# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (yes)   (never) (100)
# ==========================================================================
smtp      inet  n       -       n       -       -       smtpd
# smtpd_client_restrictions=permit_sasl_authenticated,reject - wysyłanie emaili poprzez 587 wymaga logowania
submission inet n       -       n       -       -       smtpd -o smtpd_client_restrictions=permit_sasl_authenticated,reject
# smtpd_client_restrictions=permit_sasl_authenticated,reject - wysyłanie emaili poprzez 465 wymaga logowania
smtps     inet  n       -       n       -       -       smtpd -o smtpd_tls_wrappermode=yes -o smtpd_client_restrictions=permit_sasl_authenticated,reject

smtps     inet  n       -       n       -       -       smtpd -o smtpd_tls_wrappermode=yes -o smtpd_sender_restrictions=permit_sasl_authenticated,reject

# enforce STARTTLS support to remote SMTP clients
#smtpd_enforce_tls_only = yes
smtpd_tls_auth_only = no
# require client for send certificate
# comment out this when enable smtpd_tls_wrappermode=yes
#smtpd_tls_req_ccert = yes

#inet_interfaces = localhost
inet_interfaces = all

# Enable IPv4, and IPv6 if supported
inet_protocols = all

# TRANSPORT MAP
#
# See the discussion in the ADDRESS_REWRITING_README document.
transport_maps = hash:/etc/postfix/transport

# JUNK MAIL CONTROLS
#
[...]
#
# For details, see "man header_checks".
#
#header_checks = regexp:/etc/postfix/header_checks
header_checks = pcre:/etc/postfix/header_checks.pcre

# switch on TLS on smtpd server
smtpd_use_tls = yes
# smtpd server log level information
smtpd_tls_loglevel = 1
# enforce STARTTLS by remote SMTP clients, and never send mail in the clear
# set smtpd_enforce_tls=no to enable recv mail plain text
smtpd_enforce_tls = no
# force STARTTLS before command AUTH ("yes" need SASL)
# set smtpd_tls_auth_only=no to enable AUTH without STARTTLS
smtpd_tls_auth_only = yes
# require client for send certificate
# comment out this when enable smtpd_tls_wrappermode=yes
#smtpd_tls_req_ccert = yes
# smtpd server key
smtpd_tls_key_file = /etc/pki/tls/certs/smtpd.pem
# smtpd server cert
smtpd_tls_cert_file = /etc/pki/tls/certs/smtpd.pem
# smtpd server CA
smtpd_tls_CAfile = /etc/pki/tls/certs/ca-bundle.crt

# client use TLS when a remote SMTP server TLS support
smtp_use_tls = yes
# log the hostname of a remote SMTP server that offers STARTTLS, when TLS is not already enabled for that server
smtp_tls_note_starttls_offer = yes
# require that remote SMTP servers use TLS encryption, and never send mail in the clear
# set smtp_enforce_tls=no to enable send mail plain text
smtp_enforce_tls = no
# smtp client log level information
smtp_tls_loglevel = 1
# Postfix SMTP client SASL security options, disable anonymous and plain AUTH without TLS
smtp_sasl_security_options = noanonymous, noplaintext
# The SASL authentication security options that the Postfix SMTP client uses for TLS encrypted SMTP sessions, enable pain text AUTH after STARTTLS
smtp_sasl_tls_security_options = noanonymous
# smtp client key
smtp_tls_key_file = /etc/pki/tls/certs/smtpd.pem
# smtp client cert
smtp_tls_cert_file = /etc/pki/tls/certs/smtpd.pem
# smtp client CA
smtp_tls_CAfile = /etc/pki/tls/certs/ca-bundle.crt

# The external entropy source for the in-memory tlsmgr(8) pseudo random number generator (PRNG) pool
tls_random_source = dev:/dev/urandom

# AUTH POSTFIX WITH DOVECOT
# -------------------------
# To config SASL in postfix, we need to make the following additions to /etc/postfix/main.cf:
smtpd_sasl_auth_enable = yes
broken_sasl_auth_clients = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/dovecot-auth
smtpd_sasl_security_options = noanonymous

# Report the SASL authenticated user name in the smtpd(8) Received message header
# causes display in headers: Received: from ... (Authenticated sender: ...)
smtpd_sasl_authenticated_header = yes

# Next we need to config auth default in the authentication processes section of /etc/dovecot.conf.
# Uncomment and/or add the following lines as necessary (be careful as this section is heavily commented,
# some entries already exist, others are commented out and need uncommenting such as socket listen):
auth default {
  [...]
  user = root
  [...]
  socket listen {
    client {
      path = /var/spool/postfix/private/dovecot-auth
      mode = 0660
      user = postfix
      group = postfix
    }
  }
}

service auth {
  unix_listener /var/spool/postfix/private/dovecot-auth {
    mode = 0660
    user = postfix
    group = postfix
  }
}

mydestination = $myhostname, localhost.$mydomain, localhost

mailbox_command = /usr/libexec/dovecot/deliver

mydestination = localhost.$mydomain, localhost

virtual_transport = dovecot
proxy_read_maps = $local_recipient_maps $smtpd_sender_login_maps $virtual_mailbox_domains $virtual_mailbox_maps $virtual_alias_domains $virtual_alias_maps $relay_domains $relay_recipient_maps

# dovecot 1.*
# case sensitive mailaddresses
# You should use flags=DR (without hu) if you have case sensitive directories
# for storing mails. Otherwise dovecot delivers all mails to the wrong directory.
dovecot   unix  -       n       n       -       -       pipe flags=DR user=vmail:vmail argv=/usr/libexec/dovecot/deliver -f ${sender} -d ${user}@${nexthop} -m ${extension}

# dovecot 2.*
# case sensitive mailaddresses
# You should use flags=DR (without hu) if you have case sensitive directories
# for storing mails. Otherwise dovecot delivers all mails to the wrong directory.
dovecot   unix  -       n       n       -       -       pipe flags=DR user=vmail:vmail argv=/usr/libexec/dovecot/dovecot-lda -f ${sender} -d ${user}@${nexthop} -m ${extension}

dovecot_destination_recipient_limit = 1
virtual_uid_maps = static:450
virtual_gid_maps = static:450
virtual_mailbox_base = /home/vmail
#virtual_mailbox_domains = cen05dev.xen.wbcd.pl
virtual_mailbox_domains = cen05dev.cen05dev.xen.wbcd.pl, proxy:mysql:/etc/postfix/mailbox_domains.mysql.cf
#virtual_mailbox_maps = hash:/etc/postfix/mailbox_maps
virtual_mailbox_maps = hash:/etc/postfix/mailbox_maps, proxy:mysql:/etc/postfix/mailbox_maps.mysql.cf
# cen05: fatal: bad string length 0 < 1:
#virtual_alias_domains = proxy:mysql:/etc/postfix/virtual_alias_domains.mysql.cf
#virtual_alias_maps = hash:/etc/postfix/virtual
virtual_alias_maps = hash:/etc/postfix/virtual, proxy:mysql:/etc/postfix/virtual_alias_maps.mysql.cf

dovecot_destination_recipient_limit = 1
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000
virtual_mailbox_base = /home/vmail
#virtual_mailbox_domains = cen06dev.xen.wbcd.pl
virtual_mailbox_domains = cen06dev.cen06dev.xen.wbcd.pl, proxy:mysql:/etc/postfix/mailbox_domains.mysql.cf
#virtual_mailbox_maps = hash:/etc/postfix/mailbox_maps
virtual_mailbox_maps = hash:/etc/postfix/mailbox_maps, proxy:mysql:/etc/postfix/mailbox_maps.mysql.cf
#virtual_alias_domains =
virtual_alias_domains = proxy:mysql:/etc/postfix/virtual_alias_domains.mysql.cf
#virtual_alias_maps = hash:/etc/postfix/virtual
virtual_alias_maps = hash:/etc/postfix/virtual, proxy:mysql:/etc/postfix/virtual_alias_maps.mysql.cf

# default smtpd_delay_reject=yes causes that
# any rule smtpd_client_restrictions reject mail,
# then messago about that is send after 'RCPT TO:'.
smtpd_delay_reject = yes

# client restrictions
smtpd_client_restrictions =
    permit_mynetworks,
#    reject_rbl_client relays.ordb.org,
# reject_unknown_reverse_client_hostname - Reject the request when the client IP address has no address->name mapping
    reject_unknown_reverse_client_hostname,
    check_client_access cidr:/etc/postfix/client_access.cidr,
    check_client_access pcre:/etc/postfix/client_access.pcre,
    permit

# Content /etc/postfix/client_access.pcre:
# ----------------------------------------
# /64.170.162.98/   REJECT Get lost - You are not invited
# /unixwiz.net/     REJECT Get lost - You are not invited
# ----------------------------------------
# do not compile this file !!!

# Content /etc/postfix/client_access.cidr:
# ----------------------------------------
# 64.170.162.98/32 REJECT Get lost - You are not invited
# 224.0.0.0/8      REJECT multicast not invited
# 192.168.1.1      OK
# 192.168.0.0/16   REJECT
# ----------------------------------------
# do not compile this file !!!

# alternatively you can use hash:/etc/postfix/sender_access:
# ----------------------------------------------------------
# 64.170.162.98   REJECT Get lost - You are not invited
# unixwiz.net     REJECT Get lost - You are not invited
# ----------------------------------------------------------
# Compile client_access into client_access.db:
# postmap /etc/postfix/client_access

# helo restrictions
#smtpd_helo_required is needed for: reject_unknown_helo_hostname+reject_non_fqdn_helo_hostname+reject_invalid_helo_hostname
smtpd_helo_required = yes
smtpd_helo_restrictions =
    permit_mynetworks,
# permit_sasl_authenticated - Permit the request when the client is successfully authenticated via the RFC 4954 (AUTH) protocol
    permit_sasl_authenticated,
# reject_non_fqdn_helo_hostname (Postfix<2.3: reject_non_fqdn_hostname) - Reject the request when the HELO or EHLO hostname is not in fully-qualified domain form, as required by the RFC
    reject_non_fqdn_helo_hostname,
# reject_invalid_helo_hostname (Postfix<2.3: reject_invalid_hostname) - Reject the request when the HELO or EHLO hostname is malformed
    reject_invalid_helo_hostname,
# reject_unknown_helo_hostname - Reject the request when the HELO or EHLO hostname has no DNS A or MX record
    reject_unknown_helo_hostname,
    check_helo_access pcre:/etc/postfix/helo_access.pcre,
    permit

# check_helo_access
# Content /etc/postfix/helo_access.pcre:
# --------------------------------------
# /^.*localhost.*$/     REJECT You are not localhost
# /^.*localdomain.*$/   REJECT You are not localdomain
# /^64.170.162.98$/     REJECT Get lost - you're lying about who you are
# /^unixwiz.net$/       REJECT Get lost - you're lying about who you are
# --------------------------------------
# do not compile this file !!!

# alternatively you can use hash:/etc/postfix/helo_access:
# --------------------------------------------------------
# localhost             REJECT You are not localhost
# localdomain           REJECT You are not localdomain
# localhost.localdomain REJECT You are not localhost.localdomain
# 64.170.162.98         REJECT Get lost - you're lying about who you are
# unixwiz.net           REJECT Get lost - you're lying about who you are
# --------------------------------------------------------
# Compile helo_access into helo_access.db:
# postmap /etc/postfix/helo_access

/localhost/           REJECT need fully-qualified hostname
/localdomain/         REJECT need fully-qualified hostname
/^64.170.162.98$/     REJECT Get lost - you're lying about who you are
/^unixwiz.net$/       REJECT Get lost - you're lying about who you are

# smtpd_sender_login_maps
# Optional lookup table with the SASL login names that own sender (MAIL FROM) addresses
# Content /etc/postfix/sender_login_maps:
# ---------------------------------------
# sp@cen05.xen.wbcd.pl    sp
# ---------------------------------------
# MySQL (Database) Accounts / dovecot
# Content /etc/postfix/sender_login_maps:
# ---------------------------------------
# sp@cen05dev.xen.wbcd.pl   sp@cen05dev.xen.wbcd.pl
# root@cen05dev.xen.wbcd.pl sp@cen05dev.xen.wbcd.pl
# ---------------------------------------
# Compile sender_login_maps into sender_login_maps.db:
# postmap /etc/postfix/sender_login_maps
smtpd_sender_login_maps = hash:/etc/postfix/sender_login_maps
# Request that the Postfix SMTP server rejects mail from unknown sender addresses,
# even when no explicit reject_unlisted_sender access restriction is specified.
# This can slow down an explosion of forged mail from worms or viruses.
# An address is always considered "known" when it matches a virtual(5) alias or a canonical(5) mapping.
# * The sender domain matches $mydestination, $inet_interfaces or $proxy_interfaces, but the sender is not listed in $local_recipient_maps, and $local_recipient_maps is not null.
# * The sender domain matches $virtual_alias_domains but the sender is not listed in $virtual_alias_maps.
# * The sender domain matches $virtual_mailbox_domains but the sender is not listed in $virtual_mailbox_maps, and $virtual_mailbox_maps is not null.
# * The sender domain matches $relay_domains but the sender is not listed in $relay_recipient_maps, and $relay_recipient_maps is not null.
# cat /etc/aliases | sed -n 's,^\([^#].*\):.*$,\1,p' | sed "s,$,@$HOSTNAME root,g" >> /etc/postfix/sender_login_maps;
# postmap /etc/postfix/sender_login_maps;
# sender restrictions
smtpd_sender_restrictions =
    permit_mynetworks,
# reject_sender_login_mismatch must be before permit_sasl_authenticated to disable spoofing
# (reject_sender_login_mismatch after permit_sasl_authenticated not working !!!)
# reject_sender_login_mismatch (need: smtpd_sender_login_maps) - Reject the request when $smtpd_sender_login_maps specifies an owner for the MAIL FROM address,
# but the client is not (SASL) logged in as that MAIL FROM address owner or when the client is (SASL) logged in, but the client login name doesn't own the MAIL FROM address
    reject_sender_login_mismatch,
# permit_sasl_authenticated - Permit the request when the client is successfully authenticated via the RFC 4954 (AUTH) protocol
    permit_sasl_authenticated,
# reject_unauth_pipelining - Reject the request when the client sends SMTP commands ahead of time where it is not allowed (not talking, but send all SMTP commands (HELO,MAILFROM,RCPTTO,DATA,QUIT) in one write)
    reject_unauth_pipelining,
# reject_non_fqdn_sender - Reject the request when the MAIL FROM address is not in fully-qualified domain form, as required by the RFC
    reject_non_fqdn_sender,
# reject_unknown_sender_domain - Reject the request when Postfix is not final destination for the sender address,
# and the MAIL FROM domain has 1) no DNS A or MX record, or 2) a malformed MX record such as a record with a zero-length MX hostname (Postfix>2.3)
    reject_unknown_sender_domain,
# Reject the request when the MAIL FROM address is not listed in the list of valid recipients for its domain class.
# See the smtpd_reject_unlisted_sender parameter description for details.
    reject_unlisted_sender,
    check_sender_access pcre:/etc/postfix/sender_access.pcre,
    permit

# Content /etc/postfix/sender_access.pcre:
# ----------------------------------------
# /^sp@cen05.xen.wbcd.pl$/        OK
# /^ola@cen05.xen.wbcd.pl$/       OK
# /^nobody/                       REJECT
# /cen06x64.xen.wbcd.pl$/         Domain blocked in local recipient table (in reply to RCPT TO command))
# /^root@cen05dev.xen.wbcd.pl$/   User blocked in local recipient table (in reply to RCPT TO command))
# /^\@/                           550 5.1.7 Invalid address format.
# /[!%\@].*\@/                    550 5.1.7 This server disallows weird address syntax.
# ----------------------------------------
# do not compile this file !!!

# alternatively you can use hash:/etc/postfix/sender_access:
# ----------------------------------------------------------
# sp@cen05.xen.wbcd.pl        OK
# ola@cen05.xen.wbcd.pl       OK
# root@cen05.xen.wbcd.pl      REJECT
# ----------------------------------------------------------
# Filter only mail addressed to local domains:
# filter:dummy - i.e. pipe filter: /home/local/sbin/postfix-pipe-content-filter.sh
# example.com       FILTER filter:dummy
# example.net       FILTER filter:dummy
# otherdomain.ca    FILTER filter:dummy
# ----------------------------------------------------------
# Compile sender_access into sender_access.db:
# postmap /etc/postfix/sender_access

# smtpd_recipient_restrictions
smtpd_recipient_restrictions =
    permit_mynetworks,
# permit_sasl_authenticated - Permit the request when the client is successfully authenticated via the RFC 4954 (AUTH) protocol
    permit_sasl_authenticated,
# reject_unauth_destination - Reject the request unless one of the following is true:
# * Postfix is mail forwarder: the resolved RCPT TO domain matches $relay_domains or a subdomain thereof, and contains no sender-specified routing (user@elsewhere@doma
# * Postfix is the final destination: the resolved RCPT TO domain matches $mydestination, $inet_interfaces, $proxy_interfaces, $virtual_alias_domains, or $virtual_mail
# The relay_domains_reject_code parameter specifies the response code for rejected requests (default: 554).
    reject_unauth_destination,
    check_recipient_access pcre:/etc/postfix/recipient_access.pcre,
    permit

# Content /etc/postfix/recipient_access.pcre:
# -------------------------------------------
# /^sp@cen05.xen.wbcd.pl$/        OK
# /^ola@cen05.xen.wbcd.pl$/       OK
# /^nobody/                       REJECT
# /cen05x64.xen.wbcd.pl$/         Domain blocked in local recipient table (in reply to RCPT TO command))
# /^root@cen05dev.xen.wbcd.pl$/   User blocked in local recipient table (in reply to RCPT TO command))
# /^\@/                           550 5.1.7 Invalid address format.
# /[!%\@].*\@/                    550 5.1.7 This server disallows weird address syntax.
# -------------------------------------------
# Filter only mail addressed to local domains:
# filter:dummy - i.e. pipe filter: /home/local/sbin/postfix-pipe-content-filter.sh
# example.com       FILTER filter:dummy
# example.net       FILTER filter:dummy
# otherdomain.ca    FILTER filter:dummy
# -------------------------------------------
# do not compile this file !!!

# alternatively you can use hash:/etc/postfix/recipient_access:
# -------------------------------------------------------------
# sp@cen05.xen.wbcd.pl        OK
# ola@cen05.xen.wbcd.pl       OK
# root@cen05.xen.wbcd.pl   REJECT
# -------------------------------------------------------------
# Compile recipient_access into recipient_access.db:
# postmap /etc/postfix/recipient_access

# smtpd_data_restrictions =

# smtpd_end_of_data_restrictions =

# smtpd_etrn_restrictions =

# smtpd_restriction_classes =