diff --git a/group_vars/all b/group_vars/all index 83afd35..aeb44e3 100644 --- a/group_vars/all +++ b/group_vars/all @@ -6,13 +6,15 @@ ldap_base: dc=binary-kitchen,dc=de ldap_binddn: cn=Services,ou=Roles,dc=binary-kitchen,dc=de ldap_bindpw: svcpwd +mail_domain: binary-kitchen.com + nslcd_base_group: ou=Groups,dc=binary-kitchen,dc=de nslcd_base_shadow: ou=Users,dc=binary-kitchen,dc=de nslcd_base_passwd: ou=Users,dc=binary-kitchen,dc=de ntp_servers: - 172.23.1.61 -- 172.23.2.2 +- 172.23.2.2 prosody_admin: moepman@jabber.binary-kitchen.de prosody_domain: jabber.binary-kitchen.de diff --git a/roles/mail/files/policyd-spf.conf b/roles/mail/files/policyd-spf.conf new file mode 100644 index 0000000..d32521b --- /dev/null +++ b/roles/mail/files/policyd-spf.conf @@ -0,0 +1,14 @@ +# For a fully commented sample config file see policyd-spf.conf.commented + +debugLevel = 1 +defaultSeedOnly = 1 + +HELO_reject = No_Check +Mail_From_reject = False + +Mail_From_pass_restriction = OK + +PermError_reject = False +TempError_Defer = False + +skip_addresses = 127.0.0.0/8,::ffff:127.0.0.0//104,::1//128 diff --git a/roles/mail/tasks/main.yml b/roles/mail/tasks/main.yml index 90e3f92..ce2ebad 100644 --- a/roles/mail/tasks/main.yml +++ b/roles/mail/tasks/main.yml @@ -3,25 +3,75 @@ - name: Install packages apt: name={{ item }} state=present with_items: - - postfix - amavisd-new - - postgrey - - spamassassin + - bsd-mailx - dovecot-core - dovecot-imapd - - dovecot-sieve - - dovecot-managesieved - dovecot-ldap + - dovecot-managesieved + - dovecot-sieve + - postfix + - postfix-policyd-spf-python + - postgrey + - pyzor + - razor + - spamassassin + tags: mail + +- name: Create vmail group + group: name=vmail gid=500 state=present + tags: mail + +- name: Create vmail user + user: name=vmail uid=500 createhome=yes home=/var/vmail shell=/bin/false state=present + tags: mail + +- name: Configure amavis + template: src={{ item }}.j2 dest=/etc/{{ item }} + with_items: + - amavis/15-content_filter_mode + - amavis/50-user + notify: Restart amavis + tags: mail + +- name: Configure dovecot + template: src={{ item }}.j2 dest=/etc/{{ item }} + with_items: + - dovecot/dovecot-ldap.conf.ext + - dovecot/local.conf + notify: Restart dovecot + tags: mail + +- name: Configure policyd + copy: src={{ item }} dest=/etc/postfix-policyd-spf-python/{{ item }} + with_items: + - policyd-spf.conf tags: mail - name: Configure postfix - template: src={{ item }} dest=/etc/postfix/{{ item }} + template: src={{ item }}.j2 dest=/etc/{{ item }} with_items: - - ldap-aliases.cf.j2 - - ldap-virtual-maps.cf.j2 + - postfix/helo_access + - postfix/ldap-aliases.cf + - postfix/ldap-virtual-maps.cf + - postfix/main.cf + - postfix/master.cf + - postfix/recipient_access notify: Restart postfix tags: mail +- name: Create razor directory structure + command: razor-admin -create chdir=/var/lib/amavis creates=/var/lib/amavis/.razor + become: yes + become_user: amavis + tags: mail + +- name: Register razor + command: razor-admin -register chdir=/var/lib/amavis creates=/var/lib/amavis/.razor/identity + become: yes + become_user: amavis + tags: mail + - name: Start amavis service: name=amavis state=started enabled=yes tags: mail diff --git a/roles/mail/templates/amavis/15-content_filter_mode.j2 b/roles/mail/templates/amavis/15-content_filter_mode.j2 new file mode 100644 index 0000000..1d5ffab --- /dev/null +++ b/roles/mail/templates/amavis/15-content_filter_mode.j2 @@ -0,0 +1,27 @@ +use strict; + +# You can modify this file to re-enable SPAM checking through spamassassin +# and to re-enable antivirus checking. + +# +# Default antivirus checking mode +# Please note, that anti-virus checking is DISABLED by +# default. +# If You wish to enable it, please uncomment the following lines: + + +#@bypass_virus_checks_maps = ( +# \%bypass_virus_checks, \@bypass_virus_checks_acl, \$bypass_virus_checks_re); + + +# +# Default SPAM checking mode +# Please note, that anti-spam checking is DISABLED by +# default. +# If You wish to enable it, please uncomment the following lines: + + +@bypass_spam_checks_maps = ( + \%bypass_spam_checks, \@bypass_spam_checks_acl, \$bypass_spam_checks_re); + +1; # ensure a defined return diff --git a/roles/mail/templates/amavis/50-user.j2 b/roles/mail/templates/amavis/50-user.j2 new file mode 100644 index 0000000..541d0f1 --- /dev/null +++ b/roles/mail/templates/amavis/50-user.j2 @@ -0,0 +1,33 @@ +use strict; + +# +# Place your configuration directives here. They will override those in +# earlier files. +# +# See /usr/share/doc/amavisd-new/ for documentation and examples of +# the directives you can use in this file +# + +$remove_existing_spam_headers = 1; + +$sa_tag_level_deflt = undef; +$sa_tag2_level_deflt = 5.0; +$sa_kill_level_deflt = $sa_tag2_level_deflt; +$sa_spam_subject_tag = undef; + +$final_virus_destiny = D_PASS; +$final_banned_destiny = D_PASS; +$final_spam_destiny = D_PASS; +$final_bad_header_destiny = D_PASS; + +$virus_admin = undef; + +$virus_quarantine_to = undef; +$spam_quarantine_to = undef; + +$X_HEADER_LINE = "$myproduct_name at $mydomain"; + +# todo (mrks): determine local addresses + +#------------ Do not modify anything below this line ------------- +1; # ensure a defined return diff --git a/roles/mail/templates/dovecot/dovecot-ldap.conf.ext.j2 b/roles/mail/templates/dovecot/dovecot-ldap.conf.ext.j2 new file mode 100644 index 0000000..8e48ec8 --- /dev/null +++ b/roles/mail/templates/dovecot/dovecot-ldap.conf.ext.j2 @@ -0,0 +1,145 @@ +# This file is commonly accessed via passdb {} or userdb {} section in +# conf.d/auth-ldap.conf.ext + +# This file is opened as root, so it should be owned by root and mode 0600. +# +# http://wiki2.dovecot.org/AuthDatabase/LDAP +# +# NOTE: If you're not using authentication binds, you'll need to give +# dovecot-auth read access to userPassword field in the LDAP server. +# With OpenLDAP this is done by modifying /etc/ldap/slapd.conf. There should +# already be something like this: + +# access to attribute=userPassword +# by dn="" read # add this +# by anonymous auth +# by self write +# by * none + +# Space separated list of LDAP hosts to use. host:port is allowed too. +#hosts = {{ ldap_host }} + +# LDAP URIs to use. You can use this instead of hosts list. Note that this +# setting isn't supported by all LDAP libraries. +uris = {{ ldap_uri }} + +# Distinguished Name - the username used to login to the LDAP server. +# Leave it commented out to bind anonymously (useful with auth_bind=yes). +dn = {{ ldap_binddn }} + +# Password for LDAP server, if dn is specified. +dnpass = {{ ldap_bindpw }} + +# Use SASL binding instead of the simple binding. Note that this changes +# ldap_version automatically to be 3 if it's lower. Also note that SASL binds +# and auth_bind=yes don't work together. +#sasl_bind = no +# SASL mechanism name to use. +#sasl_mech = +# SASL realm to use. +#sasl_realm = +# SASL authorization ID, ie. the dnpass is for this "master user", but the +# dn is still the logged in user. Normally you want to keep this empty. +#sasl_authz_id = + +# Use TLS to connect to the LDAP server. +tls = yes +# TLS options, currently supported only with OpenLDAP: +#tls_ca_cert_file = +#tls_ca_cert_dir = +#tls_cipher_suite = +# TLS cert/key is used only if LDAP server requires a client certificate. +#tls_cert_file = +#tls_key_file = +# Valid values: never, hard, demand, allow, try +#tls_require_cert = + +# Use the given ldaprc path. +#ldaprc_path = + +# LDAP library debug level as specified by LDAP_DEBUG_* in ldap_log.h. +# -1 = everything. You may need to recompile OpenLDAP with debugging enabled +# to get enough output. +#debug_level = 0 + +# Use authentication binding for verifying password's validity. This works by +# logging into LDAP server using the username and password given by client. +# The pass_filter is used to find the DN for the user. Note that the pass_attrs +# is still used, only the password field is ignored in it. Before doing any +# search, the binding is switched back to the default DN. +#auth_bind = no + +# If authentication binding is used, you can save one LDAP request per login +# if users' DN can be specified with a common template. The template can use +# the standard %variables (see user_filter). Note that you can't +# use any pass_attrs if you use this setting. +# +# If you use this setting, it's a good idea to use a different +# dovecot-ldap.conf.ext for userdb (it can even be a symlink, just as long as +# the filename is different in userdb's args). That way one connection is used +# only for LDAP binds and another connection is used for user lookups. +# Otherwise the binding is changed to the default DN before each user lookup. +# +# For example: +# auth_bind_userdn = cn=%u,ou=people,o=org +# +#auth_bind_userdn = + +# LDAP protocol version to use. Likely 2 or 3. +#ldap_version = 3 + +# LDAP base. %variables can be used here. +# For example: dc=mail, dc=example, dc=org +base = {{ ldap_base }} + +# Dereference: never, searching, finding, always +deref = never + +# Search scope: base, onelevel, subtree +scope = subtree + +# User attributes are given in LDAP-name=dovecot-internal-name list. The +# internal names are: +# uid - System UID +# gid - System GID +# home - Home directory +# mail - Mail location +# +# There are also other special fields which can be returned, see +# http://wiki2.dovecot.org/UserDatabase/ExtraFields +#user_attrs = homeDirectory=home,uidNumber=uid,gidNumber=gid +user_attr = + +# Filter for user lookup. Some variables can be used (see +# http://wiki2.dovecot.org/Variables for full list): +# %u - username +# %n - user part in user@domain, same as %u if there's no domain +# %d - domain part in user@domain, empty if user there's no domain +#user_filter = (&(objectClass=posixAccount)(uid=%u)) +user_filter = (&(objectClass=posixAccount)(uid=%u)) + +# Password checking attributes: +# user: Virtual user name (user@domain), if you wish to change the +# user-given username to something else +# password: Password, may optionally start with {type}, eg. {crypt} +# There are also other special fields which can be returned, see +# http://wiki2.dovecot.org/PasswordDatabase/ExtraFields +#pass_attrs = uid=user,userPassword=password + +# If you wish to avoid two LDAP lookups (passdb + userdb), you can use +# userdb prefetch instead of userdb ldap in dovecot.conf. In that case you'll +# also have to include user_attrs in pass_attrs field prefixed with "userdb_" +# string. For example: +#pass_attrs = uid=user,userPassword=password,\ +# homeDirectory=userdb_home,uidNumber=userdb_uid,gidNumber=userdb_gid + +# Filter for password lookups +#pass_filter = (&(objectClass=posixAccount)(uid=%u)) + +# Attributes and filter to get a list of all users +#iterate_attrs = uid=user +#iterate_filter = (objectClass=posixAccount) + +# Default password scheme. "{scheme}" before password overrides this. +# List of supported schemes is in: http://wiki2.dovecot.org/Authentication +#default_pass_scheme = CRYPT diff --git a/roles/mail/templates/dovecot/local.conf.j2 b/roles/mail/templates/dovecot/local.conf.j2 new file mode 100644 index 0000000..e4a0b36 --- /dev/null +++ b/roles/mail/templates/dovecot/local.conf.j2 @@ -0,0 +1,102 @@ +auth_mechanisms = plain login +auth_verbose = yes + +auth_debug=yes +mail_debug = yes +log_path = /var/log/dovecot/errors.log +info_log_path = /var/log/dovecot/info.log +#log_timestamp = "%Y-%m-%d %H:%M:%S " + +mail_privileged_group = mail + +mail_location = maildir:/var/vmail/%u/.maildir +mail_home = maildir:/var/vmail/%u +mail_uid = vmail +mail_gid = vmail + +ssl = yes +ssl_cert =