n0mad1k
71 lines
2.1 KiB
Django/Jinja
71 lines
2.1 KiB
Django/Jinja
# Postfix MTA Front Configuration for Phishing Infrastructure
|
|
# This server acts as the front-end mail relay
|
|
|
|
# Basic settings
|
|
myhostname = {{ mta_hostname | default('mail.' + domain) }}
|
|
mydomain = {{ domain }}
|
|
myorigin = $mydomain
|
|
mydestination = $myhostname, localhost
|
|
inet_interfaces = all
|
|
inet_protocols = ipv4
|
|
|
|
# Network settings
|
|
mynetworks = 127.0.0.0/8 {{ gophish_server_ip }}/32 {{ mta_allowed_ips | default([]) | join(' ') }}
|
|
relay_domains = $mydestination
|
|
|
|
# SMTP smuggling mitigation
|
|
smtpd_forbid_bare_newline = yes
|
|
smtpd_forbid_bare_newline_reject_code = 550
|
|
|
|
# TLS Configuration
|
|
smtpd_tls_cert_file = /etc/letsencrypt/live/{{ mta_hostname | default('mail.' + domain) }}/fullchain.pem
|
|
smtpd_tls_key_file = /etc/letsencrypt/live/{{ mta_hostname | default('mail.' + domain) }}/privkey.pem
|
|
smtpd_use_tls = yes
|
|
smtpd_tls_security_level = may
|
|
smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
|
|
smtp_tls_security_level = may
|
|
|
|
# SASL Authentication
|
|
smtpd_sasl_auth_enable = yes
|
|
smtpd_sasl_type = dovecot
|
|
smtpd_sasl_path = private/auth
|
|
smtpd_sasl_security_options = noanonymous
|
|
smtpd_sasl_authenticated_header = yes
|
|
|
|
# Restrictions
|
|
smtpd_helo_required = yes
|
|
smtpd_recipient_restrictions =
|
|
permit_mynetworks,
|
|
permit_sasl_authenticated,
|
|
reject_unauth_destination,
|
|
reject_unauth_pipelining,
|
|
reject_invalid_helo_hostname,
|
|
reject_non_fqdn_helo_hostname
|
|
|
|
# Rate limiting
|
|
smtpd_client_connection_rate_limit = {{ rate_limit_connections | default(100) }}
|
|
smtpd_client_message_rate_limit = {{ rate_limit_messages | default(100) }}
|
|
|
|
# Message size and queue settings
|
|
message_size_limit = {{ max_message_size | default(10240000) }}
|
|
mailbox_size_limit = 0
|
|
queue_lifetime = 1h
|
|
maximal_queue_lifetime = 1h
|
|
bounce_queue_lifetime = 0
|
|
|
|
# Header modifications
|
|
header_checks = regexp:/etc/postfix/header_checks
|
|
|
|
# DKIM signing
|
|
milter_default_action = accept
|
|
milter_protocol = 6
|
|
smtpd_milters = unix:/var/spool/postfix/opendkim/opendkim.sock
|
|
non_smtpd_milters = unix:/var/spool/postfix/opendkim/opendkim.sock
|
|
|
|
# Logging
|
|
{% if zero_logs | default(true) %}
|
|
# Zero-logs configuration
|
|
syslog_facility = local0
|
|
syslog_name =
|
|
maillog_file = /dev/null
|
|
{% endif %} |