diff options
Diffstat (limited to 'deploy/postfix')
| -rw-r--r-- | deploy/postfix/qee-mail2news-access | 3 | ||||
| -rw-r--r-- | deploy/postfix/qee-mail2news-aliases | 4 | ||||
| -rw-r--r-- | deploy/postfix/victor-master.cf.fragment | 4 |
3 files changed, 9 insertions, 2 deletions
diff --git a/deploy/postfix/qee-mail2news-access b/deploy/postfix/qee-mail2news-access new file mode 100644 index 0000000..f8c23a7 --- /dev/null +++ b/deploy/postfix/qee-mail2news-access @@ -0,0 +1,3 @@ +# Permit only the dated Mail2News recipient syntax used by ordinary email +# clients. Everything else is rejected by the dedicated qee onion listener. +/^mail2news-[0-9]{8}-[a-z][a-z0-9]+(\.[0-9a-z+_-]+)+(=[a-z][a-z0-9]+(\.[0-9a-z+_-]+)+){0,2}@mail2news\.tcpreset\.net$/ OK diff --git a/deploy/postfix/qee-mail2news-aliases b/deploy/postfix/qee-mail2news-aliases new file mode 100644 index 0000000..3025ccf --- /dev/null +++ b/deploy/postfix/qee-mail2news-aliases @@ -0,0 +1,4 @@ +# Preserve the user-facing To header, but rewrite the SMTP envelope to the +# exact client-authorized Mail2News onion ingress. Mail2News extracts and +# validates the date and newsgroups from the original To header. +/^mail2news-[0-9]{8}-[a-z][a-z0-9]+(\.[0-9a-z+_-]+)+(=[a-z][a-z0-9]+(\.[0-9a-z+_-]+)+){0,2}@mail2news\.tcpreset\.net$/ mail2news@xilb7y4kj6u6qfo45o3yk2kilfv54ffukzei3puonuqlncy7cn2afwyd.onion diff --git a/deploy/postfix/victor-master.cf.fragment b/deploy/postfix/victor-master.cf.fragment index 9012438..2e00cc1 100644 --- a/deploy/postfix/victor-master.cf.fragment +++ b/deploy/postfix/victor-master.cf.fragment @@ -5,8 +5,8 @@ -o myhostname=qee4i7sags6phsvb2yodwecfj7noimfhhalsjktsvikrwotxzis3raad.onion -o smtpd_tls_security_level=none -o smtpd_sasl_auth_enable=no - -o smtpd_relay_restrictions=reject_unauth_destination - -o smtpd_recipient_restrictions=reject_unauth_destination + -o smtpd_relay_restrictions=check_recipient_access,regexp:/etc/postfix/qee-mail2news-access,reject + -o smtpd_recipient_restrictions=check_recipient_access,regexp:/etc/postfix/qee-mail2news-access,reject -o smtpd_reject_unlisted_recipient=yes -o smtpd_helo_required=yes -o smtpd_recipient_limit=1 |