$inet_socket_port = 10024; # default listening socket
$sa_spam_subject_tag = '***SPAM*** ';
-$sa_tag_level_deflt = undef; # add spam info headers if at, or above that level
-$sa_tag2_level_deflt = 6.31; # add 'spam detected' headers at that level
-$sa_kill_level_deflt = 6.31; # triggers spam evasive actions
-$sa_dsn_cutoff_level = 10; # spam level beyond which a DSN is not sent
+$sa_tag_level_deflt = 2.0; # add spam info headers if at, or above that level
+$sa_tag2_level_deflt = 6.31; # add 'spam detected' headers at that level
+$sa_kill_level_deflt = 6.31; # triggers spam evasive actions
+$sa_dsn_cutoff_level = 10; # spam level beyond which a DSN is not sent
$sa_mail_body_size_limit = 200*1024; # don't waste time on SA if mail is larger
$sa_local_tests_only = 0; # only tests which do not require internet access?
# D_REJECT it (and don't D_REJECT mail coming from your forwarders!).
$final_virus_destiny = D_DISCARD; # (data not lost, see virus quarantine)
-$final_banned_destiny = D_BOUNCE; # D_REJECT when front-end MTA
-$final_spam_destiny = D_DISCARD;
+$final_banned_destiny = D_DISCARD;
+$final_spam_destiny = D_PASS;
$final_bad_header_destiny = D_PASS; # False-positive prone (for spam)
+$enable_dkim_verification = 0; #disabled to prevent warning
+
$virus_admin = "postmaster\@$mydomain"; # due to D_DISCARD default
# Set to empty ("") to add no header
# block certain double extensions anywhere in the base name
qr'\.[^./]*\.(exe|vbs|pif|scr|bat|cmd|com|cpl|dll)\.?$'i,
- qr'\{[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}\}?'i, # Windows Class ID CLSID, strict
+ qr'\{[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}\}?$'i, # Windows Class ID CLSID, strict
qr'^application/x-msdownload$'i, # block these MIME types
qr'^application/x-msdos-program$'i,
# [ qr'^\.(Z|gz|bz2)$' => 0 ], # allow any in Unix-compressed
# [ qr'^\.(rpm|cpio|tar)$' => 0 ], # allow any in Unix-type archives
# [ qr'^\.(zip|rar|arc|arj|zoo)$'=> 0 ], # allow any within such archives
+# [ qr'^application/x-zip-compressed$'i => 0], # allow any within such archives
qr'.\.(exe|vbs|pif|scr|bat|cmd|com|cpl)$'i, # banned extension - basic
# qr'.\.(ade|adp|app|bas|bat|chm|cmd|com|cpl|crt|emf|exe|fxp|grp|hlp|hta|
# read_hash("/var/amavis/sender_scores_sitewide"),
+# This are some examples for whitelists, since envelope senders can be forged
+# they are not enabled by default.
{ # a hash-type lookup table (associative array)
- 'nobody@cert.org' => -3.0,
- 'cert-advisory@us-cert.gov' => -3.0,
- 'owner-alert@iss.net' => -3.0,
- 'slashdot@slashdot.org' => -3.0,
- 'securityfocus.com' => -3.0,
- 'ntbugtraq@listserv.ntbugtraq.com' => -3.0,
- 'security-alerts@linuxsecurity.com' => -3.0,
- 'mailman-announce-admin@python.org' => -3.0,
- 'amavis-user-admin@lists.sourceforge.net'=> -3.0,
- 'amavis-user-bounces@lists.sourceforge.net' => -3.0,
- 'spamassassin.apache.org' => -3.0,
- 'notification-return@lists.sophos.com' => -3.0,
- 'owner-postfix-users@postfix.org' => -3.0,
- 'owner-postfix-announce@postfix.org' => -3.0,
- 'owner-sendmail-announce@lists.sendmail.org' => -3.0,
- 'sendmail-announce-request@lists.sendmail.org' => -3.0,
- 'donotreply@sendmail.org' => -3.0,
- 'ca+envelope@sendmail.org' => -3.0,
- 'noreply@freshmeat.net' => -3.0,
- 'owner-technews@postel.acm.org' => -3.0,
- 'ietf-123-owner@loki.ietf.org' => -3.0,
- 'cvs-commits-list-admin@gnome.org' => -3.0,
- 'rt-users-admin@lists.fsck.com' => -3.0,
- 'clp-request@comp.nus.edu.sg' => -3.0,
- 'surveys-errors@lists.nua.ie' => -3.0,
- 'emailnews@genomeweb.com' => -5.0,
- 'yahoo-dev-null@yahoo-inc.com' => -3.0,
- 'returns.groups.yahoo.com' => -3.0,
- 'clusternews@linuxnetworx.com' => -3.0,
- lc('lvs-users-admin@LinuxVirtualServer.org') => -3.0,
- lc('owner-textbreakingnews@CNNIMAIL12.CNN.COM') => -5.0,
+ #'nobody@cert.org' => -3.0,
+ #'cert-advisory@us-cert.gov' => -3.0,
+ #'owner-alert@iss.net' => -3.0,
+ #'slashdot@slashdot.org' => -3.0,
+ #'securityfocus.com' => -3.0,
+ #'ntbugtraq@listserv.ntbugtraq.com' => -3.0,
+ #'security-alerts@linuxsecurity.com' => -3.0,
+ #'mailman-announce-admin@python.org' => -3.0,
+ #'amavis-user-admin@lists.sourceforge.net'=> -3.0,
+ #'amavis-user-bounces@lists.sourceforge.net' => -3.0,
+ #'spamassassin.apache.org' => -3.0,
+ #'notification-return@lists.sophos.com' => -3.0,
+ #'owner-postfix-users@postfix.org' => -3.0,
+ #'owner-postfix-announce@postfix.org' => -3.0,
+ #'owner-sendmail-announce@lists.sendmail.org' => -3.0,
+ #'sendmail-announce-request@lists.sendmail.org' => -3.0,
+ #'donotreply@sendmail.org' => -3.0,
+ #'ca+envelope@sendmail.org' => -3.0,
+ #'noreply@freshmeat.net' => -3.0,
+ #'owner-technews@postel.acm.org' => -3.0,
+ #'ietf-123-owner@loki.ietf.org' => -3.0,
+ #'cvs-commits-list-admin@gnome.org' => -3.0,
+ #'rt-users-admin@lists.fsck.com' => -3.0,
+ #'clp-request@comp.nus.edu.sg' => -3.0,
+ #'surveys-errors@lists.nua.ie' => -3.0,
+ #'emailnews@genomeweb.com' => -5.0,
+ #'yahoo-dev-null@yahoo-inc.com' => -3.0,
+ #'returns.groups.yahoo.com' => -3.0,
+ #'clusternews@linuxnetworx.com' => -3.0,
+ #lc('lvs-users-admin@LinuxVirtualServer.org') => -3.0,
+ #lc('owner-textbreakingnews@CNNIMAIL12.CNN.COM') => -5.0,
# soft-blacklisting (positive score)
- 'sender@example.net' => 3.0,
- '.example.net' => 1.0,
+ #'sender@example.net' => 3.0,
+ #'.example.net' => 1.0,
},
], # end of site-wide tables
--- /dev/null
+# 2.1.7: /etc/dovecot/dovecot.conf
+# OS: Linux 2.6.32-5-vserver-amd64 x86_64 Debian 7.3 ufs
+
+# See http://help.directadmin.com/item.php?id=348
+listen = *
+
+auth_mechanisms = plain login
+log_timestamp = "%Y-%m-%d %H:%M:%S "
+login_log_format_elements = user=<%%u> method=%m %c
+mail_location = maildir:/var/mail/virtual/%u
+mail_privileged_group = mail
+passdb {
+ args = /etc/dovecot/dovecot-sql.conf
+ driver = sql
+}
+plugin {
+ sieve = ~/.dovecot.sieve
+ sieve_storage = ~/sieve
+}
+protocols = imap
+service auth {
+ unix_listener /var/spool/postfix/private/auth {
+ group = postfix
+ mode = 0660
+ user = postfix
+ }
+ unix_listener auth-master {
+ group = mail
+ mode = 0600
+ user = vmail
+ }
+ user = root
+}
+
+# PEM encoded X.509 SSL/TLS certificate and private key. They're opened before
+# dropping root privileges, so keep the key file unreadable by anyone but
+# root.
+ssl_cert = </etc/ssl/certs/cert.crt
+ssl_key = </etc/ssl/private/cert.pem
+
+# SSL ciphers to use
+#
+# Since Dovecot started using OpenSSL 1.1, we don't have to disable
+# SSLv2 anymore as it's already removed from OpenSSL.
+#
+# See http://www.virtualmin.com/node/25057
+# https://zmap.io/sslv3/servers.html
+# https://security.stackexchange.com/questions/71872/disable-sslv3-in-dovecot-tls-handshaking-failed-no-shared-cipher
+# https://bbs.archlinux.org/viewtopic.php?id=225535
+ssl_cipher_list = HIGH:MEDIUM:+TLSv1:!SSLv2:SSLv3
+
+# See https://wiki2.dovecot.org/Upgrading/2.3
+#ssl_protocols = !SSLv3
+ssl_min_protocol = TLSv1
+ssl_dh = </etc/dovecot/dh.pem
+
+userdb {
+ args = uid=5000 gid=5000 home=/var/mail/virtual/%u allow_all_users=yes
+ driver = static
+}
+userdb {
+ args = /etc/dovecot/dovecot-sql.conf
+ driver = sql
+}
+protocol pop3 {
+ pop3_uidl_format = %08Xu%08Xv
+}
+protocol lda {
+ auth_socket_path = /var/run/dovecot/auth-master
+ mail_plugins = sieve
+ postmaster_address = postmaster@<%= @fqdn %>
+}
+
+# Should saving a mail to a non-existing mailbox automatically create it?
+lda_mailbox_autocreate = yes
projects / puppet-mail.git / commitdiff