adelgado/ansible-role-postfix
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add blacklist to postfix

Browse source
This commit is contained in:
Antonio J. Delgado 2023-04-08 18:01:25 +03:00
parent 9328d488c2
commit daf2e31b46
2 changed files with 14 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
defaults/main.yml
View file

@ -11,6 +11,7 @@ mail_db_users_username_field: 'email'
mail_db_users_alias_field: 'alias' mail_db_users_alias_field: 'alias'
mail_db_users_quota_field: 'quota' mail_db_users_quota_field: 'quota'
dns_resolver: 1.1.1.1 dns_resolver: 1.1.1.1
postfix_blacklist: []
mail_domains: mail_domains:
- example.org - example.org
- example.net - example.net
@ -62,7 +63,7 @@ postfix_config:
smtpd_data_restrictions: reject_unauth_pipelining smtpd_data_restrictions: reject_unauth_pipelining
# Don't talk to mail systems that don't know their own hostname. # Don't talk to mail systems that don't know their own hostname.
smtpd_helo_restrictions: permit_mynetworks reject_unknown_helo_hostname smtpd_helo_restrictions: permit_mynetworks reject_unknown_helo_hostname
smtpd_recipient_restrictions: permit_mynetworks, permit_sasl_authenticated, permit_auth_destination, reject_unauth_destination, check_policy_service unix:private/policy-spf smtpd_recipient_restrictions: permit_mynetworks, permit_sasl_authenticated, permit_auth_destination, reject_unauth_destination, check_policy_service unix:private/policy-spf, check_client_access cidr:/etc/postfix/blacklist
smtpd_relay_restrictions: permit_mynetworks permit_sasl_authenticated defer_unauth_destination smtpd_relay_restrictions: permit_mynetworks permit_sasl_authenticated defer_unauth_destination
smtpd_sasl_auth_enable: 'yes' smtpd_sasl_auth_enable: 'yes'
smtpd_sasl_authenticated_header: 'yes' smtpd_sasl_authenticated_header: 'yes'

12
tasks/configure.yml
View file

@ -251,3 +251,15 @@
name: postfix name: postfix
enabled: true enabled: true
state: started state: started
- name: Ensure blacklist is present
file_line:
path: /etc/postfix/blacklist
line: "{{ item }} REJECT Blacklisted"
match: "^{{ item }} "
backup: true
create: true
loop: "{{ postfix_blacklist }}"
- name: Postmap blacklist
shell: /usr/sbin/postmap /etc/postfix/blacklist