothe-box.net]