I am running a postfix server on Freebsd 8.1
I have multiple domains and need to set up each domain with its own TLS
certificate.
I emailed this list and the best solution seems to be to run multiple
instances.
I read through the documentation and I want to clarify things before I
start making changes on the server.
Does each instance need its own uid and gid?
It says that "The default instance is responsible for local mail
submission" Does this mean that only the default instance needs
virtual_mailbox_domain and virtual_mailbox_maps entries?
What about sender_dependent_default_transport_maps =
mysql:/usr/local/etc/postfix/sql/mailbox_transport.cf ?
Would each instance need its own entry? If so, can I leave it the same
or do I need to have each instance have its own
../etc/postfix-instance/sql/ directory? If each instance needs its own
sql directory, can they all be links to the same directory?
I apologize for the barrage of nitpicking questions but this is a big
change and I can't let the server be down too long and I want to have an
idea of what settings I need before I go changing them. Any other help
is greatly appreciated.
I am including my current postconf -n and master.cf entries for
completeness.
Thanks for everyone's help
Mark Moellering
#
# Postfix master process configuration file. For details on the format
# of the file, see the master(5) manual page (command: "man 5 master").
#
# Do not forget to execute "postfix reload" after editing this file.
#
# ==========================================================================
# service type private unpriv chroot wakeup maxproc command + args
# (yes) (yes) (yes) (never) (100)
# ==========================================================================
smtp inet n - n - - smtpd
#smtp inet n - n - 1 postscreen
#smtpd pass - - n - - smtpd
#dnsblog unix - - n - 0 dnsblog
#tlsproxy unix - - n - 0 tlsproxy
submission inet n - n - - smtpd
# -o smtpd_tls_security_level=encrypt
# -o smtpd_sasl_auth_enable=yes
# -o smtpd_client_restrictions=permit_sasl_authenticated,reject
# -o milter_macro_daemon_name=ORIGINATING
#smtps inet n - n - - smtpd
# -o smtpd_tls_wrappermode=yes
# -o smtpd_sasl_auth_enable=yes
# -o smtpd_client_restrictions=permit_sasl_authenticated,reject
# -o milter_macro_daemon_name=ORIGINATING
saline1990 unix - - n - - smtp
-o smtp_bind_address=69.41.172.100
-o smtp_helo_name=mail.saline1990.com
-o syslog_name=postfix-saline1990
#
pioneer86 unix - - n - - smtp
-o smtp_bind_address=69.41.172.249
-o smtp_helo_name=mail.pioneer86.com
-o syslog_name=postfix-pioneer86
#
class-creator unix - - n - - smtp
-o syslog_name=postfix-class_creator
#
grissomhigh1981 unix - - n - - smtp
-o smtp_bind_address=69.41.172.62
-o smtp_helo_name=mail.grissomhigh1981.org
-o syslog_name=postfix-grissomhigh1981
#
69.41.172.62:smtp inet n - n - - smtpd
-o smtpd_tls_key_file=/etc/ssl/private/grissomhigh1981.key
-o smtpd_tls_cert_file=/etc/ssl/certs/grissomhigh1981.crt
#
anadarkohs60 unix - - n - - smtp
-o smtp_bind_address=69.41.172.174
-o smtp_helo_name=mail.anadarkohs60.com
-o syslog_name=postfix-anadarkohs60
#
porthuronhighschool unix - - n - - smtp
-o smtp_bind_address=69.41.172.180
-o smtp_helo_name=mail.porthuronhighschool.info
-o syslog_name=postfix-porthuronhighschool
#
#628 inet n - n - - qmqpd
pickup fifo n - n 60 1 pickup
cleanup unix n - n - 0 cleanup
qmgr fifo n - n 300 1 qmgr
#qmgr fifo n - n 300 1 oqmgr
tlsmgr unix - - n 1000? 1 tlsmgr
rewrite unix - - n - - trivial-rewrite
bounce unix - - n - 0 bounce
defer unix - - n - 0 bounce
trace unix - - n - 0 bounce
verify unix - - n - 1 verify
flush unix n - n 1000? 0 flush
proxymap unix - - n - - proxymap
proxywrite unix - - n - 1 proxymap
smtp unix - - n - - smtp
# When relaying mail as backup MX, disable fallback_relay to avoid MX loops
relay unix - - n - - smtp
-o smtp_fallback_relay=
# -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
showq unix n - n - - showq
error unix - - n - - error
retry unix - - n - - error
discard unix - - n - - discard
local unix - n n - - local
virtual unix - n n - - virtual
lmtp unix - - n - - lmtp
anvil unix - - n - 1 anvil
scache unix - - n - 1 scache
#
# ====================================================================
# Interfaces to non-Postfix software. Be sure to examine the manual
# pages of the non-Postfix software to find out what options it wants.
#
# Many of the following services use the Postfix pipe(8) delivery
# agent. See the pipe(8) man page for information about ${recipient}
# and other message envelope options.
# ====================================================================
#
# maildrop. See the Postfix MAILDROP_README file for details.
# Also specify in main.cf: maildrop_destination_recipient_limit=1
#
#maildrop unix - n n - - pipe
# flags=DRhu user=vmail argv=/usr/local/bin/maildrop -d ${recipient}
#
# ====================================================================
#
# Recent Cyrus versions can use the existing "lmtp" master.cf entry.
#
# Specify in cyrus.conf:
# lmtp cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
#
# Specify in main.cf one or more of the following:
# mailbox_transport = lmtp:inet:localhost
# virtual_transport = lmtp:inet:localhost
#
# ====================================================================
#
# Cyrus 2.1.5 (Amos Gouaux)
# Also specify in main.cf: cyrus_destination_recipient_limit=1
#
#cyrus unix - n n - - pipe
# user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
#
# ====================================================================
#
# Old example of delivery via Cyrus.
#
#old-cyrus unix - n n - - pipe
# flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
#
# ====================================================================
#
# See the Postfix UUCP_README file for configuration details.
#
#uucp unix - n n - - pipe
# flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail
($recipient)
#
# ====================================================================
#
# Other external delivery methods.
#
#ifmail unix - n n - - pipe
# flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
#
#bsmtp unix - n n - - pipe
# flags=Fq. user=bsmtp argv=/usr/local/sbin/bsmtp -f $sender $nexthop
$recipient
#
#scalemail-backend unix - n n - 2 pipe
# flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store
# ${nexthop} ${user} ${extension}
#
#mailman unix - n n - - pipe
# flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
# ${nexthop} ${user}
broken_sasl_auth_clients = yes
command_directory = /usr/local/sbin
config_directory = /usr/local/etc/postfix
daemon_directory = /usr/local/libexec/postfix
data_directory = /var/db/postfix
debug_peer_level = 2
header_checks = pcre:/usr/local/etc/postfix/header_checks.pcre
html_directory = /usr/local/share/doc/postfix
internal_mail_filter_classes = bounce
mail_owner = postfix
mailq_path = /usr/local/bin/mailq
manpage_directory = /usr/local/man
mynetworks = 69.41.171.62/32, 69.41.173.66/32, 69.41.174.11/32, 69.41.162.52/32
mynetworks_style = host
newaliases_path = /usr/local/bin/newaliases
queue_directory = /var/spool/postfix
readme_directory = /usr/local/share/doc/postfix
sample_directory = /usr/local/etc/postfix
sender_dependent_default_transport_maps =
mysql:/usr/local/etc/postfix/sql/mailbox_transport.cf
sendmail_path = /usr/local/sbin/sendmail -rboun...@mail.classcreator.net
setgid_group = maildrop
smtp_sasl_tls_security_options = noanonymous
smtpd_recipient_restrictions = reject_non_fqdn_recipient,
reject_unknown_sender_domain, reject_unknown_recipient_domain,
permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_sender,
reject_unauth_destination, check_recipient_access
hash:/usr/local/etc/postfix/accounts_accepted, reject_multi_recipient_bounce,
reject_rhsbl_sender zen.spamhaus.org, reject_rhsbl_sender bl.spamcop.net,
reject_unverified_sender, permit
smtpd_sasl_auth_enable = yes
smtpd_sasl_path = $queue_directory/private/auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_tls_cert_file = /etc/ssl/certs/class-creator.crt
smtpd_tls_key_file = /etc/ssl/private/class-creator.key
smtpd_tls_security_level = may
unknown_local_recipient_reject_code = 550
virtual_gid_maps = static:1002
virtual_mailbox_base = /var/spool/classes
virtual_mailbox_domains = mysql:/usr/local/etc/postfix/sql/mailbox_domains.cf
virtual_mailbox_maps = mysql:/usr/local/etc/postfix/sql/mailbox_recipients.cf
virtual_uid_maps = static:1002
