diff --git a/group_vars/all/main.yml b/group_vars/all/main.yml index 3998e22..1e146c0 100644 --- a/group_vars/all/main.yml +++ b/group_vars/all/main.yml @@ -2990,6 +2990,14 @@ copy_plain_files_postfwd: src_path: mailserver/etc/postfix/postfwd.bl-user dest_path: /etc/postfix/postfwd.bl-user + - name: postfwd.high_rate_ip + src_path: mailserver/etc/postfix/postfwd.high_rate_ip + dest_path: /etc/postfix/postfwd.high_rate_ip + + - name: postfwd.high_rate_hostname + src_path: mailserver/etc/postfix/postfwd.high_rate_hostname + dest_path: /etc/postfix/postfwd.high_rate_hostname + - name: postfwd.bl-recipient-exeeds-msg-size-20mb src_path: mailserver/etc/postfix/postfwd.bl-recipient-exeeds-msg-size-20mb dest_path: /etc/postfix/postfwd.bl-recipient-exeeds-msg-size-20mb diff --git a/host_vars/e.mx.oopen.de/e.mx-common.yml b/host_vars/e.mx.oopen.de/e.mx-common.yml index bddf9e4..0fcfd6a 100644 --- a/host_vars/e.mx.oopen.de/e.mx-common.yml +++ b/host_vars/e.mx.oopen.de/e.mx-common.yml @@ -105,17 +105,17 @@ resolved_fallback_nameserver: insert_root_ssh_keypair: true -root_ssh_keypair: - - name: id-rsa-dehydrated - priv_key_src: e.mx/root/.ssh/e.mx-id_rsa-dehydrated - priv_key_dest: /root/.ssh/id_rsa-dehydrated - pub_key_src: e.mx/root/.ssh/e.mx-id_rsa-dehydrated.pub - pub_key_dest: /root/.ssh/id_rsa-dehydrated.pub - - name: id-rsa-opendkim - priv_key_src: e.mx/root/.ssh/e.mx-id_rsa-opendkim - priv_key_dest: /root/.ssh/id_rsa-opendkim - pub_key_src: e.mx/root/.ssh/e.mx-id_rsa-opendkim.pub - pub_key_dest: /root/.ssh/id_rsa-opendkim.pub +#root_ssh_keypair: +# - name: id-rsa-dehydrated +# priv_key_src: e.mx/root/.ssh/e.mx-id_rsa-dehydrated +# priv_key_dest: /root/.ssh/id_rsa-dehydrated +# pub_key_src: e.mx/root/.ssh/e.mx-id_rsa-dehydrated.pub +# pub_key_dest: /root/.ssh/id_rsa-dehydrated.pub +# - name: id-rsa-opendkim +# priv_key_src: e.mx/root/.ssh/e.mx-id_rsa-opendkim +# priv_key_dest: /root/.ssh/id_rsa-opendkim +# pub_key_src: e.mx/root/.ssh/e.mx-id_rsa-opendkim.pub +# pub_key_dest: /root/.ssh/id_rsa-opendkim.pub # --- @@ -151,30 +151,30 @@ root_ssh_keypair: # vars used by roles/common/tasks/copy_files.yml # --- -copy_plain_files: - - - name: monitoring_check_cert_for_dovecot.conf - src_path: e.mx/root/bin/monitoring/conf/check_cert_for_dovecot.conf - dest_path: /root/bin/monitoring/conf/check_cert_for_dovecot.conf - - - name: postfix_create_opendkim_key.conf - src_path: e.mx/root/bin/postfix/conf/create_opendkim_key.conf - dest_path: /root/bin/postfix/conf/create_opendkim_key.conf - - - name: postfix_postfix_add_mailboxes.conf - src_path: e.mx/root/bin/postfix/conf/postfix_add_mailboxes.conf - dest_path: /root/bin/postfix/conf/postfix_add_mailboxes.conf - - - name: postfix_sent_userinfo_postfix.conf - src_path: e.mx/root/bin/postfix/conf/sent_userinfo_postfix.conf - dest_path: /root/bin/postfix/conf/sent_userinfo_postfix.conf - - - name: postfix_whitelist_mb_sigs.conf - src_path: e.mx/root/bin/postfix/conf/whitelist_mb_sigs.conf - dest_path: /root/bin/postfix/conf/whitelist_mb_sigs.conf - - -copy_template_files: [] +#copy_plain_files: +# +# - name: monitoring_check_cert_for_dovecot.conf +# src_path: e.mx/root/bin/monitoring/conf/check_cert_for_dovecot.conf +# dest_path: /root/bin/monitoring/conf/check_cert_for_dovecot.conf +# +# - name: postfix_create_opendkim_key.conf +# src_path: e.mx/root/bin/postfix/conf/create_opendkim_key.conf +# dest_path: /root/bin/postfix/conf/create_opendkim_key.conf +# +# - name: postfix_postfix_add_mailboxes.conf +# src_path: e.mx/root/bin/postfix/conf/postfix_add_mailboxes.conf +# dest_path: /root/bin/postfix/conf/postfix_add_mailboxes.conf +# +# - name: postfix_sent_userinfo_postfix.conf +# src_path: e.mx/root/bin/postfix/conf/sent_userinfo_postfix.conf +# dest_path: /root/bin/postfix/conf/sent_userinfo_postfix.conf +# +# - name: postfix_whitelist_mb_sigs.conf +# src_path: e.mx/root/bin/postfix/conf/whitelist_mb_sigs.conf +# dest_path: /root/bin/postfix/conf/whitelist_mb_sigs.conf +# +# +#copy_template_files: [] # # - name: mailsystem_install_amavis.conf # src_path: usr/local/src/mailsystem/conf/install_amavis.conf.j2 diff --git a/roles/common/files/e.mx.oopen.de/etc/postfix/postfwd.bl-recipient-exeeds-msg-size-20mb b/roles/common/files/e.mx.oopen.de/etc/postfix/postfwd.bl-recipient-exeeds-msg-size-20mb new file mode 100644 index 0000000..507514c --- /dev/null +++ b/roles/common/files/e.mx.oopen.de/etc/postfix/postfwd.bl-recipient-exeeds-msg-size-20mb @@ -0,0 +1,34 @@ +# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] *** + +# --- +# Block messages exeeds 20 MB for listed recipients +# +# This file is called with '=~'. This means perl regexp is possible +# +# +# To increase performance use ^ and/or $ in regular expressions +# +# @acieu\.co\.uk$ +# ^error@mailfrom\.com$ +# +# instedt of +# +# @acieu.co.uk +# error@mailfrom.com +# +# +# Example: +# +# # # annoying spammer domains +# # block all senders of maildomaindomain 'oopen.de' +# @acieu\.co\.uk$ +# +# # annoying spammer addresses +# # block sender address +# error@mailfrom.com +# sqek@eike\.se$ +# +# --- + +# MBR / VDK +info@mbr-berlin.de diff --git a/roles/common/files/e.mx.oopen.de/etc/postfix/postfwd.high-rate-number-messages b/roles/common/files/e.mx.oopen.de/etc/postfix/postfwd.high-rate-number-messages new file mode 100644 index 0000000..df6cc67 --- /dev/null +++ b/roles/common/files/e.mx.oopen.de/etc/postfix/postfwd.high-rate-number-messages @@ -0,0 +1,19 @@ +# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] *** + +# --- +# SASL Users are allowed to send up to 500 messages per hour +# +# This file is called with '=='. This means perl regexp is NOT possible +# +# +# example: +# +# # give sasl usernames here +# # +# ckubu@oopen.de +# +# --- + +# give sasl usernames here +buchsys@sprachenatelier-berlin.de + diff --git a/roles/common/files/e.mx.oopen.de/etc/postfix/postfwd.high_rate_hostname b/roles/common/files/e.mx.oopen.de/etc/postfix/postfwd.high_rate_hostname new file mode 100644 index 0000000..d124692 --- /dev/null +++ b/roles/common/files/e.mx.oopen.de/etc/postfix/postfwd.high_rate_hostname @@ -0,0 +1,40 @@ +# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] *** + +# ============================================================ +# Whitelist fuer erhoehtes Rate-Limit (100 Nachrichten/Minute) +# auf Basis des Client-Hostnamens (Reverse-DNS/PTR-Eintrag), +# statt der Standard-Grenze von 50/Minute aus RATE_CLIENT_ADDR +# +# Format: PCRE-regulaerer Ausdruck pro Zeile (kein Wildcard/Glob!), +# postfwd2 vergleicht jede Zeile gegen den von Postfix aufgeloesten +# 'client_name'-Wert (PTR-Eintrag der Client-IP). +# Leerzeilen und Zeilen, die mit '#' beginnen, werden ignoriert. +# +# Beispiele: +# /^buchsys3\.buchsys\.de$/ -> nur dieser eine Hostname +# /\.buchsys\.de$/ -> alle Subdomains von buchsys.de +# (z.B. buchsys3.buchsys.de, +# mail.buchsys.de, etc.) +# +# WICHTIG: +# - Diese Regel greift NUR, wenn Reverse-DNS fuer die jeweilige +# IP sauber konfiguriert ist und der PTR-Eintrag auf das Muster +# passt. Pruefe den tatsaechlichen 'client_name'-Wert vorher in +# den postfwd2-Logs. +# - Ein zu breites Muster (z.B. /buchsys\.de/ ohne Anker) kann auch +# unerwuenschte Hosts matchen (z.B. "evil-buchsys.de.attacker.com"). +# Deshalb immer mit '^' und '$' bzw. '\.' vor der Domain arbeiten. +# - Jeder hier gematchte Hostname umgeht das strengere 50er-Limit +# und erlaubt bis zu 100 Nachrichten/Minute. Bitte nur Muster +# eintragen, denen du tatsaechlich vertraust. +# - Nach Aenderungen an dieser Datei postfwd2 neu laden/starten: +# systemctl restart postfwd2 +# - Diese Datei wird per 'pcre:' Lookup direkt in postfwd.cf +# referenziert, siehe Regel 'HIGH_RATE_CLIENT_NAME'. +# - Die IP-basierte Regel (HIGH_RATE_CLIENT_ADDR) ist zuverlaessiger +# und sollte die primaere Loesung sein; diese Hostname-Regel +# eignet sich vor allem als Ergaenzung bei wechselnden IPs. +# ============================================================ + +/^buchsys3\.buchsys\.de$/ +/^www\.buchsys\.de$/ diff --git a/roles/common/files/e.mx.oopen.de/etc/postfix/postfwd.high_rate_ip b/roles/common/files/e.mx.oopen.de/etc/postfix/postfwd.high_rate_ip new file mode 100644 index 0000000..ca4ae87 --- /dev/null +++ b/roles/common/files/e.mx.oopen.de/etc/postfix/postfwd.high_rate_ip @@ -0,0 +1,35 @@ +# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] *** + +# ============================================================ +# Whitelist fuer erhoehtes Rate-Limit (100 Nachrichten/Minute) +# statt der Standard-Grenze von 50/Minute aus RATE_CLIENT_ADDR +# +# Hier werden IP-Adressen bzw. CIDR-Netze von vertrauenswuerdigen +# Absende-Systemen eingetragen, die routinemaessig hoehere +# Mailmengen ueber eine feste Absender-IP verschicken, z. B. +# Kunden-Mailserver, angebundene Fachanwendungen/Buchungssysteme, +# Newsletter- oder Transaktionsmail-Versender. +# +# Format: eine IP-Adresse oder ein CIDR-Netz pro Zeile. +# Leerzeilen und Zeilen, die mit '#' beginnen, werden ignoriert. +# IPv4 und IPv6 werden unterstuetzt. +# +# Beispiele: +# 116.202.85.120 +# 203.0.113.0/24 +# +# WICHTIG: +# - Jede hier eingetragene IP umgeht das strengere 50er-Limit +# und darf bis zu 100 Nachrichten/Minute senden. Bitte nur +# IPs eintragen, denen du tatsaechlich vertraust (kompromittierte +# oder falsch eingetragene Systeme koennten sonst zum offenen +# Spam-Verteiler werden). +# - Nach Aenderungen an dieser Datei postfwd2 neu laden/starten, +# damit die Aenderung sicher greift: +# systemctl restart postfwd2 +# - Diese Datei wird per 'cidr:' Lookup direkt in postfwd.cf +# referenziert, siehe Regel 'HIGH_RATE_CLIENT_ADDR'. +# ============================================================ + +# www.buchsys.de +116.202.85.120 diff --git a/roles/common/files/e.mx.oopen.de/etc/postfix/postfwd.wl-user b/roles/common/files/e.mx.oopen.de/etc/postfix/postfwd.wl-user new file mode 100644 index 0000000..66a76a8 --- /dev/null +++ b/roles/common/files/e.mx.oopen.de/etc/postfix/postfwd.wl-user @@ -0,0 +1,19 @@ +# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] *** + +# --- +# SASL Users whitelisted by postfwd +# +# example: +# +# # give trusted sasl usernames here +# ckubu@oopen.de +# vertrieb@akweb.de +# +# --- + +# give trusted sasl usernames here +abo@akweb.de +vertrieb@akweb.de +prokla@akweb.de +presse@mbr-berlin.de + diff --git a/roles/common/files/e.mx/root/.ssh/e.mx-id_rsa-dehydrated b/roles/common/files/e.mx.oopen.de/root/.ssh/e.mx-id_rsa-dehydrated similarity index 100% rename from roles/common/files/e.mx/root/.ssh/e.mx-id_rsa-dehydrated rename to roles/common/files/e.mx.oopen.de/root/.ssh/e.mx-id_rsa-dehydrated diff --git a/roles/common/files/e.mx/root/.ssh/e.mx-id_rsa-dehydrated.pub b/roles/common/files/e.mx.oopen.de/root/.ssh/e.mx-id_rsa-dehydrated.pub similarity index 100% rename from roles/common/files/e.mx/root/.ssh/e.mx-id_rsa-dehydrated.pub rename to roles/common/files/e.mx.oopen.de/root/.ssh/e.mx-id_rsa-dehydrated.pub diff --git a/roles/common/files/e.mx/root/.ssh/e.mx-id_rsa-opendkim b/roles/common/files/e.mx.oopen.de/root/.ssh/e.mx-id_rsa-opendkim similarity index 100% rename from roles/common/files/e.mx/root/.ssh/e.mx-id_rsa-opendkim rename to roles/common/files/e.mx.oopen.de/root/.ssh/e.mx-id_rsa-opendkim diff --git a/roles/common/files/e.mx/root/.ssh/e.mx-id_rsa-opendkim.pub b/roles/common/files/e.mx.oopen.de/root/.ssh/e.mx-id_rsa-opendkim.pub similarity index 100% rename from roles/common/files/e.mx/root/.ssh/e.mx-id_rsa-opendkim.pub rename to roles/common/files/e.mx.oopen.de/root/.ssh/e.mx-id_rsa-opendkim.pub diff --git a/roles/common/files/e.mx/root/bin/monitoring/conf/check_cert_for_dovecot.conf b/roles/common/files/e.mx.oopen.de/root/bin/monitoring/conf/check_cert_for_dovecot.conf similarity index 100% rename from roles/common/files/e.mx/root/bin/monitoring/conf/check_cert_for_dovecot.conf rename to roles/common/files/e.mx.oopen.de/root/bin/monitoring/conf/check_cert_for_dovecot.conf diff --git a/roles/common/files/e.mx/root/bin/postfix/conf/create_opendkim_key.conf b/roles/common/files/e.mx.oopen.de/root/bin/postfix/conf/create_opendkim_key.conf similarity index 100% rename from roles/common/files/e.mx/root/bin/postfix/conf/create_opendkim_key.conf rename to roles/common/files/e.mx.oopen.de/root/bin/postfix/conf/create_opendkim_key.conf diff --git a/roles/common/files/e.mx/root/bin/postfix/conf/postfix_add_mailboxes.conf b/roles/common/files/e.mx.oopen.de/root/bin/postfix/conf/postfix_add_mailboxes.conf similarity index 100% rename from roles/common/files/e.mx/root/bin/postfix/conf/postfix_add_mailboxes.conf rename to roles/common/files/e.mx.oopen.de/root/bin/postfix/conf/postfix_add_mailboxes.conf diff --git a/roles/common/files/e.mx/root/bin/postfix/conf/sent_userinfo_postfix.conf b/roles/common/files/e.mx.oopen.de/root/bin/postfix/conf/sent_userinfo_postfix.conf similarity index 100% rename from roles/common/files/e.mx/root/bin/postfix/conf/sent_userinfo_postfix.conf rename to roles/common/files/e.mx.oopen.de/root/bin/postfix/conf/sent_userinfo_postfix.conf diff --git a/roles/common/files/e.mx/root/bin/postfix/conf/whitelist_mb_sigs.conf b/roles/common/files/e.mx.oopen.de/root/bin/postfix/conf/whitelist_mb_sigs.conf similarity index 100% rename from roles/common/files/e.mx/root/bin/postfix/conf/whitelist_mb_sigs.conf rename to roles/common/files/e.mx.oopen.de/root/bin/postfix/conf/whitelist_mb_sigs.conf diff --git a/roles/common/files/mailserver/etc/postfix/postfwd.cf b/roles/common/files/mailserver/etc/postfix/postfwd.cf index 7dc03fe..bb6a14e 100644 --- a/roles/common/files/mailserver/etc/postfix/postfwd.cf +++ b/roles/common/files/mailserver/etc/postfix/postfwd.cf @@ -160,10 +160,29 @@ id=RATE_UNKNOWN_CLIENT_ADDR client_name==unknown action=rate(client_address/5/300/450 4.7.1 only 5 recipients per 5 minutes allowed) +# Ausnahme vom 50/Minute-Limit: IPs aus der Whitelist-Datei +# duerfen bis zu 100 Nachrichten/Minute senden. 'final=yes' +# sorgt dafuer, dass fuer diese IPs die nachfolgende +# RATE_CLIENT_ADDR-Regel NICHT mehr zusaetzlich ausgewertet wird. +id=HIGH_RATE_CLIENT_ADDR + &&INCOMING + client_address=cidr:/etc/postfix/postfwd.high_rate_ip + action=rate($$client_address/100/60/421 421 4.7.0 Too many connections (150/m) from $$client_address) + final=yes + +# Ausnahme vom 50/Minute-Limit auf Basis des Client-Hostnamens +# (Reverse-DNS/PTR). 'final=yes' verhindert die zusaetzliche +# Auswertung der nachfolgenden RATE_CLIENT_ADDR-Regel. +id=HIGH_RATE_CLIENT_NAME + &&INCOMING + client_name=pcre:/etc/postfix/postfwd.high_rate_hostname + action=rate($$client_address/100/60/421 421 4.7.0 Too many connections (150/m) from $$client_address ($$client_name)) + final=yes + # Block clients (ip-addresses) sending more than 50 messages per minute exceeded. Error:RATE_CLIENT) id=RATE_CLIENT_ADDR &&INCOMING - action=rate($$client_address/50/60/421 421 4.7.0 Too many connections from $$client_address) + action=rate($$client_address/50/60/421 421 4.7.0 Too many connections (50/m) from $$client_address) # Block messages with more than 50 recipients id=BLOCK_MSG_RCPT @@ -172,7 +191,7 @@ id=BLOCK_MSG_RCPT recipient_count=90 action=REJECT Too many recipients, please reduce to less than 90 or consider using a mailing list. Error: BLOCK_MSG_RCPT -# Higher rate limit for users in exception list +# Higher rate limit for users in exception list (limit: 500 messages/hour) id=RATE_MSG_EXCEPTION &&INCOMING &&SASL_AUTH @@ -185,7 +204,7 @@ id=RATE_MSG &&SASL_AUTH action=rate($$sasl_username/50/3600/450 4.7.1 Number messages per hour exceeded. Error:RATE_MSG) -# Higher recipient rate limit for specific users from file +# Higher recipient rate limit for specific users from file (limit: 1000 recipients total/hour) id=RATE_RCPT_HIGH &&INCOMING &&SASL_AUTH diff --git a/roles/common/files/mailserver/etc/postfix/postfwd.high_rate_hostname b/roles/common/files/mailserver/etc/postfix/postfwd.high_rate_hostname new file mode 100644 index 0000000..e62130c --- /dev/null +++ b/roles/common/files/mailserver/etc/postfix/postfwd.high_rate_hostname @@ -0,0 +1,38 @@ +# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] *** + +# ============================================================ +# Whitelist fuer erhoehtes Rate-Limit (100 Nachrichten/Minute) +# auf Basis des Client-Hostnamens (Reverse-DNS/PTR-Eintrag), +# statt der Standard-Grenze von 50/Minute aus RATE_CLIENT_ADDR +# +# Format: PCRE-regulaerer Ausdruck pro Zeile (kein Wildcard/Glob!), +# postfwd2 vergleicht jede Zeile gegen den von Postfix aufgeloesten +# 'client_name'-Wert (PTR-Eintrag der Client-IP). +# Leerzeilen und Zeilen, die mit '#' beginnen, werden ignoriert. +# +# Beispiele: +# /^buchsys3\.buchsys\.de$/ -> nur dieser eine Hostname +# /\.buchsys\.de$/ -> alle Subdomains von buchsys.de +# (z.B. buchsys3.buchsys.de, +# mail.buchsys.de, etc.) +# +# WICHTIG: +# - Diese Regel greift NUR, wenn Reverse-DNS fuer die jeweilige +# IP sauber konfiguriert ist und der PTR-Eintrag auf das Muster +# passt. Pruefe den tatsaechlichen 'client_name'-Wert vorher in +# den postfwd2-Logs. +# - Ein zu breites Muster (z.B. /buchsys\.de/ ohne Anker) kann auch +# unerwuenschte Hosts matchen (z.B. "evil-buchsys.de.attacker.com"). +# Deshalb immer mit '^' und '$' bzw. '\.' vor der Domain arbeiten. +# - Jeder hier gematchte Hostname umgeht das strengere 50er-Limit +# und erlaubt bis zu 100 Nachrichten/Minute. Bitte nur Muster +# eintragen, denen du tatsaechlich vertraust. +# - Nach Aenderungen an dieser Datei postfwd2 neu laden/starten: +# systemctl restart postfwd2 +# - Diese Datei wird per 'pcre:' Lookup direkt in postfwd.cf +# referenziert, siehe Regel 'HIGH_RATE_CLIENT_NAME'. +# - Die IP-basierte Regel (HIGH_RATE_CLIENT_ADDR) ist zuverlaessiger +# und sollte die primaere Loesung sein; diese Hostname-Regel +# eignet sich vor allem als Ergaenzung bei wechselnden IPs. +# ============================================================ + diff --git a/roles/common/files/mailserver/etc/postfix/postfwd.high_rate_ip b/roles/common/files/mailserver/etc/postfix/postfwd.high_rate_ip new file mode 100644 index 0000000..1c2d3c8 --- /dev/null +++ b/roles/common/files/mailserver/etc/postfix/postfwd.high_rate_ip @@ -0,0 +1,32 @@ +# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] *** + +# ============================================================ +# Whitelist fuer erhoehtes Rate-Limit (100 Nachrichten/Minute) +# statt der Standard-Grenze von 50/Minute aus RATE_CLIENT_ADDR +# +# Hier werden IP-Adressen bzw. CIDR-Netze von vertrauenswuerdigen +# Absende-Systemen eingetragen, die routinemaessig hoehere +# Mailmengen ueber eine feste Absender-IP verschicken, z. B. +# Kunden-Mailserver, angebundene Fachanwendungen/Buchungssysteme, +# Newsletter- oder Transaktionsmail-Versender. +# +# Format: eine IP-Adresse oder ein CIDR-Netz pro Zeile. +# Leerzeilen und Zeilen, die mit '#' beginnen, werden ignoriert. +# IPv4 und IPv6 werden unterstuetzt. +# +# Beispiele: +# 116.202.85.120 +# 203.0.113.0/24 +# +# WICHTIG: +# - Jede hier eingetragene IP umgeht das strengere 50er-Limit +# und darf bis zu 100 Nachrichten/Minute senden. Bitte nur +# IPs eintragen, denen du tatsaechlich vertraust (kompromittierte +# oder falsch eingetragene Systeme koennten sonst zum offenen +# Spam-Verteiler werden). +# - Nach Aenderungen an dieser Datei postfwd2 neu laden/starten, +# damit die Aenderung sicher greift: +# systemctl restart postfwd2 +# - Diese Datei wird per 'cidr:' Lookup direkt in postfwd.cf +# referenziert, siehe Regel 'HIGH_RATE_CLIENT_ADDR'. +# ============================================================ diff --git a/roles/common/files/mx.warenform.de/etc/postfix/postfwd.high-rate-number-messages b/roles/common/files/mx.warenform.de/etc/postfix/postfwd.high-rate-number-messages new file mode 100644 index 0000000..df6cc67 --- /dev/null +++ b/roles/common/files/mx.warenform.de/etc/postfix/postfwd.high-rate-number-messages @@ -0,0 +1,19 @@ +# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] *** + +# --- +# SASL Users are allowed to send up to 500 messages per hour +# +# This file is called with '=='. This means perl regexp is NOT possible +# +# +# example: +# +# # give sasl usernames here +# # +# ckubu@oopen.de +# +# --- + +# give sasl usernames here +buchsys@sprachenatelier-berlin.de + diff --git a/roles/common/files/mx.warenform.de/etc/postfix/postfwd.high_rate_hostname b/roles/common/files/mx.warenform.de/etc/postfix/postfwd.high_rate_hostname new file mode 100644 index 0000000..d124692 --- /dev/null +++ b/roles/common/files/mx.warenform.de/etc/postfix/postfwd.high_rate_hostname @@ -0,0 +1,40 @@ +# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] *** + +# ============================================================ +# Whitelist fuer erhoehtes Rate-Limit (100 Nachrichten/Minute) +# auf Basis des Client-Hostnamens (Reverse-DNS/PTR-Eintrag), +# statt der Standard-Grenze von 50/Minute aus RATE_CLIENT_ADDR +# +# Format: PCRE-regulaerer Ausdruck pro Zeile (kein Wildcard/Glob!), +# postfwd2 vergleicht jede Zeile gegen den von Postfix aufgeloesten +# 'client_name'-Wert (PTR-Eintrag der Client-IP). +# Leerzeilen und Zeilen, die mit '#' beginnen, werden ignoriert. +# +# Beispiele: +# /^buchsys3\.buchsys\.de$/ -> nur dieser eine Hostname +# /\.buchsys\.de$/ -> alle Subdomains von buchsys.de +# (z.B. buchsys3.buchsys.de, +# mail.buchsys.de, etc.) +# +# WICHTIG: +# - Diese Regel greift NUR, wenn Reverse-DNS fuer die jeweilige +# IP sauber konfiguriert ist und der PTR-Eintrag auf das Muster +# passt. Pruefe den tatsaechlichen 'client_name'-Wert vorher in +# den postfwd2-Logs. +# - Ein zu breites Muster (z.B. /buchsys\.de/ ohne Anker) kann auch +# unerwuenschte Hosts matchen (z.B. "evil-buchsys.de.attacker.com"). +# Deshalb immer mit '^' und '$' bzw. '\.' vor der Domain arbeiten. +# - Jeder hier gematchte Hostname umgeht das strengere 50er-Limit +# und erlaubt bis zu 100 Nachrichten/Minute. Bitte nur Muster +# eintragen, denen du tatsaechlich vertraust. +# - Nach Aenderungen an dieser Datei postfwd2 neu laden/starten: +# systemctl restart postfwd2 +# - Diese Datei wird per 'pcre:' Lookup direkt in postfwd.cf +# referenziert, siehe Regel 'HIGH_RATE_CLIENT_NAME'. +# - Die IP-basierte Regel (HIGH_RATE_CLIENT_ADDR) ist zuverlaessiger +# und sollte die primaere Loesung sein; diese Hostname-Regel +# eignet sich vor allem als Ergaenzung bei wechselnden IPs. +# ============================================================ + +/^buchsys3\.buchsys\.de$/ +/^www\.buchsys\.de$/ diff --git a/roles/common/files/mx.warenform.de/etc/postfix/postfwd.high_rate_ip b/roles/common/files/mx.warenform.de/etc/postfix/postfwd.high_rate_ip new file mode 100644 index 0000000..ca4ae87 --- /dev/null +++ b/roles/common/files/mx.warenform.de/etc/postfix/postfwd.high_rate_ip @@ -0,0 +1,35 @@ +# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] *** + +# ============================================================ +# Whitelist fuer erhoehtes Rate-Limit (100 Nachrichten/Minute) +# statt der Standard-Grenze von 50/Minute aus RATE_CLIENT_ADDR +# +# Hier werden IP-Adressen bzw. CIDR-Netze von vertrauenswuerdigen +# Absende-Systemen eingetragen, die routinemaessig hoehere +# Mailmengen ueber eine feste Absender-IP verschicken, z. B. +# Kunden-Mailserver, angebundene Fachanwendungen/Buchungssysteme, +# Newsletter- oder Transaktionsmail-Versender. +# +# Format: eine IP-Adresse oder ein CIDR-Netz pro Zeile. +# Leerzeilen und Zeilen, die mit '#' beginnen, werden ignoriert. +# IPv4 und IPv6 werden unterstuetzt. +# +# Beispiele: +# 116.202.85.120 +# 203.0.113.0/24 +# +# WICHTIG: +# - Jede hier eingetragene IP umgeht das strengere 50er-Limit +# und darf bis zu 100 Nachrichten/Minute senden. Bitte nur +# IPs eintragen, denen du tatsaechlich vertraust (kompromittierte +# oder falsch eingetragene Systeme koennten sonst zum offenen +# Spam-Verteiler werden). +# - Nach Aenderungen an dieser Datei postfwd2 neu laden/starten, +# damit die Aenderung sicher greift: +# systemctl restart postfwd2 +# - Diese Datei wird per 'cidr:' Lookup direkt in postfwd.cf +# referenziert, siehe Regel 'HIGH_RATE_CLIENT_ADDR'. +# ============================================================ + +# www.buchsys.de +116.202.85.120 diff --git a/roles/common/files/mx.warenform.de/root/.ssh/mx.warenform-id_rsa-opendkim b/roles/common/files/mx.warenform.de/root/.ssh/mx.warenform-id_rsa-opendkim new file mode 100644 index 0000000..b27ca2b --- /dev/null +++ b/roles/common/files/mx.warenform.de/root/.ssh/mx.warenform-id_rsa-opendkim @@ -0,0 +1,51 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIJKAIBAAKCAgEAquVzjpidmKqq1AhSB1TvzA9fpXWBLmhbGyiaxr7Rq987+CZd ++aDKCBI11CCHlKmWu7/SXIGFFrHENvKip+KqsfHSKp6R5cgklnc+ok+UXZuBMegK +jX9/XmD48xF2/m+p8NOGWfVxiOiXrFPvvcRX9AD/qB318uUyjvcknUJ03NeAdB72 +1u7yFIcOMLOBiVUQgguTPkB+QPMSnF5uOLqrmocLsKfHsSg4RRVN01BEKORw6f12 +JImep/yaFvVu3XmSctl7q7QtAIAobats7VUJgRxHSf31phc1pQBXWJdz3lVehfCr +HBYM09FbskIBMmOlBz4mU2cU64jnYsqQNgs8fH9Ix0VCkhKM1EichoSNDqc1TTKo +yNHnfTkreuOWPxa+b8/FBqd/d4I8QLev7h3AzNJtq1ssINRgMmkSsJPEKq1qKriZ ++ZE19TXcb6RvNeOvYokr6dtwdTYE3bIZiaffJz1CeRzsr6YJ9ItzHGubKllsIS2n +yrYXP2X6ubCAyAi6n+hubN/scUqKPPby6B0hTSzguYSBLtHtsHtS7LWtbPkfDEv7 +pS9mleMMB/PiYLOh2tmGNeTn3B2OglTFYWqe1miyeB/FNsIgC1+zbMSReufWTxDk +cmVGjg3kIuuv0DlnVmZZjvmAhXbGyi/xHuXkl1YOdCYVFdzxnqN991LGboECAwEA +AQKCAgBDSDboqzlQw9ChzezNqikGw/66G7sSVE+aL7BQEwxliGwJ1MEm6KDh8Jl0 +vKHka6hGnszpUqzdNHu1zm0vf9QIXtaJpQh32QZenu/v4zjcab7BsUOGVe4FcFRT +Dks0/S2A/SZmAHYEmt4sIJfAtK6UCFifDbypNodjNfYaW/G6iLWwAgjYshZo8osp +rWKQeQcYzAnadnW+iHSJT7xBZWzuV8DIeiXqn5UXzb1oNq+/EcFKvllnJS9rn83i +wBo35Ac+ZFWGUldtXQeNtfIatmIZjNKcVPoDvBuIrMu2u1oI7L9cKFaVpjDCrChX +1Bi4h/aPFW7tYyYfXTUL9gg03tOe44GyO4/3LMrijHV6chYKtzPdv9Kq7TKfWi63 +dyyi4W/3c7A8cWizyQwroJjN7aiFTokKXlj6TbgcbTByt5tsk2ItwMH1TwD55tpu +Uqf2vSA4PvPLw3EtGaRlBqD5OvgktH4SR/IsuCd5GRVRGUslU6T0OOzlWHMZBB16 +2d/pBrHNW3toL2jeAXxDmGPZVgK5+CLqC88bKO0lO3d8HbnSW5WBDiP5wIuNA8R2 +MRBsOwCd+PK/hqxCXWjsCNFmXLgSSJRP4aX0TvFbs06IV371f5I7LiBj5yL68oEz +dhUc+AVTFrGPTAHR/mXhevVYpNXeUUhUrkVr6spS80FfgO7tgQKCAQEA2anb3vAB +WsjuK++K29N3msqapt6SO+rA927ySpXEkM5AEf8+71b1RoEtJK9qrZ5Iy6JYrZgb +XZIycDllq7UURWej3dAPJeT4Wyy4tv+zX90GoJE2QMShnNf4jjkVtfiZ7v2qFly/ +nn5ieGXNRGF1I1m1AMK93GdlXY/HDuPLf+OEedzKeEdlQC2/WyOE6sqZwE5BBAOn +2jvr2WmxTDxoFCV4UpZ7qPcQWVasH6Csaj4lXfMLjSMKnHwOCQmrO4qlDxChKcdw +4vQyKDU+XQxQ4puxbD123ZtD/3BqcoTA8EgnpsZlTcqLZeXlQxWZP2UVKii99xC3 +u4tCP37BnGu/qQKCAQEAyP7ssmZ2AEXCwe51FdbPupOlE1D7eUIpfKGMzjiOOhus +qLjIClac7NqFhwMlu5hL9VkxyKGbjYVzbZQ39Jk8Ua20Z+XvF7uoLx3py5Rxxq8+ +DW7rfaaaM/qa73hlOL9xniuozplqihzuXFRi826BSwEFbWUEit1MZfl+S7QYWVjD +eR41YIKvHDe629mwXn1bJum4biTCCoXVS3xgDPjEY60xwLZNk1IoYTuoznTO3Nt+ +dhIywx+19v0gzBsggPfn7En9AEqqqFPOiM8WHaFU+earsFMQfUMrhcThatr7JzTc +R2WK96P6lGbl6LjMzp3MRnYSqvpYS13FciRed7lfGQKCAQARFMJbaWxBypjeO8si +2yJ8tD+Ursy9BPwlrsA22C/3ySfAAc7Xi3RuFv8K7PUrMMu3p0LcRJ6JJkrtAaQX +6Hrxw2NZqdU2fRR8WzMXsVNLR5YYjay7QnMIUu5/gr1QbXTvC1sIrDihYHurxRlp +r1g48PZCXAX4QOj0ga72XSwAGkOwKIJ/E+M/ORfWOCBbKJEORVXW0c6fUqp8gk3W +lLr6McKSgJqttM3EpQeW583//GaES+lxJvnTM+0KCoc0gfnYB88N70fNl6pD+4Gs +XaYPUnaG7v/f/ipE5naEDCTz9kWeUd1rUGTGF1d5fz1qey1BBLd7pwU0I4aMYw8g +jlgZAoIBAQCgr/03Wua3rQ3Y0PTWMtf7x5HPcYy6EoTsWJMjQt+h4QIWGTQD396x +FLpvh7qg0U7YpShBx8F+UNRJJJffeqpYelCiR5bwGFyK3pVM5i5Xsz4eqzClUY4y +RAWdsVjrF1KUKz9XfBtKs3p0YhqBlzTSa8yU+o+5HNa5J88qYp6cv3P23om50ICC +RKOko9J2mC1JXMzPcZ+Xngs5wANiG3eWYJ5H/Pbj8mjJ41I/S+8dbnUZm87tY+qr +vQ59XqqLsKW/qB8WHpt02xthEH4TzikLaLiVzLKAEjU3SoEUVmE3pPD+O1XwSS5J +ekIP3b4O6OSo6DhgbKguCJeTezPy70XxAoIBAH8+SK4eaw7EUWAkxY4VDuP+VEOh +VI80/lmPaPRzaYHodpKMVX27mYqU03n8VqE8Tu1DI0DAKcDAB28hPTdbbJ21oSGr +9sJa3lSuOC/TVv/Q3nVUCTO+EaJ/qTjJQDukDWW4pQCfMJANRszlyQ+tJ46/4ofI +MqTiWbKZj32xUw/dY+XH2ZRYOQvndT8kpxBTUuGPPJliZ1YaO+9hhUGBlhrcrU7y +Uq7xVrG3MBn0I6ibwRGy+zo82ZZIrblMT+Fz3jQVjQzyIKiQvph+8QivFWThR+ej +K2S7h4A/UD69jkIy5nDVGEmL8cMS2Wgn3RAwyS5c7aUaVS+F93zzw2cyx1E= +-----END RSA PRIVATE KEY----- diff --git a/roles/common/files/mx.warenform.de/root/.ssh/mx.warenform-id_rsa-opendkim.pub b/roles/common/files/mx.warenform.de/root/.ssh/mx.warenform-id_rsa-opendkim.pub new file mode 100644 index 0000000..61139c2 --- /dev/null +++ b/roles/common/files/mx.warenform.de/root/.ssh/mx.warenform-id_rsa-opendkim.pub @@ -0,0 +1 @@ +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCq5XOOmJ2YqqrUCFIHVO/MD1+ldYEuaFsbKJrGvtGr3zv4Jl35oMoIEjXUIIeUqZa7v9JcgYUWscQ28qKn4qqx8dIqnpHlyCSWdz6iT5Rdm4Ex6AqNf39eYPjzEXb+b6nw04ZZ9XGI6JesU++9xFf0AP+oHfXy5TKO9ySdQnTc14B0HvbW7vIUhw4ws4GJVRCCC5M+QH5A8xKcXm44uquahwuwp8exKDhFFU3TUEQo5HDp/XYkiZ6n/JoW9W7deZJy2XurtC0AgChtq2ztVQmBHEdJ/fWmFzWlAFdYl3PeVV6F8KscFgzT0VuyQgEyY6UHPiZTZxTriOdiypA2Czx8f0jHRUKSEozUSJyGhI0OpzVNMqjI0ed9OSt645Y/Fr5vz8UGp393gjxAt6/uHcDM0m2rWywg1GAyaRKwk8QqrWoquJn5kTX1NdxvpG81469iiSvp23B1NgTdshmJp98nPUJ5HOyvpgn0i3Mca5sqWWwhLafKthc/Zfq5sIDICLqf6G5s3+xxSoo89vLoHSFNLOC5hIEu0e2we1Lsta1s+R8MS/ulL2aV4wwH8+Jgs6Ha2YY15OfcHY6CVMVhap7WaLJ4H8U2wiALX7NsxJF659ZPEORyZUaODeQi66/QOWdWZlmO+YCFdsbKL/Ee5eSXVg50JhUV3PGeo333UsZugQ== root@mx diff --git a/roles/common/files/mx.warenform.de/root/bin/monitoring/conf/check_cert_for_dovecot.conf b/roles/common/files/mx.warenform.de/root/bin/monitoring/conf/check_cert_for_dovecot.conf new file mode 100644 index 0000000..63bc895 --- /dev/null +++ b/roles/common/files/mx.warenform.de/root/bin/monitoring/conf/check_cert_for_dovecot.conf @@ -0,0 +1,134 @@ +# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] *** + +#--------------------------------------- +#----------------------------- +# Settings for script check_cert_for_dovecot.sh +#----------------------------- +#--------------------------------------- + +# - service_domain +# - +# - The main domain for which the certificate was issued +# - +# - Example: +# - service_domain="a.mx.oopen.de" +# - service_domain="mail.cadus.org" +# - service_domain="mx.warenform.de" +# - +#service_domain="" +service_domain="mx.warenform.de" + +# - service_name +# - +# - Name of service. +# - +# - Note: this var will also be used to determin systemd service file +# - or sysVinit script. +# - +# - Example: +# - service_name="Mumble" +# - service_name="Prosody" +# - +# - Defaults to: +# - service_name="Dovecot" +# - +#service_name="" + + +# - check_string_ps +# - +# - String wich (clearly) identifies the service at the process list (ps) +# - +# - Example: +# - check_string_ps="[[:digit:]]\ /usr/sbin/murmurd" +# - check_string_ps="" +# - +# - Defaults to: +# - check_string_ps="[[:digit:]]\ /usr/local/dovecot-[[:digit:]]{1,2}\.[[:digit:]]{1,2}\.[[:digit:]]{1,2}(\.[[:digit:]]{1,2})?/sbin/dovecot" +# - +#check_string_ps="" + + +# - service_user +# - +# - User under which the service is running. +# - +# - Example: +# - service_user="mumble-server" +# - service_user="prosody" +# - +# - Defaults to: +# - service_user="prosody" +# - +#service_user="" + + +# - service_group +# - +# - Group under which the service is running. +# - +# - Example: +# - service_group="mumble-server" +# - service_group="prosody" +# - +# - Defaults to: +# - service_group="prosody" +# - +#service_group="" + + +# - cert_installed +# - +# - Locataion of certificate read by service +# - +# - Example: +# - cert_installed="/var/lib/mumble-server/fullchain.pem" +# - cert_installed="/var/lib/dehydrated/certs/jabber.so36.net/fullchain.pem" +# - +# - Defaults to: +# - /etc/dovecot/ssl/mailserver.crt +# - +#cert_installed="" + + +# - key_installed +# - +# - Location of the key read by service +# - +# - Example: +# - key_installed="/var/lib/mumble-server/privkey.pem" +# - key_installed="/etc/prosody/certs/privkey_jabber.so36.pem" +# - +# - Defaults to: +# - /etc/dovecot/ssl/mailserver.key +# - +#key_installed="" + + +# - cert_newest +# - +# - Location of the newest certificate. +# - +# - Example: +# - cert_newest="/var/lib/dehydrated/certs/il-mumble.oopen.de/fullchain.pem" +# - cert_newest="/var/lib/dehydrated/certs/jabber.so36.net/fullchain.pem" +# - +# - Defaults to: +# - /var/lib/dehydrated/certs/${service_domain}/fullchain.pem +# - +#cert_newest="" + + +# - key_newest +# - +# - Location of the newest Key +# - +# - Example: +# - key_newest="/var/lib/dehydrated/certs/il-mumble.oopen.de/privkey.pem" +# - key_newest="/var/lib/dehydrated/certs/jabber.so36.net/privkey.pem" +# - +# - Defaults to: +# - /var/lib/dehydrated/certs/${service_domain}/privkey.pem +# - +#key_newest="" + diff --git a/roles/common/files/mx.warenform.de/root/bin/postfix/conf/create_opendkim_key.conf b/roles/common/files/mx.warenform.de/root/bin/postfix/conf/create_opendkim_key.conf new file mode 100644 index 0000000..bab2125 --- /dev/null +++ b/roles/common/files/mx.warenform.de/root/bin/postfix/conf/create_opendkim_key.conf @@ -0,0 +1,174 @@ +# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] *** + +# --------------------------------------------------------- +# - Parameter Settings for script 'create_opendkim_key.sh'. +# --------------------------------------------------------- + + +# ---------- +# DNS Server +# ---------- + +# - dns_dkim_zone_master_server +# - +# - The DNS Server who is serving the update zone and is used +# - for the dynamic updates (nsupdate) +# - +dns_dkim_zone_master_server="dns0.warenform.de" + +# - update_dns +# - +# - Possible Values are 'true' or 'false' +# - +#update_dns="" + +# - update_zone +# - +# - Zone containing the DKIM TXT record. +# - +# - Defaults to '_domainkey.' +# - +# - Note: +# - do NOT change/set this option unless you know what you do. +# - +#update_zone="" + +# - TTL +# - +# - TTL for the DKIM TXT Record. +# - +# - Defaults to "" if update_dns=false +# - Defaults to "43200" if update_dns=true +# +#TTL="" + + +# ---------- +# TSIG Key +# ---------- + +# - key_secret +# - +# - Sectret Key used by 'nsupdate' to create/update the +# - DKIM TXT record. +# - +# - Example: +# - key_secret="EtvvMdW0PXD4GMHP+onuHZ0dT/Z8OSJGlce/xH10OwI=" +# - +#key_secret="" +key_secret="qG9e/gOucCXcwVUTU+uewU0Yth1iJh2JHgnogrHvh2A=" + +# - key_algo +# - +# - The key algorithm used for key creation. Available choices are: hmac-md5, +# - hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384 and hmac-sha512. The +# - default is hmac-sha256. Options are case-insensitive. +# - +# - Example: +# - key_algo="hmac-md5" +# - +# - Defaults to 'hmac-sha256' +# - +#key_algo="hmac-sha256" + +# - key_name +# - +# - Name of the Key +# - +# - Defaults to "$update_zone" +# - +#key_name= +key_name="update-dkim" + + +# ---------- +# Access Credentials DNS Server +# ---------- + +# - dns_ssh_user +# - +# - Defaults to 'manage-bind' +# - +#dns_ssh_user="manage-bind" + +# - dns_ssh_port +# - +# - Defaults to '22' +# - +#dns_ssh_port=22 + +# - dns_ssh_key +# - +# - Defaults to '/root/.ssh/id_rsa-opendkim' +# - +#dns_ssh_key="/root/.ssh/id_rsa-opendkim" + + +# ---------- +# Scripts envoked at DNS Server +# ---------- + +# - set_new_serial_script +# - +# - Script increases the serial for a given domain or a given +# - hostname's concerning domain. +# - +# - Defaults to '/root/bin/bind/bind_set_new_serial.sh' +# - +#set_new_serial_script="/root/bin/bind/bind_set_new_serial.sh" + +# - create_dkim_delegation_script +# - +# - Script adds DKIM subdomain delegation for a given domain +# - +# - Defaults to '/root/bin/bind/bind_create_dkim_delegation.sh' +# - +#create_dkim_delegation_script="/root/bin/bind/bind_create_dkim_delegation.sh" + +# - add_dkim_zone_master_script +# - +# - Script adds zone _domainkey. as master zone +# - +# - Defaults to '/root/bin/bind/bind_add_dkim_zone_master.sh' +# - +#add_dkim_zone_master_script="/root/bin/bind/bind_add_dkim_zone_master.sh" + +# - add_dkim_zone_slave_script +# - +# - Script adds zone _domainkey. as slave zone +# - +# - Defaults to '/root/bin/bind/bind_add_dkim_zone_slave.sh' +# - +#add_dkim_zone_slave_script="/root/bin/bind/bind_add_dkim_zone_slave.sh" + + + +# ---------- +# OpenDKIM Installation +# ---------- + +# - opendkim_dir +# - +# - OpenDKIM's etc-directory +# - +# - Defaults to opendkim_dir="/etc/opendkim" +# - +#opendkim_dir="/etc/opendkim" + +# - key_base_dir +# - +# - Defaults to "${opendkim_dir}/keys" +# - +#key_base_dir=${opendkim_dir}/keys + +# - signing_table_file +# - +# - Defaults to "${opendkim_dir}/signing.table" +# - +#signing_table_file="${opendkim_dir}/signing.table" + +# - key_table_file +# - +# - Defaults to "${opendkim_dir}/key.table" +# - +#key_table_file="${opendkim_dir}/key.table" diff --git a/roles/common/files/mx.warenform.de/root/bin/postfix/conf/postfix_add_mailboxes.conf b/roles/common/files/mx.warenform.de/root/bin/postfix/conf/postfix_add_mailboxes.conf new file mode 100644 index 0000000..206a802 --- /dev/null +++ b/roles/common/files/mx.warenform.de/root/bin/postfix/conf/postfix_add_mailboxes.conf @@ -0,0 +1,86 @@ +# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] *** + +# ---------------------------------------------------- +# --- +# - Parameter Settings for script 'postfix_add_mailboxes.sh'. +# --- +# ---------------------------------------------------- + +# - dovecot_enc_method +# - +# - The (dovecot) password scheme which should be used to generate the hashed +# - passwords of EXISTING users. +# - +# - Possible values are: +# - +# - See output of 'doveadm pw -l' +# - +# - DEFAULTS to: dovecot_enc_method="SHA512-CRYPT" +# - +#dovecot_enc_method="SHA512-CRYPT" + +# - in_file +# - +# - The file from wich the script reads the e-mail-address/password +# - kombination(s). Each line in this file must only contain +# - +# - +# - Defaults to: in_file="${conf_dir}/mailboxes_new.lst" +# - +#in_file="${conf_dir}/mailboxes_new.lst" + +# - db_type +# - +# - Type of Postfix Database +# - +# - Possible values are 'pgsql' (PostgeSQL) or 'mysql' (MySQL) +# - +# - Defaults to: db_type="pgsql" +# - +#db_type="pgsql" + +# - db_name +# - +# - Database name for the postfix database +# - +# - Defaults to: db_name="postfix" +# - +#db_name="postfix" + +# - db_name +# - +# - Database name for the postfix database +# - +# - Defaults to: db_name="postfix" +# - +#db_name="postfix" + +# - mysql_credential_args (root access to MySQL Database) +# - +# - Example +# - mysql_credential_args="--login-path=local" +# - mysql_credential_args="--defaults-file=/etc/mysql/debian.cnf" (Debian default) +# - mysql_credential_args="--defaults-file=/usr/local/mysql/sys-maint.cnf" +# - +# - Defaults to: +# - '--defaults-file=/etc/mysql/debian.cnf' if MySQL is installed from debian package system +# - '--defaults-file=/usr/local/mysql/sys-maint.cnf' otherwise +# - +#mysql_credential_args="" + +# - quota +# - +# - The quota setting for the new mailboxes. +# - +# - Defaults to: quota="536870912" +# - +#quota="536870912" +quota=2147483648 + +# - log_file +# - +# - Where to write logging informations? +# - +# - Defaults to: log_file="${script_dir}/log/postfix_add_mailboxes.log" +# - +#log_file="${script_dir}/log/postfix_add_mailboxes.log" diff --git a/roles/common/files/mx.warenform.de/root/bin/postfix/conf/sent_userinfo_postfix.conf b/roles/common/files/mx.warenform.de/root/bin/postfix/conf/sent_userinfo_postfix.conf new file mode 100644 index 0000000..e80975b --- /dev/null +++ b/roles/common/files/mx.warenform.de/root/bin/postfix/conf/sent_userinfo_postfix.conf @@ -0,0 +1,92 @@ +# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] *** + +# ---------------------------------------------------- +# --- +# - Parameter Settings for script 'sent_userinfo_postfix.sh'. +# --- +# ---------------------------------------------------- + +# - message_body_file +# - +# - Full path to file containing the user info. This file must contain +# - the message body WITHOUT e-mail headers. If file is placed in the +# - 'files' directory use '${file_dir}/' +# - +# - Defaults to '${file_dir}/sent_userinfo_postfix.message' +# - +#message_body_file="${file_dir}/sent_userinfo_postfix.email" + + +# - email_from +# - +# - From Address of user info +# - +# - Example: 'oo@oopen.de' +# - +email_from="admin@warenform.net" + + +# - email_from_org +# - +# - Example: email_from_org="O.OPEN" +# - +email_from_org="WARENFORM" + + +# - db_type +# - +# - Type of Postfix Database +# - +# - Possible values are 'pgsql' (PostgeSQL) or 'mysql' (MySQL) +# - +# - Defaults to: db_type="pgsql" +# - +#db_type="pgsql" + +# - db_name +# - +# - Database name for the postfix database +# - +# - Defaults to: db_name="postfix" +# - +#db_name="postfix" + +# - mysql_credential_args (root access to MySQL Database) +# - +# - Example +# - mysql_credential_args="--login-path=local" +# - mysql_credential_args="--defaults-file=/etc/mysql/debian.cnf" (Debian default) +# - mysql_credential_args="--defaults-file=/usr/local/mysql/sys-maint.cnf" +# - +# - Defaults to: +# - '/etc/mysql/debian.cnf' if MySQL is installed from debian package system +# - '/usr/local/mysql/sys-maint.cnf' otherwise +# - +#mysql_credential_args="" + + +# - mail_user +# - +# - The owner of the mailbox directories and within the e-mails itself. +# - +# - defaults to mail_user="vmail" +# - +#mail_user="vmail" + + +# - mail_group +# - +# - The group of the mailbox directories +# - +# - defaults to mail_group="vmail" +# - +#mail_group="vmail" + + +# - mail_basedir - No more needed! +# - +# - The root directory where all mailbox-domains are located. +# - +# - Defaults to '/var/vmail'. +# - +#mail_basedir=/var/vmail diff --git a/roles/common/files/mx.warenform.de/root/bin/postfix/conf/whitelist_mb_sigs.conf b/roles/common/files/mx.warenform.de/root/bin/postfix/conf/whitelist_mb_sigs.conf new file mode 100644 index 0000000..11c60fa --- /dev/null +++ b/roles/common/files/mx.warenform.de/root/bin/postfix/conf/whitelist_mb_sigs.conf @@ -0,0 +1,44 @@ +# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] *** + +# ====================================================== +# --- +# Parameter Settings for Script 'whitelist_mb_sigs.conf' +# --- +# ====================================================== + +# QUARANTINE_BASE_DIR +# +# Base directory where amavis stores quarantined e-mails, mostly in +# +# virus e-mails: $QUARANTINE_BASE_DIR/virus +# spam emails: $QUARANTINE_BASE_DIR/spam +# .. +# +# Defaults to: +# QUARANTINE_BASE_DIR="/var/QUARANTINE" +# +#QUARANTINE_BASE_DIR="/var/QUARANTINE" + + +# CLAMAV_VIRUS_WHITE_LIST +# +# Full path to clamav's (personal) white list file +# +# Defaults to: +# CLAMAV_VIRUS_WHITE_LIST="/var/lib/clamav/my_whitelist.ign2" +# +#CLAMAV_VIRUS_WHITE_LIST="/var/lib/clamav/my_whitelist.ign2" + + +# WHITE_LIST_STRINGS +# +# A blank separated list of strings to whitelist. +# +# Example: +# WHITE_LIST_STRINGS="google.com tinyurl.com" +# +# Defaults to: +# WHITE_LIST_STRINGS="google.com" +# +#WHITE_LIST_STRINGS="google.com" +WHITE_LIST_STRINGS="google.com tinyurl.com" diff --git a/roles/common/files/mx.warenform/etc/postfix/postfwd.high-rate-number-messages b/roles/common/files/mx.warenform/etc/postfix/postfwd.high-rate-number-messages new file mode 100644 index 0000000..df6cc67 --- /dev/null +++ b/roles/common/files/mx.warenform/etc/postfix/postfwd.high-rate-number-messages @@ -0,0 +1,19 @@ +# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] *** + +# --- +# SASL Users are allowed to send up to 500 messages per hour +# +# This file is called with '=='. This means perl regexp is NOT possible +# +# +# example: +# +# # give sasl usernames here +# # +# ckubu@oopen.de +# +# --- + +# give sasl usernames here +buchsys@sprachenatelier-berlin.de + diff --git a/roles/common/files/mx.warenform/etc/postfix/postfwd.high_rate_hostname b/roles/common/files/mx.warenform/etc/postfix/postfwd.high_rate_hostname new file mode 100644 index 0000000..d124692 --- /dev/null +++ b/roles/common/files/mx.warenform/etc/postfix/postfwd.high_rate_hostname @@ -0,0 +1,40 @@ +# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] *** + +# ============================================================ +# Whitelist fuer erhoehtes Rate-Limit (100 Nachrichten/Minute) +# auf Basis des Client-Hostnamens (Reverse-DNS/PTR-Eintrag), +# statt der Standard-Grenze von 50/Minute aus RATE_CLIENT_ADDR +# +# Format: PCRE-regulaerer Ausdruck pro Zeile (kein Wildcard/Glob!), +# postfwd2 vergleicht jede Zeile gegen den von Postfix aufgeloesten +# 'client_name'-Wert (PTR-Eintrag der Client-IP). +# Leerzeilen und Zeilen, die mit '#' beginnen, werden ignoriert. +# +# Beispiele: +# /^buchsys3\.buchsys\.de$/ -> nur dieser eine Hostname +# /\.buchsys\.de$/ -> alle Subdomains von buchsys.de +# (z.B. buchsys3.buchsys.de, +# mail.buchsys.de, etc.) +# +# WICHTIG: +# - Diese Regel greift NUR, wenn Reverse-DNS fuer die jeweilige +# IP sauber konfiguriert ist und der PTR-Eintrag auf das Muster +# passt. Pruefe den tatsaechlichen 'client_name'-Wert vorher in +# den postfwd2-Logs. +# - Ein zu breites Muster (z.B. /buchsys\.de/ ohne Anker) kann auch +# unerwuenschte Hosts matchen (z.B. "evil-buchsys.de.attacker.com"). +# Deshalb immer mit '^' und '$' bzw. '\.' vor der Domain arbeiten. +# - Jeder hier gematchte Hostname umgeht das strengere 50er-Limit +# und erlaubt bis zu 100 Nachrichten/Minute. Bitte nur Muster +# eintragen, denen du tatsaechlich vertraust. +# - Nach Aenderungen an dieser Datei postfwd2 neu laden/starten: +# systemctl restart postfwd2 +# - Diese Datei wird per 'pcre:' Lookup direkt in postfwd.cf +# referenziert, siehe Regel 'HIGH_RATE_CLIENT_NAME'. +# - Die IP-basierte Regel (HIGH_RATE_CLIENT_ADDR) ist zuverlaessiger +# und sollte die primaere Loesung sein; diese Hostname-Regel +# eignet sich vor allem als Ergaenzung bei wechselnden IPs. +# ============================================================ + +/^buchsys3\.buchsys\.de$/ +/^www\.buchsys\.de$/ diff --git a/roles/common/files/mx.warenform/etc/postfix/postfwd.high_rate_ip b/roles/common/files/mx.warenform/etc/postfix/postfwd.high_rate_ip new file mode 100644 index 0000000..ca4ae87 --- /dev/null +++ b/roles/common/files/mx.warenform/etc/postfix/postfwd.high_rate_ip @@ -0,0 +1,35 @@ +# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] *** + +# ============================================================ +# Whitelist fuer erhoehtes Rate-Limit (100 Nachrichten/Minute) +# statt der Standard-Grenze von 50/Minute aus RATE_CLIENT_ADDR +# +# Hier werden IP-Adressen bzw. CIDR-Netze von vertrauenswuerdigen +# Absende-Systemen eingetragen, die routinemaessig hoehere +# Mailmengen ueber eine feste Absender-IP verschicken, z. B. +# Kunden-Mailserver, angebundene Fachanwendungen/Buchungssysteme, +# Newsletter- oder Transaktionsmail-Versender. +# +# Format: eine IP-Adresse oder ein CIDR-Netz pro Zeile. +# Leerzeilen und Zeilen, die mit '#' beginnen, werden ignoriert. +# IPv4 und IPv6 werden unterstuetzt. +# +# Beispiele: +# 116.202.85.120 +# 203.0.113.0/24 +# +# WICHTIG: +# - Jede hier eingetragene IP umgeht das strengere 50er-Limit +# und darf bis zu 100 Nachrichten/Minute senden. Bitte nur +# IPs eintragen, denen du tatsaechlich vertraust (kompromittierte +# oder falsch eingetragene Systeme koennten sonst zum offenen +# Spam-Verteiler werden). +# - Nach Aenderungen an dieser Datei postfwd2 neu laden/starten, +# damit die Aenderung sicher greift: +# systemctl restart postfwd2 +# - Diese Datei wird per 'cidr:' Lookup direkt in postfwd.cf +# referenziert, siehe Regel 'HIGH_RATE_CLIENT_ADDR'. +# ============================================================ + +# www.buchsys.de +116.202.85.120 diff --git a/roles/common/tasks/copy_files.yml b/roles/common/tasks/copy_files.yml index f85f5d4..c850ec6 100644 --- a/roles/common/tasks/copy_files.yml +++ b/roles/common/tasks/copy_files.yml @@ -35,7 +35,31 @@ - copy-files - copy-plain-files -- name: (copy_files.yml) Copy plain files Postfix (/etc/postfix) +- name: (copy_files.yml) HOST-TREE precheck host specific source directory on controller + ansible.builtin.stat: + path: "{{ role_path }}/files/{{ inventory_hostname }}" + delegate_to: localhost + become: false + register: common_host_dir + when: + - inventory_hostname in groups['mail_server'] + tags: + - copy-files + - copy-plain-files + +- name: (copy_files.yml) HOST-TREE precheck host specific template directory on controller + ansible.builtin.stat: + path: "{{ role_path }}/templates/{{ inventory_hostname }}" + delegate_to: localhost + become: false + register: common_host_template_dir + when: + - inventory_hostname in groups['mail_server'] + tags: + - copy-files + - copy-template-files + +- name: (copy_files.yml) GLOBAL copy plain files Postfix (/etc/postfix) ansible.builtin.copy: src: "{{ item.src_path }}" dest: "{{ item.dest_path }}" @@ -49,12 +73,16 @@ - inventory_hostname in groups['mail_server'] - copy_plain_files_postfix is defined - copy_plain_files_postfix|length > 0 + - not ( + common_host_dir.stat.exists and + (lookup('ansible.builtin.fileglob', role_path ~ '/files/' ~ inventory_hostname ~ item.dest_path, wantlist=True) | length > 0) + ) tags: - copy-files - copy-plain-files notify: "Reload postfwd" -- name: (copy_files.yml) Copy host specific plain files Postfix (/etc/postfix) +- name: (copy_files.yml) FALLBACK legacy copy host specific plain files Postfix (/etc/postfix) ansible.builtin.copy: src: "{{ item.src_path }}" dest: "{{ item.dest_path }}" @@ -68,12 +96,13 @@ - inventory_hostname in groups['mail_server'] - copy_plain_files_postfix_host_specific is defined - copy_plain_files_postfix_host_specific|length > 0 + - not common_host_dir.stat.exists tags: - copy-files - copy-plain-files notify: "Reload postfwd" -- name: (copy_files.yml) Copy plain files Postfix Firewall (postfwd) +- name: (copy_files.yml) GLOBAL copy plain files Postfix Firewall (postfwd) ansible.builtin.copy: src: "{{ item.src_path }}" dest: "{{ item.dest_path }}" @@ -87,12 +116,16 @@ - inventory_hostname in groups['mail_server'] - copy_plain_files_postfwd is defined - copy_plain_files_postfwd|length > 0 + - not ( + common_host_dir.stat.exists and + (lookup('ansible.builtin.fileglob', role_path ~ '/files/' ~ inventory_hostname ~ item.dest_path, wantlist=True) | length > 0) + ) tags: - copy-files - copy-plain-files notify: "Reload postfwd" -- name: (copy_files.yml) Copy host specific plain files Postfix Firewall (postfwd) +- name: (copy_files.yml) FALLBACK legacy copy host specific plain files Postfix Firewall (postfwd) ansible.builtin.copy: src: "{{ item.src_path }}" dest: "{{ item.dest_path }}" @@ -106,12 +139,65 @@ - inventory_hostname in groups['mail_server'] - copy_plain_files_postfwd_host_specific is defined - copy_plain_files_postfwd_host_specific|length > 0 + - not common_host_dir.stat.exists tags: - copy-files - copy-plain-files notify: "Reload postfwd" -- name: (copy_files.yml) Copy template files +- name: (copy_files.yml) HOST-TREE copy all host specific files by directory structure + ansible.builtin.copy: + src: "{{ role_path }}/files/{{ inventory_hostname }}/" + dest: "/" + owner: root + group: root + mode: preserve + when: + - inventory_hostname in groups['mail_server'] + - common_host_dir.stat.exists + - common_host_dir.stat.isdir + tags: + - copy-files + - copy-plain-files + notify: "Reload postfwd" + +- name: (copy_files.yml) HOST-TREE collect host specific template files by directory structure + ansible.builtin.find: + paths: "{{ role_path }}/templates/{{ inventory_hostname }}" + recurse: true + file_type: file + patterns: "*.j2" + delegate_to: localhost + become: false + register: common_host_template_files + when: + - inventory_hostname in groups['mail_server'] + - common_host_template_dir.stat.exists + - common_host_template_dir.stat.isdir + tags: + - copy-files + - copy-template-files + +- name: (copy_files.yml) HOST-TREE render host specific template files by directory structure + ansible.builtin.template: + src: "{{ item.path }}" + dest: "/{{ item.path | regex_replace('^' ~ (role_path ~ '/templates/' ~ inventory_hostname ~ '/'), '') | regex_replace('\\.j2$', '') }}" + owner: root + group: root + mode: "0644" + loop: "{{ common_host_template_files.files }}" + loop_control: + label: "dest: /{{ item.path | regex_replace('^' ~ (role_path ~ '/templates/' ~ inventory_hostname ~ '/'), '') | regex_replace('\\.j2$', '') }}" + when: + - inventory_hostname in groups['mail_server'] + - common_host_template_dir.stat.exists + - common_host_template_dir.stat.isdir + - common_host_template_files.files | length > 0 + tags: + - copy-files + - copy-template-files + +- name: (copy_files.yml) GLOBAL copy template files (variable list) ansible.builtin.template: src: "{{ item.src_path }}" dest: "{{ item.dest_path }}" @@ -124,6 +210,11 @@ when: - copy_template_files is defined - copy_template_files|length > 0 + - not ( + inventory_hostname in groups['mail_server'] and + common_host_template_dir.stat.exists and + (lookup('ansible.builtin.fileglob', role_path ~ '/templates/' ~ inventory_hostname ~ item.dest_path ~ '.j2', wantlist=True) | length > 0) + ) tags: - copy-files - copy-template-files