diff --git a/postfix/HISTORY b/postfix/HISTORY index 813c90c65..cee5cc5d3 100644 --- a/postfix/HISTORY +++ b/postfix/HISTORY @@ -4925,10 +4925,29 @@ Apologies for any names omitted. Portability: MACOSX patches by Gerben Wierda. Portability: Solaris /dev/null is a symlink, which tripped - up the code to safely open a file before delivery. We now + up the code to safely open a file before local delivery. We now grudgingly allow symlinks owned by root. File: util/safe_open.c. 20010224 Bugfix: "postconf mynetworks" ignored the inet_interfaces setting. That was a very old one. File: postconf/postconf.c. + + INCOMPATIBLE CHANGE: POSTFIX NO LONGER RELAYS MAIL FOR + CLIENTS IN THE ENTIRE CLASS A/B/C NETWORK. POSTFIX BY + DEFAULT RELAYS MAIL FOR CLIENTS IN THE LOCAL SUBNETWORK. + Specify "mynetworks_style = class" to get the old behavior. + +20010225 + + Portability: master sigchld handler based on writing to a + pipe, so that the master wakes up from select(). Based on + code by Erik Forsberg, Linkoping University, Sweden. File: + master/master_sig.c. Disabled until after the major release. + + Code cleanup: Postfix should now run with no alias database. + + Code cleanup: local_destination_recipient_limit and + local_destination_concurrency_limit are not first-class + configuration parameters. Files: global/mail_params.h, + *qmgr/qmgr.c, postconf/postconf.c. diff --git a/postfix/RELEASE_NOTES b/postfix/RELEASE_NOTES index 1cfc98c8e..6c8a4c82d 100644 --- a/postfix/RELEASE_NOTES +++ b/postfix/RELEASE_NOTES @@ -1,3 +1,11 @@ +Incompatible changes with snapshot-20010225 +=========================================== + +POSTFIX NO LONGER RELAYS MAIL FOR CLIENTS IN THE ENTIRE CLASS A/B/C +NETWORK. To get the old behavior, specify "mynetworks_style = class" +in the main.cf file. The default (mynetworks_style = subnet) is to +relay for clients in the local IP subnet. See conf/main.cf. + Incompatible changes with snapshot-20010222 =========================================== diff --git a/postfix/conf/main.cf b/postfix/conf/main.cf index b6476b6c5..a618ef772 100644 --- a/postfix/conf/main.cf +++ b/postfix/conf/main.cf @@ -120,37 +120,35 @@ mail_owner = postfix #mydestination = $myhostname, localhost.$mydomain, $mydomain, # mail.$mydomain, www.$mydomain, ftp.$mydomain -# RELAY CONTROL +# TRUST AND RELAY CONTROL -# The mynetworks parameter specifies the list of networks that make -# up the local neighborhood. The list is used by the anti-UCE -# software to relay authorize clients. See the check_relay_domains -# and and smtpd_recipient_restrictions in the sample-smtpd.cf file. +# The mynetworks parameter specifies the list of "trusted" SMTP +# clients that have more privileges than "strangers". # -# By default, Postfix derives the mynetworks setting from the local -# machine network addresses. - -# The mynetworks_style parameter specifies how Postfix computes the -# mynetworks default value from the local machine network addresses. +# In particular, "trusted" SMTP clients are allowed to relay mail +# through Postfix. See the smtpd_recipient_restrictions parameter +# in file sample-smtpd.cf. # -# By default (mynetworks_style = subnet), Postfix relay authorizes -# all clients in the subnets that are attached to this machine. +# By default (mynetworks_style = subnet), Postfix "trusts" SMTP +# clients in the same IP subnetworks as the local machine. +# On Linux, this does works correctly only with interfaces specified +# with the "ifconfig" command. # -# Specify "mynetworks_style = class" when you want to relay authorize -# all clients in the class A, B or C networks that are attached to -# to this machine. +# Specify "mynetworks_style = class" when Postfix should "trust" SMTP +# clients in the same IP class A/B/C networks as the local machine. +# This used to be the default. It is appropriate for service providers. # -# Specify "mynetworks_style = host" if you do not want to relay -# authorize clients other than the local machine. +# Specify "mynetworks_style = host" when Postfix should "trust" +# only the local machine. # # mynetworks_style = class # mynetworks_style = subnet # mynetworks_style = host -# Instead of implicitly deriving the mynetworks value from local -# machine addresses, you can specify an explicit list of network/mask -# patterns, where the mask specifies the number of bits in the network -# part of a host address. +# Instead of using mynetworks_style to implicitly derive the mynetworks +# list from local machine addresses, you can specify an explicit list +# of network/netmask patterns, where the mask specifies the number of +# bits in the network part of a host address. # # You can also specify the absolute pathname of a pattern file instead # of listing the patterns here. @@ -430,10 +428,11 @@ mail_owner = postfix # raise eyebrows. # # Each message delivery transport has its XXX_destination_concurrency_limit -# parameter. The default is $default_destination_concurrency_limit. +# parameter. The default is $default_destination_concurrency_limit for +# most delivery transports. For the local delivery agent the default is 2. -local_destination_concurrency_limit = 2 -default_destination_concurrency_limit = 10 +#local_destination_concurrency_limit = 2 +#default_destination_concurrency_limit = 10 # DEBUGGING CONTROL # diff --git a/postfix/conf/postfix-script-nosgid b/postfix/conf/postfix-script-nosgid index d2374041a..2c5d43ae2 100755 --- a/postfix/conf/postfix-script-nosgid +++ b/postfix/conf/postfix-script-nosgid @@ -247,6 +247,8 @@ EOF (echo "$found" | grep bounce >/dev/null) || missing="$missing bounce" (echo "$found" | grep defer >/dev/null) || missing="$missing defer" (echo "$found" | grep flush >/dev/null) || missing="$missing flush" + (echo "$found" | grep incoming>/dev/null)|| missing="$missing incoming" + (echo "$found" | grep deferred>/dev/null)|| missing="$missing deferred" test -n "$missing" && { $WARN fixing main.cf hash_queue_names for missing $missing $command_directory/postconf -e hash_queue_names="$found$missing" diff --git a/postfix/conf/postfix-script-sgid b/postfix/conf/postfix-script-sgid index f86fdc3c9..a635ef679 100755 --- a/postfix/conf/postfix-script-sgid +++ b/postfix/conf/postfix-script-sgid @@ -248,6 +248,8 @@ EOF (echo "$found" | grep bounce >/dev/null) || missing="$missing bounce" (echo "$found" | grep defer >/dev/null) || missing="$missing defer" (echo "$found" | grep flush >/dev/null) || missing="$missing flush" + (echo "$found" | grep incoming>/dev/null)|| missing="$missing incoming" + (echo "$found" | grep deferred>/dev/null)|| missing="$missing deferred" test -n "$missing" && { $WARN fixing main.cf hash_queue_names for missing $missing $command_directory/postconf -e hash_queue_names="$found$missing" diff --git a/postfix/conf/sample-misc.cf b/postfix/conf/sample-misc.cf index ed7b57db4..27ddd9a75 100644 --- a/postfix/conf/sample-misc.cf +++ b/postfix/conf/sample-misc.cf @@ -211,23 +211,34 @@ mydestination = $myhostname, localhost.$mydomain # myorigin = $mydomain myorigin = $myhostname -# The mynetworks parameter specifies the list of networks that are -# local to this machine. The list is used by the anti-UCE software -# to distinguish local clients from strangers. See permit_mynetworks -# in the sample-smtpd.cf file. +# The mynetworks parameter specifies the list of "trusted" SMTP +# clients that have more privileges than "strangers". # -# The mynetworks parameter specifies the list of networks that are -# local to this machine. The list is used by the anti-UCE software -# to distinguish local clients from strangers. See permit_mynetworks -# and smtpd_recipient_restrictions in the file sample-smtpd.cf file. +# In particular, "trusted" SMTP clients are allowed to relay mail +# through Postfix. See the smtpd_recipient_restrictions parameter +# in file sample-smtpd.cf. # -# The default is a list of all networks attached to the machine: a -# complete class A network (X.0.0.0/8), a complete class B network -# (X.X.0.0/16), and so on. If you want stricter control, specify a -# list of network/mask patterns, where the mask specifies the number -# of bits in the network part of a host address. You can also specify -# the absolute pathname of a pattern file instead of listing the -# patterns here. +# By default (mynetworks_style = subnet), Postfix "trusts" SMTP +# clients in the same IP subnetworks as the local machine. +# +# Specify "mynetworks_style = class" when Postfix should "trust" SMTP +# clients in the same IP class A/B/C networks as the local machine. +# This used to be the default. It is appropriate for service providers. +# +# Specify "mynetworks_style = host" when Postfix should "trust" +# only the local machine. +# +# mynetworks_style = class +# mynetworks_style = subnet +# mynetworks_style = host + +# Instead of using mynetworks_style to implicitly derive the mynetworks +# list from local machine addresses, you can specify an explicit list +# of network/netmask patterns, where the mask specifies the number of +# bits in the network part of a host address. +# +# You can also specify the absolute pathname of a pattern file instead +# of listing the patterns here. # #mynetworks = 168.100.189.0/28, 127.0.0.0/8 diff --git a/postfix/conf/sample-smtpd.cf b/postfix/conf/sample-smtpd.cf index 56f301800..aa80fd291 100644 --- a/postfix/conf/sample-smtpd.cf +++ b/postfix/conf/sample-smtpd.cf @@ -101,6 +101,38 @@ smtpd_hard_error_limit = 100 # UCE RESTRICTIONS # +# The mynetworks parameter specifies the list of "trusted" SMTP +# clients that have more privileges than "strangers". +# +# In particular, "trusted" SMTP clients are allowed to relay mail +# through Postfix. See the smtpd_recipient_restrictions parameter +# in file sample-smtpd.cf. +# +# By default (mynetworks_style = subnet), Postfix "trusts" SMTP +# clients in the same IP subnetworks as the local machine. +# +# Specify "mynetworks_style = class" when Postfix should "trust" SMTP +# clients in the same IP class A/B/C networks as the local machine. +# This used to be the default. It is appropriate for service providers. +# +# Specify "mynetworks_style = host" when Postfix should "trust" +# only the local machine. +# +# mynetworks_style = class +mynetworks_style = subnet +# mynetworks_style = host + +# Instead of using mynetworks_style to implicitly derive the mynetworks +# list from local machine addresses, you can specify an explicit list +# of network/netmask patterns, where the mask specifies the number of +# bits in the network part of a host address. +# +# You can also specify the absolute pathname of a pattern file instead +# of listing the patterns here. +# +#mynetworks = 168.100.189.0/28, 127.0.0.0/8 +#mynetworks = $config_directory/mynetworks + # The smtpd_client_restrictions parameter specifies optional restrictions # on SMTP client host names and addresses. # diff --git a/postfix/html/basic.html b/postfix/html/basic.html index a769d5619..d0fb4f374 100644 --- a/postfix/html/basic.html +++ b/postfix/html/basic.html @@ -163,27 +163,20 @@ hostnames of the machine, including $myhostname, and localhost.$mydomain.

What clients to relay mail for

-By default, Postfix will relay mail for clients in relay authorized -networks and in relay authorized domains. +By default, Postfix will relay mail for clients in authorized +networks and in authorized domains.

-Relay authorized client networks are defined by the mynetworks parameter. The default is to -relay authorize all clients in all class A, B or C networks that -are attached to the machine. +authorize all clients in the IP subnetworks that the local machine +is attached to.

-YOU MUST CHANGE THIS DEFAULT SETTING -IF YOUR ADDRESS BLOCK IS PART OF A LARGER ADDRESS RANGE THAT IS -OWNED BY YOUR PROVIDER - IT WOULD CAUSE POSTFIX TO RELAY MAIL FROM -ALL THEIR CUSTOMERS. - -

- -Relay authorized client domains are by defined by the relay_domains comfiguration +Authorized client domains are by defined by the relay_domains configuration parameter. The default setting trusts clients with hostnames below the domain(s) listed in mydestination. @@ -315,18 +308,54 @@ top-level domain).

My own networks

The mynetworks parameter lists all networks that this machine -is attached to. This information can be used by the -anti-UCE features to distinguish between relay authorized -clients and relay unauthorized strangers. +somehow trusts. This information can be used by the +anti-UCE features to recognize trusted SMTP clients that are +allowed to relay mail through Postfix.

-By default, mynetworks is set to the class A, B or C networks -that the machine is attached to. For example, for my machines at -home, the result is: 168.100.0.0/16 127.0.0.0/8. However, -network 168.100 is owned by my ISP. Of course I do not want -to consider all their customer systems as relay authorized clients, -so I use instead: +You can specify the list of trusted networks in the main.cf +file, or you can let Postfix deduce the list for you. The default +is to let Postfix do the work for you. + +

+ +

+ +
Default: + +
mynetworks_style = subnet + +

+ +

The meaning of the styles is as follows: + +

+ +

+ +
class
Trust SMTP clients in the class A/B/C networks +that Postfix is connected to. + +

+ +

subnet (default)
Trust SMTP clients in the IP +subnetworks that Postfix is connected to. + +

+ +

host
Trust only the local machine. + +
+ +
+ +

+ +To specify the list of trusted networks by hand, specify +network blocks in CIDR (network/mask) notation, for example: + +

@@ -346,9 +375,14 @@ as if it is addressed to a domain listed in $mydestination. The default is to listen on all active interfaces. If you run mailers on virtual interfaces, you will have to specify what -interfaces to listen on. This includes the non-virtual mailer that -receives mail for the machine itself as well: it should never listen -on the virtual interfaces or you would have a mailer loop. +interfaces to listen on. + +

+ +You even have to specify explicit machine interfaces for the +non-virtual mailer that receives mail for the machine itself: the +non-virtual mailer should never listen on the virtual interfaces +or you would have a mailer loop.

diff --git a/postfix/html/faq.html b/postfix/html/faq.html index 6f2dc9829..0e39f9d05 100644 --- a/postfix/html/faq.html +++ b/postfix/html/faq.html @@ -24,6 +24,8 @@
  • Example configurations +
  • Postfix warnings and error messages +
  • Sendmail incompatibility
  • Running hundreds of Postfix processes @@ -74,6 +76,26 @@ +

    + +

    Postfix warnings and error messages

    + + + +

    +

    Sendmail incompatibility