Postfix // Maquerading internal hosts

Here we need it to be able to talk on the public network to other MXes. Make sure you’ve got a public A and PTR for this host

cp -i /etc/postfix/master.cf /etc/postfix/master.cf.dist
vi /etc/postfix/master.cf

smtp      inet  n       -       n       -       -       smtpd 

cp -i /etc/postfix/main.cf /etc/postfix/main.cf.dist
vi /etc/postfix/main.cf

OUTBOUND ONLY

It is here listening in plain-text on the internal network – this is not CIDR but rather binding to an interface.

inet_interfaces = 127.0.0.1, x.x.x.x
mynetworks_style = subnet

That one needs to resolve on the public network

smtpd_banner = relay for internal hosts
myhostname = std30.os3.su
mydomain = os3.su
myorigin = os3.su

Do something like NAT for Sender addresses (Return-path)

masquerade_domains = os3.su
sender_canonical_classes = envelope_sender, header_sender
sender_canonical_maps = regexp:/etc/postfix/sender_canonical

Dymanical for any internal host and domain (Received headers and data fields will still let you know which server originally sent the message)

vi /etc/postfix/sender_canonical

#/.+/                root@os3.su
/.+@.+\.localdomain/ root@os3.su

Note this has a mild security implication - any internal host, be it mallory, may use that relay and the return path will be yours.

Enforce outbound starttls

OUTBOUND AND INBOUND

we eventually need an origin and destination to make possible bounces end-up somewhere while avoiding loops

local user, get rid of the root alias

vi /etc/mail/aliases
newaliases

change those

inet_interfaces = all
mynetworks = 127.0.0.1/32, 10.1.1.0/24

mydestination = os3.su

get a self-signed certificate ready and enforce inbound starttls

Operations

postfix check
service postfix restart

Check you are listening on the internal interface only

netstat -an -f inet
netstat -lntup

Acceptance

check the logs on all the hosts on the way - source, relay, and eventually destination

tail -F /var/log/maillog
#tail -F /var/log/mail.log
date | mail -s `hostname` root

Resources

Bind Postfix Mail Server To Localhost or Specific IP Address Only https://www.cyberciti.biz/faq/postfix-receive-mail-on-specific-network-interfaces/

Postfix Address Rewriting –> Address masquerading http://www.postfix.org/ADDRESS_REWRITING_README.html

Postfix masquerading or changing outgoing SMTP email or mail address https://www.cyberciti.biz/tips/howto-postfix-masquerade-change-email-mail-address.html

canonical - format of Postfix canonical table http://www.porcupine.org/postfix/doc/canonical.5.html

Rewriting Addresses https://www.oreilly.com/library/view/postfix-the-definitive/0596002122/ch04s07.html

How to masquerade domains in Postfix https://access.redhat.com/solutions/21331

Forcing the from address when postfix relays over smtp https://serverfault.com/questions/147921/forcing-the-from-address-when-postfix-relays-over-smtp

Blog: How to rewrite outgoing address in Postfix http://semi-legitimate.com/blog/item/how-to-rewrite-outgoing-address-in-postfix

Address rewriting when mail is received https://www.linuxtopia.org/online_books/mail_systems/postfix_documentation/ADDRESS_REWRITING_README_003.html

How To Install and Configure Postfix as a Send-Only SMTP Server on Debian 9 https://www.digitalocean.com/community/tutorials/how-to-install-and-configure-postfix-as-a-send-only-smtp-server-on-debian-9

regexp

regexp_table - format of Postfix regular expression tables http://www.postfix.org/regexp_table.5.html

postfix smtp_generic_maps with regular expression https://serverfault.com/questions/930819/postfix-smtp-generic-maps-with-regular-expression

postfix sender address rewriting https://www.unix.com/unix-for-advanced-and-expert-users/118692-postfix-sender-address-rewriting.html

Trash

w/ generic maps –or–

vi /etc/postfix/main.cf

smtp_generic_maps = hash:/etc/postfix/generic

vi /etc/postfix/generic

root@HOST.localdomain root@os3.su

postmap /etc/postfix/generic
ls -lF /etc/postfix/generic.db

w/ canonical maps –or–

vi /etc/postfix/main.cf

canonical_maps = hash:/etc/postfix/canonical

vi /etc/postfix/canonical

@HOST.localdomain root@os3.su

postmap /etc/postfix/canonical
ls -lF /etc/postfix/canonical.db

Nethence | Pub | Lab | Pbraun | SNE Russia | xhtml