Important
Warden will configure postfix differently depending if you selected to install the amavisd-milter during setup. (amavisd-milter support was added as of Warden 2.03-1). When the amavisd-milter is installed Amavis will be configured as a before queue milter. When the amavisd-milter is not installed or if your operating system does not support the new amavisd-milter (Ubuntu 16) then Amavis will be configured as an after queue content filter.
Amavisd-milter Installed (Before-queue Milter - recommended)
Warden makes changes to the following lines in /etc/postfix/master.cf:
Before (lines may vary according to your servers operating system):
# SMTPS port (465)
smtps inet n - n - - smtpd -o smtpd_tls_wrappermode=yes
# submission port (587) (if enabled)
submission inet n - n - - smtpd -o smtpd_enforce_tls=yes -o smtpd_tls_security_level=may -o smtpd_sasl_auth_enable=yes -o smtpd_client_restrictions=permit_sasl_authenticated,reject -o smtpd_sender_restrictions= -o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination
After:
# SMTPS port (465)
smtps inet n - n - - smtpd
-o smtpd_tls_wrappermode=yes
-o milter_macro_daemon_name=SUBMISSION
# submission port (587) (if enabled)
submission inet n - n - - smtpd
-o smtpd_enforce_tls=yes
-o smtpd_tls_security_level=may
-o smtpd_sasl_auth_enable=yes
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination
-o milter_macro_daemon_name=SUBMISSION
# postfix-reentry
127.0.0.1:10025 inet n - - - - smtpd
-o syslog_name=postfix-reentry
-o content_filter=
-o local_recipient_maps=
-o relay_recipient_maps=
-o smtpd_restriction_classes=
-o smtpd_delay_reject=no
-o smtpd_client_restrictions=permit_mynetworks,reject
-o smtpd_helo_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,reject
-o smtpd_data_restrictions=reject_unauth_pipelining
-o smtpd_end_of_data_restrictions=
-o mynetworks=127.0.0.0/8
-o strict_rfc821_envelopes=yes
-o smtpd_error_sleep_time=0
-o smtpd_soft_error_limit=1001
-o smtpd_hard_error_limit=1000
-o smtpd_client_connection_count_limit=0
-o smtpd_client_connection_rate_limit=0
-o smtp_tls_security_level=none
-o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_milters
Warden also adds the following lines in /etc/postfix/main.cf. The amavisd-mitler will be added to the start of the smtp_milters and non_smtp_milters options (Any existing milters will be listed after). It is important that the amavisd-milter be listed first (inet:127.0.0.1:10024 is the amavisd-milter).
smtpd_milters = inet:127.0.0.1:10024,inet:127.0.0.1:12768
non_smtpd_milters = inet:127.0.0.1:10024
milter_connect_macros = j {client_name} {daemon_name} v
milter_default_action = accept
Amavisd-milter is not installed (After-Queue Content Filter - not supported)
Warden makes changes to the following lines in /etc/postfix/master.cf:
Before (lines may vary according to your servers operating system):
# pickup
pickup fifo n - n 60 1 pickup
# SMTPS port (465)
smtps inet n - n - - smtpd -o smtpd_tls_wrappermode=yes
# submission port (587) (if enabled)
submission inet n - n - - smtpd -o smtpd_enforce_tls=yes -o smtpd_tls_security_level=may -o smtpd_sasl_auth_enable=yes -o smtpd_client_restrictions=permit_sasl_authenticated,reject -o smtpd_sender_restrictions= -o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination
After:
# pickup
pickup fifo n - n 60 1 pickup
-o content_filter=smtp-amavis:[127.0.0.1]:10027
# SMTPS port (465)
smtps inet n - n - - smtpd -o smtpd_tls_wrappermode=yes -o content_filter=smtp-amavis:[127.0.0.1]:10026
# submission port (587) (if enabled)
submission inet n - n - - smtpd
-o smtpd_enforce_tls=yes
-o smtpd_tls_security_level=may
-o smtpd_sasl_auth_enable=yes
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination
-o content_filter=smtp-amavis:[127.0.0.1]:10026
# amavis
smtp-amavis unix - - - - 2 smtp
-o smtp_data_done_timeout=1200
-o smtp_send_xforward_command=yes
-o disable_dns_lookups=yes
-o max_use=20
-o smtp_tls_security_level=none
# postfix-reentry
127.0.0.1:10025 inet n - - - - smtpd
-o syslog_name=postfix-reentry
-o content_filter=
-o local_recipient_maps=
-o relay_recipient_maps=
-o smtpd_restriction_classes=
-o smtpd_delay_reject=no
-o smtpd_client_restrictions=permit_mynetworks,reject
-o smtpd_helo_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,reject
-o smtpd_data_restrictions=reject_unauth_pipelining
-o smtpd_end_of_data_restrictions=
-o mynetworks=127.0.0.0/8
-o strict_rfc821_envelopes=yes
-o smtpd_error_sleep_time=0
-o smtpd_soft_error_limit=1001
-o smtpd_hard_error_limit=1000
-o smtpd_client_connection_count_limit=0
-o smtpd_client_connection_rate_limit=0
-o receive_override_options=no_header_body_checks,no_unknown_recipient_checks
-o smtp_tls_security_level=none
Warden also adds the following lines in /etc/postfix/main.cf:
content_filter = smtp-amavis:[127.0.0.1]:10024
receive_override_options = no_address_mappingsRepair Installation
If you want the Warden installer to try and repair these files you can run the Warden installer from the command line. The installer will detect if the amavisd-milter is installed or not and should configure everything for you:
/usr/local/psa/admin/bin/modules/warden/install.sh