I run amavisd-new as part of my anti-spam setup. The configuration is pretty well out of the box. I use the split clean up, which if I remember correctly, is straight out of Patrick Koetter's setup guide. One of the things I have noticed is that when amavisd passes emails back into postfix it is using TLS, this seems a little pointless as both apps are on the same machine. Is there a way of implementing TLS selectively. What I have currently done is to add "-o smtpd_tls_security_level=none" to the 1270.0.0.1:10025 smtpd entry in the master.cf. While this seems to be working, is this the best way of achieving what i want, am I missing some nasty side effect or have I missed the mark entirely.
TIA JLA postconf -n alias_database = $alias_maps alias_maps = hash:/etc/aliases allow_untrusted_routing = no biff = no bounce_size_limit = 65536 broken_sasl_auth_clients = yes command_directory = /usr/sbin config_directory = /etc/postfix content_filter = amavisfeed:[127.0.0.1]:10024 daemon_directory = /usr/libexec/postfix data_directory = /var/lib/postfix debug_peer_level = 2 default_privs = nobody default_process_limit = 20 delay_warning_time = 12 disable_vrfy_command = yes header_size_limit = 32768 home_mailbox = Maildir/ html_directory = no in_flow_delay = 1s inet_protocols = all local_destination_concurrency_limit = 5 mail_owner = postfix mailbox_command = /usr/libexec/dovecot/deliver mailq_path = /usr/bin/mailq.postfix manpage_directory = /usr/share/man message_size_limit = 32768000 mydestination = localhost, localhost.localdomain, localdomain mydomain = klam.ca myhostname = mail.$mydomain mynetworks = 127.0.0.0/8, 192.168.10.0/26 myorigin = $mydomain newaliases_path = /usr/bin/newaliases.postfix proxy_interfaces = 206.53.59.9 queue_directory = /var/spool/postfix readme_directory = /usr/share/doc/postfix-2.5.5/README_FILES recipient_delimiter = + relay_domains = relayhost = [smtp.gmail.com]:587 relocated_maps = hash:/etc/postfix/maps/relocated sample_directory = /usr/share/doc/postfix-2.5.5/samples sendmail_path = /usr/sbin/sendmail.postfix setgid_group = postdrop smtp_sasl_auth_enable = yes smtp_sasl_password_maps = hash:/etc/postfix/maps/sasl_password smtp_sasl_security_options = noanonymous smtp_sasl_tls_security_options = noanonymous smtp_tls_cert_file = /etc/pki/tls/certs/klam.crt smtp_tls_enforce_peername = no smtp_tls_key_file = /etc/pki/tls/private/klam.key smtp_tls_note_starttls_offer = yes smtp_tls_security_level = may smtpd_banner = $myhostname ESMTP smtpd_delay_reject = no smtpd_error_sleep_time = 5s smtpd_hard_error_limit = 20 smtpd_helo_required = yes smtpd_recipient_limit = 128 smtpd_recipient_restrictions = reject_non_fqdn_sender, reject_non_fqdn_recipient, permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, reject_unlisted_recipient, reject_unlisted_sender, check_client_access hash:/etc/postfix/maps/client_access, reject_unknown_client_hostname, reject_rbl_client zen.spamhaus.org, reject_rbl_client bl.spamcop.net, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, check_helo_access pcre:/etc/postfix/maps/helo_checks, check_helo_access pcre:/etc/postfix/maps/helo_access, reject_unknown_helo_hostname, check_recipient_access hash:/etc/postfix/maps/recipient_access reject_unknown_sender_domain, check_policy_service unix:postgrey/socket, permit smtpd_sasl_auth_enable = yes smtpd_sasl_local_domain = $myhostname smtpd_sasl_path = private/auth smtpd_sasl_security_options = noanonymous smtpd_sasl_type = dovecot smtpd_soft_error_limit = 10 smtpd_tls_CAfile = /etc/pki/CA/sub.class2.server.ca.crt smtpd_tls_ask_ccert = yes smtpd_tls_auth_only = no smtpd_tls_cert_file = /etc/pki/tls/certs/klam.crt smtpd_tls_key_file = /etc/pki/tls/private/klam.key smtpd_tls_loglevel = 2 smtpd_tls_received_header = yes smtpd_tls_req_ccert = no smtpd_tls_security_level = may smtpd_tls_session_cache_database = btree:/var/lib/postfix/smtpd_scache smtpd_tls_session_cache_timeout = 3600s soft_bounce = no strict_rfc821_envelopes = yes tls_random_source = dev:/dev/urandom virtual_alias_maps = hash:/etc/postfix/maps/valiases virtual_gid_maps = static:5000 virtual_mailbox_base = /var/mail/vhosts virtual_mailbox_domains = /etc/postfix/maps/vdomains virtual_mailbox_maps = hash:/etc/postfix/maps/vmailbox virtual_minimum_uid = 100 virtual_transport = dovecot virtual_uid_maps = static:5000
