diff --git a/relay-1.swedenconnect.se/overlay/etc/default/opendkim b/relay-1.swedenconnect.se/overlay/etc/default/opendkim new file mode 100644 index 00000000..4fd95c7b --- /dev/null +++ b/relay-1.swedenconnect.se/overlay/etc/default/opendkim @@ -0,0 +1,31 @@ +# NOTE: This is a legacy configuration file. It is not used by the opendkim +# systemd service. Please use the corresponding configuration parameters in +# /etc/opendkim.conf instead. +# +# Previously, one would edit the default settings here, and then execute +# /lib/opendkim/opendkim.service.generate to generate systemd override files at +# /etc/systemd/system/opendkim.service.d/override.conf and +# /etc/tmpfiles.d/opendkim.conf. While this is still possible, it is now +# recommended to adjust the settings directly in /etc/opendkim.conf. +# +#DAEMON_OPTS="" +# Change to /var/spool/postfix/run/opendkim to use a Unix socket with +# postfix in a chroot: +#RUNDIR=/var/spool/postfix/run/opendkim +RUNDIR=/run/opendkim +# +# Uncomment to specify an alternate socket +# Note that setting this will override any Socket value in opendkim.conf +# default: +# SOCKET=local:$RUNDIR/opendkim.sock +# listen on all interfaces on port 54321: +#SOCKET=inet:54321 +# listen on loopback on port 12345: +#SOCKET=inet:12345@localhost +# listen on 192.0.2.1 on port 12345: +#SOCKET=inet:12345@192.0.2.1 +SOCKET="inet:8891@localhost" +USER=opendkim +GROUP=opendkim +PIDFILE=$RUNDIR/$NAME.pid +EXTRAAFTER= diff --git a/relay-1.swedenconnect.se/overlay/etc/opendkim.conf b/relay-1.swedenconnect.se/overlay/etc/opendkim.conf new file mode 100644 index 00000000..f0979896 --- /dev/null +++ b/relay-1.swedenconnect.se/overlay/etc/opendkim.conf @@ -0,0 +1,51 @@ +# This is a basic configuration for signing and verifying. It can easily be +# adapted to suit a basic installation. See opendkim.conf(5) and +# /usr/share/doc/opendkim/examples/opendkim.conf.sample for complete +# documentation of available configuration parameters. + +Syslog yes +SyslogSuccess yes +#LogWhy no + +# Common signing and verification parameters. In Debian, the "From" header is +# oversigned, because it is often the identity key used by reputation systems +# and thus somewhat security sensitive. +Canonicalization relaxed/simple +#Mode sv +#SubDomains no +OversignHeaders From + +# Signing domain, selector, and key (required). For example, perform signing +# for domain "example.com" with selector "2020" (2020._domainkey.example.com), +# using the private key stored in /etc/dkimkeys/example.private. More granular +# setup options can be found in /usr/share/doc/opendkim/README.opendkim. +Domain swedenconnect.se +Selector relay1 +KeyFile /etc/dkimkeys/relay1.private + +# In Debian, opendkim runs as user "opendkim". A umask of 007 is required when +# using a local socket with MTAs that access the socket as a non-privileged +# user (for example, Postfix). You may need to add user "postfix" to group +# "opendkim" in that case. +UserID opendkim +UMask 007 + +# Socket for the MTA connection (required). If the MTA is inside a chroot jail, +# it must be ensured that the socket is accessible. In Debian, Postfix runs in +# a chroot in /var/spool/postfix, therefore a Unix socket would have to be +# configured as shown on the last line below. +#Socket local:/run/opendkim/opendkim.sock +Socket inet:8891@localhost +#Socket inet:8891 +#Socket local:/var/spool/postfix/opendkim/opendkim.sock + +PidFile /run/opendkim/opendkim.pid + +# Hosts for which to sign rather than verify, default is 127.0.0.1. See the +# OPERATION section of opendkim(8) for more information. +#InternalHosts 192.168.0.0/16, 10.0.0.0/8, 172.16.0.0/12 + +# The trust anchor enables DNSSEC. In Debian, the trust anchor file is provided +# by the package dns-root-data. +TrustAnchorFile /usr/share/dns/root.key +#Nameservers 127.0.0.1 diff --git a/relay-1.swedenconnect.se/overlay/etc/postfix/main.cf b/relay-1.swedenconnect.se/overlay/etc/postfix/main.cf index 2f30bd8c..af516494 100644 --- a/relay-1.swedenconnect.se/overlay/etc/postfix/main.cf +++ b/relay-1.swedenconnect.se/overlay/etc/postfix/main.cf @@ -45,3 +45,10 @@ mailbox_size_limit = 0 recipient_delimiter = + inet_interfaces = all inet_protocols = all + + +# DKIM +milter_default_action = accept +milter_protocol = 2 +smtpd_milters = inet:localhost:8891 +non_smtpd_milters = inet:localhost:8891 diff --git a/relay-2.swedenconnect.se/overlay/etc/default/opendkim b/relay-2.swedenconnect.se/overlay/etc/default/opendkim new file mode 100644 index 00000000..4fd95c7b --- /dev/null +++ b/relay-2.swedenconnect.se/overlay/etc/default/opendkim @@ -0,0 +1,31 @@ +# NOTE: This is a legacy configuration file. It is not used by the opendkim +# systemd service. Please use the corresponding configuration parameters in +# /etc/opendkim.conf instead. +# +# Previously, one would edit the default settings here, and then execute +# /lib/opendkim/opendkim.service.generate to generate systemd override files at +# /etc/systemd/system/opendkim.service.d/override.conf and +# /etc/tmpfiles.d/opendkim.conf. While this is still possible, it is now +# recommended to adjust the settings directly in /etc/opendkim.conf. +# +#DAEMON_OPTS="" +# Change to /var/spool/postfix/run/opendkim to use a Unix socket with +# postfix in a chroot: +#RUNDIR=/var/spool/postfix/run/opendkim +RUNDIR=/run/opendkim +# +# Uncomment to specify an alternate socket +# Note that setting this will override any Socket value in opendkim.conf +# default: +# SOCKET=local:$RUNDIR/opendkim.sock +# listen on all interfaces on port 54321: +#SOCKET=inet:54321 +# listen on loopback on port 12345: +#SOCKET=inet:12345@localhost +# listen on 192.0.2.1 on port 12345: +#SOCKET=inet:12345@192.0.2.1 +SOCKET="inet:8891@localhost" +USER=opendkim +GROUP=opendkim +PIDFILE=$RUNDIR/$NAME.pid +EXTRAAFTER= diff --git a/relay-2.swedenconnect.se/overlay/etc/opendkim.conf b/relay-2.swedenconnect.se/overlay/etc/opendkim.conf new file mode 100644 index 00000000..1fa2c4b5 --- /dev/null +++ b/relay-2.swedenconnect.se/overlay/etc/opendkim.conf @@ -0,0 +1,51 @@ +# This is a basic configuration for signing and verifying. It can easily be +# adapted to suit a basic installation. See opendkim.conf(5) and +# /usr/share/doc/opendkim/examples/opendkim.conf.sample for complete +# documentation of available configuration parameters. + +Syslog yes +SyslogSuccess yes +#LogWhy no + +# Common signing and verification parameters. In Debian, the "From" header is +# oversigned, because it is often the identity key used by reputation systems +# and thus somewhat security sensitive. +Canonicalization relaxed/simple +#Mode sv +#SubDomains no +OversignHeaders From + +# Signing domain, selector, and key (required). For example, perform signing +# for domain "example.com" with selector "2020" (2020._domainkey.example.com), +# using the private key stored in /etc/dkimkeys/example.private. More granular +# setup options can be found in /usr/share/doc/opendkim/README.opendkim. +Domain swedenconnect.se +Selector relay2 +KeyFile /etc/dkimkeys/relay2.private + +# In Debian, opendkim runs as user "opendkim". A umask of 007 is required when +# using a local socket with MTAs that access the socket as a non-privileged +# user (for example, Postfix). You may need to add user "postfix" to group +# "opendkim" in that case. +UserID opendkim +UMask 007 + +# Socket for the MTA connection (required). If the MTA is inside a chroot jail, +# it must be ensured that the socket is accessible. In Debian, Postfix runs in +# a chroot in /var/spool/postfix, therefore a Unix socket would have to be +# configured as shown on the last line below. +#Socket local:/run/opendkim/opendkim.sock +Socket inet:8891@localhost +#Socket inet:8891 +#Socket local:/var/spool/postfix/opendkim/opendkim.sock + +PidFile /run/opendkim/opendkim.pid + +# Hosts for which to sign rather than verify, default is 127.0.0.1. See the +# OPERATION section of opendkim(8) for more information. +#InternalHosts 192.168.0.0/16, 10.0.0.0/8, 172.16.0.0/12 + +# The trust anchor enables DNSSEC. In Debian, the trust anchor file is provided +# by the package dns-root-data. +TrustAnchorFile /usr/share/dns/root.key +#Nameservers 127.0.0.1 diff --git a/relay-2.swedenconnect.se/overlay/etc/postfix/main.cf b/relay-2.swedenconnect.se/overlay/etc/postfix/main.cf index b0d52fe3..af516494 100644 --- a/relay-2.swedenconnect.se/overlay/etc/postfix/main.cf +++ b/relay-2.swedenconnect.se/overlay/etc/postfix/main.cf @@ -34,14 +34,21 @@ smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination -myhostname = relay-2.swedenconnect.se +myhostname = relay-1.swedenconnect.se alias_maps = hash:/etc/aliases alias_database = hash:/etc/aliases myorigin = /etc/mailname -mydestination = relay-2.swedenconnect.se, $myhostname, relay-2.swedenconnect.se, localhost.swedenconnect.se, localhost +mydestination = relay-1.swedenconnect.se, $myhostname, relay-1.swedenconnect.se, localhost.swedenconnect.se, localhost relayhost = mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 mailbox_size_limit = 0 recipient_delimiter = + inet_interfaces = all inet_protocols = all + + +# DKIM +milter_default_action = accept +milter_protocol = 2 +smtpd_milters = inet:localhost:8891 +non_smtpd_milters = inet:localhost:8891