import postfix-3.5.9-19.el9

c9 imports/c9/postfix-3.5.9-19.el9
CentOS Sources 2 years ago committed by MSVSphere Packaging Team
commit 2c8e259d08

2
.gitignore vendored

@ -0,0 +1,2 @@
SOURCES/pflogsumm-1.1.5.tar.gz
SOURCES/postfix-3.5.9.tar.gz

@ -0,0 +1,2 @@
d18daa19d725e64c2b7e6c8da458b2d563272645 SOURCES/pflogsumm-1.1.5.tar.gz
f7caa483ebbb7f7b4f912dcfb879a5f1017c327e SOURCES/postfix-3.5.9.tar.gz

@ -0,0 +1,440 @@
Quick Start to Authenticate with SASL and PAM:
----------------------------------------------
If you don't need the details and are an experienced system
administrator you can just do this, otherwise read on.
1) Edit /etc/postfix/main.cf and set this:
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
smtpd_recipient_restrictions =
permit_sasl_authenticated,
permit_mynetworks,
reject_unauth_destination
2) Turn on saslauthd:
/sbin/chkconfig --level 345 saslauthd on
/sbin/service saslauthd start
3) Edit /etc/sysconfig/saslauthd and set this:
MECH=pam
4) Restart Postfix:
/sbin/service postfix restart
A crash course in using SASL with Postfix:
------------------------------------------
Red Hat's Postfix RPMs include support for both SASL and TLS. SASL, the
Simple Authentication and Security Layer, allows Postfix to implement RFC
2554, which defines an extension to ESMTP, SMTP AUTH, which compliant
ESMTP clients can use to authenticate themselves to ESMTP servers.
Typically, this is used to allow roaming users to relay mail through a
server safely without configuring the SMTP server to be an open relay.
Inclusion of TLS support allows Postfix to implement RFC 2487, which
defines an extension to ESMTP, SMTP STARTTLS, which compliant ESMTP
clients and servers can use to encrypt the SMTP session. This is a
security enhancement -- normally SMTP is transmitted as cleartext over the
wire, making it vulnerable to both passive sniffing and active alteration
via monkey-in-the-middle attacks. In addition, STARTTLS can also be
used by either or both server and client to verify the identity of the
other end, making it useful for the same sorts of purposes as SMTP AUTH.
The two can even be combined. Typically, this is done by first starting
TLS, to encrypt the SMTP session, and then issuing the SMTP AUTH command,
to authenticate the client; this combination ensures that the username
and password transferred as part of the SMTP AUTH are protected by the
TLS encrypted session.
SMTP AUTH is implemented using SASL, an abstraction layer which can
authenticate against a variety of sources. On Red Hat, SASL can use
the /etc/shadow file, or it can use PAM libraries, or it can use its own
password database (/etc/sasldb), or it can do various more exotic things.
Authentication raises a number of security concerns for obvious
reasons. As a consequence authentication services on Red Hat systems
are restricted to processes running with root privileges. However for
security reasons it is also essential that a mail server such as
Postfix run without root privileges so that mail operations cannot
compromise the host system. This means that Postfix cannot directly
use authentication services because it does not execute with root
privileges. The answer to this this problem is to introduce an
intermediary process that runs with root privileges which Postfix can
communicate with and will perform authentication on behalf of
Postfix. The SASL package includes an authentication daemon called
saslauthd which provided this service, think of it as an
authentication proxy.
Using Saslauthd:
----------------
To use saslauthd there are several things you must assure are
configured.
Selecting an Authentication Method:
-----------------------------------
Recall that it is saslauthd which is authenticating, not
Postfix. To start with you must tell Postfix to use saslauthd, in
main.cf edit this configuration parameter:
smtpd_sasl_auth_enable = yes
It is also recommended that you disable anonymous logins otherwise
you've left your system open, so also add this configuration
parameter.
smtpd_sasl_security_options = noanonymous
Now you must tell saslauthd which authentication method to use. To
determine the authentication methods currently supported by saslauthd
invoke saslauthd with the -v parameter, it will print its version and
its list of methods and then exit, for example:
/usr/sbin/saslauthd -v
saslauthd 2.1.10
authentication mechanisms: getpwent kerberos5 pam rimap shadow
When saslauthd starts up it reads its configuration options from the
file /etc/sysconfig/saslauthd. Currently there are two parameters
which can be set in this file, MECH and FLAGS. MECH is the
authentication mechanism and FLAGS is any command line flags you may
wish to pass to saslauthd. To tell saslauthd to use a specific
mechanism edit /etc/sysconfig/saslauthd and set the MECH parameter,
for example to use PAM it would look like this:
MECH=pam
Of course you may use any of the other authentication mechanisms that
saslauthd reported it supports. PAM is an excellent choice as PAM
supports many of the same authentication methods that saslauthd does,
but by using PAM you will have centralized all of your authentication
configuration under PAM which is one of PAM's greatest assets.
How Postfix Interacts with SASL to Name its Authentication Services:
--------------------------------------------------------------------
It can be very helpful to understand how Postfix communicates with
SASL to name its authentication services. Knowing this will let you
identify the configuration files the various components will access.
When Postfix invokes SASL it must give SASL an application name that
SASL will use among other things to locate a configuration file for
the application. The application name Postfix identifies itself as is
"smtpd". SASL will append ".conf" to the application name and look for
a config file in its library and config directories. Thus SASL will
read Postfix's configuration from
/etc/sasl2/smtpd.conf
This file names the authentication method SASL will use for Postfix
(actually for smtpd, other MTA's such as sendmail may use the same
file). Because we want to use the saslauthd authentication proxy
daemon the contents of this file is:
pwcheck_method: saslauthd
This tells SASL when being invoked to authentication for Postfix that
it should use saslauthd. Saslauthd's mechanism is set in
/etc/sysconfig/saslauthd (see below).
When Postfix calls on SASL to authenticate it passes to SASL a service
name. This service name is used in authentication method specific
way. The service name Postfix passes to SASL is "smtp" (note this is
not the same as the application name which is "smtpd"). To understand
this better consider the case of using PAM authentication. When SASL,
or in our case saslauthd, invokes PAM it passes the service name of
"smtp" to PAM which means that when PAM wants to read configuration
information for this client it will find it under the name of "smtp".
Turning on the Authentication Daemon:
-------------------------------------
Red Hat security policy is not to automatically enable services
belonging to a package when the package is installed. The system
administrator must explicitly enable the service. To enable saslauthd
do the following:
1) Tell the init process to launch saslauthd when entering various run
levels. Assuming you want saslauthd to run at run levels 3,4,5
invoke chkconfig.
/sbin/chkconfig --level 345 saslauthd on
2) You will probably want to start saslauthd now without having to
reboot, to do this:
/sbin/service saslauthd start
Trouble Shooting Authentication:
--------------------------------
The best way to debug authentication problems is to examine log
messages from the authentication components. However, normally these
log messages are suppressed. There are two principle reasons the
messages are suppressed. The first is that they are typically logged
at the DEBUG logging priority level which is the lowest priority and
the syslog configuration typically logs only higher priority
messages. The second reason is that for security reasons authentication
logging is considered a risk. Authentication logging has been divided
into two different facilities, auth and authpriv. authpriv is private
and is typically shunted off to a different log file with higher
protection. You will want to be able to see both auth and authpriv
messages at all priorities. To do this as root edit /etc/syslog.conf
file, find the following line
authpriv.* /var/log/secure
edit the line to:
authpriv.*;auth.* /var/log/secure
Then restart syslogd so the syslog configuration changes will be
picked up:
/sbin/service syslog restart
Now all authentication messages at all priorities will log to
/var/log/secure.
Using PAM to Authenticate:
--------------------------
Edit /etc/sysconfig/saslauthd and set MECH to PAM like this:
MECH=pam
When PAM is invoked via SASL it is passed a service name of
"smtp". This means that PAM will read its configuration parameters for
Postfix from the file: /etc/pam.d/smtp. By default this file is set to
refer to the global system PAM authentication policy, thus by default
you'll get whatever PAM authentication your system is configured for
and virtually all applications use. Configuring PAM authentication is
beyond the scope of this document, please refer to the PAM
documentation if you which to modify PAM.
Trouble Shooting PAM Authentication:
------------------------------------
1) One possible reason PAM may fail to authenticate even if the user
is known to the system is if PAM fails to find the service
configuration file in /etc/pam.d. Service configuration files are not
required by PAM, if it does not find a service configuration file it
will default to "other". Since PAM does not consider the absence of a
service configuration file a problem it does not log anything nor does
it return an error to the calling application. In other words it is
completely silent about the fact it did not find a service
configuration file. On Red Hat system the default implementation of
"other" for PAM is to deny access. This means on Red Hat systems the
absence of a PAM service configuration file will mean PAM will
silently fail authentication. The PAM service configuration file for
postfix is /etc/pam.d/smtp and is intalled by the Red Hat Postfix rpm
and put under control of "alternatives" with name mta. Alternatives
allows one to select between the sendmail and postfix MTA's and
manages symbolic links for files the two MTA's share. /etc/pam.d/smtp
is one such file, if you have not selected Postfix as your prefered
MTA the link to this file will not be present. To select Postfix as
your MTA do this: "/usr/sbin/alternatives --config mta" and follow the
prompt to select postfix.
2) Is SASL appending a realm or domain to a username? PAM
authentication requires a bare username and password, other
authentication methods require the username to be qualified with a
realm. Typically the username will be rewritten as user@realm
(e.g. user@foo.com) PAM does not understand a username with
"@realm" appended to it and will fail the authentication with the
message that the user is unknown. If the log files shows saslauthd
usernames with "@realm" appended to it then the
smtpd_sasl_local_domain configuration parameter is likely set in
/etc/postfix/main.cf file, make sure its either not set or set it
to an empty string. Restart postfix and test authtentication again,
the log file should show only a bare username.
Using saslpasswd to Authenticate:
---------------------------------
SASL can maintain its own password database independent of the host
system's authentication setup, it is called saslpasswd. You may wish
to use saslpasswd if you want to isolate who can smtp authenticate
from general system users. However, it does add another password
database that a system administrator must maintain.
To authenticate against sasldb, you'll first have to create accounts.
These accounts are entirely separate from system accounts, and are used
only by connecting SMTP clients to authenticate themselves. Use the
saslpassword command:
saslpasswd -u `postconf -h myhostname` -c user
to create an account named user which can log into realm. For the
realm, make absolutely certain that you use the same value as is set for
myhostname in /etc/postfix/main.cf. If you don't, it likely won't work.
Also, be aware that saslpasswd is somewhat buggy. The first time you
run it, it may generate an error message while initializing the sasldb.
If it does, just add that user a second time.
You'll need to set permissions on the SASL password database so that
the Postfix daemons can read it:
chgrp postfix /etc/sasldb
chmod g+r /etc/sasldb
Now, you'll need to modify /etc/postfix/main.cf to tell it to
support SASL. The complete options you might want to use are in the
sample-auth.cf file in the Postfix documentation directory. An option
you will definitely need is:
# enable SASL support
smtpd_sasl_auth_enable = yes
You might also need to set the SASL authentication realm to whatever
realm you used when you created your sasldb; by default, this is set to
$myhostname, but you instead might need something like:
# set SASL realm to domain instead
smtpd_sasl_local_domain = $mydomain
Other Postfix Authentication Parameters:
----------------------------------------
If you want to allow your already configured users to still use your SMTP
server, and to allow users authenticated via SMTP AUTH to use your server
as well, then modify your existing smtpd_recipient_restrictions line to;
# also allow authenticated (RFC 2554) users
smtpd_recipient_restrictions = permit_sasl_authenticated ...
If you want to restrict use of your server to just authenticated clients
(Note: this is a bad idea for public mail servers), then instead use:
# restrict server access to authenticated (RFC 2554) clients
smtpd_delay_reject = yes
smtpd_client_restrictions = permit_sasl_authenticated ...
SASL supports several password types which have differing security
properties. Different SMTP clients may support some or all of these
password types. When the client issues an EHLO command, the server
tells it which types it supports:
$ telnet station6 25
Trying 10.100.0.6...
Connected to station6.example.com.
Escape character is '^]'.
220 station6.example.com ESMTP Postfix
ehlo station7
250-station6.example.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-AUTH PLAIN LOGIN DIGEST-MD5 CRAM-MD5
250-XVERP
250 8BITMIME
Here, the server supports PLAIN, LOGIN, DIGEST-MD5, and CRAM-MD5 password
methods.
The client then chooses the first of these listed methods which it also
supports, and issues an SMTP AUTH request.
For security, PLAIN and LOGIN methods are typically disabled. These two
methods use trivially decryptable encryption, making the username and
password issued by the client vulnerable to interception via a sniffer
in between the server and client. Unfortunately, they can't always
be disabled. Some popular SMTP clients, including MS Outlook 5.x,
only support PLAIN authentication, for example.
To limit the login methods offered by the server:
# disable unsafe password methods
smtpd_sasl_security_options = noplaintext noanonymous
Available options are:
noplaintext, which disables LOGIN and PLAIN
noanonymous, which disables disables ANON
nodictionary, which disables methods vulnerable to dictionary attacks
noactive, which disables methods vulnerable to active attacks
The last two are rarely used, since almost all supported methods are
vulnerable to those attacks ;-).
Also be aware that some broken clients mis-implement the SMTP AUTH
protocol, and send commands using incorrect syntax (AUTH=foo instead of
the correct AUTH foo). MS Outlook 4.x clients have this bug, among
a legion of others.... If you need to support these clients, use:
# support braindead MS products
broken_sasl_auth_clients = yes
To help prevent spoofing, you can also create a map file of SASL login
names which are allowed to use specific envelope sender (MAIL FROM)
addresses. If you choose to do this, you also have to tell Postfix to
reject addresses which don't match login names:
# prevent spoofing by authenticated users
reject_sender_login_mismatch
smtpd_sender_login_maps=type:/path/to/file
Configuration of SASL clients is much simpler. Postfix itself can be
made a SASL client; this is typically useful when roaming users run Linux
on their laptop and need to relay mail back through the organization's
main server.
To enable Postfix to act as an SMTP AUTH client, simply add to
/etc/postfix/main.cf:
# support authentication (RFC 2557) when relaying through a server
smtp_sasl_auth_enable = yes
and tell Postfix where to find the usernames and passwords it should
use to authenticate:
# location of passwords for authentication client
smtp_sasl_password_maps = type:/path/to/file
The file itself should have the format:
destination username:password
where destination is the name of the server, and username:password are
the username and password which should be presented to that server to
authenticate when connecting to it as a client.
Optionally, the authentication methods to be used can be specified for
the Postfix client, just as they can be for the Postfix server:
# disable plaintext and anonymous
smtp_sasl_security_options = noplaintext noanonymous
Many popular end-user MUAs can also be configured as SMTP AUTH clients.
Clients capable of this supplied with Red Hat include pine, Netscape,
and Mozilla.
Other Sources of Documentation:
-------------------------------
/usr/share/doc/postfix-<version>/README_FILES/SASL_README
Local configuration examples:
/usr/share/doc/postfix-*/samples
Postfix Howtos, Guides and Tips by Ralf Hildebrandt and Patrick
Koetter can be found at: http://postfix.state-of-mind.de
------------------------------------------------------------------------------
Please send any comments / corrections to Chris Ricker
<kaboom@gatech.edu>. This material can be freely modified and
redistributed. Additional material provided by John Dennis
<jdennis@redhat.com> and Dax Kelson <dax@gurulabs.com>.

@ -0,0 +1,15 @@
diff --git pflogsumm-1.1.5/pflogsumm.pl pflogsumm-1.1.5/pflogsumm.pl
index 31de5bd..36384dd 100755
--- pflogsumm-1.1.5/pflogsumm.pl
+++ pflogsumm-1.1.5/pflogsumm.pl
@@ -398,8 +398,8 @@ Copyright (C) 1998-2010 by James S. Seymour, Release 1.1.5
use strict;
use locale;
use Getopt::Long;
-eval { require Date::Calc };
-my $hasDateCalc = $@ ? 0 : 1;
+require Date::Calc;
+my $hasDateCalc = 1;
my $mailqCmd = "mailq";
my $release = "1.1.5";

@ -0,0 +1,13 @@
diff --git pflogsumm-1.1.5/pflogsumm.pl pflogsumm-1.1.5/pflogsumm.pl
index 36384dd..eb527d0 100755
--- pflogsumm-1.1.5/pflogsumm.pl
+++ pflogsumm-1.1.5/pflogsumm.pl
@@ -1536,7 +1536,7 @@ sub gimme_domain {
# split domain/ipaddr into separates
# newer versions of Postfix have them "dom.ain[i.p.add.ress]"
# older versions of Postfix have them "dom.ain/i.p.add.ress"
- unless((($domain, $ipAddr) = /^([^\[]+)\[((?:\d{1,3}\.){3}\d{1,3})\]/) == 2 ||
+ unless((($domain, $ipAddr) = /^([^\[]+)\[((?:\d{1,3}\.){3}\d{1,3}|[0-9a-f:]+)\]/) == 2 ||
(($domain, $ipAddr) = /^([^\/]+)\/([0-9a-f.:]+)/i) == 2) {
# more exhaustive method
($domain, $ipAddr) = /^([^\[\(\/]+)[\[\(\/]([^\]\)]+)[\]\)]?:?\s*$/;

@ -0,0 +1,18 @@
diff --git a/pflogsumm-1.1.5/pflogsumm.pl b/pflogsumm-1.1.5/pflogsumm.pl
index eb527d0..7e26206 100755
--- a/pflogsumm-1.1.5/pflogsumm.pl
+++ b/pflogsumm-1.1.5/pflogsumm.pl
@@ -503,7 +503,12 @@ $usageMsg =
# Accept either "_"s or "-"s in --switches
foreach (@ARGV) {
last if($_ eq "--");
- tr/_/-/ if(/^--\w/);
+ if (/^--\w/)
+ {
+ my @argspl = split("=", $_, 2);
+ $argspl[0] =~ tr/_/-/;
+ $_ = join("=", @argspl);
+ }
}
# Some pre-inits for convenience

@ -0,0 +1,22 @@
diff --git a/conf/post-install b/conf/post-install
index 25ef7e6..4fd6434 100644
--- a/conf/post-install
+++ b/conf/post-install
@@ -537,6 +537,17 @@ test -n "$create" && {
case $path in
no|no/*) continue;;
esac
+ # Munge paths for alternatives.
+ case $path in
+ /usr/bin/mailq) path=$path.postfix ;;
+ /usr/bin/newaliases) path=$path.postfix ;;
+ /usr/bin/rmail) path=$path.postfix ;;
+ /usr/sbin/sendmail) path=$path.postfix ;;
+ /usr/share/man/man1/mailq.1.gz) path=/usr/share/man/man1/mailq.postfix.1.gz ;;
+ /usr/share/man/man1/newaliases.1.gz) path=/usr/share/man/man1/newaliases.postfix.1.gz ;;
+ /usr/share/man/man5/aliases.5.gz) path=/usr/share/man/man5/aliases.postfix.5.gz ;;
+ /usr/share/man/man8/smtpd.8.gz) path=/usr/share/man/man8/smtpd.postfix.8.gz ;;
+ esac
# Pick up the flags.
case $flags in *u*) upgrade_flag=1;; *) upgrade_flag=;; esac
case $flags in *c*) create_flag=1;; *) create_flag=;; esac

@ -0,0 +1,63 @@
diff --git a/conf/postfix-files b/conf/postfix-files
index 4ed9d1f..19711d2 100644
--- a/conf/postfix-files
+++ b/conf/postfix-files
@@ -83,7 +83,6 @@ $shlib_directory/${LIB_PREFIX}sqlite${LIB_SUFFIX}:f:root:-:755
$meta_directory/dynamicmaps.cf.d:d:root:-:755
$meta_directory/dynamicmaps.cf:f:root:-:644
$meta_directory/main.cf.proto:f:root:-:644
-$meta_directory/makedefs.out:f:root:-:644
$meta_directory/master.cf.proto:f:root:-:644
$meta_directory/postfix-files.d:d:root:-:755
$meta_directory/postfix-files:f:root:-:644
@@ -141,18 +140,13 @@ $command_directory/postqueue:f:root:$setgid_group:2755:u
$sendmail_path:f:root:-:755
$newaliases_path:l:$sendmail_path
$mailq_path:l:$sendmail_path
-$config_directory/LICENSE:f:root:-:644:1
-$config_directory/TLS_LICENSE:f:root:-:644:1
$config_directory/access:f:root:-:644:p1
-$config_directory/aliases:f:root:-:644:p1
-$config_directory/bounce.cf.default:f:root:-:644:1
$config_directory/canonical:f:root:-:644:p1
$config_directory/cidr_table:f:root:-:644:o
$config_directory/generic:f:root:-:644:p1
$config_directory/generics:f:root:-:644:o
$config_directory/header_checks:f:root:-:644:p1
$config_directory/install.cf:f:root:-:644:o
-$config_directory/main.cf.default:f:root:-:644:1
$config_directory/main.cf:f:root:-:644:p
$config_directory/master.cf:f:root:-:644:p
$config_directory/pcre_table:f:root:-:644:o
@@ -165,8 +159,8 @@ $config_directory/postfix-script:f:root:-:755:o
$config_directory/postfix-script-sgid:f:root:-:755:o
$config_directory/postfix-script-nosgid:f:root:-:755:o
$config_directory/post-install:f:root:-:755:o
-$manpage_directory/man1/mailq.1:f:root:-:644
-$manpage_directory/man1/newaliases.1:f:root:-:644
+$manpage_directory/man1/mailq.postfix.1:f:root:-:644
+$manpage_directory/man1/newaliases.postfix.1:f:root:-:644
$manpage_directory/man1/postalias.1:f:root:-:644
$manpage_directory/man1/postcat.1:f:root:-:644
$manpage_directory/man1/postconf.1:f:root:-:644
@@ -180,9 +174,9 @@ $manpage_directory/man1/postmap.1:f:root:-:644
$manpage_directory/man1/postmulti.1:f:root:-:644
$manpage_directory/man1/postqueue.1:f:root:-:644
$manpage_directory/man1/postsuper.1:f:root:-:644
-$manpage_directory/man1/sendmail.1:f:root:-:644
+$manpage_directory/man1/sendmail.postfix.1:f:root:-:644
$manpage_directory/man5/access.5:f:root:-:644
-$manpage_directory/man5/aliases.5:f:root:-:644
+$manpage_directory/man5/aliases.postfix.5:f:root:-:644
$manpage_directory/man5/body_checks.5:f:root:-:644
$manpage_directory/man5/bounce.5:f:root:-:644
$manpage_directory/man5/canonical.5:f:root:-:644
@@ -230,7 +224,7 @@ $manpage_directory/man8/qmqpd.8:f:root:-:644
$manpage_directory/man8/scache.8:f:root:-:644
$manpage_directory/man8/showq.8:f:root:-:644
$manpage_directory/man8/smtp.8:f:root:-:644
-$manpage_directory/man8/smtpd.8:f:root:-:644
+$manpage_directory/man8/smtpd.postfix.8:f:root:-:644
$manpage_directory/man8/spawn.8:f:root:-:644
$manpage_directory/man8/tlsproxy.8:f:root:-:644
$manpage_directory/man8/tlsmgr.8:f:root:-:644

@ -0,0 +1,37 @@
diff --git a/src/util/fsspace.c b/src/util/fsspace.c
index 50a4aa7..beef3db 100644
--- a/src/util/fsspace.c
+++ b/src/util/fsspace.c
@@ -91,8 +91,15 @@ void fsspace(const char *path, struct fsspace * sp)
if (statvfs(path, &fsbuf) < 0)
msg_fatal("statvfs %s: %m", path);
- sp->block_size = fsbuf.f_frsize;
- sp->block_free = fsbuf.f_bavail;
+ if (fsbuf.f_frsize > 0)
+ sp->block_size = fsbuf.f_frsize;
+ else
+ sp->block_size = fsbuf.f_bsize;
+ /* 4G of FS blocks is surely enough space to put a mail in */
+ sp->block_free = 0;
+ sp->block_free = ~sp->block_free;
+ if (fsbuf.f_bavail < sp->block_free)
+ sp->block_free = fsbuf.f_bavail;
#endif
if (msg_verbose)
msg_info("%s: %s: block size %lu, blocks free %lu",
diff --git a/src/util/sys_defs.h b/src/util/sys_defs.h
index a8d2571..ad07498 100644
--- a/src/util/sys_defs.h
+++ b/src/util/sys_defs.h
@@ -769,8 +769,8 @@ extern int initgroups(const char *, int);
#define GETTIMEOFDAY(t) gettimeofday(t,(struct timezone *) 0)
#define ROOT_PATH "/bin:/usr/bin:/sbin:/usr/sbin"
#define FIONREAD_IN_TERMIOS_H
-#define USE_STATFS
-#define STATFS_IN_SYS_VFS_H
+#define USE_STATVFS
+#define STATVFS_IN_SYS_STATVFS_H
#define PREPEND_PLUS_TO_OPTSTRING
#define HAS_POSIX_REGEXP
#define HAS_DLOPEN

@ -0,0 +1,35 @@
--- a/examples/chroot-setup/LINUX2 2006-01-01 15:53:58.000000000 -0800
+++ b/examples/chroot-setup/LINUX2 2016-11-27 00:45:52.145301784 -0800
@@ -45,14 +45,14 @@
# 20060101 /lib64 support by Keith Owens.
#
-CP="cp -p"
+CP="cp -p -Z"
cond_copy() {
# find files as per pattern in $1
# if any, copy to directory $2
dir=`dirname "$1"`
pat=`basename "$1"`
- lr=`find "$dir" -maxdepth 1 -name "$pat"`
+ lr=`find "$dir/" -maxdepth 1 -name "$pat"`
if test ! -d "$2" ; then exit 1 ; fi
if test "x$lr" != "x" ; then $CP $1 "$2" ; fi
}
@@ -63,8 +63,8 @@
POSTFIX_DIR=${POSTFIX_DIR-/var/spool/postfix}
cd ${POSTFIX_DIR}
-mkdir -p etc lib usr/lib/zoneinfo
-test -d /lib64 && mkdir -p lib64
+mkdir -p -Z etc lib usr/lib/zoneinfo
+test -d /lib64 && mkdir -p -Z lib64
# find localtime (SuSE 5.3 does not have /etc/localtime)
lt=/etc/localtime
@@ -88,4 +88,3 @@
cond_copy '/lib64/libdb.so*' lib64
fi
-postfix reload

@ -0,0 +1,145 @@
diff --git a/conf/main.cf b/conf/main.cf
index 7af8bde..495e346 100644
--- a/conf/main.cf
+++ b/conf/main.cf
@@ -132,6 +132,10 @@ mail_owner = postfix
#inet_interfaces = all
#inet_interfaces = $myhostname
#inet_interfaces = $myhostname, localhost
+inet_interfaces = localhost
+
+# Enable IPv4, and IPv6 if supported
+inet_protocols = all
# The proxy_interfaces parameter specifies the network interface
# addresses that this mail system receives mail on by way of a
@@ -176,7 +180,7 @@ mail_owner = postfix
#
# See also below, section "REJECTING MAIL FOR UNKNOWN LOCAL USERS".
#
-#mydestination = $myhostname, localhost.$mydomain, localhost
+mydestination = $myhostname, localhost.$mydomain, localhost
#mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
#mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain,
# mail.$mydomain, www.$mydomain, ftp.$mydomain
@@ -398,7 +402,7 @@ unknown_local_recipient_reject_code = 550
# "postfix reload" to eliminate the delay.
#
#alias_maps = dbm:/etc/aliases
-#alias_maps = hash:/etc/aliases
+alias_maps = hash:/etc/aliases
#alias_maps = hash:/etc/aliases, nis:mail.aliases
#alias_maps = netinfo:/aliases
@@ -409,7 +413,7 @@ unknown_local_recipient_reject_code = 550
#
#alias_database = dbm:/etc/aliases
#alias_database = dbm:/etc/mail/aliases
-#alias_database = hash:/etc/aliases
+alias_database = hash:/etc/aliases
#alias_database = hash:/etc/aliases, hash:/opt/majordomo/aliases
# ADDRESS EXTENSIONS (e.g., user+foo)
@@ -479,7 +483,27 @@ unknown_local_recipient_reject_code = 550
#
# Cyrus IMAP over LMTP. Specify ``lmtpunix cmd="lmtpd"
# listen="/var/imap/socket/lmtp" prefork=0'' in cyrus.conf.
-#mailbox_transport = lmtp:unix:/var/imap/socket/lmtp
+#mailbox_transport = lmtp:unix:/var/lib/imap/socket/lmtp
+
+# If using the cyrus-imapd IMAP server deliver local mail to the IMAP
+# server using LMTP (Local Mail Transport Protocol), this is prefered
+# over the older cyrus deliver program by setting the
+# mailbox_transport as below:
+#
+# mailbox_transport = lmtp:unix:/var/lib/imap/socket/lmtp
+#
+# The efficiency of LMTP delivery for cyrus-imapd can be enhanced via
+# these settings.
+#
+# local_destination_recipient_limit = 300
+# local_destination_concurrency_limit = 5
+#
+# Of course you should adjust these settings as appropriate for the
+# capacity of the hardware you are using. The recipient limit setting
+# can be used to take advantage of the single instance message store
+# capability of Cyrus. The concurrency limit can be used to control
+# how many simultaneous LMTP sessions will be permitted to the Cyrus
+# message store.
#
# Cyrus IMAP via command line. Uncomment the "cyrus...pipe" and
# subsequent line in master.cf.
@@ -499,8 +523,7 @@ unknown_local_recipient_reject_code = 550
# the main.cf file, otherwise the SMTP server will reject mail for
# non-UNIX accounts with "User unknown in local recipient table".
#
-#fallback_transport = lmtp:unix:/file/name
-#fallback_transport = cyrus
+#fallback_transport = lmtp:unix:/var/lib/imap/socket/lmtp
#fallback_transport =
# The luser_relay parameter specifies an optional destination address
@@ -673,4 +696,41 @@ sample_directory =
# readme_directory: The location of the Postfix README files.
#
readme_directory =
-inet_protocols = ipv4
+
+# TLS CONFIGURATION
+#
+# Basic Postfix TLS configuration by default with self-signed certificate
+# for inbound SMTP and also opportunistic TLS for outbound SMTP.
+
+# The full pathname of a file with the Postfix SMTP server RSA certificate
+# in PEM format. Intermediate certificates should be included in general,
+# the server certificate first, then the issuing CA(s) (bottom-up order).
+#
+smtpd_tls_cert_file = /etc/pki/tls/certs/postfix.pem
+
+# The full pathname of a file with the Postfix SMTP server RSA private key
+# in PEM format. The private key must be accessible without a pass-phrase,
+# i.e. it must not be encrypted.
+#
+smtpd_tls_key_file = /etc/pki/tls/private/postfix.key
+
+# Announce STARTTLS support to remote SMTP clients, but do not require that
+# clients use TLS encryption (opportunistic TLS inbound).
+#
+smtpd_tls_security_level = may
+
+# Directory with PEM format Certification Authority certificates that the
+# Postfix SMTP client uses to verify a remote SMTP server certificate.
+#
+smtp_tls_CApath = /etc/pki/tls/certs
+
+# The full pathname of a file containing CA certificates of root CAs
+# trusted to sign either remote SMTP server certificates or intermediate CA
+# certificates.
+#
+smtp_tls_CAfile = /etc/pki/tls/certs/ca-bundle.crt
+
+# Use TLS if this is supported by the remote SMTP server, otherwise use
+# plaintext (opportunistic TLS outbound).
+#
+smtp_tls_security_level = may
diff --git a/conf/master.cf b/conf/master.cf
index c0f2508..05c5d07 100644
--- a/conf/master.cf
+++ b/conf/master.cf
@@ -98,14 +98,14 @@ postlog unix-dgram n - n - 1 postlogd
# Also specify in main.cf: cyrus_destination_recipient_limit=1
#
#cyrus unix - n n - - pipe
-# flags=DRX user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
+# flags=DRX user=cyrus argv=/usr/lib/cyrus-imapd/deliver -e -r ${sender} -m ${extension} ${user}
#
# ====================================================================
#
# Old example of delivery via Cyrus.
#
#old-cyrus unix - n n - - pipe
-# flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
+# flags=R user=cyrus argv=/usr/lib/cyrus-imapd/deliver -e -m ${extension} ${user}
#
# ====================================================================
#

@ -0,0 +1,17 @@
diff --git a/src/util/dict_inline.c b/src/util/dict_inline.c
index a416d7c..72339b2 100644
--- a/src/util/dict_inline.c
+++ b/src/util/dict_inline.c
@@ -113,9 +113,9 @@ DICT *dict_inline_open(const char *name, int open_flags, int dict_flags)
dict = dict_open3(DICT_TYPE_HT, name, open_flags, dict_flags);
dict_type_override(dict, DICT_TYPE_INLINE);
while ((nameval = mystrtokq(&cp, CHARS_COMMA_SP, CHARS_BRACE)) != 0) {
- if ((nameval[0] != CHARS_BRACE[0]
- || (err = free_me = extpar(&nameval, CHARS_BRACE, EXTPAR_FLAG_STRIP)) == 0)
- && (err = split_qnameval(nameval, &vname, &value)) != 0)
+ if (nameval[0] == CHARS_BRACE[0])
+ err = free_me = extpar(&nameval, CHARS_BRACE, EXTPAR_FLAG_STRIP);
+ if (err != 0 || (err = split_qnameval(nameval, &vname, &value)) != 0)
break;
if ((dict->flags & DICT_FLAG_SRC_RHS_IS_FILE) != 0) {

@ -0,0 +1,12 @@
diff --git a/src/util/sys_defs.h b/src/util/sys_defs.h
index 99bec9b..95c78ec 100644
--- a/src/util/sys_defs.h
+++ b/src/util/sys_defs.h
@@ -802,6 +803,7 @@ extern int initgroups(const char *, int);
#define _PATH_PROCNET_IFINET6 "/proc/net/if_inet6"
#endif
#endif
+#define HAS_CLOSEFROM
#include <linux/version.h>
#if !defined(KERNEL_VERSION)
#define KERNEL_VERSION(a,b,c) (LINUX_VERSION_CODE + 1)

@ -0,0 +1,13 @@
diff --git a/src/cleanup/cleanup_message.c b/src/cleanup/cleanup_message.c
index 391c711..be5ce42 100644
--- a/src/cleanup/cleanup_message.c
+++ b/src/cleanup/cleanup_message.c
@@ -773,6 +773,8 @@ static void cleanup_header_done_callback(void *context)
/* Normalize whitespace. */
token = tok822_scan_limit(state->fullname, &dummy_token,
var_token_limit);
+ if (!token)
+ token = tok822_alloc(TOK822_QSTRING, state->fullname);
} else {
token = tok822_alloc(TOK822_QSTRING, state->fullname);
}

@ -0,0 +1,4 @@
#!/bin/bash
[ -x /etc/postfix/chroot-update ] && exec /etc/postfix/chroot-update
exit 0

@ -0,0 +1,164 @@
#!/bin/bash
#
# postfix Postfix Mail Transfer Agent
#
# chkconfig: - 80 30
# description: Postfix is a Mail Transport Agent, which is the program \
# that moves mail from one machine to another.
# processname: master
# pidfile: /var/spool/postfix/pid/master.pid
# config: /etc/postfix/main.cf
# config: /etc/postfix/master.cf
#
# Based on startup script from Simon J Mudd <sjmudd@pobox.com>
# 25/02/99: Mostly s/sendmail/postfix/g by John A. Martin <jam@jamux.com>
# 23/11/00: Changes & suggestions by Ajay Ramaswamy <ajayr@bigfoot.com>
# 20/01/01: Changes to fall in line with RedHat 7.0 style
# 23/02/01: Fix a few untidy problems with help from Daniel Roesen.
### BEGIN INIT INFO
# Provides: postfix $mail-transfer-agent
# Required-Start: $local_fs $network $remote_fs
# Required-Stop: $local_fs $network $remote_fs
# Short-Description: start and stop postfix
# Description: Postfix is a Mail Transport Agent, which is the program that
# moves mail from one machine to another.
### END INIT INFO
# Source function library.
. /etc/rc.d/init.d/functions
# Source networking configuration.
. /etc/sysconfig/network
RETVAL=0
prog="postfix"
lockfile=/var/lock/subsys/$prog
pidfile=/var/spool/postfix/pid/master.pid
ALIASESDB_STAMP=/var/lib/misc/postfix.aliasesdb-stamp
# Script to update chroot environment
CHROOT_UPDATE=/etc/postfix/chroot-update
status -p $pidfile -l $(basename $lockfile) master >/dev/null 2>&1
running=$?
conf_check() {
[ -x /usr/sbin/postfix ] || exit 5
[ -d /etc/postfix ] || exit 6
[ -d /var/spool/postfix ] || exit 5
}
make_aliasesdb() {
if [ "$(/usr/sbin/postconf -h alias_database)" == "hash:/etc/aliases" ]
then
# /etc/aliases.db may be used by other MTA, make sure nothing
# has touched it since our last newaliases call
[ /etc/aliases -nt /etc/aliases.db ] ||
[ "$ALIASESDB_STAMP" -nt /etc/aliases.db ] ||
[ "$ALIASESDB_STAMP" -ot /etc/aliases.db ] || return
/usr/bin/newaliases
touch -r /etc/aliases.db "$ALIASESDB_STAMP"
else
/usr/bin/newaliases
fi
}
start() {
[ "$EUID" != "0" ] && exit 4
# Check that networking is up.
[ ${NETWORKING} = "no" ] && exit 1
conf_check
# Start daemons.
echo -n $"Starting postfix: "
make_aliasesdb >/dev/null 2>&1
[ -x $CHROOT_UPDATE ] && $CHROOT_UPDATE
/usr/sbin/postfix start 2>/dev/null 1>&2 && success || failure $"$prog start"
RETVAL=$?
[ $RETVAL -eq 0 ] && touch $lockfile
echo
return $RETVAL
}
stop() {
[ "$EUID" != "0" ] && exit 4
conf_check
# Stop daemons.
echo -n $"Shutting down postfix: "
/usr/sbin/postfix stop 2>/dev/null 1>&2 && success || failure $"$prog stop"
RETVAL=$?
[ $RETVAL -eq 0 ] && rm -f $lockfile $pidfile
echo
return $RETVAL
}
reload() {
conf_check
echo -n $"Reloading postfix: "
[ -x $CHROOT_UPDATE ] && $CHROOT_UPDATE
/usr/sbin/postfix reload 2>/dev/null 1>&2 && success || failure $"$prog reload"
RETVAL=$?
echo
return $RETVAL
}
abort() {
conf_check
/usr/sbin/postfix abort 2>/dev/null 1>&2 && success || failure $"$prog abort"
return $?
}
flush() {
conf_check
/usr/sbin/postfix flush 2>/dev/null 1>&2 && success || failure $"$prog flush"
return $?
}
check() {
conf_check
/usr/sbin/postfix check 2>/dev/null 1>&2 && success || failure $"$prog check"
return $?
}
# See how we were called.
case "$1" in
start)
[ $running -eq 0 ] && exit 0
start
;;
stop)
[ $running -eq 0 ] || exit 0
stop
;;
restart|force-reload)
stop
start
;;
reload)
[ $running -eq 0 ] || exit 7
reload
;;
abort)
abort
;;
flush)
flush
;;
check)
check
;;
status)
status -p $pidfile -l $(basename $lockfile) master
;;
condrestart)
[ $running -eq 0 ] || exit 0
stop
start
;;
*)
echo $"Usage: $0 {start|stop|restart|reload|abort|flush|check|status|condrestart}"
exit 2
esac
exit $?

@ -0,0 +1,3 @@
#%PAM-1.0
auth include password-auth
account include password-auth

@ -0,0 +1,2 @@
pwcheck_method: saslauthd
mech_list: plain login

@ -0,0 +1,20 @@
#!/bin/bash
ALIASESDB_STAMP=/var/lib/misc/postfix.aliasesdb-stamp
make_aliasesdb() {
if [ "$(/usr/sbin/postconf -h alias_database)" == "hash:/etc/aliases" ]
then
# /etc/aliases.db may be used by other MTA, make sure nothing
# has touched it since our last newaliases call
[ /etc/aliases -nt /etc/aliases.db ] ||
[ "$ALIASESDB_STAMP" -nt /etc/aliases.db ] ||
[ "$ALIASESDB_STAMP" -ot /etc/aliases.db ] || return 0
/usr/bin/newaliases
touch -r /etc/aliases.db "$ALIASESDB_STAMP"
else
/usr/bin/newaliases
fi
}
make_aliasesdb

@ -0,0 +1,22 @@
[Unit]
Description=Postfix Mail Transport Agent
After=syslog.target network.target
Conflicts=sendmail.service exim.service
[Service]
Type=forking
PIDFile=/var/spool/postfix/pid/master.pid
EnvironmentFile=-/etc/sysconfig/network
PrivateTmp=true
CapabilityBoundingSet=~ CAP_NET_ADMIN CAP_SYS_ADMIN CAP_SYS_BOOT CAP_SYS_MODULE
ProtectSystem=true
PrivateDevices=true
ExecStartPre=-/usr/sbin/restorecon -R /var/spool/postfix/pid/master.pid
ExecStartPre=-/usr/libexec/postfix/aliasesdb
ExecStartPre=-/usr/libexec/postfix/chroot-update
ExecStart=/usr/sbin/postfix start
ExecReload=/usr/sbin/postfix reload
ExecStop=/usr/sbin/postfix stop
[Install]
WantedBy=multi-user.target

File diff suppressed because it is too large Load Diff
Loading…
Cancel
Save