mikenye/postfix Docker 镜像 - 轩辕镜像

mikenye/postfix

!Docker !Linting

Postfix is Wietse Venema's excellent mail server.

This container attempts to simplify and streamline setting up inbound and outbound mail relays, to protect and enhance self hosted email servers (eg: Microsoft Exchange). However, if you find an alternate use, please let me know so I can add to "Deployment Recipes".

The container employs Postfix's Postscreen for enhanced protection.

Apart from basic email relaying, the container can optionally:

• Implement up-to-date TLS/SSL security for SMTP connections
• Perform email virus scanning with ClamAV for all inbound/outbound email
• Implement DNSBLs for inbound email
• Perform DKIM signing for all outbound email
• Perform DKIM verification for all inbound email
• Implement spf checking for inbound email
• Implement greylisting) for inbound email
• Implement LDAP-based recipient verification for inbound email

The container is fully configured via environment variables - each service's configuration files built from environment variables on container start. It also supports some configuration files via volume mappings.

Currently supported docker architectures are linux/386, linux/amd64, linux/arm/v7 and linux/arm64.

---

Please note - docker hub cuts off this readme as it is quite long. To view the full readme click here.

---

Services

This container implement's the excellent s6-overlay for process supervision (and a bunch of other handy stuff).

Deployment Recipes

Wrap a Local Exchange Server

!Wrapping an Exchange Server

In this deployment recipe, two containers (mail_in and mail_out) are created.

mail_in is designed to sit between the internet and a local legacy Exchange server. It handles inbound email, and provides the following:

• Uses postscreen to ensure the sending MTA is standards compliant
• Uses DNSBLs as an initial anti-spam measure
• Provides up-to-date TLS for incoming clients
• Performs greylisting as another anti-spam measure
• Performs SPF & DKIM verification
• Performs various header/sender/recipient checks to make sure the message is valid
• Performs recipient verification via LDAP to internal Active Directory
• Scans the email for viruses with ClamAV
• Forwards the email to the legacy Exchange server

mail_out is designed to sit between the local legacy Exchange server and the internet. It handles outbound email, and provides the following:

• Provides up-to-date TLS for talking to external MTAs
• Performs DKIM signing
• Scans the email for viruses with ClamAV
• Delivers the outgoing email

From a networking perspective:

• The site's internet router is configured to NAT incoming connections on TCP port 25 through to the docker host running mail_in on port TCP 2525.
• The site's Exchange server is configured to send email (via "smart host") to the docker host (which is hard-coded to TCP port 25)

An example docker-compose.yml file is follows:

yaml
version: '3.8'

volumes:
  queue_out:
    driver: local
  queue_in:
    driver: local
  certs:
    driver: local
  dkim:
    driver: local
  clamav_in:
    driver: local
  clamav_out:
    driver: local
  postgrey_in:
    driver: local
  tables_in:
    driver: local
  aliases_in:
    driver: local
  asupdata_in:
    driver: local
  logs_in:
    driver: local
  logs_out:
    driver: local

services:

  mail_out:
    image: mikenye/postfix
    container_name: mail_out
    restart: always
    logging:
      driver: "json-file"
      options:
        max-file: "10"
        max-size: "10m"
    ports:
      - "25:25"
    environment:
      TZ: "Australia/Perth"
      POSTMASTER_*** "***"
      POSTFIX_INET_PROTOCOLS: "ipv4"
      POSTFIX_MYORIGIN: "mail.yourdomain.tld"
      POSTFIX_PROXY_INTERFACES: "your.external.IP.address"
      POSTFIX_MYNETWORKS: "your.local.LAN.subnet/prefix"
      POSTFIX_MYDOMAIN: "yourdomain.tld"
      POSTFIX_MYHOSTNAME: "mail.yourdomain.tld"
      POSTFIX_MAIL_NAME: "outbound"
      POSTFIX_SMTPD_TLS_CHAIN_FILES: "/etc/postfix/certs/privkey.pem, /etc/postfix/certs/fullchain.pem"
      POSTFIX_SMTP_TLS_CHAIN_FILES: "/etc/postfix/certs/privkey.pem, /etc/postfix/certs/fullchain.pem"
      POSTFIX_SMTPD_TLS_SECURITY_LEVEL: "may"
      POSTFIX_SMTPD_TLS_LOGLEVEL: 1
      POSTFIX_REJECT_INVALID_HELO_HOSTNAME: "false"
      POSTFIX_REJECT_NON_FQDN_HELO_HOSTNAME: "false"
      POSTFIX_REJECT_UNKNOWN_HELO_HOSTNAME: "false"
      ENABLE_OPENDKIM: "true"
      OPENDKIM_SIGNINGTABLE: "/etc/mail/dkim/SigningTable"
      OPENDKIM_KEYTABLE: "/etc/mail/dkim/KeyTable"
      OPENDKIM_MODE: "s"
      OPENDKIM_INTERNALHOSTS: "your.local.LAN.subnet/prefix"
      OPENDKIM_LOGRESULTS: "true"
      OPENDKIM_LOGWHY: "true"
      ENABLE_CLAMAV: "true"
      CLAMAV_MILTER_REPORT_HOSTNAME: "mail.yourdomain.tld"
    volumes:
      - "certs:/etc/postfix/certs:ro"
      - "dkim:/etc/mail/dkim:rw"
      - "clamav_out:/var/lib/clamav:rw"
      - "queue_out:/var/spool/postfix:rw"
      - "logs_out:/var/log:rw"

  mail_in:
    image: mikenye/postfix
    container_name: mail_in
    restart: always
    logging:
      driver: "json-file"
      options:
        max-file: "10"
        max-size: "10m"
    dns:
      - 8.8.8.8
      - 8.8.4.4
    ports:
      - "2525:25"
    environment:
      TZ: "Australia/Perth"
      POSTMASTER_*** "***"
      POSTFIX_INET_PROTOCOLS: "ipv4"
      POSTFIX_MYORIGIN: "mail.yourdomain.tld"
      POSTFIX_PROXY_INTERFACES: "your.external.IP.address"
      POSTFIX_MYDOMAIN: "yourdomain.tld"
      POSTFIX_MYHOSTNAME: "mail.yourdomain.tld"
      POSTFIX_MAIL_NAME: "inbound"
      POSTFIX_SMTPD_TLS_CHAIN_FILES: "/etc/postfix/certs/privkey.pem, /etc/postfix/certs/fullchain.pem"
      POSTFIX_SMTP_TLS_CHAIN_FILES: "/etc/postfix/certs/privkey.pem, /etc/postfix/certs/fullchain.pem"
      POSTFIX_SMTPD_TLS_SECURITY_LEVEL: "may"
      POSTFIX_SMTPD_TLS_LOGLEVEL: 1
      POSTFIX_RELAYHOST: "exchange.server.IP.addr"
      POSTFIX_RELAY_DOMAINS: "yourdomain.tld,someotherdomain.tld"
      POSTFIX_DNSBL_SITES: "hostkarma.junkemailfilter.com=127.0.0.2, bl.spamcop.net, cbl.abuseat.org=127.0.0.2, zen.spamhaus.org"
      ENABLE_OPENDKIM: "true"
      OPENDKIM_MODE: "v"
      OPENDKIM_LOGRESULTS: "true"
      OPENDKIM_LOGWHY: "true"
      ENABLE_SPF: "true"
      ENABLE_CLAMAV: "true"
      CLAMAV_MILTER_REPORT_HOSTNAME: "mail.yourdomain.tld"
      ENABLE_POSTGREY: "true"
      ENABLE_LDAP_RECIPIENT_ACCESS: "true"
      POSTFIX_LDAP_SERVERS: "active.directory.server.IP,active.directory.server.IP"
      POSTFIX_LDAP_BIND_DN: "CN=mailrelay,OU=Service Accounts,OU=Users,DC=yourdomain,DC=tld"
      POSTFIX_LDAP_BIND_PW: "***"
      POSTFIX_LDAP_SEARCH_BASE: "DC=yourdomain,DC=tld"
    volumes:
      - "certs:/etc/postfix/certs:ro"
      - "queue_in:/var/spool/postfix:rw"
      - "clamav_in:/var/lib/clamav:rw"
      - "postgrey_in:/etc/postgrey:ro"
      - "tables_in:/etc/postfix/tables:ro"
      - "aliases_in:/etc/postfix/local_aliases:ro"
      - "logs_in:/var/log:rw"

It is recommended to make your volume mounts somewhere you can access them, so you can edit files, load certificates, view logs easily, etc.

For example, you could map through to a known local path:

yaml
volumes:
  queue_out:
    driver: local
      type: 'none'
      o: 'bind'
      device: '/opt/mail/queue_out'
...

...or, another example useing NFS to a filer/server, eg:

yaml
volumes:
  queue_out:
    driver: local
      type: nfs
      o: addr=1.2.3.4,rw
      device: ":/vol/mail/queue_out"
...

Environment Variables

Container configuration

Syslog Configuration

Postfix Configuration

LDAP Recipient Verification

See "LDAP" section below.

If ENABLE_LDAP_RECIPIENT_ACCESS is enabled, the final smtpd_recipient_restrictions action becomes defer (from the default of permit).

OpenDKIM Configuration

ClamAV Configuration

Configuration Files

The following files can be optionally configured.

Postfix table files

If using postfix table files, it is recommened to place all files into a single directory, and map this directory through to the container at /etc/postfix/tables.

Postgrey whitelist files

For the format of this file, see the postgrey manpage.

The system whitelist is downloaded from <[***]> once every 24 hours if postgrey is enabled.

Local Aliases

The format of this file is as-per the /etc/aliases file.

The system aliases file maps postmaster, root, postfix and clamav through to the address specified by POSTMASTER_EMAIL.

Paths

Required to be mapped

Optional