mirror of
https://gitlab.archlinux.org/archlinux/infrastructure.git
synced 2026-11-06 01:58:51 +01:00
Levente Polyak
c54eec4e43
In certain specific cases, OpenPGP signatures that were sent through our
postfix are corrupting and showing as invalid. The culprit is that MUA's
that also populate the multipart section with a User-Agent will have
their signed multipart section chopped. This only affects these MUA's
that do also add the User-Agent not just to the global section, but the
signed multipart section, which is well covered by the spec. One of the
examples is Thunderbird, which started adding it to the multipart
section.
The fix avoids this problem by only allowing the `msa_header_checks`
cleanup for the global section and avoid touching any of the multipart
of nested sections, which are these that are signed in case a signature
is issued. The reason is that `header_checks` is also inherited by
`mime_header_checks` and `nested_header_checks` in case these are not
declared.
Subsequently the fix explicitly declares and empty `mime_header_checks`
and `nested_header_checks`, removing the inherited `header_checks` for
these sections.
Link: https://www.postfix.org/header_checks.5.html
Fixes: 5eb777b9 ("postfix: Strip sensitive headers (user-agent + sender ip)")
87 lines
4.3 KiB
Django/Jinja
87 lines
4.3 KiB
Django/Jinja
#
|
|
# {{ansible_managed}}
|
|
#
|
|
#
|
|
# Postfix master process configuration file. For details on the format
|
|
# of the file, see the master(5) manual page (command: "man 5 master" or
|
|
# on-line: http://www.postfix.org/master.5.html).
|
|
#
|
|
# Do not forget to execute "postfix reload" after editing this file.
|
|
#
|
|
# ==========================================================================
|
|
# service type private unpriv chroot wakeup maxproc command + args
|
|
# (yes) (yes) (no) (never) (100)
|
|
# ==========================================================================
|
|
smtp inet n - n - - smtpd
|
|
-o smtpd_client_connection_count_limit=20
|
|
-o smtpd_proxy_options=speed_adjust
|
|
|
|
msa_cleanup unix n - n - 0 cleanup
|
|
-o header_checks=pcre:/etc/postfix/msa_header_checks
|
|
-o mime_header_checks=
|
|
-o nested_header_checks=
|
|
submissions inet n - n - - smtpd
|
|
-o cleanup_service_name=msa_cleanup
|
|
-o smtpd_tls_wrappermode=yes
|
|
-o syslog_name=postfix/submission
|
|
-o smtpd_tls_security_level=encrypt
|
|
-o smtpd_sasl_auth_enable=yes
|
|
-o smtpd_recipient_restrictions=$submission_recipient_restrictions
|
|
-o smtpd_client_connection_count_limit=10
|
|
|
|
#smtp inet n - n - 1 postscreen
|
|
#smtpd pass - - n - - smtpd
|
|
#dnsblog unix - - n - 0 dnsblog
|
|
#tlsproxy unix - - n - 0 tlsproxy
|
|
#submission inet n - n - - smtpd
|
|
# -o syslog_name=postfix/submission
|
|
# -o smtpd_tls_security_level=encrypt
|
|
# -o smtpd_sasl_auth_enable=yes
|
|
# -o smtpd_reject_unlisted_recipient=no
|
|
# -o smtpd_client_restrictions=$mua_client_restrictions
|
|
# -o smtpd_helo_restrictions=$mua_helo_restrictions
|
|
# -o smtpd_sender_restrictions=$mua_sender_restrictions
|
|
# -o smtpd_recipient_restrictions=
|
|
# -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
|
|
# -o milter_macro_daemon_name=ORIGINATING
|
|
#smtps inet n - n - - smtpd
|
|
# -o syslog_name=postfix/smtps
|
|
# -o smtpd_tls_wrappermode=yes
|
|
# -o smtpd_sasl_auth_enable=yes
|
|
# -o smtpd_reject_unlisted_recipient=no
|
|
# -o smtpd_client_restrictions=$mua_client_restrictions
|
|
# -o smtpd_helo_restrictions=$mua_helo_restrictions
|
|
# -o smtpd_sender_restrictions=$mua_sender_restrictions
|
|
# -o smtpd_recipient_restrictions=
|
|
# -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
|
|
# -o milter_macro_daemon_name=ORIGINATING
|
|
#628 inet n - n - - qmqpd
|
|
pickup unix n - n 60 1 pickup
|
|
cleanup unix n - n - 0 cleanup
|
|
qmgr unix n - n 300 1 qmgr
|
|
#qmgr unix n - n 300 1 oqmgr
|
|
tlsmgr unix - - n 1000? 1 tlsmgr
|
|
rewrite unix - - n - - trivial-rewrite
|
|
bounce unix - - n - 0 bounce
|
|
defer unix - - n - 0 bounce
|
|
trace unix - - n - 0 bounce
|
|
verify unix - - n - 1 verify
|
|
flush unix n - n 1000? 0 flush
|
|
proxymap unix - - n - - proxymap
|
|
proxywrite unix - - n - 1 proxymap
|
|
smtp unix - - n - - smtp
|
|
relay unix - - n - - smtp
|
|
# -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
|
|
showq unix n - n - - showq
|
|
error unix - - n - - error
|
|
retry unix - - n - - error
|
|
discard unix - - n - - discard
|
|
local unix - n n - - local
|
|
virtual unix - n n - - virtual
|
|
lmtp unix - - n - - lmtp
|
|
anvil unix - - n - 1 anvil
|
|
scache unix - - n - 1 scache
|
|
|
|
wiki_bouncehandler unix - n n - - pipe
|
|
flags=DFRX user={{postfix_wiki_bounce_user}} argv=/usr/bin/systemd-cat {{postfix_wiki_bounce_mail_handler}} {{postfix_wiki_bounce_config}}
|