aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--README6
-rw-r--r--files/tls_policy.d/.ignore0
-rw-r--r--manifests/classes/postfix-amavis.pp6
-rw-r--r--manifests/classes/postfix-mta.pp6
-rw-r--r--manifests/classes/postfix-tlspolicy.pp68
-rw-r--r--manifests/classes/postfix.pp39
-rw-r--r--manifests/definitions/config.pp4
-rw-r--r--manifests/definitions/tlspolicy_snippet.pp47
-rw-r--r--templates/master.cf.debian-etch.erb4
-rw-r--r--templates/master.cf.debian-lenny.erb120
-rw-r--r--templates/master.cf.debian-squeeze.erb143
-rw-r--r--templates/master.cf.redhat5.erb4
12 files changed, 439 insertions, 8 deletions
diff --git a/README b/README
index 964125f..337193f 100644
--- a/README
+++ b/README
@@ -4,6 +4,12 @@ This module will help install and configure postfix.
A couple of classes will preconfigure postfix for common needs.
+Config
+------
+- set $postfix_use_amavisd="yes" to include postfix::amavis
+- set $postfix_manage_tls_policy="yes" to manage TLS policy (see
+ postfix::tlspolicy for details)
+
== Example:
include postfix
diff --git a/files/tls_policy.d/.ignore b/files/tls_policy.d/.ignore
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/files/tls_policy.d/.ignore
diff --git a/manifests/classes/postfix-amavis.pp b/manifests/classes/postfix-amavis.pp
new file mode 100644
index 0000000..7e17836
--- /dev/null
+++ b/manifests/classes/postfix-amavis.pp
@@ -0,0 +1,6 @@
+class postfix::amavis {
+ include amavisd-new
+ postfix::config {
+ "content_filter": value => "amavis:[127.0.0.1]:10024";
+ }
+}
diff --git a/manifests/classes/postfix-mta.pp b/manifests/classes/postfix-mta.pp
index 16b1981..c36c0bc 100644
--- a/manifests/classes/postfix-mta.pp
+++ b/manifests/classes/postfix-mta.pp
@@ -32,9 +32,9 @@
#
class postfix::mta {
- case $postfix_relayhost {
- "": { fail("Required \$postfix_relayhost variable is not defined.") }
- }
+ #case $postfix_relayhost {
+ # "": { fail("Required \$postfix_relayhost variable is not defined.") }
+ #}
case $postfix_mydestination {
"": { $postfix_mydestination = "\$myorigin" }
diff --git a/manifests/classes/postfix-tlspolicy.pp b/manifests/classes/postfix-tlspolicy.pp
new file mode 100644
index 0000000..30b1f58
--- /dev/null
+++ b/manifests/classes/postfix-tlspolicy.pp
@@ -0,0 +1,68 @@
+#
+# == Class: postfix::tlspolicy
+#
+# Manages Postfix TLS policy by merging policy snippets shipped:
+# - in the module's files/tls_policy.d/
+# - via postfix::tlspolicy_snippet defines
+#
+# Parameters:
+# - $postfix_tls_fingerprint_digest (defaults to sha1)
+#
+# Example usage:
+#
+# node "toto.example.com" {
+# $postfix_manage_tls_policy = yes
+# include postfix
+# }
+#
+class postfix::tlspolicy {
+
+ # Default value for parameters
+ case $postfix_tls_fingerprint_digest {
+ "": { $postfix_tls_fingerprint_digest = 'sha1' }
+ }
+
+ include common::moduledir
+ module_dir{'postfix/tls_policy': }
+
+ $postfix_tlspolicy_dir = "${common::moduledir::module_dir_path}/postfix/tls_policy"
+ $postfix_tlspolicy_snippets_dir = "${postfix_tlspolicy_dir}/tls_policy.d"
+ $postfix_merged_tlspolicy = "${postfix_tlspolicy_dir}/merged_tls_policy"
+
+ file {"$postfix_tlspolicy_snippets_dir":
+ ensure => 'directory',
+ owner => 'root',
+ group => '0',
+ mode => '700',
+ source => [
+ "puppet:///modules/site-postfix/${fqdn}/tls_policy.d",
+ "puppet:///modules/site-postfix/tls_policy.d",
+ "puppet:///modules/postfix/tls_policy.d"
+ ],
+ recurse => true,
+ purge => false,
+ }
+
+ concatenated_file { "$postfix_merged_tlspolicy":
+ dir => "${postfix_tlspolicy_snippets_dir}",
+ require => File["$postfix_tlspolicy_snippets_dir"],
+ }
+
+ postfix::hash { '/etc/postfix/tls_policy':
+ source => "$postfix_merged_tlspolicy",
+ subscribe => File["$postfix_merged_tlspolicy"],
+ }
+
+ postfix::config {
+ 'smtp_tls_fingerprint_digest': value => "$postfix_tls_fingerprint_digest";
+ }
+
+ postfix::config { 'smtp_tls_policy_maps':
+ value => 'hash:/etc/postfix/tls_policy',
+ require => [
+ Postfix::Hash['/etc/postfix/tls_policy'],
+ Postfix::Config['smtp_tls_fingerprint_digest'],
+ ],
+ }
+
+}
diff --git a/manifests/classes/postfix.pp b/manifests/classes/postfix.pp
index 1d60a57..588bfc8 100644
--- a/manifests/classes/postfix.pp
+++ b/manifests/classes/postfix.pp
@@ -5,13 +5,13 @@
# delivery and an SMTP server listening on the loopback interface.
#
# Parameters:
-# - *$postfix_ng_smtp_listen*: address on which the smtp service will listen to. defaults to 127.0.0.1
+# - *$postfix_smtp_listen*: address on which the smtp service will listen to. defaults to 127.0.0.1
# - *$root_mail_recipient*: who will recieve root's emails. defaults to "nobody"
#
# Example usage:
#
# node "toto.example.com" {
-# $postfix_ng_smtp_listen = "192.168.1.10"
+# $postfix_smtp_listen = "192.168.1.10"
# include postfix
# }
#
@@ -40,12 +40,45 @@ class postfix {
case $root_mail_recipient {
"": { $root_mail_recipient = "nobody" }
}
+ case $postfix_manage_tls_policy {
+ "": { $postfix_manage_tls_policy = "no" }
+ }
+ case $postfix_use_amavisd {
+ "": { $postfix_use_amavisd = "no" }
+ }
+ case $postfix_use_dovecot_lda {
+ "": { $postfix_use_dovecot_lda = "no" }
+ }
+ case $postfix_use_schleuder {
+ "": { $postfix_use_schleuder = "no" }
+ }
+ case $postfix_use_sympa {
+ "": { $postfix_use_sympa = "no" }
+ }
+ case $postfix_mastercf_tail {
+ "": { $postfix_mastercf_tail = "" }
+ }
+ # Bootstrap moduledir
+ include common::moduledir
+ module_dir{'postfix': }
+
+ # Include optional classes
+ if $postfix_manage_tls_policy == 'yes' {
+ include postfix::tlspolicy
+ }
+ if $postfix_use_amavisd == 'yes' {
+ include postfix::amavis
+ }
package { ["postfix", "mailx"]:
ensure => installed
}
+ if $operatingsystem == 'debian' {
+ Package[mailx] { name => 'bsd-mailx' }
+ }
+
service { "postfix":
ensure => running,
require => Package["postfix"],
@@ -83,7 +116,7 @@ class postfix {
content => $operatingsystem ? {
Redhat => template("postfix/master.cf.redhat5.erb"),
CentOS => template("postfix/master.cf.redhat5.erb"),
- Debian => template("postfix/master.cf.debian-etch.erb"),
+ Debian => template("postfix/master.cf.debian-$lsbdistcodename.erb"),
Ubuntu => template("postfix/master.cf.debian-etch.erb"),
},
seltype => $postfix_seltype,
diff --git a/manifests/definitions/config.pp b/manifests/definitions/config.pp
index aaf73b5..8e203a6 100644
--- a/manifests/definitions/config.pp
+++ b/manifests/definitions/config.pp
@@ -34,8 +34,8 @@ define postfix::config ($ensure = present, $value, $nonstandard = false) {
present: {
exec {"postconf -e ${name}='${value}'":
unless => $nonstandard ? {
- false => "test \"x$(postconf -h ${name})\" == 'x${value}'",
- true => "test \"x$(egrep '^${name} ' /etc/postfix/main.cf | cut -d= -f2 | cut -d' ' -f2)\" == 'x${value}'",
+ false => "test \"x$(postconf -h ${name})\" = 'x${value}'",
+ true => "test \"x$(egrep '^${name} ' /etc/postfix/main.cf | cut -d= -f2 | cut -d' ' -f2)\" = 'x${value}'",
},
notify => Service["postfix"],
require => File["/etc/postfix/main.cf"],
diff --git a/manifests/definitions/tlspolicy_snippet.pp b/manifests/definitions/tlspolicy_snippet.pp
new file mode 100644
index 0000000..2596dbc
--- /dev/null
+++ b/manifests/definitions/tlspolicy_snippet.pp
@@ -0,0 +1,47 @@
+/*
+== Definition: postfix::tlspolicy_snippet
+
+Adds a TLS policy snippets to /etc/postfix/tls_policy.d/.
+See the postfix::tlspolicy class for details.
+
+Parameters:
+- *name*: name of destination domain Postfix will lookup. See TLS_README.
+- *value*: right-hand part of the tls_policy map
+- *ensure*: present/absent, defaults to present.
+
+Requires:
+- Class["postfix"]
+- Class["postfix::tlspolicy"]
+
+Example usage:
+
+ node "toto.example.com" {
+ $postfix_manage_tls_policy = yes
+ include postfix
+ postfix::tlspolicy_snippet {
+ 'example.com': value => 'encrypt';
+ '.example.com': value => 'encrypt';
+ 'nothing.com': value => 'fingerprint match=2A:FF:F0:EC:52:04:99:45:73:1B:C2:22:7F:FD:31:6B:8F:07:43:29';
+ }
+ }
+
+*/
+
+define postfix::tlspolicy_snippet ($ensure="present", $value = false) {
+
+ include postfix::tlspolicy
+
+ if ($value == false) and ($ensure == "present") {
+ fail("The value parameter must be set when using the postfix::tlspolicy_snippet define with ensure=present.")
+ }
+
+ file { "${postfix::tlspolicy::postfix_tlspolicy_snippets_dir}/${name}":
+ ensure => "$ensure",
+ content => "${name} ${value}\n",
+ mode => 600,
+ owner => root,
+ group => 0,
+ notify => Exec["concat_${postfix::tlspolicy::postfix_merged_tlspolicy}"],
+ }
+
+}
diff --git a/templates/master.cf.debian-etch.erb b/templates/master.cf.debian-etch.erb
index e6bc4ec..4b39f45 100644
--- a/templates/master.cf.debian-etch.erb
+++ b/templates/master.cf.debian-etch.erb
@@ -108,3 +108,7 @@ sympa unix - n n - - pipe
sympabounce unix - n n - - pipe
flags=R user=sympa argv=/usr/lib/sympa/bin/bouncequeue ${user}
<% end %>
+
+<%- unless postfix_mastercf_tail.to_s.empty? then -%>
+<%= postfix_mastercf_tail %>
+<%- end -%>
diff --git a/templates/master.cf.debian-lenny.erb b/templates/master.cf.debian-lenny.erb
new file mode 100644
index 0000000..11d0fa0
--- /dev/null
+++ b/templates/master.cf.debian-lenny.erb
@@ -0,0 +1,120 @@
+# file managed by puppet
+#
+# Postfix master process configuration file. For details on the format
+# of the file, see the master(5) manual page (command: "man 5 master").
+#
+# Do not forget to execute "postfix reload" after editing this file.
+#
+# ==========================================================================
+# service type private unpriv chroot wakeup maxproc command + args
+# (yes) (yes) (yes) (never) (100)
+# ==========================================================================
+<% if postfix_smtp_listen == 'all' %>smtp inet n - - - - smtpd
+<% else %><%= postfix_smtp_listen %>:smtp inet n - - - - smtpd<% end %>
+#submission inet n - - - - smtpd
+# -o smtpd_tls_security_level=encrypt
+# -o smtpd_sasl_auth_enable=yes
+# -o smtpd_client_restrictions=permit_sasl_authenticated,reject
+# -o milter_macro_daemon_name=ORIGINATING
+#smtps inet n - - - - smtpd
+# -o smtpd_tls_wrappermode=yes
+# -o smtpd_sasl_auth_enable=yes
+# -o smtpd_client_restrictions=permit_sasl_authenticated,reject
+# -o milter_macro_daemon_name=ORIGINATING
+#628 inet n - - - - qmqpd
+pickup fifo n - - 60 1 pickup
+cleanup unix n - - - 0 cleanup
+qmgr fifo n - n 300 1 qmgr
+#qmgr fifo n - - 300 1 oqmgr
+tlsmgr unix - - - 1000? 1 tlsmgr
+rewrite unix - - - - - trivial-rewrite
+bounce unix - - - - 0 bounce
+defer unix - - - - 0 bounce
+trace unix - - - - 0 bounce
+verify unix - - - - 1 verify
+flush unix n - - 1000? 0 flush
+proxymap unix - - n - - proxymap
+proxywrite unix - - n - 1 proxymap
+smtp unix - - - - - smtp
+# When relaying mail as backup MX, disable fallback_relay to avoid MX loops
+relay unix - - - - - smtp
+ -o smtp_fallback_relay=
+# -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
+showq unix n - - - - showq
+error unix - - - - - error
+retry unix - - - - - error
+discard unix - - - - - discard
+local unix - n n - - local
+virtual unix - n n - - virtual
+lmtp unix - - - - - lmtp
+anvil unix - - - - 1 anvil
+scache unix - - - - 1 scache
+#
+# ====================================================================
+# Interfaces to non-Postfix software. Be sure to examine the manual
+# pages of the non-Postfix software to find out what options it wants.
+#
+# Many of the following services use the Postfix pipe(8) delivery
+# agent. See the pipe(8) man page for information about ${recipient}
+# and other message envelope options.
+# ====================================================================
+#
+# maildrop. See the Postfix MAILDROP_README file for details.
+# Also specify in main.cf: maildrop_destination_recipient_limit=1
+#
+maildrop unix - n n - - pipe
+ flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
+#
+# See the Postfix UUCP_README file for configuration details.
+#
+uucp unix - n n - - pipe
+ flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
+#
+# Other external delivery methods.
+#
+ifmail unix - n n - - pipe
+ flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
+bsmtp unix - n n - - pipe
+ flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
+scalemail-backend unix - n n - 2 pipe
+ flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
+mailman unix - n n - - pipe
+ flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
+ ${nexthop} ${user}
+<% if postfix_use_amavisd == 'yes' %>
+amavis unix - - - - 2 smtp
+ -o smtp_data_done_timeout=1200
+ -o smtp_send_xforward_command=yes
+
+127.0.0.1:10025 inet n - - - - smtpd
+ -o content_filter=
+ -o local_recipient_maps=
+ -o relay_recipient_maps=
+ -o smtpd_restriction_classes=
+ -o smtpd_client_restrictions=
+ -o smtpd_helo_restrictions=
+ -o smtpd_sender_restrictions=
+ -o smtpd_recipient_restrictions=permit_mynetworks,reject
+ -o mynetworks=127.0.0.0/8
+ -o strict_rfc821_envelopes=yes
+ -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
+ -o smtpd_bind_address=127.0.0.1
+<% end %>
+<% if postfix_use_dovecot_lda == 'yes' %>
+dovecot unix - n n - - pipe
+ flags=DRhu user=vmail:vmail argv=/usr/lib/dovecot/deliver -d ${recipient}
+<% end %>
+<% if postfix_use_schleuder == 'yes' %>
+schleuder unix - n n - - pipe
+ flags=DRhu user=schleuder argv=/usr/bin/schleuder ${user}
+<% end %>
+<% if postfix_use_sympa == 'yes' %>
+sympa unix - n n - - pipe
+ flags=R user=sympa argv=/usr/lib/sympa/bin/queue ${recipient}
+sympabounce unix - n n - - pipe
+ flags=R user=sympa argv=/usr/lib/sympa/bin/bouncequeue ${user}
+<% end %>
+
+<%- unless postfix_mastercf_tail.to_s.empty? then -%>
+<%= postfix_mastercf_tail %>
+<%- end -%>
diff --git a/templates/master.cf.debian-squeeze.erb b/templates/master.cf.debian-squeeze.erb
new file mode 100644
index 0000000..be86a08
--- /dev/null
+++ b/templates/master.cf.debian-squeeze.erb
@@ -0,0 +1,143 @@
+#
+# Postfix master process configuration file. For details on the format
+# of the file, see the master(5) manual page (command: "man 5 master").
+#
+# Do not forget to execute "postfix reload" after editing this file.
+#
+# ==========================================================================
+# service type private unpriv chroot wakeup maxproc command + args
+# (yes) (yes) (yes) (never) (100)
+# ==========================================================================
+<% if postfix_smtp_listen == 'all' %>smtp inet n - - - - smtpd
+<% else %><%= postfix_smtp_listen %>:smtp inet n - - - - smtpd<% end %>
+#submission inet n - - - - smtpd
+#smtp inet n - - - 1 postscreen
+#smtpd pass - - - - - smtpd
+#dnsblog unix - - - - 0 dnsblog
+# -o smtpd_tls_security_level=encrypt
+# -o smtpd_sasl_auth_enable=yes
+# -o smtpd_client_restrictions=permit_sasl_authenticated,reject
+# -o milter_macro_daemon_name=ORIGINATING
+#smtps inet n - - - - smtpd
+# -o smtpd_tls_wrappermode=yes
+# -o smtpd_sasl_auth_enable=yes
+# -o smtpd_client_restrictions=permit_sasl_authenticated,reject
+# -o milter_macro_daemon_name=ORIGINATING
+#628 inet n - - - - qmqpd
+pickup fifo n - - 60 1 pickup
+cleanup unix n - - - 0 cleanup
+qmgr fifo n - n 300 1 qmgr
+#qmgr fifo n - - 300 1 oqmgr
+tlsmgr unix - - - 1000? 1 tlsmgr
+rewrite unix - - - - - trivial-rewrite
+bounce unix - - - - 0 bounce
+defer unix - - - - 0 bounce
+trace unix - - - - 0 bounce
+verify unix - - - - 1 verify
+flush unix n - - 1000? 0 flush
+proxymap unix - - n - - proxymap
+proxywrite unix - - n - 1 proxymap
+smtp unix - - - - - smtp
+# When relaying mail as backup MX, disable fallback_relay to avoid MX loops
+relay unix - - - - - smtp
+ -o smtp_fallback_relay=
+# -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
+showq unix n - - - - showq
+error unix - - - - - error
+retry unix - - - - - error
+discard unix - - - - - discard
+local unix - n n - - local
+virtual unix - n n - - virtual
+lmtp unix - - - - - lmtp
+anvil unix - - - - 1 anvil
+scache unix - - - - 1 scache
+#
+# ====================================================================
+# Interfaces to non-Postfix software. Be sure to examine the manual
+# pages of the non-Postfix software to find out what options it wants.
+#
+# Many of the following services use the Postfix pipe(8) delivery
+# agent. See the pipe(8) man page for information about ${recipient}
+# and other message envelope options.
+# ====================================================================
+#
+# maildrop. See the Postfix MAILDROP_README file for details.
+# Also specify in main.cf: maildrop_destination_recipient_limit=1
+#
+maildrop unix - n n - - pipe
+ flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
+#
+# ====================================================================
+#
+# Recent Cyrus versions can use the existing "lmtp" master.cf entry.
+#
+# Specify in cyrus.conf:
+# lmtp cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
+#
+# Specify in main.cf one or more of the following:
+# mailbox_transport = lmtp:inet:localhost
+# virtual_transport = lmtp:inet:localhost
+#
+# ====================================================================
+#
+# Cyrus 2.1.5 (Amos Gouaux)
+# Also specify in main.cf: cyrus_destination_recipient_limit=1
+#
+#cyrus unix - n n - - pipe
+# user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
+#
+# ====================================================================
+#
+# See the Postfix UUCP_README file for configuration details.
+#
+uucp unix - n n - - pipe
+ flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
+#
+# Other external delivery methods.
+#
+ifmail unix - n n - - pipe
+ flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
+bsmtp unix - n n - - pipe
+ flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
+scalemail-backend unix - n n - 2 pipe
+ flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
+mailman unix - n n - - pipe
+ flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
+ ${nexthop} ${user}
+<% if postfix_use_amavisd == 'yes' %>
+amavis unix - - - - 2 smtp
+ -o smtp_data_done_timeout=1200
+ -o smtp_send_xforward_command=yes
+
+127.0.0.1:10025 inet n - - - - smtpd
+ -o content_filter=
+ -o local_recipient_maps=
+ -o relay_recipient_maps=
+ -o smtpd_restriction_classes=
+ -o smtpd_client_restrictions=
+ -o smtpd_helo_restrictions=
+ -o smtpd_sender_restrictions=
+ -o smtpd_recipient_restrictions=permit_mynetworks,reject
+ -o mynetworks=127.0.0.0/8
+ -o strict_rfc821_envelopes=yes
+ -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
+ -o smtpd_bind_address=127.0.0.1
+<% end %>
+<% if postfix_use_dovecot_lda == 'yes' %>
+dovecot unix - n n - - pipe
+ flags=DRhu user=vmail:vmail argv=/usr/lib/dovecot/deliver -d ${recipient}
+<% end %>
+<% if postfix_use_schleuder == 'yes' %>
+schleuder unix - n n - - pipe
+ flags=DRhu user=schleuder argv=/usr/bin/schleuder ${user}
+<% end %>
+<% if postfix_use_sympa == 'yes' %>
+sympa unix - n n - - pipe
+ flags=R user=sympa argv=/usr/lib/sympa/bin/queue ${recipient}
+sympabounce unix - n n - - pipe
+ flags=R user=sympa argv=/usr/lib/sympa/bin/bouncequeue ${user}
+<% end %>
+
+<%- unless postfix_mastercf_tail.to_s.empty? then -%>
+<%= postfix_mastercf_tail %>
+<%- end -%>
diff --git a/templates/master.cf.redhat5.erb b/templates/master.cf.redhat5.erb
index 8c3ee53..3d0c7d6 100644
--- a/templates/master.cf.redhat5.erb
+++ b/templates/master.cf.redhat5.erb
@@ -79,3 +79,7 @@ ifmail unix - n n - - pipe
flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp unix - n n - - pipe
flags=Fq. user=foo argv=/usr/local/sbin/bsmtp -f $sender $nexthop $recipient
+
+<%- unless postfix_mastercf_tail.to_s.empty? then -%>
+<%= postfix_mastercf_tail %>
+<%- end -%>
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-21 16:14:45 +0000