Each restriction list is evaluated from left to right until diff --git a/postfix/html/SMTPD_POLICY_README.html b/postfix/html/SMTPD_POLICY_README.html index 995db85b1..5770535b4 100644 --- a/postfix/html/SMTPD_POLICY_README.html +++ b/postfix/html/SMTPD_POLICY_README.html @@ -235,8 +235,8 @@ or to a UNIX-domain socket. Examples:
@@ -261,7 +261,7 @@ daemon, you would use something like this: 6 smtpd_recipient_restrictions = 7 ... 8 reject_unauth_destination - 9 check_policy_service unix:private/policy + 9 check_policy_service unix:private/policy 10 ... 11 policy_time_limit = 3600 @@ -411,7 +411,7 @@ processes only: 7 smtpd_recipient_restrictions = 8 ... 9 reject_unauth_destination -10 check_policy_service unix:private/greylist +10 check_policy_service unix:private/greylist 11 ... @@ -454,7 +454,7 @@ a built-in suffix (in the above example: "_time_limit").inet:127.0.0.1:9998 -unix:/some/where/policy -unix:private/policy +unix:/some/where/policy +unix:private/policy
With Solaris < 9, or Postfix < 2.10 on any Solaris -version, use inet: style sockets instead of unix: +version, use inet: style sockets instead of unix: style, as detailed in the "Policy client/server configuration" section above.
@@ -492,7 +492,7 @@ forged MAIL FROM domains could be found at 6 check_sender_access hash:/etc/postfix/sender_access 7 ... 8 smtpd_restriction_classes = greylist - 9 greylist = check_policy_service unix:private/greylist + 9 greylist = check_policy_service unix:private/greylist 10 11 /etc/postfix/sender_access: 12 aol.com greylist @@ -548,7 +548,7 @@ most of the delays and most of the database pollution problem. 4 ... 5 reject_unauth_destination 6 check_sender_access hash:/etc/postfix/sender_access - 7 check_policy_service unix:private/policy + 7 check_policy_service unix:private/policy 8 ... 9 10 /etc/postfix/sender_access: diff --git a/postfix/html/TLS_README.html b/postfix/html/TLS_README.html index 34939a3b4..cd75ee8ab 100644 --- a/postfix/html/TLS_README.html +++ b/postfix/html/TLS_README.html @@ -226,9 +226,11 @@ size of the server TLS handshake. -If you use RFC 6698 TLSA "2 0 1" or "2 1 1" records to +
If you publish RFC 6698 TLSA "2 0 1" or "2 1 1" records to specify root CA certificate digests, you must include the corresponding -root CA certificates in the "server.pem" certificate file.
+root CA certificates in the "server.pem" certificate file. See the +documentation of the tls_dane_trust_anchor_digest_enable main.cf +parameter.-@@ -236,29 +238,20 @@ root CA certificates in the "server.pem" certificate file.
Remote SMTP clients will -be able to use the TLSA record you publish (which only contains the -certificate digest) only if they have access to the corresponding -certificate. Failure to verify certificates per the server's -published TLSA records will typically cause the SMTP client to defer -mail delivery. The foregoing also applies to "2 0 2" and "2 1 2" -TLSA records or any other digest of a CA certificate, but it is -expected that SHA256 will be by far the most common digest for TLSA. -You are strongly urged to likewise include the root CA -certificate in your server certificate file even if you use "0 0 -1" or "0 1 1" TLSA records. Some DANE implementations in SMTP -clients (Postfix among them) may treat RFC 6698 certificate usages -"0" and "2" interchangeably.
+Remote SMTP clients will be able to use the TLSA record you +publish (which only contains the certificate digest) only if they +have access to the corresponding certificate. Failure to verify +certificates per the server's published TLSA records will typically +cause the SMTP client to defer mail delivery. The foregoing also +applies to "2 0 2" and "2 1 2" TLSA records or any other digest of +a CA certificate, but it is expected that SHA256 will be by far the +most common digest for TLSA.
-By default, support for TLSA records that specify certificate -usage "0" via a digest is disabled in the Postfix SMTP client. As -a best practice, publish either "3 0 1" or "3 1 1" TLSA associations -that specify the SHA256 digest of the server certificate public key -with the alias-expanded hostname of each STARTTLS capable SMTP -server. These continue to work when a certificate is renewed with -the same public/private key pair. See the documentation of the -tls_dane_trust_anchor_digest_enable main.cf parameter for details. -
+As a best practice, publish either "3 0 1" or "3 1 1" TLSA +associations that specify the SHA256 digest of the server certificate +public key with the alias-expanded hostname of each STARTTLS capable +SMTP server. These continue to work when a certificate is renewed +with the same public/private key pair.
@@ -614,7 +607,7 @@ from scratch.Since Postfix uses multiple smtpd(8) service processes, an in-memory cache is not sufficient for session re-use. Clients store -at most one cached session per server and are very unlikey to +at most one cached session per server and are very unlikely to repeatedly connect to the same server process. Thus session caching in the Postfix SMTP server generally requires a shared cache (an alternative available with Postfix ≥ 2.11 is described below). @@ -861,8 +854,8 @@ certificates that use only the anonymous ciphers. This is enabled by explicitly setting "smtpd_tls_cert_file = none" and not specifying an smtpd_tls_dcert_file or smtpd_tls_eccert_file.
-Example, MSA that requires TLSv1, not SSLv2 or SSLv3, with high grade -ciphers:
+Example, MSA that requires TLSv1 or higher, not SSLv2 or SSLv3, +with high grade ciphers:
@@ -872,9 +865,9 @@ ciphers:
smtpd_tls_mandatory_ciphers = high
smtpd_tls_mandatory_exclude_ciphers = aNULL, MD5
smtpd_tls_security_level = encrypt
- # Preferred form with Postfix ≥ 2.5:
+ # Preferred syntax with Postfix ≥ 2.5:
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
- # Alternative form.
+ # Legacy syntax:
smtpd_tls_mandatory_protocols = TLSv1
@@ -918,23 +911,27 @@ secure for most situations.
Postfix 2.8 and later, in combination with OpenSSL 0.9.7 and later -allows TLS servers to preempt the TLS client's cipher preference list. +allows TLS servers to preempt the TLS client's cipher-suite preference list. This is possible only with SSLv3 and later, as in SSLv2 the client -chooses the cipher from a list supplied by the server.
+chooses the cipher-suite from a list supplied by the server.By default, the OpenSSL server selects the client's most preferred -cipher that the server supports. With SSLv3 and later, the server -may choose its own most preferred cipher that is supported (offered) +cipher-suite that the server supports. With SSLv3 and later, the server +may choose its own most preferred cipher-suite that is supported (offered) by the client. Setting "tls_preempt_cipherlist = yes" enables server -cipher preferences. The default OpenSSL behavior applies with +cipher-suite preferences. The default OpenSSL behavior applies with "tls_preempt_cipherlist = no".
-While server cipher selection may in some cases lead to a more secure -or performant cipher choice, there is some risk of interoperability -issues. In the past, some SSL clients have listed lower priority ciphers -that they did not implement correctly. If the server chooses a cipher -that the client prefers less, it may select a cipher whose client -implementation is flawed.
+While server cipher-suite selection may in some cases lead to +a more secure or performant cipher-suite choice, there is some risk +of interoperability issues. In the past, some SSL clients have +listed lower priority ciphers that they did not implement correctly. +If the server chooses a cipher that the client prefers less, it may +select a cipher whose client implementation is flawed. Most notably +Windows 2003 Microsoft Exchange servers have flawed implementations +of DES-CBC3-SHA, which OpenSSL considers stronger than RC4-SHA. +Enabling server cipher-suite selection may create interoperability +issues with Windows 2003 Microsoft Exchange clients.
If TLSA records are published for a given remote SMTP server +(implying TLS support), but are all "unusable" due to unsupported +parameters or malformed data, the Postfix SMTP client will use mandatory unauthenticated TLS. -Otherwise, the Postfix SMTP client behavior is the same as with may.
+Otherwise, when no TLSA records are published, the Postfix SMTP +client behavior is the same as with may. + +TLSA records must be published in DNSSEC validated DNS zones. +Any TLSA records in DNS zones not protected via DNSSEC are ignored. +The Postfix SMTP client will not look for TLSA records associated +with MX hosts whose "A" or "AAAA" records lie in an "insecure" DNS +zone. Such lookups have been observed to cause interoperability +issues with poorly implemented DNS servers, and are in any case not +expected to ever yield "secure" results, since that would require +a very unlikely DLV DNS trust anchor configured between the host +record and the associated "_25._tcp" child TLSA record.
The "dane-only" level is a form of secure-channel TLS based on the DANE PKI. -If usable TLSA records are present these are used to authenticate the +If "usable" TLSA records are present these are used to authenticate the remote SMTP server. Otherwise, or when server certificate verification fails, delivery via the server in question tempfails.
@@ -1271,73 +1281,51 @@ to be in effect, the destination domain's containing DNS zone must be signed and the Postfix SMTP client's operating system must be configured to send its DNS queries to a recursive DNS nameserver that is able to validate the signed records. Each MX host's DNS -zone should also be signed, and should publish DANE TLSA (RFC 6698) +zone needs to also be signed, and needs to publish DANE TLSA (RFC 6698) records that specify how that MX host's TLS certificate is to be -verified. TLSA records do not preempt the normal SMTP MX host +verified. + +TLSA records do not preempt the normal SMTP MX host selection algorithm, if some MX hosts support TLSA and others do not, TLS security will vary from delivery to delivery. It is up to the domain owner to configure their MX hosts and their DNS sensibly. To configure the Postfix SMTP client for DNSSEC lookups see the documentation for the smtp_dns_support_level main.cf parameter. The tls_dane_trust_anchor_digest_enable main.cf parameter -controls optional support for trust-anchor digest TLSA records. +controls support for trust-anchor digest TLSA records. The +tls_dane_digests and tls_dane_digest_agility parameters control +the list of supported digests and digest downgrade attack resistance.
-The Postfix SMTP client deviates from RFC 6698 in cases where -strict adherence is likely to create opportunities for delayed (or -eventually bounced) email with no substantive security gain. Most -notably, it is not expected that smtp_tls_CAfile and smtp_tls_CApath -can reasonably include every public CA that a remote SMTP server's -administrator may believe to be well-known. Therefore, certificate -usages "0" and "2" from RFC 6698 which are intended to "constrain" -existing PKI trust, are instead treated as "trust assertions" and -mapped to "1" and "3" respectively. That is, with certificate usage -"0" and "2", Postfix will not require the remote SMTP server's -certificate to be trusted with respect to any locally defined public -CAs, it is the domain owner's responsibility to ensure that the -certificate associations in their TLSA records are appropriate -to authenticate their SMTP servers.
+DANE for SMTP MTAs deviates in some details from the baseline +DANE protocol in RFC 6698. Most notably, it is not expected that +SMTP MTAs can reasonably include every public CA that a remote SMTP +server's administrator may believe to be well-known. Nor is there +an interactive user to "click OK" when authentication fails.
-In addition, the Postfix SMTP client does not assume that the -remote SMTP server will necessarily be configured to present the -certificate of any usage "0" root CA in its TLS protocol certificate_list. -Therefore, support for usage "0" certificate and public-key digests -is disabled by default, see tls_dane_trust_anchor_digest_enable for -details. While undigested trust-anchor certificates in TLSA records -are supported, publishing complete certificates in DNS is unwise -given the resulting excessively large DNS record sizes. Therefore, -in its default configuration the Postfix SMTP client essentially -supports only certificate usages "1", "2" and "3" (with "1" treated as -though it were "3").
+Therefore, certificate usages "0" and "1" from RFC 6698 which +are intended to "constrain" existing PKI trust, are not supported. +TLSA records with usage "0" are treated as "unusable". TLSA records +with usage "1" are instead treated as "trust assertions" and mapped +to usage "3". Specifically, with certificate usage "1", Postfix +will not require the remote SMTP server's certificate to be trusted +with respect to any locally defined public CAs, it is the domain +owner's responsibility to ensure that the certificate associations +in their TLSA records are appropriate to authenticate their SMTP +servers.
-Finally, the interaction of DANE with MX hostnames that are -CNAMEs differs from the draft specification in the names used to -construct the associated TLSA -queries. When the MX hostname is a CNAME, the draft proposal -to use the unexpanded MX hostname in TLSA lookups is fragile and -unintuitive. For this to work, the domain owner has to either -duplicate the TLSA records of the target (host, service) pair in -his own DNS or furnish the target host with an additional -certificate and private key that would be negotiated via SNI. -Neither of these are robust or easy to manage. It is far better -to expand the CNAME recursively to the underlying target hostname -(keeping track of DNSSEC validation along the way) and to use the -expanded name to construct the TLSA query and, if appropriate, in -server certificate name checks. This is the approach taken by the -Postfix SMTP client, and if sanity prevails will also be the approach -taken in the final standard.
+The Postfix SMTP client supports only certificate usages "2" +and "3" (with "1" treated as though it were "3"). See +tls_dane_trust_anchor_digest_enable for usage "2" usability +considerations. Support for certificate usage "1" is an experiment, +it may be withdrawn in the future. Server operators SHOULD NOT +publish TLSA records with usage "1".
When usable TLSA records are obtained for the remote SMTP server -the Postfix SMTP client is obligated to include the SNI TLS extension -in its SSL client hello message. This may help the remote SMTP -server live up to its promise to provide a certificate that matches -its TLSA records. Since TLS extensions require TLS 1.0 or later, -the Postfix SMTP client must disable SSLv2 and SSLv3 when SNI is -required. If you use "dane" or "dane-only", do not disable TLSv1, -except perhaps via the policy table for destinations which you are -sure will support TLSv1.1 or TLSv1.2.
+the Postfix SMTP client sends the SNI TLS extension in its SSL +client hello message. This may help the remote SMTP server live +up to its promise to provide a certificate that matches its TLSA +records.For purposes of protocol and cipher selection, the "dane" security level is treated like a "mandatory" TLS security level, @@ -1357,14 +1345,14 @@ certificate must contain at least one of these names.
When a DANE TLSA record specifies an end-entity (EE) certificate, (that is the actual server certificate), as with the fingerprint security level below, no name checks or certificate expiration checks -are applied. The server certificate (or its public key) either matches +are applied. The server certificate (or its public key) either matches the DANE record or not. Server administrators should publish such EE records in preference to all other types.
The pre-requisites for DANE support in the Postfix SMTP client are:
On the SMTP client, there are further complications. When delivering -mail to a given domain, in contrast to HTTPS, one rarely uses the domain -name directly as the target host of the SMTP session. More typically, -one uses MX lookups - these are usually unauthenticated - to obtain the domain's SMTP server -hostname(s). When, as is current practice, the client verifies the -insecurely obtained MX hostname, it is subject to a DNS man-in-the-middle +
On the SMTP client, there are further complications. When +delivering mail to a given domain, in contrast to HTTPS, one rarely +uses the domain name directly as the target host of the SMTP session. +More typically, one uses MX lookups — these are usually +unauthenticated — to obtain the domain's SMTP server hostname(s). +When, as is current practice, the client verifies the insecurely +obtained MX hostname, it is subject to a DNS man-in-the-middle attack.
Adoption of DNSSEC and RFC6698 (DANE) may gradually (as domains @@ -2184,24 +2173,19 @@ DNSSEC. If no TLSA records are found, the effective security level used is may. If TLSA records are found, but none are usable, the effective security level is encrypt. When usable TLSA records -are obtained for the remote SMTP server, SSLv2 and SSLv3 are -automatically disabled (see smtp_tls_mandatory_protocols), and the -server certificate must match the TLSA records. The -tls_dane_trust_anchor_digest_enable parameter controls optional -support for trust-anchor digest TLSA records. RFC 6698 (DANE) TLS -authentication and DNSSEC support is available with Postfix 2.11 -and later. +are obtained for the remote SMTP server, SSLv2 is automatically +disabled (see smtp_tls_mandatory_protocols), and the server certificate +must match the TLSA records. RFC 6698 (DANE) TLS authentication +and DNSSEC support is available with Postfix 2.11 and later.
-virtual_transport = lmtp:unix:/path/name (uses UNIX-domain socket) +virtual_transport = lmtp:unix:/path/name (uses UNIX-domain socket) virtual_transport = lmtp:hostname:port (uses TCP socket) virtual_transport = maildrop: (uses pipe(8) to command)diff --git a/postfix/html/lmdb_table.5.html b/postfix/html/lmdb_table.5.html index d8dd19faf..52075553f 100644 --- a/postfix/html/lmdb_table.5.html +++ b/postfix/html/lmdb_table.5.html @@ -34,16 +34,16 @@ LMDB_TABLE(5) LMDB_TABLE(5) When a transaction fails due to a full database, Postfix resizes the database and retries the transaction. - Postfix access, address mapping and routing tables will - generate partial search keys such as domain names without - one or more subdomains, network addresses without one or - more least-significant octets, or email addresses without - the localpart, address extension or domain portion. This - behavior is also found with btree:, hash:, or ldap: - tables. + Postfix access, address mapping and routing table lookups + may generate partial search keys such as domain names + without one or more subdomains, network addresses without + one or more least-significant octets, or email addresses + without the localpart, address extension or domain por- + tion. This behavior is also found with btree:, hash:, or + ldap: tables. Unlike other flat-file based Postfix databases, changes to - an LMDB database do not require automatic daemon program + an LMDB database do not trigger automatic daemon program restart. RELIABILITY @@ -56,10 +56,12 @@ LMDB_TABLE(5) LMDB_TABLE(5) The Postfix LMDB adapter implements locking with fcntl(2) locks at whole-file granularity. LMDB's native locking scheme would require world-writable lockfiles and would - therefore violate the Postfix security model. Unlike some - other Postfix flat-file databases, LMDB databases can - safely be updated without serializing requests through the - proxymap(8) service. + therefore violate the Postfix security model. + + Multiple processes can safely update an LMDB database + without serializing requests through the proxymap(8) ser- + vice. This makes LMDB suitable as a shared cache for ver- + ify(8) or postscreen(8) services. CONFIGURATION PARAMETERS Short-lived programs automatically pick up changes to diff --git a/postfix/html/lmtp.8.html b/postfix/html/lmtp.8.html index 4ef7b501f..fce80c8e5 100644 --- a/postfix/html/lmtp.8.html +++ b/postfix/html/lmtp.8.html @@ -598,14 +598,13 @@ SMTP(8) SMTP(8) hostname is not an alias and its address records lie in an unsigned zone. - tls_dane_trust_anchor_digest_enable (trust-anchor-asser- - tion) + tls_dane_trust_anchor_digest_enable (yes) RFC 6698 trust-anchor digest support in the Postfix TLS library. tlsmgr_service_name (tlsmgr) - The name of the tlsmgr(8) service entry in mas- - ter.cf. + The name of the tlsmgr(8) service entry in mas- + ter.cf. OBSOLETE STARTTLS CONTROLS The following configuration parameters exist for compati- diff --git a/postfix/html/local.8.html b/postfix/html/local.8.html index ee4dff4de..d88e556fc 100644 --- a/postfix/html/local.8.html +++ b/postfix/html/local.8.html @@ -609,7 +609,9 @@ LOCAL(8) LOCAL(8) recipient_delimiter (empty) The set of characters that can separate a user name - from its address extension (user+foo). + from its extension (example: user+foo), or a .for- + ward file name from its extension (example: .for- + ward+foo). require_home_directory (no) Require that a local(8) recipient's home directory diff --git a/postfix/html/memcache_table.5.html b/postfix/html/memcache_table.5.html index 46822efd5..238509bc6 100644 --- a/postfix/html/memcache_table.5.html +++ b/postfix/html/memcache_table.5.html @@ -41,12 +41,12 @@ MEMCACHE_TABLE(5) MEMCACHE_TABLE(5) "inet:" followed by a hostname or address, ":", and a port name or number. Specify an IPv6 address inside "[]". For a UNIX-domain server specify - "unix:" followed by the socket pathname. Examples: + "unix:" followed by the socket pathname. Examples: memcache = inet:memcache.example.com:11211 memcache = inet:127.0.0.1:11211 memcache = inet:[fc00:8d00:189::3]:11211 - memcache = unix:/path/to/socket + memcache = unix:/path/to/socket NOTE: to access a UNIX-domain socket with the prox- ymap(8) server, the socket must be accessible by diff --git a/postfix/html/mysql_table.5.html b/postfix/html/mysql_table.5.html index 2e7e68d9f..f8264f609 100644 --- a/postfix/html/mysql_table.5.html +++ b/postfix/html/mysql_table.5.html @@ -80,10 +80,10 @@ MYSQL_TABLE(5) MYSQL_TABLE(5) MYSQL PARAMETERS hosts The hosts that Postfix will try to connect to and - query from. Specify unix: for UNIX domain sockets, + query from. Specify unix: for UNIX domain sockets, inet: for TCP connections (default). Example: hosts = host1.some.domain host2.some.domain:port - hosts = unix:/file/name + hosts = unix:/file/name The hosts are tried in random order, with all con- nections over UNIX domain sockets being tried diff --git a/postfix/html/pgsql_table.5.html b/postfix/html/pgsql_table.5.html index bb1cb36d9..427629e09 100644 --- a/postfix/html/pgsql_table.5.html +++ b/postfix/html/pgsql_table.5.html @@ -86,10 +86,10 @@ PGSQL_TABLE(5) PGSQL_TABLE(5) PGSQL PARAMETERS hosts The hosts that Postfix will try to connect to and - query from. Specify unix: for UNIX-domain sockets, + query from. Specify unix: for UNIX-domain sockets, inet: for TCP connections (default). Example: hosts = host1.some.domain host2.some.domain:port - hosts = unix:/file/name + hosts = unix:/file/name The hosts are tried in random order, with all con- nections over UNIX domain sockets being tried @@ -97,7 +97,7 @@ PGSQL_TABLE(5) PGSQL_TABLE(5) matically closed after being idle for about 1 minute, and are re-opened as necessary. - NOTE: the unix: and inet: prefixes are accepted for + NOTE: the unix: and inet: prefixes are accepted for backwards compatibility reasons, but are actually ignored. The PostgreSQL client library will always try to connect to an UNIX socket if the name starts diff --git a/postfix/html/pipe.8.html b/postfix/html/pipe.8.html index 9705d00e5..90e831fe2 100644 --- a/postfix/html/pipe.8.html +++ b/postfix/html/pipe.8.html @@ -488,7 +488,9 @@ PIPE(8) PIPE(8) recipient_delimiter (empty) The set of characters that can separate a user name - from its address extension (user+foo). + from its extension (example: user+foo), or a .for- + ward file name from its extension (example: .for- + ward+foo). syslog_facility (mail) The syslog facility of Postfix logging. diff --git a/postfix/html/postconf.1.html b/postfix/html/postconf.1.html index 44fc4a22a..06501c540 100644 --- a/postfix/html/postconf.1.html +++ b/postfix/html/postconf.1.html @@ -15,13 +15,35 @@ POSTCONF(1) POSTCONF(1) postconf [-dfhnovx] [-c config_dir] [-C class,...] [param- eter ...] - postconf [-ev] [-c config_dir] [parameter=value ...] + postconf [-ev] [-c config_dir] parameter=value ... - postconf [-#vX] [-c config_dir] [parameter ...] + postconf [-#vX] [-c config_dir] parameter ... - Managing master.cf: + Managing master.cf service entries: - postconf [-fMovx] [-c config_dir] [service ...] + postconf [-fMovx] [-c config_dir] [service[/type] ...] + + postconf [-eMv] [-c config_dir] service/type=value ... + + postconf [-#MvX] [-c config_dir] service/type ... + + Managing master.cf service fields: + + postconf [-fFovx] [-c config_dir] [service[/type[/field]] + ...] + + postconf [-eFv] [-c config_dir] service/type/field=value + ... + + Managing master.cf service parameters: + + postconf [-fPovx] [-c config_dir] [service[/type[/parame- + ter]] ...] + + postconf [-ePv] [-c config_dir] service/type/parame- + ter=value ... + + postconf [-PXv] [-c config_dir] service/type/parameter ... Managing bounce message templates: @@ -35,73 +57,73 @@ POSTCONF(1) POSTCONF(1) By default, the postconf(1) command displays the values of main.cf configuration parameters, and warns about possible mis-typed parameter names (Postfix 2.9 and later). It can - also change main.cf configuration parameter values, or - display other configuration information about the Postfix + also change main.cf configuration parameter values, or + display other configuration information about the Postfix mail system. Options: - -a List the available SASL server plug-in types. The - SASL plug-in type is selected with the + -a List the available SASL server plug-in types. The + SASL plug-in type is selected with the smtpd_sasl_type configuration parameter by specify- ing one of the names listed below. - cyrus This server plug-in is available when Post- + cyrus This server plug-in is available when Post- fix is built with Cyrus SASL support. dovecot This server plug-in uses the Dovecot authen- tication server, and is available when Post- - fix is built with any form of SASL support. - - This feature is available with Postfix 2.3 and - later. - - -A List the available SASL client plug-in types. The - SASL plug-in type is selected with the - smtp_sasl_type or lmtp_sasl_type configuration - parameters by specifying one of the names listed - below. - - cyrus This client plug-in is available when Post- - fix is built with Cyrus SASL support. - - This feature is available with Postfix 2.3 and - later. - - -b [template_file] - Display the message text that appears at the begin- - ning of delivery status notification (DSN) mes- - sages, replacing $name expressions with actual val- - ues as described in bounce(5). - - To override the built-in templates, specify a tem- - plate file name at the end of the postconf(1) com- - mand line, or specify a file name in main.cf with - the bounce_template_file parameter. - - To force selection of the built-in templates, spec- - ify an empty template file name on the postconf(1) - command line (in shell language: ""). + fix is built with any form of SASL support. This feature is available with Postfix 2.3 and later. + -A List the available SASL client plug-in types. The + SASL plug-in type is selected with the + smtp_sasl_type or lmtp_sasl_type configuration + parameters by specifying one of the names listed + below. + + cyrus This client plug-in is available when Post- + fix is built with Cyrus SASL support. + + This feature is available with Postfix 2.3 and + later. + + -b [template_file] + Display the message text that appears at the begin- + ning of delivery status notification (DSN) mes- + sages, replacing $name expressions with actual val- + ues as described in bounce(5). + + To override the built-in templates, specify a tem- + plate file name at the end of the postconf(1) com- + mand line, or specify a file name in main.cf with + the bounce_template_file parameter. + + To force selection of the built-in templates, spec- + ify an empty template file name on the postconf(1) + command line (in shell language: ""). + + This feature is available with Postfix 2.3 and + later. + -c config_dir - The main.cf configuration file is in the named + The main.cf configuration file is in the named directory instead of the default configuration directory. -C class,... - When displaying main.cf parameters, select only + When displaying main.cf parameters, select only parameters from the specified class(es): builtin Parameters with built-in names. service - Parameters with service-defined names (the - first field of a master.cf entry plus a + Parameters with service-defined names (the + first field of a master.cf entry plus a Postfix-defined suffix). user Parameters with user-defined names. @@ -111,18 +133,41 @@ POSTCONF(1) POSTCONF(1) The default is as if "-C all" is specified. -d Print main.cf default parameter settings instead of - actual settings. Specify -df to fold long lines + actual settings. Specify -df to fold long lines for human readability (Postfix 2.9 and later). - -e Edit the main.cf configuration file, and update - parameter settings with the "name=value" pairs on - the postconf(1) command line. The file is copied to - a temporary file then renamed into place. Specify - quotes to protect special characters and whitespace - on the postconf(1) command line. + -e Edit the main.cf configuration file, and update + parameter settings with the "name=value" pairs on + the postconf(1) command line. - The -e is no longer needed with Postfix version 2.8 - and later. + With -M, edit the master.cf configuration file, and + replace one or more service entries with new values + as specified with "service/type=value" on the post- + conf(1) command line. + + With -F, edit the master.cf configuration file, and + replace one or more service fields with new values + as specied with "service/type/field=value" on the + postconf(1) command line. Currently, the "command" + field contains the command name and command argu- + ments. this may change in the near future, so that + the "command" field contains only the command name, + and a new "arguments" pseudofield contains the com- + mand arguments. + + With -P, edit the master.cf configuration file, and + add or update one or more service parameter set- + tings (-o parameter=value settings) with new values + as specied with "service/type/parameter=value" on + the postconf(1) command line. + + In all cases the file is copied to a temporary file + then renamed into place. Specify quotes to protect + special characters and whitespace on the post- + conf(1) command line. + + The -e option is no longer needed with Postfix ver- + sion 2.8 and later. -f Fold long lines when printing main.cf or master.cf configuration file entries, for human readability. @@ -130,8 +175,22 @@ POSTCONF(1) POSTCONF(1) This feature is available with Postfix 2.9 and later. - -h Show main.cf parameter values without the "name = " - label that normally precedes the value. + -F Show master.cf per-entry field settings (by default + all services and all fields), formatted as one + "service/type/field=value" per line. Specify -Ff to + fold long lines. + + Specify one or more "service/type/field" instances + on the postconf(1) command line to limit the output + to fields of interest. Trailing parameter name or + service type fields that are omitted will be han- + dled as "*" wildcard fields. + + This feature is available with Postfix 2.11 and + later. + + -h Show parameter or attribute values without the + "name = " label that normally precedes the value. -l List the names of all supported mailbox locking methods. Postfix supports the following methods: @@ -195,15 +254,15 @@ POSTCONF(1) POSTCONF(1) A non-shared, in-memory hash table. Its con- tent are lost when a process terminates. - ldap (read-only) - LDAP database client. This is described in - ldap_table(5). - lmdb OpenLDAP LMDB database (a memory-mapped, persistent file). Available on systems with - support for LMDB databases. This is + support for LMDB databases. This is described in lmdb_table(5). + ldap (read-only) + LDAP database client. This is described in + ldap_table(5). + memcache Memcache database client. This is described in memcache_table(5). @@ -213,12 +272,6 @@ POSTCONF(1) POSTCONF(1) with support for MySQL databases. This is described in mysql_table(5). - nis (read-only) - NIS client. - - nisplus (read-only) - NIS+ client. - pcre (read-only) A lookup table based on Perl Compatible Reg- ular Expressions. The file format is @@ -274,13 +327,13 @@ POSTCONF(1) POSTCONF(1) database. The following tables are imple- mented: - unix:passwd.byname + unix:passwd.byname The table is the UNIX password data- base. The key is a login name. The result is a password file entry in passwd(5) format. - unix:group.byname + unix:group.byname The table is the UNIX group database. The key is a group name. The result is a group file entry in group(5) @@ -293,28 +346,52 @@ POSTCONF(1) POSTCONF(1) file contents. Specify -Mf to fold long lines for human readability. - If service ... is specified, only the matching ser- - vices will be output. For example, "postconf -Mf - inet" will output all services that listen on the - network. + Specify zero or more arguments, each with a ser- + vice-name or service-name/service-type pair, where + service-name is the first field of a master.cf + entry and service-type is one of (inet, unix, fifo, + or pass). - Specify zero or more arguments, each with a ser- - vice-type name (inet, unix, fifo, or pass) or with - a service-name.service-type pair, where service- - name is the first field of a master.cf entry. + If service-name or service-name/service-type is + specified, only the matching master.cf entries will + be output. For example, "postconf -Mf smtp" will + output all services named "smtp", and "postconf -Mf + smtp/inet" will output only the smtp service that + listens on the network. Trailing service type + fields that are omitted will be handled as "*" + wildcard fields. - This feature is available with Postfix 2.9 and - later. + This feature is available with Postfix 2.9 and + later. The syntax was changed from "name.type" to + "name/type", and "*" wildcard support was added + with Postfix 2.11. - -n Show only configuration parameters that have - explicit name=value settings in main.cf. Specify + -n Show only configuration parameters that have + explicit name=value settings in main.cf. Specify -nf to fold long lines for human readability (Post- fix 2.9 and later). -o name=value Override main.cf parameter settings. - This feature is available with Postfix 2.10 and + This feature is available with Postfix 2.10 and + later. + + -p Show main.cf parameter settings. This is the + default. + + -P Show master.cf service parameter settings (by + default all services and all parameters). format- + ted as one "service/type/parameter=value" per line. + Specify -Pf to fold long lines. + + Specify one or more "service/type/parameter" + instances on the postconf(1) command line to limit + the output to parameters of interest. Trailing + parameter name or service type fields that are + omitted will be handled as "*" wildcard fields. + + This feature is available with Postfix 2.11 and later. -t [template_file] @@ -346,25 +423,51 @@ POSTCONF(1) POSTCONF(1) -X Edit the main.cf configuration file, and remove the parameters named on the postconf(1) command line. - The file is copied to a temporary file then renamed - into place. Specify a list of parameter names, not - "name=value" pairs. There is no postconf(1) com- - mand to perform the reverse operation. + Specify a list of parameter names, not "name=value" + pairs. - This feature is available with Postfix 2.10 and - later. + With -M, edit the master.cf configuration file, and + remove one or more service entries as specified + with "service/type" on the postconf(1) command + line. + + With -P, edit the master.cf configuration file, and + remove one or more service parameter settings (-o + parameter=value settings) as specied with "ser- + vice/type/parameter" on the postconf(1) command + line. + + In all cases the file is copied to a temporary file + then renamed into place. Specify quotes to protect + special characters on the postconf(1) command line. + + There is no postconf(1) command to perform the + reverse operation. + + This feature is available with Postfix 2.10 and + later. Support for -M and -P was added with Post- + fix 2.11. -# Edit the main.cf configuration file, and comment out the parameters named on the postconf(1) command line, so that those parameters revert to their - default values. The file is copied to a temporary - file then renamed into place. Specify a list of - parameter names, not "name=value" pairs. There is - no postconf(1) command to perform the reverse oper- - ation. + default values. Specify a list of parameter names, + not "name=value" pairs. + + With -M, edit the master.cf configuration file, and + comment out one or more service entries as speci- + fied with "service/type" on the postconf(1) command + line. + + In all cases the file is copied to a temporary file + then renamed into place. Specify quotes to protect + special characters on the postconf(1) command line. + + There is no postconf(1) command to perform the + reverse operation. This feature is available with Postfix 2.6 and - later. + later. Support for -M was added with Postfix 2.11. DIAGNOSTICS Problems are reported to the standard error stream. @@ -374,41 +477,39 @@ POSTCONF(1) POSTCONF(1) Directory with Postfix configuration files. CONFIGURATION PARAMETERS - The following main.cf parameters are especially relevant + The following main.cf parameters are especially relevant to this program. - The text below provides only a parameter summary. See + The text below provides only a parameter summary. See postconf(5) for more details including examples. config_directory (see 'postconf -d' output) - The default location of the Postfix main.cf and + The default location of the Postfix main.cf and master.cf configuration files. bounce_template_file (empty) - Pathname of a configuration file with bounce mes- + Pathname of a configuration file with bounce mes- sage templates. FILES /etc/postfix/main.cf, Postfix configuration parameters - /etc/postfix/master.cf, Postfix master daemon configuraton + /etc/postfix/master.cf, Postfix master daemon configuration SEE ALSO - bounce(5), bounce template file format - master(5), master.cf configuration file syntax - postconf(5), main.cf configuration file syntax + bounce(5), bounce template file format master(5), master.cf + configuration file syntax postconf(5), main.cf configuration + file syntax README FILES DATABASE_README, Postfix lookup table overview LICENSE - The Secure Mailer license must be distributed with this + The Secure Mailer license must be distributed with this software. AUTHOR(S) - Wietse Venema - IBM T.J. Watson Research - P.O. Box 704 - Yorktown Heights, NY 10598, USA + Wietse Venema IBM T.J. Watson Research P.O. Box 704 Yorktown + Heights, NY 10598, USA POSTCONF(1)