|
|
| (44 dazwischenliegende Versionen desselben Benutzers werden nicht angezeigt) |
| Zeile 1: |
Zeile 1: |
| == Introduction ==
| |
| Postfix has several hundred configuration parameters that are controlled via the [https://www.postfix.org/postconf.5.html main.cf] file.
| |
| * Fortunately, all parameters have sensible default values.
| |
| * In many cases, you need to configure only two or three parameters before you can start to play with the mail system.
| |
| * Here's a quick introduction to the syntax: * [https://www.postfix.org/BASIC_CONFIGURATION_README.html#syntax Postfix configuration files]
| |
|
| |
| The text below assumes that you already have Postfix installed on the system, either by compiling the source code yourself (as described in the [https://www.postfix.org/INSTALL.html INSTALL] file) or by installing an already compiled version.
| |
|
| |
| This document covers basic Postfix configuration.
| |
| * Information about how to configure Postfix for specific applications such as mailhub, firewall or dial-up client can be found in the [https://www.postfix.org/STANDARD_CONFIGURATION_README.html STANDARD_CONFIGURATION_README] file.
| |
| * But don't go there until you already have covered the material presented below.
| |
|
| |
| The first parameters of interest specify the machine's identity and role in the network. * [https://www.postfix.org/BASIC_CONFIGURATION_README.html#myorigin What domain name to use in outbound mail ]
| |
| * [https://www.postfix.org/BASIC_CONFIGURATION_README.html#mydestination What domains to receive mail for ]
| |
| * [https://www.postfix.org/BASIC_CONFIGURATION_README.html#relay_from What clients to relay mail from ]
| |
| * [https://www.postfix.org/BASIC_CONFIGURATION_README.html#relay_to What destinations to relay mail to ]
| |
| * [https://www.postfix.org/BASIC_CONFIGURATION_README.html#relayhost What delivery method: direct or indirect ]
| |
|
| |
| The default values for many other configuration parameters are derived from just these.
| |
|
| |
| The next parameter of interest controls the amount of mail sent to the local postmaster: * [https://www.postfix.org/BASIC_CONFIGURATION_README.html#notify What trouble to report to the postmaster ]
| |
|
| |
| Be sure to set the following correctly if you're behind a proxy or network address translator, and you are running a backup MX host for some other domain: * [https://www.postfix.org/BASIC_CONFIGURATION_README.html#proxy_interfaces Proxy/NAT external network addresses ]
| |
|
| |
| Postfix daemon processes run in the background, and log problems and normal activity to the syslog daemon.
| |
| * Here are a few things that you need to be aware of: * [https://www.postfix.org/BASIC_CONFIGURATION_README.html#syslog_howto What you need to know about Postfix logging ]
| |
|
| |
| If your machine has unusual security requirements you may want to run Postfix daemon processes inside a chroot environment. * [https://www.postfix.org/BASIC_CONFIGURATION_README.html#chroot_setup Running Postfix daemon processes chrooted ]
| |
|
| |
| If you run Postfix on a virtual network interface, or if your machine runs other mailers on virtual interfaces, you'll have to look at the other parameters listed here as well: * [https://www.postfix.org/BASIC_CONFIGURATION_README.html#myhostname My own hostname ]
| |
| * [https://www.postfix.org/BASIC_CONFIGURATION_README.html#mydomain My own domain name ]
| |
| * [https://www.postfix.org/BASIC_CONFIGURATION_README.html#inet_interfaces My own network addresses ]
| |
|
| |
| == Grundkonfiguration ==
| |
| Nach der Installation folgt die Grundkonfiguration
| |
| * Standardwerte übernehmen, bei Fragen, die hier nicht angesprochen werden
| |
|
| |
| === Typ der Konfiguration / Einsatzszenario === | | === Typ der Konfiguration / Einsatzszenario === |
| {| class="wikitable sortable" | | {| class="wikitable sortable" |
| Zeile 41: |
Zeile 4: |
| ! Typ !! Beschreibung | | ! Typ !! Beschreibung |
| |- | | |- |
| | [[Postfix:Keine Konfiguration|Keine Konfiguration]] || Aktuelle Konfiguration unverändert lassen | | | [[Postfix/Keine Konfiguration|Keine Konfiguration]] || Aktuelle Konfiguration unverändert lassen |
| |- | | |- |
| | [[Postfix:Internet Site|Internet Site]] || Mail wird empfangen und verschickt (Standard). | | | [[Postfix/Internet Site|Internet Site]] || Mail wird empfangen und verschickt (Standard) |
| * Echter Mailserver mit fester IP-Adresse, z.B. | | * Echter Mailserver mit fester IP-Adresse, beispielsweise Root-Server, E-Mails werden direkt via SMTP versandt und empfangen |
| * Root-Server, E-Mails werden direkt via SMTP versandt und empfangen.
| |
| |- | | |- |
| | [[Postfix:Smarthost|Smarthost]] || Wie Internet Site, aber Mail wird nicht direkt an den entfernten Server zugestellt, sondern über einen anderen Server (etwa beim ISP) geleitet. | | | [[Postfix/Smarthost|Smarthost]] || Wie Internet Site, aber Mail wird nicht direkt an den entfernten Server zugestellt, sondern über einen anderen Server (etwa beim ISP) geleitet |
| * Mailserver mit dynamischer IP-Adresse, die sonst sehr oft als potentielle Spam- oder Virenversender blockiert werden. | | * Mailserver mit dynamischer IP-Adresse, die sonst als potenzielle Spam- oder Virenversender blockiert werden |
| * E-Mails werden direkt mittels SMTP oder über ein Hilfsprogramm wie [[Fetchmail]] empfangen. | | * E-Mails werden direkt mittels SMTP oder über ein Hilfsprogramm wie [[Fetchmail]] empfangen |
| * Ausgehende E-Mails werden über einen Smarthost versandt- | | * Ausgehende E-Mails werden über einen Smarthost versandt |
| |- | | |- |
| | [[Postfix:Satellite System|Satellite System]] || Keine Mail wird empfangen, alle ausgehende Mail über einen Smarthost (s.o.) verschickt. | | | [[Postfix/Satellite System|Satellite System]] || Keine Mail wird empfangen, alle ausgehende Mail über einen Smarthost (s.o.) verschickt |
| * Mail durch Admin-Skripte oder Webapplikationen verschicken lassen. | | * Mail durch Admin-Skripte oder Webapplikationen verschicken lassen |
| * Alle E-Mails werden zur Zustellung einer anderen Maschine, genannt »Smarthost«, übergeben. | | * Alle E-Mails werden zur Zustellung einer anderen Maschine, genannt ''Smarthost'', übergeben |
| |- | | |- |
| | [[Postfix:Local only|Local only]] || Mail wird lokal auf dem Rechner zugestellt, es wird keine Mail von außen empfangen bzw. | | | [[Postfix/Lokaler Mailserver|Lokaler Mailserver]] || Mail wird lokal auf dem Rechner zugestellt, es wird keine Mail von außen empfangen bzw. nach außen geschickt |
| * nach außen geschickt.
| | * Wie ''Satellite System'', aber die Mail soll direkt auf demselben System gelesen werden |
| * Wie ''Satellite System'', aber die Mail soll direkt auf demselben System gelesen werden. | | * Es werden nur E-Mails für lokale Benutzer zugestellt |
| * Es werden nur E-Mails für lokale Benutzer zugestellt. | |
| * Ohne Netzwerkzugang. | | * Ohne Netzwerkzugang. |
| |} | | |} |
|
| |
| === Grundkonfiguration wiederholen ===
| |
| # '''dpkg-reconfigure postfix'''
| |
|
| |
|
| === Wohin soll die Mail für root gehen? === | | === Wohin soll die Mail für root gehen? === |
| Zeile 73: |
Zeile 31: |
| * In den meisten Fällen sollte man einfach den Hostnamen als Mailnamen akzeptieren, außer man ist im Besitz eines geeigneteren Domain-Namens. | | * In den meisten Fällen sollte man einfach den Hostnamen als Mailnamen akzeptieren, außer man ist im Besitz eines geeigneteren Domain-Namens. |
|
| |
|
| === SMTP relay host? === | | === SMTP relay host === |
| * Mailserver des Anbieters z.B. | | * Mailserver des Anbieters beispielsweise ''smtp.mailanbieter.de'' |
| ** ''smtp.mailanbieter.de''
| |
|
| |
|
| === Für welche weiteren Rechner möchten Sie Mails akzeptieren? === | | === Für welche weiteren Rechner möchten Sie Mails akzeptieren? === |
| Zeile 87: |
Zeile 44: |
| 127.0.0.0/8, 192.168.1.0/24 | | 127.0.0.0/8, 192.168.1.0/24 |
|
| |
|
| Wer seinen Server, bspw. | | Wer seinen Server, bspw. einen Root-Server, über das Internet nutzen will, sollte hier auf keinen Fall weite Adressbereiche erlauben, sondern für den Versand stattdessen eine [[Postfix/Authentifizierung]] verlangen. |
| * einen Root-Server, über das Internet nutzen will, sollte hier auf keinen Fall weite Adressbereiche erlauben, sondern für den Versand stattdessen eine [[Postfix:Authentifizierung]] verlangen.
| |
|
| |
|
| '''Hinweis''' | | '''Hinweis''' |
| Zeile 96: |
Zeile 52: |
| Danach ist die erste Konfiguration von Postfix abgeschlossen und wird in der Datei '''/etc/postfix/main.cf''' hinterlegt. | | Danach ist die erste Konfiguration von Postfix abgeschlossen und wird in der Datei '''/etc/postfix/main.cf''' hinterlegt. |
|
| |
|
| === Postfix configuration files === | | === Grundkonfiguration wiederholen === |
| By default, Postfix configuration files are in /etc/postfix.
| | # '''dpkg-reconfigure postfix''' |
| * The two most important files are [https://www.postfix.org/postconf.5.html main.cf] and [https://www.postfix.org/master.5.html master.cf]<nowiki>; these files must be owned by root.
| |
| * Giving someone else write permission to </nowiki>[https://www.postfix.org/postconf.5.html main.cf] or [https://www.postfix.org/master.5.html master.cf] (or to their parent directories) means giving root privileges to that person.
| |
| | |
| In /etc/postfix/[https://www.postfix.org/postconf.5.html main.cf] you will have to set up a minimal number of configuration parameters.
| |
| * Postfix configuration parameters resemble shell variables, with two important differences: the first one is that Postfix does not know about quotes like the UNIX shell does.
| |
| | |
| You specify a configuration parameter as:
| |
| | |
| /etc/postfix/[https://www.postfix.org/postconf.5.html main.cf]:
| |
| parameter = value
| |
| | |
| and you use it by putting a "$" character in front of its name:
| |
| | |
| /etc/postfix/[https://www.postfix.org/postconf.5.html main.cf]:
| |
| other_parameter = $parameter
| |
| | |
| You can use $parameter before it is given a value (that is the second main difference with UNIX shell variables).
| |
| * The Postfix configuration language uses lazy evaluation, and does not look at a parameter value until it is needed at runtime.
| |
| | |
| Postfix uses database files for access control, address rewriting and other purposes.
| |
| * The [https://www.postfix.org/DATABASE_README.html DATABASE_README] file gives an introduction to how Postfix works with Berkeley DB, LDAP or SQL and other types.
| |
| * Here is a common example of how Postfix invokes a database:
| |
| | |
| /etc/postfix/[https://www.postfix.org/postconf.5.html main.cf]:
| |
| [https://www.postfix.org/postconf.5.html#virtual_alias_maps virtual_alias_maps] = [https://www.postfix.org/DATABASE_README.html#types hash]:/etc/postfix/virtual
| |
| | |
| Whenever you make a change to the [https://www.postfix.org/postconf.5.html main.cf] or [https://www.postfix.org/master.5.html master.cf] file, execute the following command as root in order to refresh a running mail system:
| |
| | |
| <nowiki># postfix reload</nowiki>
| |
| | |
| === What domain name to use in outbound mail ===
| |
| The [https://www.postfix.org/postconf.5.html#myorigin myorigin] parameter specifies the domain that appears in mail that is posted on this machine.
| |
| * The default is to use the local machine name, $[https://www.postfix.org/postconf.5.html#myhostname myhostname], which defaults to the name of the machine.
| |
| * Unless you are running a really small site, you probably want to change that into $[https://www.postfix.org/postconf.5.html#mydomain mydomain], which defaults to the parent domain of the machine name.
| |
| | |
| For the sake of consistency between sender and recipient addresses, [https://www.postfix.org/postconf.5.html#myorigin myorigin] also specifies the domain name that is appended to an unqualified recipient address.
| |
| | |
| Examples (specify only one of the following):
| |
| /etc/postfix/[https://www.postfix.org/postconf.5.html main.cf]:
| |
| [https://www.postfix.org/postconf.5.html#myorigin myorigin] = $[https://www.postfix.org/postconf.5.html#myhostname myhostname] (default: send mail as "user@$[https://www.postfix.org/postconf.5.html#myhostname myhostname]")
| |
| [https://www.postfix.org/postconf.5.html#myorigin myorigin] = $[https://www.postfix.org/postconf.5.html#mydomain mydomain] (probably desirable: "user@$[https://www.postfix.org/postconf.5.html#mydomain mydomain]")
| |
| | |
| === What domains to receive mail for ===
| |
| The [https://www.postfix.org/postconf.5.html#mydestination mydestination] parameter specifies what domains this machine will deliver locally, instead of forwarding to another machine.
| |
| * The default is to receive mail for the machine itself.
| |
| * See the [https://www.postfix.org/VIRTUAL_README.html VIRTUAL_README] file for how to configure Postfix for [https://www.postfix.org/VIRTUAL_README.html#canonical hosted domains].
| |
| | |
| You can specify zero or more domain names, "/file/name" patterns and/or "[https://www.postfix.org/DATABASE_README.html type:table]" lookup tables (such as [https://www.postfix.org/DATABASE_README.html#types hash]:, [https://www.postfix.org/DATABASE_README.html#types btree]:, nis:, [https://www.postfix.org/ldap_table.5.html ldap]:, or [https://www.postfix.org/mysql_table.5.html mysql]:), separated by whitespace and/or commas.
| |
| * A "/file/name" pattern is replaced by its contents; "[https://www.postfix.org/DATABASE_README.html type:table]" requests that a table lookup is done and merely tests for existence: the lookup result is ignored.
| |
| | |
| IMPORTANT: If your machine is a mail server for its entire domain, you must list $[https://www.postfix.org/postconf.5.html#mydomain mydomain] as well.
| |
| | |
| Example 1: default setting.
| |
| | |
| /etc/postfix/[https://www.postfix.org/postconf.5.html main.cf]:
| |
| [https://www.postfix.org/postconf.5.html#mydestination mydestination] = $[https://www.postfix.org/postconf.5.html#myhostname myhostname] localhost.$[https://www.postfix.org/postconf.5.html#mydomain mydomain] localhost
| |
| | |
| Example 2: domain-wide mail server.
| |
| | |
| /etc/postfix/[https://www.postfix.org/postconf.5.html main.cf]:
| |
| [https://www.postfix.org/postconf.5.html#mydestination mydestination] = $[https://www.postfix.org/postconf.5.html#myhostname myhostname] localhost.$[https://www.postfix.org/postconf.5.html#mydomain mydomain] localhost $[https://www.postfix.org/postconf.5.html#mydomain mydomain]
| |
| | |
| Example 3: host with multiple DNS A records.
| |
| | |
| /etc/postfix/[https://www.postfix.org/postconf.5.html main.cf]:
| |
| [https://www.postfix.org/postconf.5.html#mydestination mydestination] = $[https://www.postfix.org/postconf.5.html#myhostname myhostname] localhost.$[https://www.postfix.org/postconf.5.html#mydomain mydomain] localhost
| |
| www.$[https://www.postfix.org/postconf.5.html#mydomain mydomain] ftp.$[https://www.postfix.org/postconf.5.html#mydomain mydomain]
| |
| | |
| Caution: in order to avoid mail delivery loops, you must list all hostnames of the machine, including $[https://www.postfix.org/postconf.5.html#myhostname myhostname], and localhost.$[https://www.postfix.org/postconf.5.html#mydomain mydomain].
| |
| | |
| === What clients to relay mail from ===
| |
| By default, Postfix will forward mail from clients in authorized network blocks to any destination.
| |
| * Authorized networks are defined with the [https://www.postfix.org/postconf.5.html#mynetworks mynetworks] configuration parameter.
| |
| * The current default is to authorize the local machine only.
| |
| * Prior to Postfix 3.0, the default was to authorize all clients in the IP subnetworks that the local machine is attached to.
| |
| | |
| Postfix can also be configured to relay mail from "mobile" clients that send mail from outside an authorized network block.
| |
| * This is explained in the [https://www.postfix.org/SASL_README.html SASL_README] and [https://www.postfix.org/TLS_README.html TLS_README] documents.
| |
| | |
| IMPORTANT: If your machine is connected to a wide area network then the "[https://www.postfix.org/postconf.5.html#mynetworks_style mynetworks_style] = subnet" setting may be too friendly.
| |
| | |
| Examples (specify only one of the following):
| |
| | |
| /etc/postfix/[https://www.postfix.org/postconf.5.html main.cf]:
| |
| [https://www.postfix.org/postconf.5.html#mynetworks_style mynetworks_style] = subnet (not safe on a wide area network)
| |
| [https://www.postfix.org/postconf.5.html#mynetworks_style mynetworks_style] = host (authorize local machine only)
| |
| [https://www.postfix.org/postconf.5.html#mynetworks mynetworks] = 127.0.0.0/8 (authorize local machine only)
| |
| [https://www.postfix.org/postconf.5.html#mynetworks mynetworks] = 127.0.0.0/8 168.100.189.2/32 (authorize local machine)
| |
| [https://www.postfix.org/postconf.5.html#mynetworks mynetworks] = 127.0.0.0/8 168.100.189.2/28 (authorize local networks) | |
| | |
| You can specify the trusted networks in the [https://www.postfix.org/postconf.5.html main.cf] file, or you can let Postfix do the work for you.
| |
| * The default is to let Postfix do the work.
| |
| * The result depends on the [https://www.postfix.org/postconf.5.html#mynetworks_style mynetworks_style] parameter value. * Specify "[https://www.postfix.org/postconf.5.html#mynetworks_style mynetworks_style] = host" (the default when [https://www.postfix.org/postconf.5.html#compatibility_level compatibility_level] ≥ 2) when Postfix should forward mail from only the local machine.
| |
| * Specify "[https://www.postfix.org/postconf.5.html#mynetworks_style mynetworks_style] = subnet" (the default when [https://www.postfix.org/postconf.5.html#compatibility_level compatibility_level] < 2) when Postfix should forward mail from SMTP clients in the same IP subnetworks as the local machine.
| |
| * On Linux, this works correctly only with interfaces specified with the "ifconfig" or "ip" command.
| |
| * Specify "[https://www.postfix.org/postconf.5.html#mynetworks_style mynetworks_style] = class" when Postfix should forward mail from SMTP clients in the same IP class A/B/C networks as the local machine.
| |
| * Don't do this with a dialup site - it would cause Postfix to "trust" your entire provider's network.
| |
| * Instead, specify an explicit [https://www.postfix.org/postconf.5.html#mynetworks mynetworks] list by hand, as described below.
| |
| | |
| Alternatively, you can specify the [https://www.postfix.org/postconf.5.html#mynetworks mynetworks] list by hand, in which case Postfix ignores the [https://www.postfix.org/postconf.5.html#mynetworks_style mynetworks_style] setting.
| |
| * To specify the list of trusted networks by hand, specify network blocks in CIDR (network/mask) notation, for example:
| |
| | |
| /etc/postfix/[https://www.postfix.org/postconf.5.html main.cf]:
| |
| [https://www.postfix.org/postconf.5.html#mynetworks mynetworks] = 168.100.189.0/28, 127.0.0.0/8
| |
| | |
| You can also specify the absolute pathname of a pattern file instead of listing the patterns in the [https://www.postfix.org/postconf.5.html main.cf] file.
| |
| | |
| === What destinations to relay mail to ===
| |
| By default, Postfix will forward mail from strangers (clients outside authorized networks) to authorized remote destinations only.
| |
| * Authorized remote destinations are defined with the [https://www.postfix.org/postconf.5.html#relay_domains relay_domains] configuration parameter.
| |
| * The default is to authorize all domains (and subdomains) of the domains listed with the [https://www.postfix.org/postconf.5.html#mydestination mydestination] parameter.
| |
| | |
| Examples (specify only one of the following):
| |
| | |
| /etc/postfix/[https://www.postfix.org/postconf.5.html main.cf]:
| |
| [https://www.postfix.org/postconf.5.html#relay_domains relay_domains] = $[https://www.postfix.org/postconf.5.html#mydestination mydestination] (default)
| |
| [https://www.postfix.org/postconf.5.html#relay_domains relay_domains] = (safe: never forward mail from strangers)
| |
| [https://www.postfix.org/postconf.5.html#relay_domains relay_domains] = $[https://www.postfix.org/postconf.5.html#mydomain mydomain] (forward mail to my domain and subdomains)
| |
| | |
| === What delivery method: direct or indirect ===
| |
| By default, Postfix tries to deliver mail directly to the Internet.
| |
| * Depending on your local conditions this may not be possible or desirable.
| |
| * For example, your system may be turned off outside office hours, it may be behind a firewall, or it may be connected via a provider who does not allow direct mail to the Internet.
| |
| * In those cases you need to configure Postfix to deliver mail indirectly via a [https://www.postfix.org/postconf.5.html#relayhost relay host].
| |
| | |
| Examples (specify only one of the following):
| |
| | |
| /etc/postfix/[https://www.postfix.org/postconf.5.html main.cf]:
| |
| [https://www.postfix.org/postconf.5.html#relayhost relayhost] = (default: direct delivery to Internet)
| |
| [https://www.postfix.org/postconf.5.html#relayhost relayhost] = $[https://www.postfix.org/postconf.5.html#mydomain mydomain] (deliver via local mailhub)
| |
| [https://www.postfix.org/postconf.5.html#relayhost relayhost] = [mail.$[https://www.postfix.org/postconf.5.html#mydomain mydomain]] (deliver via local mailhub)
| |
| [https://www.postfix.org/postconf.5.html#relayhost relayhost] = [mail.isp.tld] (deliver via provider mailhub)
| |
| | |
| The form enclosed with <tt>[]</tt> eliminates DNS MX lookups.
| |
| * Don't worry if you don't know what that means.
| |
| * Just be sure to specify the <tt>[]</tt> around the mailhub hostname that your ISP gave to you, otherwise mail may be mis-delivered.
| |
| | |
| The [https://www.postfix.org/STANDARD_CONFIGURATION_README.html STANDARD_CONFIGURATION_README] file has more hints and tips for firewalled and/or dial-up networks.
| |
| | |
| === What trouble to report to the postmaster ===
| |
| You should set up a postmaster alias in the [https://www.postfix.org/aliases.5.html aliases(5)] table that directs mail to a human person.
| |
| * The postmaster address is required to exist, so that people can report mail delivery problems.
| |
| * While you're updating the [https://www.postfix.org/aliases.5.html aliases(5)] table, be sure to direct mail for the super-user to a human person too.
| |
| | |
| /etc/aliases:
| |
| postmaster: you
| |
| root: you
| |
| | |
| Execute the command "newaliases" after changing the aliases file.
| |
| * Instead of /etc/aliases, your alias file may be located elsewhere.
| |
| * Use the command "postconf [https://www.postfix.org/postconf.5.html#alias_maps alias_maps]" to find out.
| |
| | |
| The Postfix system reports problems to the postmaster alias.
| |
| * You may not be interested in all types of trouble reports, so this reporting mechanism is configurable.
| |
| * The default is to report only serious problems (resource, software) to postmaster:
| |
| | |
| Default setting:
| |
| | |
| /etc/postfix/[https://www.postfix.org/postconf.5.html main.cf]:
| |
| [https://www.postfix.org/postconf.5.html#notify_classes notify_classes] = resource, software
| |
| | |
| The meaning of the classes is as follows:
| |
| | |
| <div style="margin-left:0cm;margin-right:0cm;">bounce </div>
| |
| | |
| <div style="margin-left:1cm;margin-right:0cm;">Inform the postmaster of undeliverable mail.
| |
| * Either send the postmaster a copy of undeliverable mail that is returned to the sender, or send a transcript of the SMTP session when Postfix rejected mail.
| |
| * For privacy reasons, the postmaster copy of undeliverable mail is truncated after the original message headers.
| |
| * This implies "2bounce" (see below).
| |
| * See also the [https://www.postfix.org/postconf.5.html#luser_relay luser_relay] feature.
| |
| * The notification is sent to the address specified with the [https://www.postfix.org/postconf.5.html#bounce_notice_recipient bounce_notice_recipient] configuration parameter (default: postmaster). </div>
| |
| | |
| <div style="margin-left:0cm;margin-right:0cm;">2bounce </div>
| |
| | |
| <div style="margin-left:1cm;margin-right:0cm;">When Postfix is unable to return undeliverable mail to the sender, send it to the postmaster instead (without truncating the message after the primary headers).
| |
| * The notification is sent to the address specified with the [https://www.postfix.org/postconf.5.html#2bounce_notice_recipient 2bounce_notice_recipient] configuration parameter (default: postmaster). </div>
| |
| | |
| <div style="margin-left:0cm;margin-right:0cm;">delay </div>
| |
| | |
| <div style="margin-left:1cm;margin-right:0cm;">Inform the postmaster of delayed mail.
| |
| * In this case, the postmaster receives message headers only.
| |
| * The notification is sent to the address specified with the [https://www.postfix.org/postconf.5.html#delay_notice_recipient delay_notice_recipient] configuration parameter (default: postmaster). </div>
| |
| | |
| <div style="margin-left:0cm;margin-right:0cm;">policy </div>
| |
| | |
| <div style="margin-left:1cm;margin-right:0cm;">Inform the postmaster of client requests that were rejected because of (UCE) policy restrictions.
| |
| * The postmaster receives a transcript of the SMTP session.
| |
| * The notification is sent to the address specified with the [https://www.postfix.org/postconf.5.html#error_notice_recipient error_notice_recipient] configuration parameter (default: postmaster). </div>
| |
| | |
| <div style="margin-left:0cm;margin-right:0cm;">protocol </div>
| |
| | |
| <div style="margin-left:1cm;margin-right:0cm;">Inform the postmaster of protocol errors (client or server side) or attempts by a client to execute unimplemented commands.
| |
| * The postmaster receives a transcript of the SMTP session.
| |
| * The notification is sent to the address specified with the [https://www.postfix.org/postconf.5.html#error_notice_recipient error_notice_recipient] configuration parameter (default: postmaster). </div>
| |
| | |
| <div style="margin-left:0cm;margin-right:0cm;">resource </div>
| |
| | |
| <div style="margin-left:1cm;margin-right:0cm;">Inform the postmaster of mail not delivered due to resource problems (for example, queue file write errors).
| |
| * The notification is sent to the address specified with the [https://www.postfix.org/postconf.5.html#error_notice_recipient error_notice_recipient] configuration parameter (default: postmaster). </div>
| |
| | |
| <div style="margin-left:0cm;margin-right:0cm;">software </div>
| |
| | |
| <div style="margin-left:1cm;margin-right:0cm;">Inform the postmaster of mail not delivered due to software problems.
| |
| * The notification is sent to the address specified with the [https://www.postfix.org/postconf.5.html#error_notice_recipient error_notice_recipient] configuration parameter (default: postmaster). </div>
| |
| | |
| === Proxy/NAT external network addresses ===
| |
| Some mail servers are connected to the Internet via a network address translator (NAT) or proxy.
| |
| * This means that systems on the Internet connect to the address of the NAT or proxy, instead of connecting to the network address of the mail server.
| |
| * The NAT or proxy forwards the connection to the network address of the mail server, but Postfix does not know this.
| |
| | |
| If you run a Postfix server behind a proxy or NAT, you need to configure the [https://www.postfix.org/postconf.5.html#proxy_interfaces proxy_interfaces] parameter and specify all the external proxy or NAT addresses that Postfix receives mail on.
| |
| * You may specify symbolic hostnames instead of network addresses.
| |
| | |
| IMPORTANT: You must specify your proxy/NAT external addresses when your system is a backup MX host for other domains, otherwise mail delivery loops will happen when the primary MX host is down.
| |
| | |
| Example: host behind NAT box running a backup MX host.
| |
| | |
| /etc/postfix/[https://www.postfix.org/postconf.5.html main.cf]:
| |
| [https://www.postfix.org/postconf.5.html#proxy_interfaces proxy_interfaces] = 1.2.3.4 (the proxy/NAT external network address)
| |
| | |
| === What you need to know about Postfix logging ===
| |
| Postfix daemon processes run in the background, and log problems and normal activity to the syslog daemon.
| |
| * The syslogd process sorts events by class and severity, and appends them to logfiles.
| |
| * The logging classes, levels and logfile names are usually specified in /etc/syslog.conf.
| |
| * At the very least you need something like:
| |
| | |
| /etc/syslog.conf:
| |
| mail.err /dev/console
| |
| mail.debug /var/log/maillog
| |
| | |
| After changing the syslog.conf file, send a "HUP" signal to the syslogd process.
| |
| | |
| IMPORTANT: many syslogd implementations will not create files.
| |
| * You must create files before (re)starting syslogd.
| |
| | |
| IMPORTANT: on Linux you need to put a "-" character before the pathname, e.g., -/var/log/maillog, otherwise the syslogd process will use more system resources than Postfix.
| |
| | |
| Hopefully, the number of problems will be small, but it is a good idea to run every night before the syslog files are rotated:
| |
| | |
| <nowiki># postfix check</nowiki>
| |
| <nowiki># egrep '(reject|warning|error|fatal|panic):' /some/log/file</nowiki>* The first line (postfix check) causes Postfix to report file permission/ownership discrepancies.
| |
| * The second line looks for problem reports from the mail software, and reports how effective the relay and junk mail access blocks are.
| |
| * This may produce a lot of output.
| |
| * You will want to apply some postprocessing to eliminate uninteresting information.
| |
| | |
| The [https://www.postfix.org/DEBUG_README.html#logging DEBUG_README ]document describes the meaning of the "warning" etc.
| |
| * labels in Postfix logging.
| |
| | |
| === Running Postfix daemon processes chrooted ===
| |
| Postfix daemon processes can be configured (via the [https://www.postfix.org/master.5.html master.cf] file) to run in a chroot jail.
| |
| * The processes run at a fixed low privilege and with file system access limited to the Postfix queue directories (/var/spool/postfix).
| |
| * This provides a significant barrier against intrusion.
| |
| * The barrier is not impenetrable (chroot limits file system access only), but every little bit helps.
| |
| | |
| With the exception of Postfix daemons that deliver mail locally and/or that execute non-Postfix commands, every Postfix daemon can run chrooted.
| |
| | |
| Sites with high security requirements should consider to chroot all daemons that talk to the network: the [https://www.postfix.org/smtp.8.html smtp(8)] and [https://www.postfix.org/smtpd.8.html smtpd(8)] processes, and perhaps also the [https://www.postfix.org/lmtp.8.html lmtp(8)] client.
| |
| * The author's own porcupine.org mail server runs all daemons chrooted that can be chrooted.
| |
| | |
| The default /etc/postfix/[https://www.postfix.org/master.5.html master.cf] file specifies that no Postfix daemon runs chrooted.
| |
| * In order to enable chroot operation, edit the file /etc/postfix/[https://www.postfix.org/master.5.html master.cf], and follow instructions in the file.
| |
| * When you're finished, execute "postfix reload" to make the change effective.
| |
| | |
| Note that a chrooted daemon resolves all filenames relative to the Postfix queue directory (/var/spool/postfix).
| |
| * For successful use of a chroot jail, most UNIX systems require you to bring in some files or device nodes.
| |
| * The examples/chroot-setup directory in the source code distribution has a collection of scripts that help you set up Postfix chroot environments on different operating systems.
| |
| | |
| Additionally, you almost certainly need to configure syslogd so that it listens on a socket inside the Postfix queue directory.
| |
| * Examples of syslogd command line options that achieve this for specific systems:
| |
| | |
| FreeBSD: <tt>syslogd -l /var/spool/postfix/var/run/log</tt>
| |
| | |
| Linux, OpenBSD: <tt>syslogd -a /var/spool/postfix/dev/log</tt>
| |
| | |
| === My own hostname ===
| |
| The [https://www.postfix.org/postconf.5.html#myhostname myhostname] parameter specifies the fully-qualified domain name of the machine running the Postfix system. $[https://www.postfix.org/postconf.5.html#myhostname myhostname] appears as the default value in many other Postfix configuration parameters.
| |
| | |
| By default, [https://www.postfix.org/postconf.5.html#myhostname myhostname] is set to the local machine name.
| |
| * If your local machine name is not in fully-qualified domain name form, or if you run Postfix on a virtual interface, you will have to specify the fully-qualified domain name that the mail system should use.
| |
| | |
| Alternatively, if you specify [https://www.postfix.org/postconf.5.html#mydomain mydomain] in [https://www.postfix.org/postconf.5.html main.cf], then Postfix will use its value to generate a fully-qualified default value for the [https://www.postfix.org/postconf.5.html#myhostname myhostname] parameter.
| |
| | |
| Examples (specify only one of the following):
| |
| | |
| /etc/postfix/[https://www.postfix.org/postconf.5.html main.cf]:
| |
| [https://www.postfix.org/postconf.5.html#myhostname myhostname] = host.local.domain (machine name is not FQDN)
| |
| [https://www.postfix.org/postconf.5.html#myhostname myhostname] = host.virtual.domain (virtual interface)
| |
| [https://www.postfix.org/postconf.5.html#myhostname myhostname] = virtual.domain (virtual interface)
| |
| | |
| === My own domain name ===
| |
| The [https://www.postfix.org/postconf.5.html#mydomain mydomain] parameter specifies the parent domain of $[https://www.postfix.org/postconf.5.html#myhostname myhostname].
| |
| * By default, it is derived from $[https://www.postfix.org/postconf.5.html#myhostname myhostname] by stripping off the first part (unless the result would be a top-level domain).
| |
| | |
| Conversely, if you specify [https://www.postfix.org/postconf.5.html#mydomain mydomain] in [https://www.postfix.org/postconf.5.html main.cf], then Postfix will use its value to generate a fully-qualified default value for the [https://www.postfix.org/postconf.5.html#myhostname myhostname] parameter.
| |
| | |
| Examples (specify only one of the following):
| |
| | |
| /etc/postfix/[https://www.postfix.org/postconf.5.html main.cf]:
| |
| [https://www.postfix.org/postconf.5.html#mydomain mydomain] = local.domain
| |
| [https://www.postfix.org/postconf.5.html#mydomain mydomain] = virtual.domain (virtual interface)
| |
| | |
| === My own network addresses ===
| |
| The [https://www.postfix.org/postconf.5.html#inet_interfaces inet_interfaces] parameter specifies all network interface addresses that the Postfix system should listen on; mail addressed to "user@[network address]" will be delivered locally, as if it is addressed to a domain listed in $[https://www.postfix.org/postconf.5.html#mydestination mydestination].
| |
| | |
| You can override the [https://www.postfix.org/postconf.5.html#inet_interfaces inet_interfaces] setting in the Postfix [https://www.postfix.org/master.5.html master.cf] file by prepending an IP address to a server name.
| |
| | |
| The default is to listen on all active interfaces.
| |
| * If you run mailers on virtual interfaces, you will have to specify what interfaces to listen on.
| |
| | |
| IMPORTANT: If you run MTAs on virtual interfaces you must specify explicit [https://www.postfix.org/postconf.5.html#inet_interfaces inet_interfaces] values for the MTA that receives mail for the machine itself: this MTA should never listen on the virtual interfaces or you would have a mailer loop when a virtual MTA is down.
| |
| | |
| Example: default setting.
| |
| | |
| /etc/postfix/[https://www.postfix.org/postconf.5.html main.cf]:
| |
| [https://www.postfix.org/postconf.5.html#inet_interfaces inet_interfaces] = all
| |
|
| |
|
| Example: host running one or more virtual mailers.
| |
| * For each Postfix instance, specify only one of the following.
| |
|
| |
|
| /etc/postfix/[https://www.postfix.org/postconf.5.html main.cf]:
| |
| [https://www.postfix.org/postconf.5.html#inet_interfaces inet_interfaces] = virtual.host.tld (virtual Postfix)
| |
| [https://www.postfix.org/postconf.5.html#inet_interfaces inet_interfaces] = $[https://www.postfix.org/postconf.5.html#myhostname myhostname] localhost... (non-virtual Postfix)
| |
|
| |
|
| Note: you need to stop and start Postfix after changing this parameter.
| | [[Kategorie:Postfix/Verwaltung]] |
| [[Kategorie:Entwurf]]
| | [[Kategorie:Postfix/Konfiguration]] |
| [[Kategorie:Postfix:Verwaltung]] | |
| [[Kategorie:Postfix:Konfiguration]] | |