ナレッジベース

Overview

The Warden module modifies Postfix configuration files to enable secure SMTP submission ports (SMTPS on port 465 and Submission on port 587), configure a local reentry service for content filtering, and integrate the amavisd-milter. These changes ensure proper mail routing, TLS enforcement, authentication handling, and spam/virus scanning.

Configuration Changes

Postfix Master Configuration (/etc/postfix/master.cf)

Warden updates the master configuration file to define secure submission services and a local reentry listener. The following examples illustrate the typical state before and after modification. Note that initial configurations may vary based on the operating system.

Original Configuration:

# SMTPS port (465)
smtps      inet  n       -       n       -       -       smtpd -o smtpd_tls_wrappermode=yes

# submission port (587) (if enabled)
submission inet  n       -       n       -       -       smtpd -o smtpd_enforce_tls=yes -o smtpd_tls_security_level=may -o smtpd_sasl_auth_enable=yes -o smtpd_client_restrictions=permit_sasl_authenticated,reject -o smtpd_sender_restrictions= -o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination

Modified Configuration:

# SMTPS port (465)
smtps      inet  n       -       n       -       -       smtpd
    -o smtpd_tls_wrappermode=yes
    -o milter_macro_daemon_name=SUBMISSION

# submission port (587) (if enabled)
submission inet  n       -       n       -       -       smtpd
    -o smtpd_enforce_tls=yes
    -o smtpd_tls_security_level=may
    -o smtpd_sasl_auth_enable=yes
    -o smtpd_client_restrictions=permit_sasl_authenticated,reject
    -o smtpd_sender_restrictions=
    -o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination
    -o milter_macro_daemon_name=SUBMISSION

# postfix-reentry
127.0.0.1:10025 inet n   -       -       -       -       smtpd
    -o syslog_name=postfix-reentry
    -o content_filter=
    -o local_recipient_maps=
    -o relay_recipient_maps=
    -o smtpd_restriction_classes=
    -o smtpd_delay_reject=no
    -o smtpd_client_restrictions=permit_mynetworks,reject
    -o smtpd_helo_restrictions=
    -o smtpd_sender_restrictions=
    -o smtpd_recipient_restrictions=permit_mynetworks,reject
    -o smtpd_data_restrictions=reject_unauth_pipelining
    -o smtpd_end_of_data_restrictions=
    -o mynetworks=127.0.0.0/8
    -o strict_rfc821_envelopes=yes
    -o smtpd_error_sleep_time=0
    -o smtpd_soft_error_limit=1001
    -o smtpd_hard_error_limit=1000
    -o smtpd_client_connection_count_limit=0
    -o smtpd_client_connection_rate_limit=0
    -o smtp_tls_security_level=none
    -o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_milters

Postfix Main Configuration (/etc/postfix/main.cf)

Warden appends milter configuration directives to the main Postfix configuration file. The amavisd-milter is prepended to both the smtpd_milters and non_smtpd_milters parameters. Any existing milters will be retained but positioned after the amavisd-milter.

Critical Configuration Note: The amavisd-milter (inet:127.0.0.1:10024) must always be listed first in both milter parameters to ensure proper mail processing order.

smtpd_milters = inet:127.0.0.1:10024,inet:127.0.0.1:12768
non_smtpd_milters = inet:127.0.0.1:10024
milter_connect_macros = j {client_name} {daemon_name} v
milter_default_action = accept

Repair Installation

If configuration files are missing, corrupted, or require restoration to their default Warden-managed state, execute the following command to run the installer in repair mode:

/usr/local/psa/admin/bin/modules/warden/install.sh

Troubleshooting & Common Issues

• Milter Processing Order: Verify that inet:127.0.0.1:10024 remains the first entry in both smtpd_milters and non_smtpd_milters. Incorrect ordering may bypass content filtering or cause delivery failures.
• Service Restart Required: After manual edits to /etc/postfix/master.cf or /etc/postfix/main.cf, restart the Postfix service to apply changes: systemctl restart postfix.
• Configuration Drift: If custom modifications conflict with Warden updates, run the repair installation command provided above to restore the expected configuration baseline.
• Port Availability: Ensure that ports 465 and 587 are not blocked by local firewalls. Verify listener status using: ss -tlnp | grep -E ':(465|587)'.