LJ_SSO_Part_1.tar0100600000175300017540000026400010307434771013365 0ustar jillljeditoralias.ldif0000644000076500007650000000021110302701653014120 0ustar leggettleggett00000000000000dn: cn=test-alias,ou=aliases,o=ci,dc=example,dc=com objectClass: top objectClass: nisMailAlias cn: test-alias rfc822MailMember: leggett etc/0000755000076500007650000000000010303737502012753 5ustar leggettleggett00000000000000etc/conf.d/0000755000076500007650000000000010302702173014115 5ustar leggettleggett00000000000000etc/conf.d/cyrus0000644000076500007650000000047310262514526015221 0ustar leggettleggett00000000000000# Copyright 1999-2004 Gentoo Foundation # Distributed under the terms of the GNU General Public License v2 # $Header: /var/cvsroot/gentoo-x86/net-mail/cyrus-imapd/files/cyrus.confd,v 1.1 2004/12/29 06:44:00 swegener Exp $ # Additional options for the cyrus master CYRUS_OPTS="" export KRB5_KTNAME=/etc/imap.keytab etc/conf.d/postfix0000644000076500007650000000005410302701255015533 0ustar leggettleggett00000000000000export KRB5_KTNAME=/etc/postfix/smtp.keytab etc/conf.d/saslauthd0000644000076500007650000000162010262514532016034 0ustar leggettleggett00000000000000# $Header: /var/cvsroot/gentoo-x86/dev-libs/cyrus-sasl/files/saslauthd-2.1.19.conf,v 1.1 2004/07/16 23:53:38 langthang Exp $ # Config file for /etc/init.d/saslauthd # Initial (empty) options. SASLAUTHD_OPTS="" # Specify the authentications mechanism. # *NOTE* For list see: saslauthd -v # From 2.1.19, add "-r" to options for old behavior # ie. reassemble user and realm to user@realm form. # SASLAUTHD_OPTS="${SASLAUTH_MECH} -a pam -r" SASLAUTHD_OPTS="${SASLAUTH_MECH} -a kerberos5" # Specify the hostname for remote IMAP server. # *NOTE* Only needed if rimap auth mech is used. #SASLAUTHD_OPTS="${SASLAUTHD_OPTS} -O localhost" # Specify the number of worker processes to create. #SASLAUTHD_OPTS="${SASLAUTHD_OPTS} -n 5" # Enable credential cache, cache size, and timeout. # *NOTE* Size is measured in kilobytes # Timeout is measured in seconds #SASLAUTHD_OPTS="${SASLAUTHD_OPTS} -c -s 128 -t 30" etc/conf.d/slapd0000644000076500007650000000011210262514533015143 0ustar leggettleggett00000000000000OPTS="-h 'ldap:// ldaps://'" export KRB5_KTNAME=/etc/openldap/ldap.keytab etc/conf.d/slurpd0000644000076500007650000000005410262514533015356 0ustar leggettleggett00000000000000export KRB5CCNAME=/var/run/slurpd.krb5cache etc/cron.d/0000755000076500007650000000000010302702234014127 5ustar leggettleggett00000000000000etc/cron.d/slurp-regen0000644000076500007650000000010210262514533016316 0ustar leggettleggett00000000000000#!/bin/sh KRB5CCNAME=/var/run/slurpd.krb5cache /usr/bin/kinit -k etc/cron.hourly/0000755000076500007650000000000010302702265015232 5ustar leggettleggett00000000000000etc/cron.hourly/krb5prop0000644000076500007650000000122010262514531016716 0ustar leggettleggett00000000000000#!/bin/sh # Distribute KDC database to slave servers # Created by Jason Garmon for use with MIT Kerberos 5 # Configurables slavekdcs="ldap.example.com" krb5prefix="/usr" slavedata="/etc/krb5kdc/slavedata" success=1 /usr/sbin/kdb5_util dump ${slavedata} error=$? if [ ${error} -ne 0 ]; then echo "Kerberos database dump failed with exit code ${error}." exit 1 fi for kdc in ${slavekdcs} do ${krb5prefix}/sbin/kprop -f ${slavedata} ${kdc} 2>&1 > /dev/null error=$? if [ ${error} -ne 0 ] then echo "Propagation of database to host ${kdc} failed with exit code ${error}." success=0 fi done if [ ${success} -eq 1 ] then exit 0 else exit 1 fi etc/cyrus.conf0000644000076500007650000000250410262514527014774 0ustar leggettleggett00000000000000# $Header: /var/cvsroot/gentoo-x86/net-mail/cyrus-imapd/files/cyrus.conf,v 1.4 2004/07/18 04:02:23 dragonheart Exp $ # Standard standalone server configuration. START { # Do not delete this entry! recover cmd="ctl_cyrusdb -r" # This is only necessary if using idled for IMAP IDLE. #idled cmd="idled" } # UNIX sockets start with a slash and are put into /var/imap/socket. SERVICES { # Add or remove based on preferences. imap cmd="imapd" listen="imap2" prefork=0 # pop3 cmd="pop3d" listen="pop-3" prefork=0 # Don't forget to generate the needed keys for SSL or TLS # (see doc/html/install-configure.html). imaps cmd="imapd -s" listen="imaps" prefork=0 #pop3s cmd="pop3d -s" listen="pop3s" prefork=0 sieve cmd="timsieved" listen="sieve" prefork=0 # at least one LMTP is required for delivery #lmtp cmd="lmtpd" listen="lmtp" prefork=0 lmtpunix cmd="lmtpd" listen="/var/imap/socket/lmtp" prefork=0 # this is only necessary if using notifications #notify cmd="notifyd" listen="/var/imap/socket/notify" proto="udp" prefork=1 } EVENTS { # This is required. checkpoint cmd="ctl_cyrusdb -c" period=30 # This is only necessary if using duplicate delivery suppression. delprune cmd="ctl_deliver -E 3" period=1440 # This is only necessary if caching TLS sessions. tlsprune cmd="tls_prune" period=1440 } etc/imapd.conf0000644000076500007650000000314010302634453014712 0ustar leggettleggett00000000000000# $Header: /var/cvsroot/gentoo-x86/net-mail/cyrus-imapd/files/imapd.conf,v 1.5 2004/08/27 06:02:45 langthang Exp $ # Don't forget to use chattr +S (if you are using ext[23]) # when you change these directories (read the docs). configdirectory: /var/imap partition-default: /var/spool/imap sievedir: /var/imap/sieve tls_ca_path: /etc/ssl/certs tls_cert_file: /etc/ssl/cyrus/imap-cert.pem tls_key_file: /etc/ssl/cyrus/imap-key.pem # Don't use an everyday user as admin. admins: cyrus hashimapspool: yes allowanonymouslogin: no allowplaintext: no # Allow renaming of top-level mailboxes. #allowusermoves: yes # Use this if sieve-scripts could be in ~user/.sieve. #sieveusehomedir: yes # Use saslauthd if you want to use pam for imap. # But be warned: login with DIGEST-MD5 or CRAM-MD5 # is not possible using pam. sasl_pwcheck_method: saslauthd sasl_mech_list: gssapi plain login sasl_minimum_layer: 56 lmtpsocket: /var/imap/socket/lmtp #################################################### ## This is a recommended authentication method if you ## emerge cyrus-sasl with 'postgres' or 'mysql' ## To use with mysql database uncomment those lines below. ## possible values for sasl_auxprop_plugin 'mysql', 'pgsql', 'sqlite'. #sasl_sql_engine: mysql ## all possible values. #sasl_mech_list: LOGIN PLAIN CRAM-MD5 DIGEST-MD5 NTLM ## or limit to CRAM-MD5 only #sasl_mech_list: CRAM-MD5 ## change below to suit your setup. #sasl_sql_user: mailsqluser #sasl_sql_passwd: password #sasl_sql_database: mailsqldb #sasl_sql_hostnames: localhost #sasl_sql_select: SELECT clear FROM users WHERE email = '%u@%r' etc/krb5.conf0000644000076500007650000000117510302634611014465 0ustar leggettleggett00000000000000[libdefaults] ticket_lifetime = 600 default_realm = CI.EXAMPLE.COM default_tkt_enctypes = des3-hmac-sha1 des-cbc-crc default_tgs_enctypes = des3-hmac-sha1 des-cbc-crc [realms] CI.EXAMPLE.COM = { kdc = kdc.example.com:88 kdc = ldap.example.com:88 admin_server = kdc.example.com:749 } [domain_realm] .example.com = CI.EXAMPLE.COM example.com = CI.EXAMPLE.COM [kdc] profile = /etc/krb5kdc/kdc.conf [logging] kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmin.log default = FILE:/var/log/krb5lib.log etc/krb5kdc/0000755000076500007650000000000010302702116014270 5ustar leggettleggett00000000000000etc/krb5kdc/kadm5.acl0000644000076500007650000000005110302634466015762 0ustar leggettleggett00000000000000*/admin@CI.EXAMPLE.COM * etc/krb5kdc/kdc.conf0000644000076500007650000000102710262514530015706 0ustar leggettleggett00000000000000[kdcdefaults] kdc_ports = 88,750 [realms] CI.EXAMPLE.COM = { database_name = /etc/krb5kdc/principal admin_keytab = /etc/krb5kdc/kadm5.keytab acl_file = /etc/krb5kdc/kadm5.acl dict_file = /etc/krb5kdc/kadm5.dict key_stash_file = /etc/krb5kdc/.k5.CI.EXAMPLE.COM kadmind_port = 749 max_life = 10h 0m 0s max_renewable_life = 7d 0h 0m 0s master_key_type = des3-hmac-sha1 supported_enctypes = des3-hmac-sha1:normal des-cbc-crc:normal } etc/krb5kdc/kpropd.acl0000644000076500007650000000011110262514530016247 0ustar leggettleggett00000000000000host/kdc.example.com@CI.EXAMPLE.COM host/ldap.example.com@CI.EXAMPLE.COM etc/ldap.conf0000644000076500007650000000076010303737502014545 0ustar leggettleggett00000000000000host ldap.example.com kdc.example.com base o=ci,dc=example,dc=com ssl start_tls tls_checkpeer no tls_cacertdir /etc/ssl/certs nss_base_passwd ou=people,o=ci,dc=example,dc=com nss_base_group ou=group,o=ci,dc=example,dc=com nss_base_hosts ou=hosts,o=ci,dc=example,dc=com nss_base_services ou=services,o=ci,dc=example,dc=com nss_base_protocols ou=protocols,o=ci,dc=example,dc=com nss_base_netgroup ou=netgroups,o=ci,dc=example,dc=com nss_base_automount ou=mounts,o=ci,dc=example,dc=com etc/openldap/0000755000076500007650000000000010303737567014570 5ustar leggettleggett00000000000000etc/openldap/ldap.conf0000644000076500007650000000056410303737567016364 0ustar leggettleggett00000000000000# $OpenLDAP: pkg/ldap/libraries/libldap/ldap.conf,v 1.9 2000/09/04 19:57:01 kurt Exp $ # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. BASE o=ci,dc=example,dc=com URI ldaps://ldap.example.com ldaps://kdc.example.com TLS_CACERTDIR /etc/ssl/certs TLS_REQCERT allow #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never etc/openldap/master-slapd.conf0000644000076500007650000001506110275630333020025 0ustar leggettleggett00000000000000# # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/autofs.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/misc.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules: # modulepath /usr/lib/openldap/openldap # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind security ssf=1 tls=128 update_tls=128 #disallow bind_simple allow bind_v2 bind_anon_dn TLSCipherSuite HIGH TLSCACertificatePath /etc/ssl/certs TLSCertificateFile /etc/openldap/ssl/slapd-cert.pem TLSCertificateKeyFile /etc/openldap/ssl/slapd-key.pem TLSVerifyClient allow sasl-secprops noplain,noanonymous,noactive,minssf=56 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy is: # Allow read by all # # rootdn can always write! # Map SASL authentication DNs to LDAP DNs # This leaves "username/admin" principals untouched sasl-regexp uid=([^/]*),cn=GSSAPI,cn=auth "uid=$1,ou=People,o=ci,dc=example,dc=com" # This should be a ^ plus, not a star, but slapd won't accept it #access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read #access to * # by self write # by users read # by anonymous auth # Samba accounts passwords access to attrs=sambaLMPassword,sambaNTPassword by dn.regex="uid=.*/admin,cn=GSSAPI,cn=auth" write by dn.exact="uid=samba_server,ou=people,o=ci,dc=uchicago,dc=edu" write by self write by anonymous auth by * none # Passwords should not be in entered by anyone access to attrs=userPassword by dn.regex="uid=.*/admin,cn=GSSAPI,cn=auth" write by dn.exact="uid=samba_server,ou=people,o=ci,dc=uchicago,dc=edu" write by self write by anonymous auth by * none # Users can change their shell, anyone else can see it access to attrs=loginShell by dn.regex="uid=.*/admin,cn=GSSAPI,cn=auth" write by self write by * read # Only the user can see their employeeNumber access to attrs=employeeNumber by dn.regex="uid=.*/admin,cn=GSSAPI,cn=auth" write by self read by * none # Allow everyone to get People information access to dn.children="ou=People,o=ci,dc=uchicago,dc=edu" by dn.regex="uid=.*/admin,cn=GSSAPI,cn=auth" write by * read # Default read access for everything else access to * by dn.regex="uid=.*/admin,cn=GSSAPI,cn=auth" write by dn.exact="uid=samba_server,ou=people,o=ci,dc=uchicago,dc=edu" write by peername=192.168.1.* read by anonymous none by * read # Limit number of search results to prevent trolling of directory # by spammers, etc. #sizelimit 10 # Alternatively, specify a large enough size limit to ensure we can dump # the entire directory sizelimit 5000 # Limit the number of threads # The default is 16 and that has been reported on the openldap mailing # list to be too many for a machine with < 1 GB of RAM threads 8 # Disconnect idle connections after 4 hours. Otherwise connections # from nss_ldap keep piling up and we eventually exceed our open file # handle limit. Increasing that limit above 1024 is difficult on Linux # because slapd uses select(2) and the FD_SETSIZE is hard-coded at 1024. # Presumably slapd will eventually be converted to use poll(2) instead # of select, which doesn't have that limit. But until then this is our # workaround. idletimeout 14400 # Turn off logging. We can always turn it back on when we need to see # what's going on. # 256 is the default. 256 logs connections, operations and results, # it would be nice to log only operations but there isn't a level just # for operations. #loglevel 0 #loglevel 2472 loglevel 256 ####################################################################### # ldbm database definitions ####################################################################### database bdb suffix "o=ci,dc=example,dc=com" #rootdn "cn=Manager,o=ci,dc=example,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. #rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/openldap-data mode 0600 # Indices to maintain index objectClass eq index cn pres,eq index uid,uidNumber pres,eq index gidNumber,memberUID pres,eq index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq # Increase the size of slapd's entry cache. Note that this is a # seperate cache from BDB's cache, who's size is configured in DB_CONFIG cachesize 10000 # BDB tuning # It would be preferable to do all BDB tuning in BDB's configuration # file, but there are some settings that aren't supported there. # BDB's config file is var/openldap-data/DB_CONFIG # Docs: http://www.openldap.org/faq/data/cache/893.html # # Turn on checkpointing, which is off by default. This reduces the # amount of time it takes db_recover to run on a restart. checkpoint 256 15 # Replication log replogfile /var/lib/openldap-data/slapd.replog replica host=kdc.example.com:389 suffix="o=ci,dc=example,dc=com" bindmethod=sasl saslmech=gssapi authcId=host/ldap.example.com@EXAMPLE.COM tls=yes etc/openldap/slave-slapd.conf0000644000076500007650000001031710275630626017650 0ustar leggettleggett00000000000000# # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/autofs.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/misc.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args #loglevel 2472 loglevel 256 # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind allow bind_v2 bind_anon_dn # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy is: # Allow read by all # # rootdn can always write! #access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read #access to * # by self write # by users read # by anonymous auth access to * by dn.regex="uid=host/ldap.example.com,cn=GSSAPI,cn=auth" write by peername=192.168.1.* read by anonymous auth by * read # Limit number of search results to prevent trolling of directory # by spammers, etc. #sizelimit 10 # Alternatively, specify a large enough size limit to ensure we can dump # the entire directory sizelimit 5000 # Limit the number of threads # The default is 16 and that has been reported on the openldap mailing # list to be too many for a machine with < 1 GB of RAM threads 8 # Disconnect idle connections after 4 hours. Otherwise connections # from nss_ldap keep piling up and we eventually exceed our open file # handle limit. Increasing that limit above 1024 is difficult on Linux # because slapd uses select(2) and the FD_SETSIZE is hard-coded at 1024. # Presumably slapd will eventually be converted to use poll(2) instead # of select, which doesn't have that limit. But until then this is our # workaround. idletimeout 14400 ####################################################################### # ldbm database definitions ####################################################################### database bdb suffix "o=ci,dc=example,dc=com" #rootdn "cn=Manager,o=ci,dc=example,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw {SSHA}hashhere # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/openldap-data mode 0600 # Indices to maintain index objectClass eq index cn pres,eq index uid,uidNumber pres,eq index gidNumber,memberUID pres,eq index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq # Increase the size of slapd's entry cache. Note that this is a # seperate cache from BDB's cache, who's size is configured in DB_CONFIG cachesize 10000 # BDB tuning # It would be preferable to do all BDB tuning in BDB's configuration # file, but there are some settings that aren't supported there. # BDB's config file is var/openldap-data/DB_CONFIG # Docs: http://www.openldap.org/faq/data/cache/893.html # # Turn on checkpointing, which is off by default. This reduces the # amount of time it takes db_recover to run on a restart. checkpoint 256 15 updatedn "uid=host/ldap.example.com,cn=gssapi,cn=auth" updateref ldap://ldap.example.com etc/postfix/0000755000076500007650000000000010302702123014435 5ustar leggettleggett00000000000000etc/postfix/aliases.cf0000644000076500007650000000040710302701413016372 0ustar leggettleggett00000000000000server_host = ldap.example.com start_tls = yes version = 3 tls_ca_cert_dir = /etc/ssl/certs tls_require_cert = yes scope = one search_base = ou=aliases,o=ci,dc=example,dc=com query_filter = (&(objectClass=nisMailAlias)(cn=%s)) result_attribute = rfc822MailMember etc/postfix/main.cf0000644000076500007650000006300010302635766015714 0ustar leggettleggett00000000000000# Global Postfix configuration file. This file lists only a subset # of all 300+ parameters. See the postconf(5) manual page for a # complete list. # # The general format of each line is: parameter = value. Lines # that begin with whitespace continue the previous line. A value can # contain references to other $names or ${name}s. # # NOTE - CHANGE NO MORE THAN 2-3 PARAMETERS AT A TIME, AND TEST IF # POSTFIX STILL WORKS AFTER EVERY CHANGE. owner_request_special = no recipient_delimiter = + unknown_local_recipient_reject_code = 550 # SOFT BOUNCE # # The soft_bounce parameter provides a limited safety net for # testing. When soft_bounce is enabled, mail will remain queued that # would otherwise bounce. This parameter disables locally-generated # bounces, and prevents the SMTP server from rejecting mail permanently # (by changing 5xx replies into 4xx replies). However, soft_bounce # is no cure for address rewriting mistakes or mail routing mistakes. # #soft_bounce = no # LOCAL PATHNAME INFORMATION # # The queue_directory specifies the location of the Postfix queue. # This is also the root directory of Postfix daemons that run chrooted. # See the files in examples/chroot-setup for setting up Postfix chroot # environments on different UNIX systems. # queue_directory = /var/spool/postfix # The command_directory parameter specifies the location of all # postXXX commands. # command_directory = /usr/sbin # The daemon_directory parameter specifies the location of all Postfix # daemon programs (i.e. programs listed in the master.cf file). This # directory must be owned by root. # daemon_directory = /usr/lib/postfix # QUEUE AND PROCESS OWNERSHIP # # The mail_owner parameter specifies the owner of the Postfix queue # and of most Postfix daemon processes. Specify the name of a user # account THAT DOES NOT SHARE ITS USER OR GROUP ID WITH OTHER ACCOUNTS # AND THAT OWNS NO OTHER FILES OR PROCESSES ON THE SYSTEM. In # particular, don't specify nobody or daemon. PLEASE USE A DEDICATED # USER. # mail_owner = postfix # The default_privs parameter specifies the default rights used by # the local delivery agent for delivery to external file or command. # These rights are used in the absence of a recipient user context. # DO NOT SPECIFY A PRIVILEGED USER OR THE POSTFIX OWNER. # default_privs = nobody # INTERNET HOST AND DOMAIN NAMES # # The myhostname parameter specifies the internet hostname of this # mail system. The default is to use the fully-qualified domain name # from gethostname(). $myhostname is used as a default value for many # other configuration parameters. # myhostname = mail.example.com #myhostname = virtual.domain.tld # The mydomain parameter specifies the local internet domain name. # The default is to use $myhostname minus the first component. # $mydomain is used as a default value for many other configuration # parameters. # mydomain = ci.example.com # SENDING MAIL # # The myorigin parameter specifies the domain that locally-posted # mail appears to come from. The default is to append $myhostname, # which is fine for small sites. If you run a domain with multiple # machines, you should (1) change this to $mydomain and (2) set up # a domain-wide alias database that aliases each user to # user@that.users.mailhost. # # For the sake of consistency between sender and recipient addresses, # myorigin also specifies the default domain name that is appended # to recipient addresses that have no @domain part. # #myorigin = $myhostname myorigin = $mydomain # RECEIVING MAIL # The inet_interfaces parameter specifies the network interface # addresses that this mail system receives mail on. By default, # the software claims all active interfaces on the machine. The # parameter also controls delivery of mail to user@[ip.address]. # # See also the proxy_interfaces parameter, for network addresses that # are forwarded to us via a proxy or network address translator. # # Note: you need to stop/start Postfix when this parameter changes. # #inet_interfaces = all #inet_interfaces = $myhostname #inet_interfaces = $myhostname, localhost # The proxy_interfaces parameter specifies the network interface # addresses that this mail system receives mail on by way of a # proxy or network address translation unit. This setting extends # the address list specified with the inet_interfaces parameter. # # You must specify your proxy/NAT addresses when your system is a # backup MX host for other domains, otherwise mail delivery loops # will happen when the primary MX host is down. # #proxy_interfaces = #proxy_interfaces = 1.2.3.4 # The mydestination parameter specifies the list of domains that this # machine considers itself the final destination for. # # These domains are routed to the delivery agent specified with the # local_transport parameter setting. By default, that is the UNIX # compatible delivery agent that lookups all recipients in /etc/passwd # and /etc/aliases or their equivalent. # # The default is $myhostname + localhost.$mydomain. On a mail domain # gateway, you should also include $mydomain. # # Do not specify the names of virtual domains - those domains are # specified elsewhere (see VIRTUAL_README). # # Do not specify the names of domains that this machine is backup MX # host for. Specify those names via the relay_domains settings for # the SMTP server, or use permit_mx_backup if you are lazy (see # STANDARD_CONFIGURATION_README). # # The local machine is always the final destination for mail addressed # to user@[the.net.work.address] of an interface that the mail system # receives mail on (see the inet_interfaces parameter). # # Specify a list of host or domain names, /file/name or type:table # patterns, separated by commas and/or whitespace. A /file/name # pattern is replaced by its contents; a type:table is matched when # a name matches a lookup key (the right-hand side is ignored). # Continue long lines by starting the next line with whitespace. # # See also below, section "REJECTING MAIL FOR UNKNOWN LOCAL USERS". # #mydestination = $myhostname, localhost.$mydomain, localhost mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain #mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain, # mail.$mydomain, www.$mydomain, ftp.$mydomain # REJECTING MAIL FOR UNKNOWN LOCAL USERS # # The local_recipient_maps parameter specifies optional lookup tables # with all names or addresses of users that are local with respect # to $mydestination, $inet_interfaces or $proxy_interfaces. # # If this parameter is defined, then the SMTP server will reject # mail for unknown local users. This parameter is defined by default. # # To turn off local recipient checking in the SMTP server, specify # local_recipient_maps = (i.e. empty). # # The default setting assumes that you use the default Postfix local # delivery agent for local delivery. You need to update the # local_recipient_maps setting if: # # - You define $mydestination domain recipients in files other than # /etc/passwd, /etc/aliases, or the $virtual_alias_maps files. # For example, you define $mydestination domain recipients in # the $virtual_mailbox_maps files. # # - You redefine the local delivery agent in master.cf. # # - You redefine the "local_transport" setting in main.cf. # # - You use the "luser_relay", "mailbox_transport", or "fallback_transport" # feature of the Postfix local delivery agent (see local(8)). # # Details are described in the LOCAL_RECIPIENT_README file. # # Beware: if the Postfix SMTP server runs chrooted, you probably have # to access the passwd file via the proxymap service, in order to # overcome chroot restrictions. The alternative, having a copy of # the system passwd file in the chroot jail is just not practical. # # The right-hand side of the lookup tables is conveniently ignored. # In the left-hand side, specify a bare username, an @domain.tld # wild-card, or specify a user@domain.tld address. # #local_recipient_maps = unix:passwd.byname $alias_maps #local_recipient_maps = proxy:unix:passwd.byname $alias_maps #local_recipient_maps = # The unknown_local_recipient_reject_code specifies the SMTP server # response code when a recipient domain matches $mydestination or # ${proxy,inet}_interfaces, while $local_recipient_maps is non-empty # and the recipient address or address local-part is not found. # # The default setting is 550 (reject mail) but it is safer to start # with 450 (try again later) until you are certain that your # local_recipient_maps settings are OK. # #unknown_local_recipient_reject_code = 550 # TRUST AND RELAY CONTROL # The mynetworks parameter specifies the list of "trusted" SMTP # clients that have more privileges than "strangers". # # In particular, "trusted" SMTP clients are allowed to relay mail # through Postfix. See the smtpd_recipient_restrictions parameter # in postconf(5). # # You can specify the list of "trusted" network addresses by hand # or you can let Postfix do it for you (which is the default). # # By default (mynetworks_style = subnet), Postfix "trusts" SMTP # clients in the same IP subnetworks as the local machine. # On Linux, this does works correctly only with interfaces specified # with the "ifconfig" command. # # Specify "mynetworks_style = class" when Postfix should "trust" SMTP # clients in the same IP class A/B/C networks as the local machine. # Don't do this with a dialup site - it would cause Postfix to "trust" # your entire provider's network. Instead, specify an explicit # mynetworks list by hand, as described below. # # Specify "mynetworks_style = host" when Postfix should "trust" # only the local machine. # #mynetworks_style = class mynetworks_style = subnet #mynetworks_style = host # Alternatively, you can specify the mynetworks list by hand, in # which case Postfix ignores the mynetworks_style setting. # # Specify an explicit list of network/netmask patterns, where the # mask specifies the number of bits in the network part of a host # address. # # You can also specify the absolute pathname of a pattern file instead # of listing the patterns here. Specify type:table for table-based lookups # (the value on the table right-hand side is not used). # #mynetworks = 168.100.189.0/28, 127.0.0.0/8 #mynetworks = $config_directory/mynetworks #mynetworks = hash:/etc/postfix/network_table # The relay_domains parameter restricts what destinations this system will # relay mail to. See the smtpd_recipient_restrictions description in # postconf(5) for detailed information. # # By default, Postfix relays mail # - from "trusted" clients (IP address matches $mynetworks) to any destination, # - from "untrusted" clients to destinations that match $relay_domains or # subdomains thereof, except addresses with sender-specified routing. # The default relay_domains value is $mydestination. # # In addition to the above, the Postfix SMTP server by default accepts mail # that Postfix is final destination for: # - destinations that match $inet_interfaces or $proxy_interfaces, # - destinations that match $mydestination # - destinations that match $virtual_alias_domains, # - destinations that match $virtual_mailbox_domains. # These destinations do not need to be listed in $relay_domains. # # Specify a list of hosts or domains, /file/name patterns or type:name # lookup tables, separated by commas and/or whitespace. Continue # long lines by starting the next line with whitespace. A file name # is replaced by its contents; a type:name table is matched when a # (parent) domain appears as lookup key. # # NOTE: Postfix will not automatically forward mail for domains that # list this system as their primary or backup MX host. See the # permit_mx_backup restriction description in postconf(5). # #relay_domains = $mydestination smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination # INTERNET OR INTRANET # The relayhost parameter specifies the default host to send mail to # when no entry is matched in the optional transport(5) table. When # no relayhost is given, mail is routed directly to the destination. # # On an intranet, specify the organizational domain name. If your # internal DNS uses no MX records, specify the name of the intranet # gateway host instead. # # In the case of SMTP, specify a domain, host, host:port, [host]:port, # [address] or [address]:port; the form [host] turns off MX lookups. # # If you're connected via UUCP, see also the default_transport parameter. # #relayhost = $mydomain #relayhost = [gateway.my.domain] #relayhost = [smtp.example.com] #relayhost = uucphost #relayhost = [an.ip.add.ress] # REJECTING UNKNOWN RELAY USERS # # The relay_recipient_maps parameter specifies optional lookup tables # with all addresses in the domains that match $relay_domains. # # If this parameter is defined, then the SMTP server will reject # mail for unknown relay users. This feature is off by default. # # The right-hand side of the lookup tables is conveniently ignored. # In the left-hand side, specify an @domain.tld wild-card, or specify # a user@domain.tld address. # #relay_recipient_maps = hash:/etc/postfix/relay_recipients # INPUT RATE CONTROL # # The in_flow_delay configuration parameter implements mail input # flow control. This feature is turned on by default, although it # still needs further development (it's disabled on SCO UNIX due # to an SCO bug). # # A Postfix process will pause for $in_flow_delay seconds before # accepting a new message, when the message arrival rate exceeds the # message delivery rate. With the default 100 SMTP server process # limit, this limits the mail inflow to 100 messages a second more # than the number of messages delivered per second. # # Specify 0 to disable the feature. Valid delays are 0..10. # #in_flow_delay = 1s # ADDRESS REWRITING # # The ADDRESS_REWRITING_README document gives information about # address masquerading or other forms of address rewriting including # username->Firstname.Lastname mapping. # ADDRESS REDIRECTION (VIRTUAL DOMAIN) # # The VIRTUAL_README document gives information about the many forms # of domain hosting that Postfix supports. # "USER HAS MOVED" BOUNCE MESSAGES # # See the discussion in the ADDRESS_REWRITING_README document. # TRANSPORT MAP # # See the discussion in the ADDRESS_REWRITING_README document. # ALIAS DATABASE # # The alias_maps parameter specifies the list of alias databases used # by the local delivery agent. The default list is system dependent. # # On systems with NIS, the default is to search the local alias # database, then the NIS alias database. See aliases(5) for syntax # details. # # If you change the alias database, run "postalias /etc/aliases" (or # wherever your system stores the mail alias file), or simply run # "newaliases" to build the necessary DBM or DB file. # # It will take a minute or so before changes become visible. Use # "postfix reload" to eliminate the delay. # #alias_maps = dbm:/etc/aliases #alias_maps = hash:/etc/aliases #alias_maps = hash:/etc/aliases, nis:mail.aliases #alias_maps = netinfo:/aliases # The alias_database parameter specifies the alias database(s) that # are built with "newaliases" or "sendmail -bi". This is a separate # configuration parameter, because alias_maps (see above) may specify # tables that are not necessarily all under control by Postfix. # #alias_database = dbm:/etc/aliases #alias_database = dbm:/etc/mail/aliases #alias_database = hash:/etc/aliases #alias_database = hash:/etc/aliases, hash:/opt/majordomo/aliases # ADDRESS EXTENSIONS (e.g., user+foo) # # The recipient_delimiter parameter specifies the separator between # user names and address extensions (user+foo). See canonical(5), # local(8), relocated(5) and virtual(5) for the effects this has on # aliases, canonical, virtual, relocated and .forward file lookups. # Basically, the software tries user+foo and .forward+foo before # trying user and .forward. # #recipient_delimiter = + # DELIVERY TO MAILBOX # # The home_mailbox parameter specifies the optional pathname of a # mailbox file relative to a user's home directory. The default # mailbox file is /var/spool/mail/user or /var/mail/user. Specify # "Maildir/" for qmail-style delivery (the / is required). # #home_mailbox = Mailbox #home_mailbox = Maildir/ # The mail_spool_directory parameter specifies the directory where # UNIX-style mailboxes are kept. The default setting depends on the # system type. # #mail_spool_directory = /var/mail #mail_spool_directory = /var/spool/mail # The mailbox_command parameter specifies the optional external # command to use instead of mailbox delivery. The command is run as # the recipient with proper HOME, SHELL and LOGNAME environment settings. # Exception: delivery for root is done as $default_user. # # Other environment variables of interest: USER (recipient username), # EXTENSION (address extension), DOMAIN (domain part of address), # and LOCAL (the address localpart). # # Unlike other Postfix configuration parameters, the mailbox_command # parameter is not subjected to $parameter substitutions. This is to # make it easier to specify shell syntax (see example below). # # Avoid shell meta characters because they will force Postfix to run # an expensive shell process. Procmail alone is expensive enough. # # IF YOU USE THIS TO DELIVER MAIL SYSTEM-WIDE, YOU MUST SET UP AN # ALIAS THAT FORWARDS MAIL FOR ROOT TO A REAL USER. # #mailbox_command = /some/where/procmail #mailbox_command = /some/where/procmail -a "$EXTENSION" # The mailbox_transport specifies the optional transport in master.cf # to use after processing aliases and .forward files. This parameter # has precedence over the mailbox_command, fallback_transport and # luser_relay parameters. # # Specify a string of the form transport:nexthop, where transport is # the name of a mail delivery transport defined in master.cf. The # :nexthop part is optional. For more details see the sample transport # configuration file. # # NOTE: if you use this feature for accounts not in the UNIX password # file, then you must update the "local_recipient_maps" setting in # the main.cf file, otherwise the SMTP server will reject mail for # non-UNIX accounts with "User unknown in local recipient table". # #mailbox_transport = lmtp:unix:/var/imap/socket/lmtp mailbox_transport = cyrus # The fallback_transport specifies the optional transport in master.cf # to use for recipients that are not found in the UNIX passwd database. # This parameter has precedence over the luser_relay parameter. # # Specify a string of the form transport:nexthop, where transport is # the name of a mail delivery transport defined in master.cf. The # :nexthop part is optional. For more details see the sample transport # configuration file. # # NOTE: if you use this feature for accounts not in the UNIX password # file, then you must update the "local_recipient_maps" setting in # the main.cf file, otherwise the SMTP server will reject mail for # non-UNIX accounts with "User unknown in local recipient table". # #fallback_transport = lmtp:unix:/file/name fallback_transport = cyrus #fallback_transport = # The luser_relay parameter specifies an optional destination address # for unknown recipients. By default, mail for unknown@$mydestination, # unknown@[$inet_interfaces] or unknown@[$proxy_interfaces] is returned # as undeliverable. # # The following expansions are done on luser_relay: $user (recipient # username), $shell (recipient shell), $home (recipient home directory), # $recipient (full recipient address), $extension (recipient address # extension), $domain (recipient domain), $local (entire recipient # localpart), $recipient_delimiter. Specify ${name?value} or # ${name:value} to expand value only when $name does (does not) exist. # # luser_relay works only for the default Postfix local delivery agent. # # NOTE: if you use this feature for accounts not in the UNIX password # file, then you must specify "local_recipient_maps =" (i.e. empty) in # the main.cf file, otherwise the SMTP server will reject mail for # non-UNIX accounts with "User unknown in local recipient table". # #luser_relay = $user@other.host #luser_relay = $local@other.host #luser_relay = admin+$local # JUNK MAIL CONTROLS # # The controls listed here are only a very small subset. The file # SMTPD_ACCESS_README provides an overview. # The header_checks parameter specifies an optional table with patterns # that each logical message header is matched against, including # headers that span multiple physical lines. # # By default, these patterns also apply to MIME headers and to the # headers of attached messages. With older Postfix versions, MIME and # attached message headers were treated as body text. # # For details, see "man header_checks". # #header_checks = regexp:/etc/postfix/header_checks # FAST ETRN SERVICE # # Postfix maintains per-destination logfiles with information about # deferred mail, so that mail can be flushed quickly with the SMTP # "ETRN domain.tld" command, or by executing "sendmail -qRdomain.tld". # See the ETRN_README document for a detailed description. # # The fast_flush_domains parameter controls what destinations are # eligible for this service. By default, they are all domains that # this server is willing to relay mail to. # #fast_flush_domains = $relay_domains # SHOW SOFTWARE VERSION OR NOT # # The smtpd_banner parameter specifies the text that follows the 220 # code in the SMTP server's greeting banner. Some people like to see # the mail version advertised. By default, Postfix shows no version. # # You MUST specify $myhostname at the start of the text. That is an # RFC requirement. Postfix itself does not care. # #smtpd_banner = $myhostname ESMTP $mail_name #smtpd_banner = $myhostname ESMTP $mail_name ($mail_version) # PARALLEL DELIVERY TO THE SAME DESTINATION # # How many parallel deliveries to the same user or domain? With local # delivery, it does not make sense to do massively parallel delivery # to the same user, because mailbox updates must happen sequentially, # and expensive pipelines in .forward files can cause disasters when # too many are run at the same time. With SMTP deliveries, 10 # simultaneous connections to the same domain could be sufficient to # raise eyebrows. # # Each message delivery transport has its XXX_destination_concurrency_limit # parameter. The default is $default_destination_concurrency_limit for # most delivery transports. For the local delivery agent the default is 2. #local_destination_concurrency_limit = 2 #default_destination_concurrency_limit = 20 # DEBUGGING CONTROL # # The debug_peer_level parameter specifies the increment in verbose # logging level when an SMTP client or server host name or address # matches a pattern in the debug_peer_list parameter. # debug_peer_level = 2 # The debug_peer_list parameter specifies an optional list of domain # or network patterns, /file/name patterns or type:name tables. When # an SMTP client or server host name or address matches a pattern, # increase the verbose logging level by the amount specified in the # debug_peer_level parameter. # #debug_peer_list = 127.0.0.1 #debug_peer_list = some.domain # The debugger_command specifies the external command that is executed # when a Postfix daemon program is run with the -D option. # # Use "command .. & sleep 5" so that the debugger can attach before # the process marches on. If you use an X-based debugger, be sure to # set up your XAUTHORITY environment variable before starting Postfix. # debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin xxgdb $daemon_directory/$process_name $process_id & sleep 5 # If you don't have X installed on the Postfix machine, try: # debugger_command = # PATH=/bin:/usr/bin:/usr/local/bin; export PATH; (echo cont; # echo where) | gdb $daemon_directory/$process_name $process_id 2>&1 # >$config_directory/$process_name.$process_id.log & sleep 5 # INSTALL-TIME CONFIGURATION INFORMATION # # The following parameters are used when installing a new Postfix version. # # sendmail_path: The full pathname of the Postfix sendmail command. # This is the Sendmail-compatible mail posting interface. # sendmail_path = /usr/sbin/sendmail # newaliases_path: The full pathname of the Postfix newaliases command. # This is the Sendmail-compatible command to build alias databases. # newaliases_path = /usr/bin/newaliases # mailq_path: The full pathname of the Postfix mailq command. This # is the Sendmail-compatible mail queue listing command. # mailq_path = /usr/bin/mailq # setgid_group: The group for mail submission and queue management # commands. This must be a group name with a numerical group ID that # is not shared with other accounts, not even with the Postfix account. # setgid_group = postdrop # html_directory: The location of the Postfix HTML documentation. # html_directory = no # manpage_directory: The location of the Postfix on-line manual pages. # manpage_directory = /usr/share/man # sample_directory: The location of the Postfix sample configuration files. # This parameter is obsolete as of Postfix 2.1. # sample_directory = /etc/postfix # readme_directory: The location of the Postfix README files. # readme_directory = /usr/share/doc/postfix-2.1.5-r1/readme default_destination_concurrency_limit = 2 alias_database = hash:/etc/mail/aliases local_destination_concurrency_limit = 5 local_destination_recipient_limit = 300 alias_maps = hash:/etc/mail/aliases, ldap:/etc/postfix/aliases.cf home_mailbox = .maildir/ smtp_use_tls = yes smtp_sasl_auth_enable = no smtp_tls_note_starttls_offer = yes smtpd_use_tls = yes smtpd_sasl_auth_enable = yes smtpd_sasl_security_options = noanonymous, noplaintext smtpd_sasl_tls_security_options = noanonymous smtpd_tls_cert_file = /etc/ssl/postfix/smtp-cert.pem smtpd_tls_key_file = /etc/ssl/postfix/smtp-key.pem smtpd_tls_loglevel = 1 smtpd_tls_auth_only = yes #smtpd_tls_session_cache_database = btree:/etc/postfix/smtpd_scache smtpd_tls_session_cache_timeout = 3600s tls_random_source = dev:/dev/urandom etc/postfix/master.cf0000644000076500007650000001540310262514532016257 0ustar leggettleggett00000000000000# # Postfix master process configuration file. Each logical line # describes how a Postfix daemon program should be run. # # A logical line starts with non-whitespace, non-comment text. # Empty lines and whitespace-only lines are ignored, as are comment # lines whose first non-whitespace character is a `#'. # A line that starts with whitespace continues a logical line. # # The fields that make up each line are described below. A "-" field # value requests that a default value be used for that field. # # Service: any name that is valid for the specified transport type # (the next field). With INET transports, a service is specified as # host:port. The host part (and colon) may be omitted. Either host # or port may be given in symbolic form or in numeric form. Examples # for the SMTP server: localhost:smtp receives mail via the loopback # interface only; 10025 receives mail on port 10025. # # Transport type: "inet" for Internet sockets, "unix" for UNIX-domain # sockets, "fifo" for named pipes. # # Private: whether or not access is restricted to the mail system. # Default is private service. Internet (inet) sockets can't be private. # # Unprivileged: whether the service runs with root privileges or as # the owner of the Postfix system (the owner name is controlled by the # mail_owner configuration variable in the main.cf file). Only the # pipe, virtual and local delivery daemons require privileges. # # Chroot: whether or not the service runs chrooted to the mail queue # directory (pathname is controlled by the queue_directory configuration # variable in the main.cf file). Presently, all Postfix daemons can run # chrooted, except for the pipe, virtual and local delivery daemons. # The proxymap server can run chrooted, but doing so defeats most of # the purpose of having that service in the first place. # The files in the examples/chroot-setup subdirectory describe how # to set up a Postfix chroot environment for your type of machine. # # Wakeup time: automatically wake up the named service after the # specified number of seconds. A ? at the end of the wakeup time # field requests that wake up events be sent only to services that # are actually being used. Specify 0 for no wakeup. Presently, only # the pickup, queue manager and flush daemons need a wakeup timer. # # Max procs: the maximum number of processes that may execute this # service simultaneously. Default is to use a globally configurable # limit (the default_process_limit configuration parameter in main.cf). # Specify 0 for no process count limit. # # Command + args: the command to be executed. The command name is # relative to the Postfix program directory (pathname is controlled by # the daemon_directory configuration variable). Adding one or more # -v options turns on verbose logging for that service; adding a -D # option enables symbolic debugging (see the debugger_command variable # in the main.cf configuration file). See individual command man pages # for specific command-line options, if any. # # General main.cf options can be overridden for specific services. # To override one or more main.cf options, specify them as arguments # below, preceding each option by "-o". There must be no whitespace # in the option itself (separate multiple values for an option by # commas). # # In order to use the "uucp" message tranport below, set up entries # in the transport table. # # In order to use the "cyrus" message transport below, configure it # in main.cf as the mailbox_transport. # # SPECIFY ONLY PROGRAMS THAT ARE WRITTEN TO RUN AS POSTFIX DAEMONS. # ALL DAEMONS SPECIFIED HERE MUST SPEAK A POSTFIX-INTERNAL PROTOCOL. # # DO NOT SHARE THE POSTFIX QUEUE BETWEEN MULTIPLE POSTFIX INSTANCES. # # ========================================================================== # service type private unpriv chroot wakeup maxproc command + args # (yes) (yes) (yes) (never) (100) # ========================================================================== smtp inet n - n - - smtpd #smtps inet n - n - - smtpd # -o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes #submission inet n - n - - smtpd # -o smtpd_enforce_tls=yes -o smtpd_sasl_auth_enable=yes -o smtpd_etrn_restrictions=reject #628 inet n - n - - qmqpd pickup fifo n - n 60 1 pickup cleanup unix n - n - 0 cleanup qmgr fifo n - n 300 1 qmgr #qmgr fifo n - n 300 1 oqmgr #tlsmgr fifo - - n 300 1 tlsmgr rewrite unix - - n - - trivial-rewrite bounce unix - - n - 0 bounce defer unix - - n - 0 bounce trace unix - - n - 0 bounce verify unix - - n - 1 verify flush unix n - n 1000? 0 flush proxymap unix - - n - - proxymap smtp unix - - n - - smtp relay unix - - n - - smtp # -o smtp_helo_timeout=5 -o smtp_connect_timeout=5 showq unix n - n - - showq error unix - - n - - error local unix - n n - - local virtual unix - n n - - virtual lmtp unix - - n - - lmtp anvil unix - - n - 1 anvil # # Interfaces to non-Postfix software. Be sure to examine the manual # pages of the non-Postfix software to find out what options it wants. # # maildrop. See the Postfix MAILDROP_README file for details. # maildrop unix - n n - - pipe flags=DRhu user=vmail argv=/usr/local/bin/maildrop -d ${recipient} # # The Cyrus deliver program has changed incompatibly, multiple times. # old-cyrus unix - n n - - pipe flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user} # Cyrus 2.1.5 (Amos Gouaux) # Also specify in main.cf: cyrus_destination_recipient_limit=1 cyrus unix - n n - - pipe user=cyrus argv=/usr/lib/cyrus/deliver -e -r ${sender} -m ${extension} ${user} uucp unix - n n - - pipe flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient) ifmail unix - n n - - pipe flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient) bsmtp unix - n n - - pipe flags=Fq. user=foo argv=/usr/local/sbin/bsmtp -f $sender $nexthop $recipient etc/sasl2/0000755000076500007650000000000010302702161013767 5ustar leggettleggett00000000000000etc/sasl2/smtpd.conf0000644000076500007650000000011210262514534015771 0ustar leggettleggett00000000000000pwcheck_method: saslauthd mech_list: gssapi plain login minimum_layer: 56 etc/ssl/0000755000076500007650000000000010302701715013550 5ustar leggettleggett00000000000000etc/ssl/example.com/0000755000076500007650000000000010302702012015747 5ustar leggettleggett00000000000000etc/ssl/example.com/ca-ssl.cnf0000644000076500007650000000223210302634147017635 0ustar leggettleggett00000000000000HOME = . RANDFILE = $ENV::HOME/.rnd oid_section = new_oids [ new_oids ] [ ca ] default_ca = CI [ CI ] dir = /etc/ssl/example.com certs = $dir/certs crl_dir = $dir/crl database = $dir/index.txt new_certs_dir = $dir/newcerts certificate = $dir/ci-cert.pem serial = $dir/serial crl = $dir/crl.pem private_key = $dir/private/ci-key.pem RANDFILE = $dir/private/.rand x509_extensions = usr_cert name_opt = ca_default cert_opt = ca_default default_days = 3650 default_crl_days = 30 default_md = md5 preserve = no policy = policy_match [ policy_match ] 0.domainComponent = match 1.domainComponent = match organizationName = match organizationalUnitName = supplied commonName = supplied emailAddress = supplied [ req ] default_bits = 1024 default_keyfile = /etc/ssl/example.com/private/ci-key.pem prompt = no distinguished_name = root_ca_distinguished_name x509_extensions = root_ca_extensions default_days = 3650 string_mask = nombstr [ root_ca_distinguished_name ] 0.domainComponent = com 1.domainComponent = example organizationName = ci commonName = Example Certificate Authority emailAddress = support@ci.example.com [ root_ca_extensions ] basicConstraints = CA:true etc/ssl/example.com/ssl.cnf0000644000076500007650000000445210302634236017261 0ustar leggettleggett00000000000000HOME = . RANDFILE = $ENV::HOME/.rnd oid_section = new_oids [ new_oids ] [ ca ] default_ca = CI # The default ca section [ CI ] dir = /etc/ssl/examples.com # Where everything is kept certs = $dir/certs # Where the issued certs are kept crl_dir = $dir/crl # Where the issued crl are kept database = $dir/index.txt # database index file. new_certs_dir = $dir/newcerts # default place for new certs. certificate = $dir/ci-cert.pem # The CA certificate serial = $dir/serial # The current serial number crl = $dir/crl.pem # The current CRL private_key = $dir/private/ci-key.pem # The private key RANDFILE = $dir/private/.rand # private random number file x509_extensions = usr_cert # The extentions to add to the cert name_opt = ca_default # Subject Name options cert_opt = ca_default # Certificate field options default_days = 3650 # how long to certify for default_crl_days= 30 # how long before next CRL default_md = md5 # which md to use. preserve = no # keep passed DN ordering policy = policy_anything [ policy_anything ] domainComponent = match organizationName = match organizationalUnitName = supplied commonName = supplied emailAddress = supplied [ req ] default_bits = 1024 default_keyfile = privkey.pem distinguished_name = req_distinguished_name attributes = req_attributes string_mask = nombstr [ req_distinguished_name ] 0.domainComponent = Level 0 Domain Component 0.domainComponent_default = com 1.domainComponent = Level 1 Domain Component 1.domainComponent_default = example organizationName = Organization Name organizationName_default = ci organizationalUnitName = hosts or people organizationalUnitName_default = hosts commonName = Fully Qualified Hostname or Your Full Name commonName_max = 64 emailAddress = Email Address emailAddress_max = 64 [ req_attributes ] [ usr_cert ] basicConstraints=CA:FALSE nsCertType = server nsComment = "Example Certificate" subjectKeyIdentifier=hash authorityKeyIdentifier=keyid,issuer:always subjectAltName=email:copy [ v3_req ] basicConstraints = CA:FALSE keyUsage = nonRepudiation, digitalSignature, keyEncipherment [ v3_ca ] subjectKeyIdentifier=hash authorityKeyIdentifier=keyid:always,issuer:always basicConstraints = CA:true nsCertType = sslCA, emailCA [ crl_ext ] authorityKeyIdentifier=keyid:always,issuer:always etc/xinetd.d/0000755000076500007650000000000010302702313014457 5ustar leggettleggett00000000000000etc/xinetd.d/kpropd0000644000076500007650000000053310262514530015711 0ustar leggettleggett00000000000000# default: off # description: kpropd is the kerberos propagation daemon. # It is used to propagate a KDC service krb5_prop { port = 754 socket_type = stream wait = no only_from = kdc.example.com user = root server = /usr/sbin/kpropd log_on_failure += HOST disable = no } usr/0000755000076500007650000000000010302705101012776 5ustar leggettleggett00000000000000usr/bin/0000755000076500007650000000000010302705122013551 5ustar leggettleggett00000000000000usr/bin/c_rehash0000755000076500007650000000707210302705122015261 0ustar leggettleggett00000000000000#!/usr/bin/perl # Perl c_rehash script, scan all files in a directory # and add symbolic links to their hash values. my $openssl; my $dir = "/etc/ssl"; if(defined $ENV{OPENSSL}) { $openssl = $ENV{OPENSSL}; } else { $openssl = "openssl"; $ENV{OPENSSL} = $openssl; } $ENV{PATH} .= ":$dir/bin"; if(! -x $openssl) { my $found = 0; foreach (split /:/, $ENV{PATH}) { if(-x "$_/$openssl") { $found = 1; last; } } if($found == 0) { print STDERR "c_rehash: rehashing skipped ('openssl' program not available)\n"; exit 0; } } if(@ARGV) { @dirlist = @ARGV; } elsif($ENV{SSL_CERT_DIR}) { @dirlist = split /:/, $ENV{SSL_CERT_DIR}; } else { $dirlist[0] = "$dir/certs"; } foreach (@dirlist) { if(-d $_ and -w $_) { hash_dir($_); } } sub hash_dir { my %hashlist; print "Doing $_[0]\n"; chdir $_[0]; opendir(DIR, "."); my @flist = readdir(DIR); # Delete any existing symbolic links foreach (grep {/^[\da-f]+\.r{0,1}\d+$/} @flist) { if(-l $_) { unlink $_; } } closedir DIR; FILE: foreach $fname (grep {/\.pem$/} @flist) { # Check to see if certificates and/or CRLs present. my ($cert, $crl) = check_file($fname); if(!$cert && !$crl) { print STDERR "WARNING: $fname does not contain a certificate or CRL: skipping\n"; next; } link_hash_cert($fname) if($cert); link_hash_crl($fname) if($crl); } } sub check_file { my ($is_cert, $is_crl) = (0,0); my $fname = $_[0]; open IN, $fname; while() { if(/^-----BEGIN (.*)-----/) { my $hdr = $1; if($hdr =~ /^(X509 |TRUSTED |)CERTIFICATE$/) { $is_cert = 1; last if($is_crl); } elsif($hdr eq "X509 CRL") { $is_crl = 1; last if($is_cert); } } } close IN; return ($is_cert, $is_crl); } # Link a certificate to its subject name hash value, each hash is of # the form . where n is an integer. If the hash value already exists # then we need to up the value of n, unless its a duplicate in which # case we skip the link. We check for duplicates by comparing the # certificate fingerprints sub link_hash_cert { my $fname = $_[0]; $fname =~ s/'/'\\''/g; my ($hash, $fprint) = `"$openssl" x509 -hash -fingerprint -noout -in '$fname'`; chomp $hash; chomp $fprint; $fprint =~ s/^.*=//; $fprint =~ tr/://d; my $suffix = 0; # Search for an unused hash filename while(exists $hashlist{"$hash.$suffix"}) { # Hash matches: if fingerprint matches its a duplicate cert if($hashlist{"$hash.$suffix"} eq $fprint) { print STDERR "WARNING: Skipping duplicate certificate $fname\n"; return; } $suffix++; } $hash .= ".$suffix"; print "$fname => $hash\n"; $symlink_exists=eval {symlink("",""); 1}; if ($symlink_exists) { symlink $fname, $hash; } else { system ("cp", $fname, $hash); } $hashlist{$hash} = $fprint; } # Same as above except for a CRL. CRL links are of the form .r sub link_hash_crl { my $fname = $_[0]; $fname =~ s/'/'\\''/g; my ($hash, $fprint) = `"$openssl" crl -hash -fingerprint -noout -in '$fname'`; chomp $hash; chomp $fprint; $fprint =~ s/^.*=//; $fprint =~ tr/://d; my $suffix = 0; # Search for an unused hash filename while(exists $hashlist{"$hash.r$suffix"}) { # Hash matches: if fingerprint matches its a duplicate cert if($hashlist{"$hash.r$suffix"} eq $fprint) { print STDERR "WARNING: Skipping duplicate CRL $fname\n"; return; } $suffix++; } $hash .= ".r$suffix"; print "$fname => $hash\n"; $symlink_exists=eval {symlink("",""); 1}; if ($symlink_exists) { symlink $fname, $hash; } else { system ("cp", $fname, $hash); } $hashlist{$hash} = $fprint; }