3510 lines
114 KiB
XML
3510 lines
114 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
||
<froxlor>
|
||
<distribution name="Debian" codename="Bookworm"
|
||
version="12.x" defaulteditor="/bin/nano">
|
||
<!-- OS defaults to be loaded on installation -->
|
||
<defaults>
|
||
<default settinggroup="system" varname="nssextrausers" value="1"></default>
|
||
<default for="lighttpd" settinggroup="system" varname="apacheconf_vhost" value="/etc/lighttpd/conf-enabled/"></default>
|
||
<default for="lighttpd" settinggroup="system" varname="apacheconf_diroptions" value="/etc/lighttpd/froxlor-diroptions/"></default>
|
||
<default for="lighttpd" settinggroup="system" varname="apacheconf_htpasswddir" value="/etc/lighttpd/froxlor-htpasswd/"></default>
|
||
<default for="lighttpd" settinggroup="system" varname="apachereload_command" value="service lighttpd reload"></default>
|
||
<default for="lighttpd" settinggroup="system" varname="letsencryptacmeconf" value="/etc/lighttpd/acme.conf"></default>
|
||
<default for="lighttpd" settinggroup="phpfpm" varname="fastcgi_ipcdir" value="/var/run/lighttpd/"></default>
|
||
<default for="nginx" settinggroup="system" varname="apacheconf_vhost" value="/etc/nginx/sites-enabled/"></default>
|
||
<default for="nginx" settinggroup="system" varname="apacheconf_diroptions" value="/etc/nginx/sites-enabled/"></default>
|
||
<default for="nginx" settinggroup="system" varname="apacheconf_htpasswddir" value="/etc/nginx/froxlor-htpasswd/"></default>
|
||
<default for="nginx" settinggroup="system" varname="apachereload_command" value="service nginx reload"></default>
|
||
<default for="nginx" settinggroup="system" varname="letsencryptacmeconf" value="/etc/nginx/acme.conf"></default>
|
||
<default for="nginx" settinggroup="phpfpm" varname="fastcgi_ipcdir" value="/var/run/nginx/"></default>
|
||
</defaults>
|
||
<services>
|
||
<!-- HTTP -->
|
||
<service type="http" title="{{lng.admin.configfiles.http}}">
|
||
<!-- general HTTP commands -->
|
||
<general>
|
||
<commands index="1">
|
||
<command>
|
||
<visibility mode="isdir">{{settings.system.apacheconf_vhost}}
|
||
</visibility>
|
||
<content><![CDATA[mkdir -p {{settings.system.apacheconf_vhost}}]]></content>
|
||
</command>
|
||
<command>
|
||
<visibility mode="isfile">{{settings.system.apacheconf_vhost}}
|
||
</visibility>
|
||
<content><![CDATA[touch {{settings.system.apacheconf_vhost}}]]></content>
|
||
</command>
|
||
<command><![CDATA[chown root:0 {{settings.system.apacheconf_vhost}}]]></command>
|
||
<command><![CDATA[chmod 0600 {{settings.system.apacheconf_vhost}}]]></command>
|
||
<command>
|
||
<visibility mode="isdir">{{settings.system.apacheconf_diroptions}}
|
||
</visibility>
|
||
<content><![CDATA[mkdir -p {{settings.system.apacheconf_diroptions}}]]></content>
|
||
</command>
|
||
<command>
|
||
<visibility mode="isfile">{{settings.system.apacheconf_diroptions}}
|
||
</visibility>
|
||
<content><![CDATA[touch {{settings.system.apacheconf_diroptions}}]]></content>
|
||
</command>
|
||
<command><![CDATA[chown root:0 {{settings.system.apacheconf_diroptions}}]]></command>
|
||
<command><![CDATA[chmod 0600 {{settings.system.apacheconf_diroptions}}]]></command>
|
||
<command><![CDATA[mkdir -p {{settings.system.documentroot_prefix}}]]></command>
|
||
<command><![CDATA[mkdir -p {{settings.system.logfiles_directory}}]]></command>
|
||
<command>
|
||
<visibility mode="notempty">{{settings.system.deactivateddocroot}}
|
||
</visibility>
|
||
<content><![CDATA[mkdir -p {{settings.system.deactivateddocroot}}]]></content>
|
||
</command>
|
||
</commands>
|
||
</general>
|
||
<!-- HTTP Apache -->
|
||
<daemon name="apache" version="2.4" title="Apache 2.4"
|
||
default="true">
|
||
<install><![CDATA[apt-get install apache2]]></install>
|
||
<include>//service[@type='http']/general/commands</include>
|
||
<command><![CDATA[a2dismod userdir]]></command>
|
||
<command><![CDATA[a2enmod headers]]></command>
|
||
<command>
|
||
<visibility mode="true">{{settings.system.use_ssl}}
|
||
</visibility>
|
||
<content><![CDATA[a2enmod ssl]]></content>
|
||
</command>
|
||
<command>
|
||
<visibility mode="true">{{settings.phpfpm.enabled}}
|
||
</visibility>
|
||
<content><![CDATA[
|
||
# Please remember to activate the use of mod_proxy / mod_proxy_fcgi in the PHP-FPM settings!!!
|
||
a2enmod proxy_fcgi
|
||
]]>
|
||
</content>
|
||
</command>
|
||
<file name="{{settings.system.letsencryptacmeconf}}">
|
||
<visibility mode="true">{{settings.system.leenabled}}
|
||
</visibility>
|
||
<content><![CDATA[
|
||
Alias "/.well-known/acme-challenge" "{{settings.system.letsencryptchallengepath}}/.well-known/acme-challenge"
|
||
<Directory "{{settings.system.letsencryptchallengepath}}/.well-known/acme-challenge">
|
||
Require all granted
|
||
</Directory>
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<command><![CDATA[{{settings.system.apachereload_command}}]]></command>
|
||
</daemon>
|
||
<!-- HTTP Lighttpd -->
|
||
<daemon name="lighttpd" title="LigHTTPd (deprecated)">
|
||
<install><![CDATA[apt-get install lighttpd]]></install>
|
||
<file name="/etc/lighttpd/lighttpd.conf">
|
||
<content><![CDATA[
|
||
server.modules = (
|
||
"mod_access",
|
||
"mod_alias",
|
||
"mod_compress",
|
||
"mod_redirect",
|
||
"mod_rewrite",
|
||
"mod_setenv",
|
||
)
|
||
|
||
server.document-root = "/var/www"
|
||
server.upload-dirs = ( "/var/cache/lighttpd/uploads" )
|
||
server.errorlog = "/var/log/lighttpd/error.log"
|
||
server.pid-file = "/var/run/lighttpd.pid"
|
||
server.username = "www-data"
|
||
server.groupname = "www-data"
|
||
server.port = 80
|
||
|
||
|
||
index-file.names = ( "index.php", "index.html", "index.lighttpd.html" )
|
||
url.access-deny = ( "~", ".inc" )
|
||
static-file.exclude-extensions = ( ".php", ".pl", ".fcgi" )
|
||
|
||
compress.cache-dir = "/var/cache/lighttpd/compress/"
|
||
compress.filetype = ( "application/javascript", "text/css", "text/html", "text/plain" )
|
||
|
||
alias.url += ("/.well-known/acme-challenge/" => "{{settings.system.letsencryptchallengepath}}/.well-known/acme-challenge/")
|
||
|
||
# default listening port for IPv6 falls back to the IPv4 port
|
||
include_shell "/usr/share/lighttpd/use-ipv6.pl " + server.port
|
||
include_shell "/usr/share/lighttpd/create-mime.assign.pl"
|
||
include_shell "/usr/share/lighttpd/include-conf-enabled.pl"
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<include>//service[@type='http']/general/commands</include>
|
||
<command>
|
||
<visibility mode="isdir">{{settings.system.apacheconf_vhost}}
|
||
</visibility>
|
||
<content><![CDATA[echo -e '\\ninclude_shell "cat {{settings.system.apacheconf_vhost}}*.conf"' >> /etc/lighttpd/lighttpd.conf]]></content>
|
||
</command>
|
||
<command>
|
||
<visibility mode="isfile">{{settings.system.apacheconf_vhost}}
|
||
</visibility>
|
||
<content><![CDATA[echo -e '\\ninclude "{{settings.system.apacheconf_vhost}}"' >> /etc/lighttpd/lighttpd.conf]]></content>
|
||
</command>
|
||
<command>
|
||
<visibility mode="isdir">{{settings.system.apacheconf_diroptions}}
|
||
</visibility>
|
||
<content><![CDATA[echo -e '\\ninclude_shell "cat {{settings.system.apacheconf_diroptions}}*.conf"' >> /etc/lighttpd/lighttpd.conf]]></content>
|
||
</command>
|
||
<command>
|
||
<visibility mode="isfile">{{settings.system.apacheconf_diroptions}}
|
||
</visibility>
|
||
<content><![CDATA[echo -e '\\ninclude "{{settings.system.apacheconf_diroptions}}"' >> /etc/lighttpd/lighttpd.conf]]></content>
|
||
</command>
|
||
<command><![CDATA[lighty-disable-mod cgi]]></command>
|
||
<command><![CDATA[lighty-disable-mod fastcgi]]></command>
|
||
<command><![CDATA[{{settings.system.apachereload_command}}]]></command>
|
||
</daemon>
|
||
<!-- HTTP Nginx -->
|
||
<daemon name="nginx" title="nginx">
|
||
<install><![CDATA[apt-get install nginx]]></install>
|
||
<install>
|
||
<visibility mode="false">{{settings.phpfpm.enabled}}
|
||
</visibility>
|
||
<visibility mode="false">{{settings.system.mod_fcgid}}
|
||
</visibility>
|
||
<content><![CDATA[apt-get install php-cgi]]></content>
|
||
</install>
|
||
<file name="/etc/nginx/nginx.conf" backup="true">
|
||
<content><![CDATA[
|
||
user www-data;
|
||
worker_processes auto;
|
||
pid /var/run/nginx.pid;
|
||
include /etc/nginx/modules-enabled/*.conf;
|
||
|
||
events {
|
||
worker_connections 768;
|
||
# multi_accept on;
|
||
}
|
||
|
||
http {
|
||
|
||
##
|
||
# Basic Settings
|
||
##
|
||
|
||
sendfile on;
|
||
tcp_nopush on;
|
||
tcp_nodelay on;
|
||
keepalive_timeout 65;
|
||
types_hash_max_size 2048;
|
||
# server_tokens off;
|
||
|
||
# server_names_hash_bucket_size 64;
|
||
# server_name_in_redirect off;
|
||
|
||
include /etc/nginx/mime.types;
|
||
default_type application/octet-stream;
|
||
|
||
##
|
||
# Logging Settings
|
||
##
|
||
|
||
access_log /var/log/nginx/access.log;
|
||
error_log /var/log/nginx/error.log;
|
||
|
||
##
|
||
# Gzip Settings
|
||
##
|
||
|
||
gzip on;
|
||
gzip_disable "msie6";
|
||
|
||
# gzip_vary on;
|
||
# gzip_proxied any;
|
||
# gzip_comp_level 6;
|
||
# gzip_buffers 16 8k;
|
||
# gzip_http_version 1.1;
|
||
# gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;
|
||
|
||
##
|
||
# nginx-naxsi config
|
||
##
|
||
# Uncomment it if you installed nginx-naxsi
|
||
##
|
||
|
||
#include /etc/nginx/naxsi_core.rules;
|
||
|
||
##
|
||
# nginx-passenger config
|
||
##
|
||
# Uncomment it if you installed nginx-passenger
|
||
##
|
||
|
||
#passenger_root /usr;
|
||
#passenger_ruby /usr/bin/ruby;
|
||
|
||
##
|
||
# Virtual Host Configs
|
||
##
|
||
|
||
include /etc/nginx/conf.d/*.conf;
|
||
include /etc/nginx/sites-enabled/*;
|
||
}
|
||
|
||
|
||
#mail {
|
||
# # See sample authentication script at:
|
||
# # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
|
||
#
|
||
# # auth_http localhost/auth.php;
|
||
# # pop3_capabilities "TOP" "USER";
|
||
# # imap_capabilities "IMAP4rev1" "UIDPLUS";
|
||
#
|
||
# server {
|
||
# listen localhost:110;
|
||
# protocol pop3;
|
||
# proxy on;
|
||
# }
|
||
#
|
||
# server {
|
||
# listen localhost:143;
|
||
# protocol imap;
|
||
# proxy on;
|
||
# }
|
||
#}
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<file name="/etc/nginx/fastcgi_params" backup="true">
|
||
<content><![CDATA[
|
||
fastcgi_connect_timeout 65;
|
||
fastcgi_send_timeout 180;
|
||
fastcgi_read_timeout 180;
|
||
|
||
fastcgi_param QUERY_STRING $query_string;
|
||
fastcgi_param REQUEST_METHOD $request_method;
|
||
fastcgi_param CONTENT_TYPE $content_type;
|
||
fastcgi_param CONTENT_LENGTH $content_length;
|
||
|
||
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
|
||
fastcgi_param REQUEST_URI $request_uri;
|
||
fastcgi_param DOCUMENT_URI $document_uri;
|
||
fastcgi_param DOCUMENT_ROOT $document_root;
|
||
fastcgi_param SERVER_PROTOCOL $server_protocol;
|
||
fastcgi_param HTTPS $https if_not_empty;
|
||
|
||
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
|
||
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
|
||
|
||
fastcgi_param REMOTE_ADDR $remote_addr;
|
||
fastcgi_param REMOTE_PORT $remote_port;
|
||
fastcgi_param SERVER_ADDR $server_addr;
|
||
fastcgi_param SERVER_PORT $server_port;
|
||
fastcgi_param SERVER_NAME $server_name;
|
||
|
||
# PHP only, required if PHP was built with --enable-force-cgi-redirect
|
||
fastcgi_param REDIRECT_STATUS 200;
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<file name="{{settings.system.letsencryptacmeconf}}">
|
||
<visibility mode="true">{{settings.system.leenabled}}
|
||
</visibility>
|
||
<content><![CDATA[
|
||
location /.well-known/acme-challenge {
|
||
alias {{settings.system.letsencryptchallengepath}}/.well-known/acme-challenge;
|
||
|
||
location ~ /.well-known/acme-challenge/(.*) {
|
||
default_type text/plain;
|
||
}
|
||
}
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<file name="/etc/init.d/php-fcgi" backup="true" chmod="u+x">
|
||
<visibility mode="false">{{settings.phpfpm.enabled}}
|
||
</visibility>
|
||
<visibility mode="false">{{settings.system.mod_fcgid}}
|
||
</visibility>
|
||
<content><![CDATA[
|
||
#!/bin/bash
|
||
BIND="127.0.0.1:8888"
|
||
USER="www-data"
|
||
PHP_FCGI_CHILDREN="15"
|
||
PHP_FCGI_MAX_REQUESTS="1000"
|
||
|
||
PHP_CGI="/usr/bin/php-cgi"
|
||
PHP_CGI_NAME="$(basename ${PHP_CGI})"
|
||
PHP_CGI_ARGS="- USER=${USER} PATH=/usr/bin PHP_FCGI_CHILDREN=${PHP_FCGI_CHILDREN} PHP_FCGI_MAX_REQUESTS=${PHP_FCGI_MAX_REQUESTS} ${PHP_CGI} -b ${BIND}"
|
||
RETVAL="0"
|
||
|
||
start() {
|
||
echo -n "Starting PHP FastCGI: "
|
||
start-stop-daemon --quiet --start --background --chuid "$USER" --exec /usr/bin/env -- $PHP_CGI_ARGS
|
||
RETVAL="$?"
|
||
echo "${PHP_CGI_NAME}."
|
||
}
|
||
stop() {
|
||
echo -n "Stopping PHP FastCGI: "
|
||
killall -q -w -u ${USER} ${PHP_CGI}
|
||
RETVAL="$?"
|
||
echo "${PHP_CGI_NAME}."
|
||
}
|
||
|
||
case "$1" in
|
||
start)
|
||
start
|
||
;;
|
||
stop)
|
||
stop
|
||
;;
|
||
restart)
|
||
stop
|
||
start
|
||
;;
|
||
*)
|
||
echo "Usage: php-fastcgi {start|stop|restart}"
|
||
exit 1
|
||
;;
|
||
esac
|
||
exit "$RETVAL"
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<include>//service[@type='http']/general/commands</include>
|
||
<command>
|
||
<visibility mode="false">{{settings.phpfpm.enabled}}
|
||
</visibility>
|
||
<visibility mode="false">{{settings.system.mod_fcgid}}
|
||
</visibility>
|
||
<content><![CDATA[/etc/init.d/php-fcgi restart]]></content>
|
||
</command>
|
||
<command><![CDATA[{{settings.system.apachereload_command}}]]></command>
|
||
</daemon>
|
||
</service>
|
||
<!--DNS -->
|
||
<service type="dns" title="{{lng.admin.configfiles.dns}}">
|
||
<!--Bind9 -->
|
||
<daemon name="bind" title="Bind9 nameserver" default="true">
|
||
<install><![CDATA[apt-get install bind9]]></install>
|
||
<command><![CDATA[echo "include \"{{settings.system.bindconf_directory}}froxlor_bind.conf\";" >> /etc/bind/named.conf.local]]></command>
|
||
<command><![CDATA[touch {{settings.system.bindconf_directory}}froxlor_bind.conf]]></command>
|
||
<command><![CDATA[chown bind:0 {{settings.system.bindconf_directory}}froxlor_bind.conf]]></command>
|
||
<command><![CDATA[chmod 0644 {{settings.system.bindconf_directory}}froxlor_bind.conf]]></command>
|
||
<command><![CDATA[service bind9 restart]]></command>
|
||
</daemon>
|
||
<daemon name="powerdns" title="PowerDNS (standalone)">
|
||
<install><![CDATA[apt-get install pdns-server pdns-backend-mysql]]></install>
|
||
<file name="/etc/powerdns/pdns.conf" backup="true" chown="root:pdns" chmod="640">
|
||
<content><![CDATA[
|
||
#################################
|
||
# allow-axfr-ips Allow zonetransfers only to these subnets
|
||
#
|
||
allow-axfr-ips=127.0.0.0/8,::1,<NAMESERVERS_IP>
|
||
|
||
#################################
|
||
# allow-dnsupdate-from A global setting to allow DNS updates from these IP ranges.
|
||
#
|
||
# allow-dnsupdate-from=127.0.0.0/8,::1
|
||
|
||
#################################
|
||
# also-notify When notifying a domain, also notify these nameservers
|
||
#
|
||
# also-notify=
|
||
|
||
#################################
|
||
# any-to-tcp Answer ANY queries with tc=1, shunting to TCP
|
||
#
|
||
# any-to-tcp=no
|
||
|
||
#################################
|
||
# cache-ttl Seconds to store packets in the PacketCache
|
||
#
|
||
# cache-ttl=20
|
||
|
||
#################################
|
||
# carbon-interval Number of seconds between carbon (graphite) updates
|
||
#
|
||
# carbon-interval=30
|
||
|
||
#################################
|
||
# carbon-ourname If set, overrides our reported hostname for carbon stats
|
||
#
|
||
# carbon-ourname=
|
||
|
||
#################################
|
||
# carbon-server If set, send metrics in carbon (graphite) format to this server
|
||
#
|
||
# carbon-server=
|
||
|
||
#################################
|
||
# chroot If set, chroot to this directory for more security
|
||
#
|
||
# chroot=
|
||
|
||
#################################
|
||
# config-dir Location of configuration directory (pdns.conf)
|
||
#
|
||
config-dir=/etc/powerdns
|
||
|
||
#################################
|
||
# config-name Name of this virtual configuration - will rename the binary image
|
||
#
|
||
# config-name=
|
||
|
||
#################################
|
||
# control-console Debugging switch - don't use
|
||
#
|
||
# control-console=no
|
||
|
||
#################################
|
||
# daemon Operate as a daemon
|
||
#
|
||
daemon=yes
|
||
|
||
#################################
|
||
# default-ksk-algorithms Default KSK algorithms
|
||
#
|
||
# default-ksk-algorithms=rsasha256
|
||
|
||
#################################
|
||
# default-ksk-size Default KSK size (0 means default)
|
||
#
|
||
# default-ksk-size=0
|
||
|
||
#################################
|
||
# default-soa-mail mail address to insert in the SOA record if none set in the backend
|
||
#
|
||
# default-soa-mail=
|
||
|
||
#################################
|
||
# default-soa-name name to insert in the SOA record if none set in the backend
|
||
#
|
||
# default-soa-name=a.misconfigured.powerdns.server
|
||
|
||
#################################
|
||
# default-ttl Seconds a result is valid if not set otherwise
|
||
#
|
||
# default-ttl=3600
|
||
|
||
#################################
|
||
# default-zsk-algorithms Default ZSK algorithms
|
||
#
|
||
# default-zsk-algorithms=rsasha256
|
||
|
||
#################################
|
||
# default-zsk-size Default ZSK size (0 means default)
|
||
#
|
||
# default-zsk-size=0
|
||
|
||
#################################
|
||
# direct-dnskey Fetch DNSKEY RRs from backend during DNSKEY synthesis
|
||
#
|
||
# direct-dnskey=no
|
||
|
||
#################################
|
||
# disable-axfr Disable zonetransfers but do allow TCP queries
|
||
#
|
||
# disable-axfr=no
|
||
|
||
#################################
|
||
# disable-axfr-rectify Disable the rectify step during an outgoing AXFR. Only required for regression testing.
|
||
#
|
||
# disable-axfr-rectify=no
|
||
|
||
#################################
|
||
# disable-tcp Do not listen to TCP queries
|
||
#
|
||
# disable-tcp=no
|
||
|
||
#################################
|
||
# distributor-threads Default number of Distributor (backend) threads to start
|
||
#
|
||
# distributor-threads=3
|
||
|
||
#################################
|
||
# do-ipv6-additional-processing Do AAAA additional processing
|
||
#
|
||
# do-ipv6-additional-processing=yes
|
||
|
||
#################################
|
||
# edns-subnet-processing If we should act on EDNS Subnet options
|
||
#
|
||
# edns-subnet-processing=no
|
||
|
||
#################################
|
||
# entropy-source If set, read entropy from this file
|
||
#
|
||
# entropy-source=/dev/urandom
|
||
|
||
#################################
|
||
# experimental-api-key REST API Static authentication key (required for API use)
|
||
#
|
||
# experimental-api-key=
|
||
|
||
#################################
|
||
# experimental-api-readonly If the JSON API should disallow data modification
|
||
#
|
||
# experimental-api-readonly=no
|
||
|
||
#################################
|
||
# experimental-dname-processing If we should support DNAME records
|
||
#
|
||
# experimental-dname-processing=no
|
||
|
||
#################################
|
||
# experimental-dnsupdate Enable/Disable DNS update (RFC2136) support. Default is no.
|
||
#
|
||
# experimental-dnsupdate=no
|
||
|
||
#################################
|
||
# experimental-json-interface If the webserver should serve JSON data
|
||
#
|
||
# experimental-json-interface=no
|
||
|
||
#################################
|
||
# experimental-logfile Filename of the log file for JSON parser
|
||
#
|
||
# experimental-logfile=/var/log/pdns.log
|
||
|
||
#################################
|
||
# forward-dnsupdate A global setting to allow DNS update packages that are for a Slave domain, to be forwarded to the master.
|
||
#
|
||
# forward-dnsupdate=yes
|
||
|
||
#################################
|
||
# guardian Run within a guardian process
|
||
#
|
||
guardian=yes
|
||
|
||
#################################
|
||
# include-dir Include *.conf files from this directory
|
||
#
|
||
# include-dir=
|
||
|
||
#################################
|
||
# launch Which backends to launch and order to query them in
|
||
#
|
||
# launch=
|
||
|
||
#################################
|
||
# load-modules Load this module - supply absolute or relative path
|
||
#
|
||
# load-modules=
|
||
|
||
#################################
|
||
# local-address Local IP addresses to which we bind
|
||
#
|
||
local-address=<SERVERIP>,127.0.0.1
|
||
|
||
#################################
|
||
# local-address-nonexist-fail Fail to start if one or more of the local-address's do not exist on this server
|
||
#
|
||
# local-address-nonexist-fail=yes
|
||
|
||
#################################
|
||
# local-ipv6 Local IP address to which we bind
|
||
#
|
||
# local-ipv6=
|
||
|
||
#################################
|
||
# local-ipv6-nonexist-fail Fail to start if one or more of the local-ipv6 addresses do not exist on this server
|
||
#
|
||
# local-ipv6-nonexist-fail=yes
|
||
|
||
#################################
|
||
# local-port The port on which we listen
|
||
#
|
||
# local-port=53
|
||
|
||
#################################
|
||
# log-dns-details If PDNS should log DNS non-erroneous details
|
||
#
|
||
# log-dns-details=no
|
||
|
||
#################################
|
||
# log-dns-queries If PDNS should log all incoming DNS queries
|
||
#
|
||
# log-dns-queries=no
|
||
|
||
#################################
|
||
# logging-facility Log under a specific facility
|
||
#
|
||
# logging-facility=
|
||
|
||
#################################
|
||
# loglevel Amount of logging. Higher is more. Do not set below 3
|
||
#
|
||
# loglevel=4
|
||
|
||
#################################
|
||
# lua-prequery-script Lua script with prequery handler
|
||
#
|
||
# lua-prequery-script=
|
||
|
||
#################################
|
||
# master Act as a master
|
||
#
|
||
master=yes
|
||
|
||
#################################
|
||
# max-cache-entries Maximum number of cache entries
|
||
#
|
||
# max-cache-entries=1000000
|
||
|
||
#################################
|
||
# max-ent-entries Maximum number of empty non-terminals in a zone
|
||
#
|
||
# max-ent-entries=100000
|
||
|
||
#################################
|
||
# max-nsec3-iterations Limit the number of NSEC3 hash iterations
|
||
#
|
||
# max-nsec3-iterations=500
|
||
|
||
#################################
|
||
# max-queue-length Maximum queuelength before considering situation lost
|
||
#
|
||
# max-queue-length=5000
|
||
|
||
#################################
|
||
# max-signature-cache-entries Maximum number of signatures cache entries
|
||
#
|
||
# max-signature-cache-entries=
|
||
|
||
#################################
|
||
# max-tcp-connections Maximum number of TCP connections
|
||
#
|
||
# max-tcp-connections=10
|
||
|
||
#################################
|
||
# module-dir Default directory for modules
|
||
#
|
||
# module-dir=/usr/lib/TRIPLET/pdns
|
||
|
||
#################################
|
||
# negquery-cache-ttl Seconds to store negative query results in the QueryCache
|
||
#
|
||
# negquery-cache-ttl=60
|
||
|
||
#################################
|
||
# no-shuffle Set this to prevent random shuffling of answers - for regression testing
|
||
#
|
||
# no-shuffle=off
|
||
|
||
#################################
|
||
# only-notify Only send AXFR NOTIFY to these IP addresses or netmasks
|
||
#
|
||
# only-notify=0.0.0.0/0,::/0
|
||
|
||
#################################
|
||
# out-of-zone-additional-processing Do out of zone additional processing
|
||
#
|
||
# out-of-zone-additional-processing=yes
|
||
|
||
#################################
|
||
# overload-queue-length Maximum queuelength moving to packetcache only
|
||
#
|
||
# overload-queue-length=0
|
||
|
||
#################################
|
||
# pipebackend-abi-version Version of the pipe backend ABI
|
||
#
|
||
# pipebackend-abi-version=1
|
||
|
||
#################################
|
||
# prevent-self-notification Don't send notifications to what we think is ourself
|
||
#
|
||
# prevent-self-notification=yes
|
||
|
||
#################################
|
||
# query-cache-ttl Seconds to store query results in the QueryCache
|
||
#
|
||
# query-cache-ttl=20
|
||
|
||
#################################
|
||
# query-local-address Source IP address for sending queries
|
||
#
|
||
# query-local-address=0.0.0.0
|
||
|
||
#################################
|
||
# query-local-address6 Source IPv6 address for sending queries
|
||
#
|
||
# query-local-address6=::
|
||
|
||
#################################
|
||
# query-logging Hint backends that queries should be logged
|
||
#
|
||
# query-logging=no
|
||
|
||
#################################
|
||
# queue-limit Maximum number of milliseconds to queue a query
|
||
#
|
||
# queue-limit=1500
|
||
|
||
#################################
|
||
# receiver-threads Default number of receiver threads to start
|
||
#
|
||
# receiver-threads=1
|
||
|
||
#################################
|
||
# retrieval-threads Number of AXFR-retrieval threads for slave operation
|
||
#
|
||
# retrieval-threads=2
|
||
|
||
#################################
|
||
# reuseport Enable higher performance on compliant kernels by using SO_REUSEPORT allowing each receiver thread to open its own socket
|
||
#
|
||
# reuseport=no
|
||
|
||
#################################
|
||
# security-poll-suffix Domain name from which to query security update notifications
|
||
#
|
||
# security-poll-suffix=secpoll.powerdns.com.
|
||
|
||
#################################
|
||
# send-root-referral Send out old-fashioned root-referral instead of ServFail in case of no authority
|
||
#
|
||
# send-root-referral=no
|
||
|
||
#################################
|
||
# server-id Returned when queried for 'server.id' TXT or NSID, defaults to hostname - disabled or custom
|
||
#
|
||
# server-id=
|
||
|
||
#################################
|
||
# setgid If set, change group id to this gid for more security
|
||
#
|
||
setgid=pdns
|
||
|
||
#################################
|
||
# setuid If set, change user id to this uid for more security
|
||
#
|
||
setuid=pdns
|
||
|
||
#################################
|
||
# signing-threads Default number of signer threads to start
|
||
#
|
||
# signing-threads=3
|
||
|
||
#################################
|
||
# slave Act as a slave
|
||
#
|
||
# slave=no
|
||
|
||
#################################
|
||
# slave-cycle-interval Reschedule failed SOA serial checks once every .. seconds
|
||
#
|
||
# slave-cycle-interval=60
|
||
|
||
#################################
|
||
# slave-renotify If we should send out notifications for slaved updates
|
||
#
|
||
# slave-renotify=no
|
||
|
||
#################################
|
||
# soa-expire-default Default SOA expire
|
||
#
|
||
# soa-expire-default=604800
|
||
|
||
#################################
|
||
# soa-minimum-ttl Default SOA minimum ttl
|
||
#
|
||
# soa-minimum-ttl=3600
|
||
|
||
#################################
|
||
# soa-refresh-default Default SOA refresh
|
||
#
|
||
# soa-refresh-default=10800
|
||
|
||
#################################
|
||
# soa-retry-default Default SOA retry
|
||
#
|
||
# soa-retry-default=3600
|
||
|
||
#################################
|
||
# socket-dir Where the controlsocket will live
|
||
#
|
||
# socket-dir=/var/run
|
||
|
||
#################################
|
||
# tcp-control-address If set, PowerDNS can be controlled over TCP on this address
|
||
#
|
||
# tcp-control-address=
|
||
|
||
#################################
|
||
# tcp-control-port If set, PowerDNS can be controlled over TCP on this address
|
||
#
|
||
# tcp-control-port=53000
|
||
|
||
#################################
|
||
# tcp-control-range If set, remote control of PowerDNS is possible over these networks only
|
||
#
|
||
# tcp-control-range=127.0.0.0/8, 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, ::1/128, fe80::/10
|
||
|
||
#################################
|
||
# tcp-control-secret If set, PowerDNS can be controlled over TCP after passing this secret
|
||
#
|
||
# tcp-control-secret=
|
||
|
||
#################################
|
||
# traceback-handler Enable the traceback handler (Linux only)
|
||
#
|
||
# traceback-handler=yes
|
||
|
||
#################################
|
||
# trusted-notification-proxy IP address of incoming notification proxy
|
||
#
|
||
# trusted-notification-proxy=
|
||
|
||
#################################
|
||
# udp-truncation-threshold Maximum UDP response size before we truncate
|
||
#
|
||
# udp-truncation-threshold=1680
|
||
|
||
#################################
|
||
# version-string PowerDNS version in packets - full, anonymous, powerdns or custom
|
||
#
|
||
|
||
version-string=powerdns
|
||
#################################
|
||
# webserver Start a webserver for monitoring
|
||
#
|
||
# webserver=no
|
||
|
||
#################################
|
||
# webserver-address IP Address of webserver to listen on
|
||
#
|
||
# webserver-address=127.0.0.1
|
||
|
||
#################################
|
||
# webserver-allow-from Webserver access is only allowed from these subnets
|
||
#
|
||
# webserver-allow-from=0.0.0.0/0,::/0
|
||
|
||
#################################
|
||
# webserver-password Password required for accessing the webserver
|
||
#
|
||
# webserver-password=
|
||
|
||
#################################
|
||
# webserver-port Port of webserver to listen on
|
||
#
|
||
# webserver-port=8081
|
||
|
||
#################################
|
||
# webserver-print-arguments If the webserver should print arguments
|
||
#
|
||
# webserver-print-arguments=no
|
||
|
||
# include froxlor-bind-specific config
|
||
include-dir=/etc/powerdns/froxlor/
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<command><![CDATA[mkdir -p /etc/powerdns/froxlor/]]></command>
|
||
<file name="/etc/powerdns/froxlor/pdns_froxlor.conf"
|
||
chown="root:pdns" chmod="640">
|
||
<content><![CDATA[
|
||
# mysql-settings / you need to create the power-dns database for yourself!
|
||
launch=gmysql
|
||
gmysql-host=127.0.0.1
|
||
gmysql-port=3306
|
||
gmysql-dbname=pdns
|
||
gmysql-user=powerdns
|
||
gmysql-group=client
|
||
gmysql-password=
|
||
#gmysql-ssl-ca-file=
|
||
#gmysql-ssl-verify-server-certificate=0
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<command><![CDATA[service pdns restart]]></command>
|
||
</daemon>
|
||
<daemon name="powerdns_bind"
|
||
title="PowerDNS via bind-backend">
|
||
<install><![CDATA[apt-get install pdns-server]]></install>
|
||
<file name="/etc/powerdns/pdns.conf" backup="true" chown="root:pdns" chmod="640">
|
||
<content><![CDATA[
|
||
#################################
|
||
# allow-axfr-ips Allow zonetransfers only to these subnets
|
||
#
|
||
# allow-axfr-ips=127.0.0.0/8,::1,<NAMESERVERS_IP>
|
||
|
||
#################################
|
||
# allow-dnsupdate-from A global setting to allow DNS updates from these IP ranges.
|
||
#
|
||
# allow-dnsupdate-from=127.0.0.0/8,::1
|
||
|
||
#################################
|
||
# also-notify When notifying a domain, also notify these nameservers
|
||
#
|
||
# also-notify=
|
||
|
||
#################################
|
||
# any-to-tcp Answer ANY queries with tc=1, shunting to TCP
|
||
#
|
||
# any-to-tcp=no
|
||
|
||
#################################
|
||
# cache-ttl Seconds to store packets in the PacketCache
|
||
#
|
||
# cache-ttl=20
|
||
|
||
#################################
|
||
# carbon-interval Number of seconds between carbon (graphite) updates
|
||
#
|
||
# carbon-interval=30
|
||
|
||
#################################
|
||
# carbon-ourname If set, overrides our reported hostname for carbon stats
|
||
#
|
||
# carbon-ourname=
|
||
|
||
#################################
|
||
# carbon-server If set, send metrics in carbon (graphite) format to this server
|
||
#
|
||
# carbon-server=
|
||
|
||
#################################
|
||
# chroot If set, chroot to this directory for more security
|
||
#
|
||
# chroot=
|
||
|
||
#################################
|
||
# config-dir Location of configuration directory (pdns.conf)
|
||
#
|
||
config-dir=/etc/powerdns
|
||
|
||
#################################
|
||
# config-name Name of this virtual configuration - will rename the binary image
|
||
#
|
||
# config-name=
|
||
|
||
#################################
|
||
# control-console Debugging switch - don't use
|
||
#
|
||
# control-console=no
|
||
|
||
#################################
|
||
# daemon Operate as a daemon
|
||
#
|
||
daemon=yes
|
||
|
||
#################################
|
||
# default-ksk-algorithms Default KSK algorithms
|
||
#
|
||
# default-ksk-algorithms=rsasha256
|
||
|
||
#################################
|
||
# default-ksk-size Default KSK size (0 means default)
|
||
#
|
||
# default-ksk-size=0
|
||
|
||
#################################
|
||
# default-soa-mail mail address to insert in the SOA record if none set in the backend
|
||
#
|
||
# default-soa-mail=
|
||
|
||
#################################
|
||
# default-soa-name name to insert in the SOA record if none set in the backend
|
||
#
|
||
# default-soa-name=a.misconfigured.powerdns.server
|
||
|
||
#################################
|
||
# default-ttl Seconds a result is valid if not set otherwise
|
||
#
|
||
# default-ttl=3600
|
||
|
||
#################################
|
||
# default-zsk-algorithms Default ZSK algorithms
|
||
#
|
||
# default-zsk-algorithms=rsasha256
|
||
|
||
#################################
|
||
# default-zsk-size Default ZSK size (0 means default)
|
||
#
|
||
# default-zsk-size=0
|
||
|
||
#################################
|
||
# direct-dnskey Fetch DNSKEY RRs from backend during DNSKEY synthesis
|
||
#
|
||
# direct-dnskey=no
|
||
|
||
#################################
|
||
# disable-axfr Disable zonetransfers but do allow TCP queries
|
||
#
|
||
# disable-axfr=no
|
||
|
||
#################################
|
||
# disable-axfr-rectify Disable the rectify step during an outgoing AXFR. Only required for regression testing.
|
||
#
|
||
# disable-axfr-rectify=no
|
||
|
||
#################################
|
||
# disable-tcp Do not listen to TCP queries
|
||
#
|
||
# disable-tcp=no
|
||
|
||
#################################
|
||
# distributor-threads Default number of Distributor (backend) threads to start
|
||
#
|
||
# distributor-threads=3
|
||
|
||
#################################
|
||
# do-ipv6-additional-processing Do AAAA additional processing
|
||
#
|
||
# do-ipv6-additional-processing=yes
|
||
|
||
#################################
|
||
# edns-subnet-processing If we should act on EDNS Subnet options
|
||
#
|
||
# edns-subnet-processing=no
|
||
|
||
#################################
|
||
# entropy-source If set, read entropy from this file
|
||
#
|
||
# entropy-source=/dev/urandom
|
||
|
||
#################################
|
||
# experimental-api-key REST API Static authentication key (required for API use)
|
||
#
|
||
# experimental-api-key=
|
||
|
||
#################################
|
||
# experimental-api-readonly If the JSON API should disallow data modification
|
||
#
|
||
# experimental-api-readonly=no
|
||
|
||
#################################
|
||
# experimental-dname-processing If we should support DNAME records
|
||
#
|
||
# experimental-dname-processing=no
|
||
|
||
#################################
|
||
# experimental-dnsupdate Enable/Disable DNS update (RFC2136) support. Default is no.
|
||
#
|
||
# experimental-dnsupdate=no
|
||
|
||
#################################
|
||
# experimental-json-interface If the webserver should serve JSON data
|
||
#
|
||
# experimental-json-interface=no
|
||
|
||
#################################
|
||
# experimental-logfile Filename of the log file for JSON parser
|
||
#
|
||
# experimental-logfile=/var/log/pdns.log
|
||
|
||
#################################
|
||
# forward-dnsupdate A global setting to allow DNS update packages that are for a Slave domain, to be forwarded to the master.
|
||
#
|
||
# forward-dnsupdate=yes
|
||
|
||
#################################
|
||
# guardian Run within a guardian process
|
||
#
|
||
guardian=yes
|
||
|
||
#################################
|
||
# include-dir Include *.conf files from this directory
|
||
#
|
||
# include-dir=
|
||
|
||
#################################
|
||
# launch Which backends to launch and order to query them in
|
||
#
|
||
# launch=
|
||
launch=bind
|
||
|
||
#################################
|
||
# load-modules Load this module - supply absolute or relative path
|
||
#
|
||
# load-modules=
|
||
|
||
#################################
|
||
# local-address Local IP addresses to which we bind
|
||
#
|
||
local-address=<SERVERIP>,127.0.0.1
|
||
|
||
#################################
|
||
# local-address-nonexist-fail Fail to start if one or more of the local-address's do not exist on this server
|
||
#
|
||
# local-address-nonexist-fail=yes
|
||
|
||
#################################
|
||
# local-ipv6 Local IP address to which we bind
|
||
#
|
||
# local-ipv6=
|
||
|
||
#################################
|
||
# local-ipv6-nonexist-fail Fail to start if one or more of the local-ipv6 addresses do not exist on this server
|
||
#
|
||
# local-ipv6-nonexist-fail=yes
|
||
|
||
#################################
|
||
# local-port The port on which we listen
|
||
#
|
||
# local-port=53
|
||
|
||
#################################
|
||
# log-dns-details If PDNS should log DNS non-erroneous details
|
||
#
|
||
# log-dns-details=no
|
||
|
||
#################################
|
||
# log-dns-queries If PDNS should log all incoming DNS queries
|
||
#
|
||
# log-dns-queries=no
|
||
|
||
#################################
|
||
# logging-facility Log under a specific facility
|
||
#
|
||
# logging-facility=
|
||
|
||
#################################
|
||
# loglevel Amount of logging. Higher is more. Do not set below 3
|
||
#
|
||
# loglevel=4
|
||
|
||
#################################
|
||
# lua-prequery-script Lua script with prequery handler
|
||
#
|
||
# lua-prequery-script=
|
||
|
||
#################################
|
||
# master Act as a master
|
||
#
|
||
master=yes
|
||
|
||
#################################
|
||
# max-cache-entries Maximum number of cache entries
|
||
#
|
||
# max-cache-entries=1000000
|
||
|
||
#################################
|
||
# max-ent-entries Maximum number of empty non-terminals in a zone
|
||
#
|
||
# max-ent-entries=100000
|
||
|
||
#################################
|
||
# max-nsec3-iterations Limit the number of NSEC3 hash iterations
|
||
#
|
||
# max-nsec3-iterations=500
|
||
|
||
#################################
|
||
# max-queue-length Maximum queuelength before considering situation lost
|
||
#
|
||
# max-queue-length=5000
|
||
|
||
#################################
|
||
# max-signature-cache-entries Maximum number of signatures cache entries
|
||
#
|
||
# max-signature-cache-entries=
|
||
|
||
#################################
|
||
# max-tcp-connections Maximum number of TCP connections
|
||
#
|
||
# max-tcp-connections=10
|
||
|
||
#################################
|
||
# module-dir Default directory for modules
|
||
#
|
||
# module-dir=/usr/lib/TRIPLET/pdns
|
||
|
||
#################################
|
||
# negquery-cache-ttl Seconds to store negative query results in the QueryCache
|
||
#
|
||
# negquery-cache-ttl=60
|
||
|
||
#################################
|
||
# no-shuffle Set this to prevent random shuffling of answers - for regression testing
|
||
#
|
||
# no-shuffle=off
|
||
|
||
#################################
|
||
# only-notify Only send AXFR NOTIFY to these IP addresses or netmasks
|
||
#
|
||
# only-notify=0.0.0.0/0,::/0
|
||
|
||
#################################
|
||
# out-of-zone-additional-processing Do out of zone additional processing
|
||
#
|
||
# out-of-zone-additional-processing=yes
|
||
|
||
#################################
|
||
# overload-queue-length Maximum queuelength moving to packetcache only
|
||
#
|
||
# overload-queue-length=0
|
||
|
||
#################################
|
||
# pipebackend-abi-version Version of the pipe backend ABI
|
||
#
|
||
# pipebackend-abi-version=1
|
||
|
||
#################################
|
||
# prevent-self-notification Don't send notifications to what we think is ourself
|
||
#
|
||
# prevent-self-notification=yes
|
||
|
||
#################################
|
||
# query-cache-ttl Seconds to store query results in the QueryCache
|
||
#
|
||
# query-cache-ttl=20
|
||
|
||
#################################
|
||
# query-local-address Source IP address for sending queries
|
||
#
|
||
# query-local-address=0.0.0.0
|
||
|
||
#################################
|
||
# query-local-address6 Source IPv6 address for sending queries
|
||
#
|
||
# query-local-address6=::
|
||
|
||
#################################
|
||
# query-logging Hint backends that queries should be logged
|
||
#
|
||
# query-logging=no
|
||
|
||
#################################
|
||
# queue-limit Maximum number of milliseconds to queue a query
|
||
#
|
||
# queue-limit=1500
|
||
|
||
#################################
|
||
# receiver-threads Default number of receiver threads to start
|
||
#
|
||
# receiver-threads=1
|
||
|
||
#################################
|
||
# retrieval-threads Number of AXFR-retrieval threads for slave operation
|
||
#
|
||
# retrieval-threads=2
|
||
|
||
#################################
|
||
# reuseport Enable higher performance on compliant kernels by using SO_REUSEPORT allowing each receiver thread to open its own socket
|
||
#
|
||
# reuseport=no
|
||
|
||
#################################
|
||
# security-poll-suffix Domain name from which to query security update notifications
|
||
#
|
||
# security-poll-suffix=secpoll.powerdns.com.
|
||
|
||
#################################
|
||
# send-root-referral Send out old-fashioned root-referral instead of ServFail in case of no authority
|
||
#
|
||
# send-root-referral=no
|
||
|
||
#################################
|
||
# server-id Returned when queried for 'server.id' TXT or NSID, defaults to hostname - disabled or custom
|
||
#
|
||
# server-id=
|
||
|
||
#################################
|
||
# setgid If set, change group id to this gid for more security
|
||
#
|
||
setgid=pdns
|
||
|
||
#################################
|
||
# setuid If set, change user id to this uid for more security
|
||
#
|
||
setuid=pdns
|
||
|
||
#################################
|
||
# signing-threads Default number of signer threads to start
|
||
#
|
||
# signing-threads=3
|
||
|
||
#################################
|
||
# slave Act as a slave
|
||
#
|
||
# slave=no
|
||
|
||
#################################
|
||
# slave-cycle-interval Reschedule failed SOA serial checks once every .. seconds
|
||
#
|
||
# slave-cycle-interval=60
|
||
|
||
#################################
|
||
# slave-renotify If we should send out notifications for slaved updates
|
||
#
|
||
# slave-renotify=no
|
||
|
||
#################################
|
||
# soa-expire-default Default SOA expire
|
||
#
|
||
# soa-expire-default=604800
|
||
|
||
#################################
|
||
# soa-minimum-ttl Default SOA minimum ttl
|
||
#
|
||
# soa-minimum-ttl=3600
|
||
|
||
#################################
|
||
# soa-refresh-default Default SOA refresh
|
||
#
|
||
# soa-refresh-default=10800
|
||
|
||
#################################
|
||
# soa-retry-default Default SOA retry
|
||
#
|
||
# soa-retry-default=3600
|
||
|
||
#################################
|
||
# socket-dir Where the controlsocket will live
|
||
#
|
||
# socket-dir=/var/run
|
||
|
||
#################################
|
||
# tcp-control-address If set, PowerDNS can be controlled over TCP on this address
|
||
#
|
||
# tcp-control-address=
|
||
|
||
#################################
|
||
# tcp-control-port If set, PowerDNS can be controlled over TCP on this address
|
||
#
|
||
# tcp-control-port=53000
|
||
|
||
#################################
|
||
# tcp-control-range If set, remote control of PowerDNS is possible over these networks only
|
||
#
|
||
# tcp-control-range=127.0.0.0/8, 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, ::1/128, fe80::/10
|
||
|
||
#################################
|
||
# tcp-control-secret If set, PowerDNS can be controlled over TCP after passing this secret
|
||
#
|
||
# tcp-control-secret=
|
||
|
||
#################################
|
||
# traceback-handler Enable the traceback handler (Linux only)
|
||
#
|
||
# traceback-handler=yes
|
||
|
||
#################################
|
||
# trusted-notification-proxy IP address of incoming notification proxy
|
||
#
|
||
# trusted-notification-proxy=
|
||
|
||
#################################
|
||
# udp-truncation-threshold Maximum UDP response size before we truncate
|
||
#
|
||
# udp-truncation-threshold=1680
|
||
|
||
#################################
|
||
# version-string PowerDNS version in packets - full, anonymous, powerdns or custom
|
||
#
|
||
|
||
version-string=powerdns
|
||
#################################
|
||
# webserver Start a webserver for monitoring
|
||
#
|
||
# webserver=no
|
||
|
||
#################################
|
||
# webserver-address IP Address of webserver to listen on
|
||
#
|
||
# webserver-address=127.0.0.1
|
||
|
||
#################################
|
||
# webserver-allow-from Webserver access is only allowed from these subnets
|
||
#
|
||
# webserver-allow-from=0.0.0.0/0,::/0
|
||
|
||
#################################
|
||
# webserver-password Password required for accessing the webserver
|
||
#
|
||
# webserver-password=
|
||
|
||
#################################
|
||
# webserver-port Port of webserver to listen on
|
||
#
|
||
# webserver-port=8081
|
||
|
||
#################################
|
||
# webserver-print-arguments If the webserver should print arguments
|
||
#
|
||
# webserver-print-arguments=no
|
||
|
||
# include froxlor-bind-specific config
|
||
include-dir=/etc/powerdns/froxlor/
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<command><![CDATA[mkdir -p /etc/powerdns/froxlor/]]></command>
|
||
<file name="/etc/powerdns/froxlor/pdns_froxlor.conf"
|
||
chown="root:pdns" chmod="640">
|
||
<content><![CDATA[
|
||
# Bind backend configuration
|
||
|
||
# Location of the Bind configuration file to parse.
|
||
bind-config=<BIND_CONFIG_PATH>named.conf
|
||
|
||
# How often to check for zone changes. See 'Operation' section.
|
||
bind-check-interval=180
|
||
|
||
# Uncomment to enable Huffman compression on zone data.
|
||
# Currently saves around 20% of memory actually used, but slows down operation.
|
||
# bind-enable-huffman
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<command><![CDATA[service pdns restart]]></command>
|
||
</daemon>
|
||
</service>
|
||
<!-- SMTP services -->
|
||
<service type="smtp" title="{{lng.admin.configfiles.smtp}}">
|
||
<!-- general SMTP commands -->
|
||
<general>
|
||
<commands index="1">
|
||
<command>
|
||
<visibility mode="groupnotexists">{{settings.system.vmail_gid}}
|
||
</visibility>
|
||
<content><![CDATA[groupadd -g {{settings.system.vmail_gid}} vmail]]></content>
|
||
</command>
|
||
<command>
|
||
<visibility mode="usernotexists">{{settings.system.vmail_uid}}
|
||
</visibility>
|
||
<content><![CDATA[useradd -u {{settings.system.vmail_uid}} -g vmail vmail]]></content>
|
||
</command>
|
||
</commands>
|
||
<installs index="1">
|
||
<install><![CDATA[apt-get install postfix postfix-mysql]]></install>
|
||
</installs>
|
||
<commands index="2">
|
||
<command><![CDATA[mkdir -p /var/spool/postfix/etc/pam.d]]></command>
|
||
<command><![CDATA[mkdir -p /var/spool/postfix/var/run/mysqld]]></command>
|
||
<command><![CDATA[mkdir -p {{settings.system.vmail_homedir}}]]></command>
|
||
<command><![CDATA[chown -R {{settings.system.vmail_uid}}:{{settings.system.vmail_gid}} {{settings.system.vmail_homedir}}]]></command>
|
||
<command><![CDATA[chmod 0750 {{settings.system.vmail_homedir}}]]></command>
|
||
</commands>
|
||
<files index="0">
|
||
<file name="/etc/postfix/mysql-virtual_alias_maps.cf"
|
||
chown="root:postfix" chmod="0640">
|
||
<content><![CDATA[
|
||
user = <SQL_UNPRIVILEGED_USER>
|
||
password = <SQL_UNPRIVILEGED_PASSWORD>
|
||
dbname = <SQL_DB>
|
||
hosts = <SQL_HOST>
|
||
query = SELECT destination FROM mail_virtual AS v, panel_customers AS c WHERE c.customerid = v.customerid AND c.deactivated = 0 AND v.email = '%s' AND trim(v.destination) <> ''
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<file name="/etc/postfix/mysql-virtual_mailbox_domains.cf"
|
||
chown="root:postfix" chmod="0640">
|
||
<content><![CDATA[
|
||
user = <SQL_UNPRIVILEGED_USER>
|
||
password = <SQL_UNPRIVILEGED_PASSWORD>
|
||
dbname = <SQL_DB>
|
||
hosts = <SQL_HOST>
|
||
query = SELECT domain FROM panel_domains WHERE domain = '%s' AND isemaildomain = '1' AND deactivated = 0
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<file name="/etc/postfix/mysql-virtual_mailbox_maps.cf"
|
||
chown="root:postfix" chmod="0640">
|
||
<content><![CDATA[
|
||
user = <SQL_UNPRIVILEGED_USER>
|
||
password = <SQL_UNPRIVILEGED_PASSWORD>
|
||
dbname = <SQL_DB>
|
||
expansion_limit = 1
|
||
hosts = <SQL_HOST>
|
||
query = SELECT CONCAT(homedir,maildir) FROM mail_users WHERE email = '%s'
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<file name="/etc/postfix/mysql-virtual_sender_permissions.cf"
|
||
chown="root:postfix" chmod="0640">
|
||
<content><![CDATA[
|
||
user = <SQL_UNPRIVILEGED_USER>
|
||
password = <SQL_UNPRIVILEGED_PASSWORD>
|
||
dbname = <SQL_DB>
|
||
hosts = <SQL_HOST>
|
||
query = SELECT DISTINCT username FROM mail_users WHERE email in ((SELECT mail_virtual.email_full FROM mail_virtual WHERE mail_virtual.email = '%s' UNION SELECT mail_virtual.destination FROM mail_virtual WHERE mail_virtual.email = '%s'));
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<file name="/etc/postfix/mysql-virtual_uid_maps.cf"
|
||
chown="root:postfix" chmod="0640">
|
||
<content><![CDATA[
|
||
user = <SQL_UNPRIVILEGED_USER>
|
||
password = <SQL_UNPRIVILEGED_PASSWORD>
|
||
dbname = <SQL_DB>
|
||
expansion_limit = 1
|
||
hosts = <SQL_HOST>
|
||
query = SELECT uid FROM mail_users WHERE email = '%s'
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<file name="/etc/postfix/mysql-virtual_gid_maps.cf"
|
||
chown="root:postfix" chmod="0640">
|
||
<content><![CDATA[
|
||
user = <SQL_UNPRIVILEGED_USER>
|
||
password = <SQL_UNPRIVILEGED_PASSWORD>
|
||
dbname = <SQL_DB>
|
||
expansion_limit = 1
|
||
hosts = <SQL_HOST>
|
||
query = SELECT gid FROM mail_users WHERE email = '%s'
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<file name="/etc/aliases" backup="true">
|
||
<content><![CDATA[
|
||
# /etc/aliases
|
||
mailer-daemon: postmaster
|
||
postmaster: root
|
||
nobody: root
|
||
hostmaster: root
|
||
usenet: root
|
||
news: root
|
||
webmaster: root
|
||
www: root
|
||
ftp: root
|
||
abuse: root
|
||
noc: root
|
||
security: root
|
||
|
||
# change this to a valid e-mail address you can access
|
||
root: <ADMIN_MAIL>
|
||
]]>
|
||
</content>
|
||
</file>
|
||
</files>
|
||
<commands index="3">
|
||
<command><![CDATA[newaliases]]></command>
|
||
<command><![CDATA[service postfix restart]]></command>
|
||
</commands>
|
||
</general>
|
||
<!-- postfix with dovecot -->
|
||
<daemon name="postfix_dovecot" title="Postfix with dovecot"
|
||
default="true">
|
||
<include>//service[@type='smtp']/general/commands[@index=1]
|
||
</include>
|
||
<include>//service[@type='smtp']/general/installs[@index=1]
|
||
</include>
|
||
<include>//service[@type='smtp']/general/commands[@index=2]
|
||
</include>
|
||
<file name="/etc/postfix/main.cf" chown="root:root"
|
||
chmod="0644" backup="true">
|
||
<content><![CDATA[
|
||
# Global Postfix configuration file. This file lists only a subset
|
||
# of all parameters. For the syntax, and for a complete parameter
|
||
# list, see the postconf(5) manual page (command: "man 5 postconf").
|
||
#
|
||
# For common configuration examples, see BASIC_CONFIGURATION_README
|
||
# and STANDARD_CONFIGURATION_README. To find these documents, use
|
||
# the command "postconf html_directory readme_directory", or go to
|
||
# http://www.postfix.org/.
|
||
#
|
||
# For best results, change no more than 2-3 parameters at a time,
|
||
# and test if Postfix still works after every change.
|
||
|
||
# SOFT BOUNCE
|
||
#
|
||
# The soft_bounce parameter provides a limited safety net for
|
||
# testing. When soft_bounce is enabled, mail will remain queued that
|
||
# would otherwise bounce. This parameter disables locally-generated
|
||
# bounces, and prevents the SMTP server from rejecting mail permanently
|
||
# (by changing 5xx replies into 4xx replies). However, soft_bounce
|
||
# is no cure for address rewriting mistakes or mail routing mistakes.
|
||
#
|
||
#soft_bounce = no
|
||
|
||
# LOCAL PATHNAME INFORMATION
|
||
#
|
||
# The queue_directory specifies the location of the Postfix queue.
|
||
# This is also the root directory of Postfix daemons that run chrooted.
|
||
# See the files in examples/chroot-setup for setting up Postfix chroot
|
||
# environments on different UNIX systems.
|
||
#
|
||
#queue_directory = /var/spool/postfix
|
||
|
||
# The command_directory parameter specifies the location of all
|
||
# postXXX commands.
|
||
#
|
||
command_directory = /usr/sbin
|
||
|
||
# The daemon_directory parameter specifies the location of all Postfix
|
||
# daemon programs (i.e. programs listed in the master.cf file). This
|
||
# directory must be owned by root.
|
||
#
|
||
daemon_directory = /usr/lib/postfix/sbin
|
||
|
||
# The data_directory parameter specifies the location of Postfix-writable
|
||
# data files (caches, random numbers). This directory must be owned
|
||
# by the mail_owner account (see below).
|
||
#
|
||
data_directory = /var/lib/postfix
|
||
|
||
# QUEUE AND PROCESS OWNERSHIP
|
||
#
|
||
# The mail_owner parameter specifies the owner of the Postfix queue
|
||
# and of most Postfix daemon processes. Specify the name of a user
|
||
# account THAT DOES NOT SHARE ITS USER OR GROUP ID WITH OTHER ACCOUNTS
|
||
# AND THAT OWNS NO OTHER FILES OR PROCESSES ON THE SYSTEM. In
|
||
# particular, don't specify nobody or daemon. PLEASE USE A DEDICATED
|
||
# USER.
|
||
#
|
||
#mail_owner = postfix
|
||
|
||
# The default_privs parameter specifies the default rights used by
|
||
# the local delivery agent for delivery to external file or command.
|
||
# These rights are used in the absence of a recipient user context.
|
||
# DO NOT SPECIFY A PRIVILEGED USER OR THE POSTFIX OWNER.
|
||
#
|
||
#default_privs = nobody
|
||
|
||
# INTERNET HOST AND DOMAIN NAMES
|
||
#
|
||
# The myhostname parameter specifies the internet hostname of this
|
||
# mail system. The default is to use the fully-qualified domain name
|
||
# from gethostname(). $myhostname is used as a default value for many
|
||
# other configuration parameters.
|
||
#
|
||
# Froxlor Note: $myhostname can and should be the same as $mydomain as long as
|
||
# you don't intend to send mail to it (it will be considered local, not virtual)
|
||
# for the case of a subdomain, $mydomain *must* be equal to $myhostname,
|
||
# otherwise you cannot use the main domain for virtual transport.
|
||
# also check the note about $mydomain below.
|
||
myhostname = $mydomain
|
||
#myhostname = virtual.domain.tld
|
||
|
||
# The mydomain parameter specifies the local internet domain name.
|
||
# The default is to use $myhostname minus the first component.
|
||
# $mydomain is used as a default value for many other configuration
|
||
# parameters.
|
||
#
|
||
# Froxlor Note: We are using a default here but that may or may not make sense,
|
||
# depending on your dns configuration, please check yourself.
|
||
|
||
# FQDN from Froxlor
|
||
mydomain = <SERVERNAME>
|
||
|
||
# SENDING MAIL
|
||
#
|
||
# The myorigin parameter specifies the domain that locally-posted
|
||
# mail appears to come from. The default is to append $myhostname,
|
||
# which is fine for small sites. If you run a domain with multiple
|
||
# machines, you should (1) change this to $mydomain and (2) set up
|
||
# a domain-wide alias database that aliases each user to
|
||
# user@that.users.mailhost.
|
||
#
|
||
# For the sake of consistency between sender and recipient addresses,
|
||
# myorigin also specifies the default domain name that is appended
|
||
# to recipient addresses that have no @domain part.
|
||
#
|
||
# Debian GNU/Linux specific: Specifying a file name will cause the
|
||
# first line of that file to be used as the name. The Debian default
|
||
# is /etc/mailname.
|
||
#
|
||
#myorigin = /etc/mailname
|
||
#myorigin = $myhostname
|
||
#myorigin = $mydomain
|
||
|
||
# RECEIVING MAIL
|
||
|
||
# The inet_interfaces parameter specifies the network interface
|
||
# addresses that this mail system receives mail on. By default,
|
||
# the software claims all active interfaces on the machine. The
|
||
# parameter also controls delivery of mail to user@[ip.address].
|
||
#
|
||
# See also the proxy_interfaces parameter, for network addresses that
|
||
# are forwarded to us via a proxy or network address translator.
|
||
#
|
||
# Note: you need to stop/start Postfix when this parameter changes.
|
||
#
|
||
inet_interfaces = all
|
||
#inet_interfaces = $myhostname
|
||
#inet_interfaces = $myhostname, localhost
|
||
|
||
# The proxy_interfaces parameter specifies the network interface
|
||
# addresses that this mail system receives mail on by way of a
|
||
# proxy or network address translation unit. This setting extends
|
||
# the address list specified with the inet_interfaces parameter.
|
||
#
|
||
# You must specify your proxy/NAT addresses when your system is a
|
||
# backup MX host for other domains, otherwise mail delivery loops
|
||
# will happen when the primary MX host is down.
|
||
#
|
||
#proxy_interfaces =
|
||
#proxy_interfaces = 1.2.3.4
|
||
|
||
# The mydestination parameter specifies the list of domains that this
|
||
# machine considers itself the final destination for.
|
||
#
|
||
# These domains are routed to the delivery agent specified with the
|
||
# local_transport parameter setting. By default, that is the UNIX
|
||
# compatible delivery agent that lookups all recipients in /etc/passwd
|
||
# and /etc/aliases or their equivalent.
|
||
#
|
||
# The default is $myhostname + localhost.$mydomain. On a mail domain
|
||
# gateway, you should also include $mydomain.
|
||
#
|
||
# Do not specify the names of virtual domains - those domains are
|
||
# specified elsewhere (see VIRTUAL_README).
|
||
#
|
||
# Do not specify the names of domains that this machine is backup MX
|
||
# host for. Specify those names via the relay_domains settings for
|
||
# the SMTP server, or use permit_mx_backup if you are lazy (see
|
||
# STANDARD_CONFIGURATION_README).
|
||
#
|
||
# The local machine is always the final destination for mail addressed
|
||
# to user@[the.net.work.address] of an interface that the mail system
|
||
# receives mail on (see the inet_interfaces parameter).
|
||
#
|
||
# Specify a list of host or domain names, /file/name or type:table
|
||
# patterns, separated by commas and/or whitespace. A /file/name
|
||
# pattern is replaced by its contents; a type:table is matched when
|
||
# a name matches a lookup key (the right-hand side is ignored).
|
||
# Continue long lines by starting the next line with whitespace.
|
||
#
|
||
# See also below, section "REJECTING MAIL FOR UNKNOWN LOCAL USERS".
|
||
#
|
||
mydestination = $myhostname, localhost.$mydomain, localhost
|
||
#mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
|
||
#mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain,
|
||
# mail.$mydomain, www.$mydomain, ftp.$mydomain
|
||
|
||
# REJECTING MAIL FOR UNKNOWN LOCAL USERS
|
||
#
|
||
# The local_recipient_maps parameter specifies optional lookup tables
|
||
# with all names or addresses of users that are local with respect
|
||
# to $mydestination, $inet_interfaces or $proxy_interfaces.
|
||
#
|
||
# If this parameter is defined, then the SMTP server will reject
|
||
# mail for unknown local users. This parameter is defined by default.
|
||
#
|
||
# To turn off local recipient checking in the SMTP server, specify
|
||
# local_recipient_maps = (i.e. empty).
|
||
#
|
||
# The default setting assumes that you use the default Postfix local
|
||
# delivery agent for local delivery. You need to update the
|
||
# local_recipient_maps setting if:
|
||
#
|
||
# - You define $mydestination domain recipients in files other than
|
||
# /etc/passwd, /etc/aliases, or the $virtual_alias_maps files.
|
||
# For example, you define $mydestination domain recipients in
|
||
# the $virtual_mailbox_maps files.
|
||
#
|
||
# - You redefine the local delivery agent in master.cf.
|
||
#
|
||
# - You redefine the "local_transport" setting in main.cf.
|
||
#
|
||
# - You use the "luser_relay", "mailbox_transport", or "fallback_transport"
|
||
# feature of the Postfix local delivery agent (see local(8)).
|
||
#
|
||
# Details are described in the LOCAL_RECIPIENT_README file.
|
||
#
|
||
# Beware: if the Postfix SMTP server runs chrooted, you probably have
|
||
# to access the passwd file via the proxymap service, in order to
|
||
# overcome chroot restrictions. The alternative, having a copy of
|
||
# the system passwd file in the chroot jail is just not practical.
|
||
#
|
||
# The right-hand side of the lookup tables is conveniently ignored.
|
||
# In the left-hand side, specify a bare username, an @domain.tld
|
||
# wild-card, or specify a user@domain.tld address.
|
||
#
|
||
#local_recipient_maps = unix:passwd.byname $alias_maps
|
||
#local_recipient_maps = proxy:unix:passwd.byname $alias_maps
|
||
#local_recipient_maps =
|
||
|
||
# The unknown_local_recipient_reject_code specifies the SMTP server
|
||
# response code when a recipient domain matches $mydestination or
|
||
# ${proxy,inet}_interfaces, while $local_recipient_maps is non-empty
|
||
# and the recipient address or address local-part is not found.
|
||
#
|
||
# The default setting is 550 (reject mail) but it is safer to start
|
||
# with 450 (try again later) until you are certain that your
|
||
# local_recipient_maps settings are OK.
|
||
#
|
||
unknown_local_recipient_reject_code = 550
|
||
|
||
# TRUST AND RELAY CONTROL
|
||
|
||
# The mynetworks parameter specifies the list of "trusted" SMTP
|
||
# clients that have more privileges than "strangers".
|
||
#
|
||
# In particular, "trusted" SMTP clients are allowed to relay mail
|
||
# through Postfix. See the smtpd_recipient_restrictions parameter
|
||
# in postconf(5).
|
||
#
|
||
# You can specify the list of "trusted" network addresses by hand
|
||
# or you can let Postfix do it for you (which is the default).
|
||
#
|
||
# By default (mynetworks_style = subnet), Postfix "trusts" SMTP
|
||
# clients in the same IP subnetworks as the local machine.
|
||
# On Linux, this does works correctly only with interfaces specified
|
||
# with the "ifconfig" command.
|
||
#
|
||
# Specify "mynetworks_style = class" when Postfix should "trust" SMTP
|
||
# clients in the same IP class A/B/C networks as the local machine.
|
||
# Don't do this with a dialup site - it would cause Postfix to "trust"
|
||
# your entire provider's network. Instead, specify an explicit
|
||
# mynetworks list by hand, as described below.
|
||
#
|
||
# Specify "mynetworks_style = host" when Postfix should "trust"
|
||
# only the local machine.
|
||
#
|
||
#mynetworks_style = class
|
||
#mynetworks_style = subnet
|
||
#mynetworks_style = host
|
||
|
||
# Alternatively, you can specify the mynetworks list by hand, in
|
||
# which case Postfix ignores the mynetworks_style setting.
|
||
#
|
||
# Specify an explicit list of network/netmask patterns, where the
|
||
# mask specifies the number of bits in the network part of a host
|
||
# address.
|
||
#
|
||
# You can also specify the absolute pathname of a pattern file instead
|
||
# of listing the patterns here. Specify type:table for table-based lookups
|
||
# (the value on the table right-hand side is not used).
|
||
#
|
||
#mynetworks = 168.100.189.0/28, 127.0.0.0/8
|
||
#mynetworks = $config_directory/mynetworks
|
||
#mynetworks = hash:/etc/postfix/network_table
|
||
mynetworks = 127.0.0.0/8
|
||
|
||
# The relay_domains parameter restricts what destinations this system will
|
||
# relay mail to. See the smtpd_recipient_restrictions description in
|
||
# postconf(5) for detailed information.
|
||
#
|
||
# By default, Postfix relays mail
|
||
# - from "trusted" clients (IP address matches $mynetworks) to any destination,
|
||
# - from "untrusted" clients to destinations that match $relay_domains or
|
||
# subdomains thereof, except addresses with sender-specified routing.
|
||
# The default relay_domains value is $mydestination.
|
||
#
|
||
# In addition to the above, the Postfix SMTP server by default accepts mail
|
||
# that Postfix is final destination for:
|
||
# - destinations that match $inet_interfaces or $proxy_interfaces,
|
||
# - destinations that match $mydestination
|
||
# - destinations that match $virtual_alias_domains,
|
||
# - destinations that match $virtual_mailbox_domains.
|
||
# These destinations do not need to be listed in $relay_domains.
|
||
#
|
||
# Specify a list of hosts or domains, /file/name patterns or type:name
|
||
# lookup tables, separated by commas and/or whitespace. Continue
|
||
# long lines by starting the next line with whitespace. A file name
|
||
# is replaced by its contents; a type:name table is matched when a
|
||
# (parent) domain appears as lookup key.
|
||
#
|
||
# NOTE: Postfix will not automatically forward mail for domains that
|
||
# list this system as their primary or backup MX host. See the
|
||
# permit_mx_backup restriction description in postconf(5).
|
||
#
|
||
#relay_domains = $mydestination
|
||
|
||
# INTERNET OR INTRANET
|
||
|
||
# The relayhost parameter specifies the default host to send mail to
|
||
# when no entry is matched in the optional transport(5) table. When
|
||
# no relayhost is given, mail is routed directly to the destination.
|
||
#
|
||
# On an intranet, specify the organizational domain name. If your
|
||
# internal DNS uses no MX records, specify the name of the intranet
|
||
# gateway host instead.
|
||
#
|
||
# In the case of SMTP, specify a domain, host, host:port, [host]:port,
|
||
# [address] or [address]:port; the form [host] turns off MX lookups.
|
||
#
|
||
# If you're connected via UUCP, see also the default_transport parameter.
|
||
#
|
||
#relayhost = $mydomain
|
||
#relayhost = [gateway.my.domain]
|
||
#relayhost = [mailserver.isp.tld]
|
||
#relayhost = uucphost
|
||
#relayhost = [an.ip.add.ress]
|
||
|
||
# REJECTING UNKNOWN RELAY USERS
|
||
#
|
||
# The relay_recipient_maps parameter specifies optional lookup tables
|
||
# with all addresses in the domains that match $relay_domains.
|
||
#
|
||
# If this parameter is defined, then the SMTP server will reject
|
||
# mail for unknown relay users. This feature is off by default.
|
||
#
|
||
# The right-hand side of the lookup tables is conveniently ignored.
|
||
# In the left-hand side, specify an @domain.tld wild-card, or specify
|
||
# a user@domain.tld address.
|
||
#
|
||
#relay_recipient_maps = hash:/etc/postfix/relay_recipients
|
||
|
||
# INPUT RATE CONTROL
|
||
#
|
||
# The in_flow_delay configuration parameter implements mail input
|
||
# flow control. This feature is turned on by default, although it
|
||
# still needs further development (it's disabled on SCO UNIX due
|
||
# to an SCO bug).
|
||
#
|
||
# A Postfix process will pause for $in_flow_delay seconds before
|
||
# accepting a new message, when the message arrival rate exceeds the
|
||
# message delivery rate. With the default 100 SMTP server process
|
||
# limit, this limits the mail inflow to 100 messages a second more
|
||
# than the number of messages delivered per second.
|
||
#
|
||
# Specify 0 to disable the feature. Valid delays are 0..10.
|
||
#
|
||
#in_flow_delay = 1s
|
||
|
||
# ADDRESS REWRITING
|
||
#
|
||
# The ADDRESS_REWRITING_README document gives information about
|
||
# address masquerading or other forms of address rewriting including
|
||
# username->Firstname.Lastname mapping.
|
||
|
||
# ADDRESS REDIRECTION (VIRTUAL DOMAIN)
|
||
#
|
||
# The VIRTUAL_README document gives information about the many forms
|
||
# of domain hosting that Postfix supports.
|
||
|
||
# "USER HAS MOVED" BOUNCE MESSAGES
|
||
#
|
||
# See the discussion in the ADDRESS_REWRITING_README document.
|
||
|
||
# TRANSPORT MAP
|
||
#
|
||
# See the discussion in the ADDRESS_REWRITING_README document.
|
||
|
||
# ALIAS DATABASE
|
||
#
|
||
# The alias_maps parameter specifies the list of alias databases used
|
||
# by the local delivery agent. The default list is system dependent.
|
||
#
|
||
# On systems with NIS, the default is to search the local alias
|
||
# database, then the NIS alias database. See aliases(5) for syntax
|
||
# details.
|
||
#
|
||
# If you change the alias database, run "postalias /etc/aliases" (or
|
||
# wherever your system stores the mail alias file), or simply run
|
||
# "newaliases" to build the necessary DBM or DB file.
|
||
#
|
||
# It will take a minute or so before changes become visible. Use
|
||
# "postfix reload" to eliminate the delay.
|
||
#
|
||
#alias_maps = dbm:/etc/aliases
|
||
#alias_maps = hash:/etc/aliases
|
||
#alias_maps = hash:/etc/aliases, nis:mail.aliases
|
||
#alias_maps = netinfo:/aliases
|
||
|
||
# The alias_database parameter specifies the alias database(s) that
|
||
# are built with "newaliases" or "sendmail -bi". This is a separate
|
||
# configuration parameter, because alias_maps (see above) may specify
|
||
# tables that are not necessarily all under control by Postfix.
|
||
#
|
||
#alias_database = dbm:/etc/aliases
|
||
#alias_database = dbm:/etc/mail/aliases
|
||
#alias_database = hash:/etc/aliases
|
||
#alias_database = hash:/etc/aliases, hash:/opt/majordomo/aliases
|
||
|
||
# ADDRESS EXTENSIONS (e.g., user+foo)
|
||
#
|
||
# The recipient_delimiter parameter specifies the separator between
|
||
# user names and address extensions (user+foo). See canonical(5),
|
||
# local(8), relocated(5) and virtual(5) for the effects this has on
|
||
# aliases, canonical, virtual, relocated and .forward file lookups.
|
||
# Basically, the software tries user+foo and .forward+foo before
|
||
# trying user and .forward.
|
||
#
|
||
#recipient_delimiter = +
|
||
|
||
# DELIVERY TO MAILBOX
|
||
#
|
||
# The home_mailbox parameter specifies the optional pathname of a
|
||
# mailbox file relative to a user's home directory. The default
|
||
# mailbox file is /var/spool/mail/user or /var/mail/user. Specify
|
||
# "Maildir/" for qmail-style delivery (the / is required).
|
||
#
|
||
#home_mailbox = Mailbox
|
||
#home_mailbox = Maildir/
|
||
|
||
# The mail_spool_directory parameter specifies the directory where
|
||
# UNIX-style mailboxes are kept. The default setting depends on the
|
||
# system type.
|
||
#
|
||
#mail_spool_directory = /var/mail
|
||
#mail_spool_directory = /var/spool/mail
|
||
|
||
# The mailbox_command parameter specifies the optional external
|
||
# command to use instead of mailbox delivery. The command is run as
|
||
# the recipient with proper HOME, SHELL and LOGNAME environment settings.
|
||
# Exception: delivery for root is done as $default_user.
|
||
#
|
||
# Other environment variables of interest: USER (recipient username),
|
||
# EXTENSION (address extension), DOMAIN (domain part of address),
|
||
# and LOCAL (the address localpart).
|
||
#
|
||
# Unlike other Postfix configuration parameters, the mailbox_command
|
||
# parameter is not subjected to $parameter substitutions. This is to
|
||
# make it easier to specify shell syntax (see example below).
|
||
#
|
||
# Avoid shell meta characters because they will force Postfix to run
|
||
# an expensive shell process. Procmail alone is expensive enough.
|
||
#
|
||
# IF YOU USE THIS TO DELIVER MAIL SYSTEM-WIDE, YOU MUST SET UP AN
|
||
# ALIAS THAT FORWARDS MAIL FOR ROOT TO A REAL USER.
|
||
#
|
||
mailbox_command = /usr/lib/dovecot/deliver
|
||
#mailbox_command = /usr/bin/procmail -a "$EXTENSION"
|
||
|
||
# The mailbox_transport specifies the optional transport in master.cf
|
||
# to use after processing aliases and .forward files. This parameter
|
||
# has precedence over the mailbox_command, fallback_transport and
|
||
# luser_relay parameters.
|
||
#
|
||
# Specify a string of the form transport:nexthop, where transport is
|
||
# the name of a mail delivery transport defined in master.cf. The
|
||
# :nexthop part is optional. For more details see the sample transport
|
||
# configuration file.
|
||
#
|
||
# NOTE: if you use this feature for accounts not in the UNIX password
|
||
# file, then you must update the "local_recipient_maps" setting in
|
||
# the main.cf file, otherwise the SMTP server will reject mail for
|
||
# non-UNIX accounts with "User unknown in local recipient table".
|
||
#
|
||
# Cyrus IMAP over LMTP. Specify ``lmtpunix cmd="lmtpd"
|
||
# listen="/var/imap/socket/lmtp" prefork=0'' in cyrus.conf.
|
||
#mailbox_transport = lmtp:unix:/var/imap/socket/lmtp
|
||
#
|
||
# Cyrus IMAP via command line. Uncomment the "cyrus...pipe" and
|
||
# subsequent line in master.cf.
|
||
#mailbox_transport = cyrus
|
||
|
||
# The fallback_transport specifies the optional transport in master.cf
|
||
# to use for recipients that are not found in the UNIX passwd database.
|
||
# This parameter has precedence over the luser_relay parameter.
|
||
#
|
||
# Specify a string of the form transport:nexthop, where transport is
|
||
# the name of a mail delivery transport defined in master.cf. The
|
||
# :nexthop part is optional. For more details see the sample transport
|
||
# configuration file.
|
||
#
|
||
# NOTE: if you use this feature for accounts not in the UNIX password
|
||
# file, then you must update the "local_recipient_maps" setting in
|
||
# the main.cf file, otherwise the SMTP server will reject mail for
|
||
# non-UNIX accounts with "User unknown in local recipient table".
|
||
#
|
||
#fallback_transport = lmtp:unix:/file/name
|
||
#fallback_transport = cyrus
|
||
#fallback_transport =
|
||
|
||
# The luser_relay parameter specifies an optional destination address
|
||
# for unknown recipients. By default, mail for unknown@$mydestination,
|
||
# unknown@[$inet_interfaces] or unknown@[$proxy_interfaces] is returned
|
||
# as undeliverable.
|
||
#
|
||
# The following expansions are done on luser_relay: $user (recipient
|
||
# username), $shell (recipient shell), $home (recipient home directory),
|
||
# $recipient (full recipient address), $extension (recipient address
|
||
# extension), $domain (recipient domain), $local (entire recipient
|
||
# localpart), $recipient_delimiter. Specify ${name?value} or
|
||
# ${name:value} to expand value only when $name does (does not) exist.
|
||
#
|
||
# luser_relay works only for the default Postfix local delivery agent.
|
||
#
|
||
# NOTE: if you use this feature for accounts not in the UNIX password
|
||
# file, then you must specify "local_recipient_maps =" (i.e. empty) in
|
||
# the main.cf file, otherwise the SMTP server will reject mail for
|
||
# non-UNIX accounts with "User unknown in local recipient table".
|
||
#
|
||
#luser_relay = $user@other.host
|
||
#luser_relay = $local@other.host
|
||
#luser_relay = admin+$local
|
||
|
||
# JUNK MAIL CONTROLS
|
||
#
|
||
# The controls listed here are only a very small subset. The file
|
||
# SMTPD_ACCESS_README provides an overview.
|
||
|
||
# The header_checks parameter specifies an optional table with patterns
|
||
# that each logical message header is matched against, including
|
||
# headers that span multiple physical lines.
|
||
#
|
||
# By default, these patterns also apply to MIME headers and to the
|
||
# headers of attached messages. With older Postfix versions, MIME and
|
||
# attached message headers were treated as body text.
|
||
#
|
||
# For details, see "man header_checks".
|
||
#
|
||
#header_checks = regexp:/etc/postfix/header_checks
|
||
|
||
# FAST ETRN SERVICE
|
||
#
|
||
# Postfix maintains per-destination logfiles with information about
|
||
# deferred mail, so that mail can be flushed quickly with the SMTP
|
||
# "ETRN domain.tld" command, or by executing "sendmail -qRdomain.tld".
|
||
# See the ETRN_README document for a detailed description.
|
||
#
|
||
# The fast_flush_domains parameter controls what destinations are
|
||
# eligible for this service. By default, they are all domains that
|
||
# this server is willing to relay mail to.
|
||
#
|
||
#fast_flush_domains = $relay_domains
|
||
|
||
# SHOW SOFTWARE VERSION OR NOT
|
||
#
|
||
# The smtpd_banner parameter specifies the text that follows the 220
|
||
# code in the SMTP server's greeting banner. Some people like to see
|
||
# the mail version advertised. By default, Postfix shows no version.
|
||
#
|
||
# You MUST specify $myhostname at the start of the text. That is an
|
||
# RFC requirement. Postfix itself does not care.
|
||
#
|
||
#smtpd_banner = $myhostname ESMTP $mail_name
|
||
#smtpd_banner = $myhostname ESMTP $mail_name ($mail_version)
|
||
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
|
||
|
||
|
||
# PARALLEL DELIVERY TO THE SAME DESTINATION
|
||
#
|
||
# How many parallel deliveries to the same user or domain? With local
|
||
# delivery, it does not make sense to do massively parallel delivery
|
||
# to the same user, because mailbox updates must happen sequentially,
|
||
# and expensive pipelines in .forward files can cause disasters when
|
||
# too many are run at the same time. With SMTP deliveries, 10
|
||
# simultaneous connections to the same domain could be sufficient to
|
||
# raise eyebrows.
|
||
#
|
||
# Each message delivery transport has its XXX_destination_concurrency_limit
|
||
# parameter. The default is $default_destination_concurrency_limit for
|
||
# most delivery transports. For the local delivery agent the default is 2.
|
||
|
||
#local_destination_concurrency_limit = 2
|
||
#default_destination_concurrency_limit = 20
|
||
|
||
# DEBUGGING CONTROL
|
||
#
|
||
# The debug_peer_level parameter specifies the increment in verbose
|
||
# logging level when an SMTP client or server host name or address
|
||
# matches a pattern in the debug_peer_list parameter.
|
||
#
|
||
#debug_peer_level = 2
|
||
|
||
# The debug_peer_list parameter specifies an optional list of domain
|
||
# or network patterns, /file/name patterns or type:name tables. When
|
||
# an SMTP client or server host name or address matches a pattern,
|
||
# increase the verbose logging level by the amount specified in the
|
||
# debug_peer_level parameter.
|
||
#
|
||
#debug_peer_list = 127.0.0.1
|
||
#debug_peer_list = some.domain
|
||
|
||
# The debugger_command specifies the external command that is executed
|
||
# when a Postfix daemon program is run with the -D option.
|
||
#
|
||
# Use "command .. & sleep 5" so that the debugger can attach before
|
||
# the process marches on. If you use an X-based debugger, be sure to
|
||
# set up your XAUTHORITY environment variable before starting Postfix.
|
||
#
|
||
debugger_command =
|
||
PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
|
||
ddd $daemon_directory/$process_name $process_id & sleep 5
|
||
|
||
# If you can't use X, use this to capture the call stack when a
|
||
# daemon crashes. The result is in a file in the configuration
|
||
# directory, and is named after the process name and the process ID.
|
||
#
|
||
# debugger_command =
|
||
# PATH=/bin:/usr/bin:/usr/local/bin; export PATH; (echo cont;
|
||
# echo where) | gdb $daemon_directory/$process_name $process_id 2>&1
|
||
# >$config_directory/$process_name.$process_id.log & sleep 5
|
||
#
|
||
# Another possibility is to run gdb under a detached screen session.
|
||
# To attach to the screen session, su root and run "screen -r
|
||
# <id_string>" where <id_string> uniquely matches one of the detached
|
||
# sessions (from "screen -list").
|
||
#
|
||
# debugger_command =
|
||
# PATH=/bin:/usr/bin:/sbin:/usr/sbin; export PATH; screen
|
||
# -dmS $process_name gdb $daemon_directory/$process_name
|
||
# $process_id & sleep 1
|
||
|
||
# INSTALL-TIME CONFIGURATION INFORMATION
|
||
#
|
||
# The following parameters are used when installing a new Postfix version.
|
||
#
|
||
# sendmail_path: The full pathname of the Postfix sendmail command.
|
||
# This is the Sendmail-compatible mail posting interface.
|
||
#
|
||
sendmail_path = /usr/sbin/sendmail
|
||
|
||
# newaliases_path: The full pathname of the Postfix newaliases command.
|
||
# This is the Sendmail-compatible command to build alias databases.
|
||
#
|
||
newaliases_path = /usr/bin/newaliases
|
||
|
||
# mailq_path: The full pathname of the Postfix mailq command. This
|
||
# is the Sendmail-compatible mail queue listing command.
|
||
#
|
||
mailq_path = /usr/bin/mailq
|
||
|
||
# setgid_group: The group for mail submission and queue management
|
||
# commands. This must be a group name with a numerical group ID that
|
||
# is not shared with other accounts, not even with the Postfix account.
|
||
#
|
||
setgid_group = postdrop
|
||
|
||
# html_directory: The location of the Postfix HTML documentation.
|
||
#
|
||
html_directory = no
|
||
|
||
# manpage_directory: The location of the Postfix on-line manual pages.
|
||
#
|
||
manpage_directory = /usr/share/man
|
||
|
||
# sample_directory: The location of the Postfix sample configuration files.
|
||
# This parameter is obsolete as of Postfix 2.1.
|
||
#
|
||
sample_directory = /usr/share/doc/postfix
|
||
|
||
# readme_directory: The location of the Postfix README files.
|
||
#
|
||
readme_directory = /usr/share/doc/postfix
|
||
inet_protocols = ipv4
|
||
|
||
append_dot_mydomain = no
|
||
biff = no
|
||
smtpd_helo_required = yes
|
||
smtpd_recipient_restrictions = permit_mynetworks,
|
||
permit_sasl_authenticated,
|
||
reject_unauth_destination,
|
||
reject_unauth_pipelining,
|
||
reject_non_fqdn_recipient
|
||
smtpd_sender_restrictions = permit_mynetworks,
|
||
reject_sender_login_mismatch,
|
||
permit_sasl_authenticated,
|
||
reject_unknown_helo_hostname,
|
||
reject_unknown_recipient_domain,
|
||
reject_unknown_sender_domain
|
||
smtpd_client_restrictions = permit_mynetworks,
|
||
permit_sasl_authenticated,
|
||
reject_unknown_client_hostname
|
||
|
||
# Postfix 2.10 requires this option. Postfix < 2.10 ignores this.
|
||
# The option is intentionally left empty.
|
||
smtpd_relay_restrictions =
|
||
|
||
# Maximum size of Message in bytes (50MB)
|
||
message_size_limit = 52428800
|
||
|
||
## SASL Auth Settings
|
||
smtpd_sasl_auth_enable = yes
|
||
smtpd_sasl_local_domain = $myhostname
|
||
broken_sasl_auth_clients = yes
|
||
## Dovecot Settings for deliver, SASL Auth and virtual transport
|
||
smtpd_sasl_type = dovecot
|
||
virtual_transport = dovecot
|
||
dovecot_destination_recipient_limit = 1
|
||
smtpd_sasl_path = private/auth
|
||
|
||
# Virtual delivery settings
|
||
virtual_mailbox_base = /
|
||
virtual_mailbox_maps = proxy:mysql:/etc/postfix/mysql-virtual_mailbox_maps.cf
|
||
virtual_mailbox_domains = proxy:mysql:/etc/postfix/mysql-virtual_mailbox_domains.cf
|
||
virtual_alias_maps = proxy:mysql:/etc/postfix/mysql-virtual_alias_maps.cf
|
||
smtpd_sender_login_maps = proxy:mysql:/etc/postfix/mysql-virtual_sender_permissions.cf
|
||
virtual_uid_maps = static:<VIRTUAL_UID_MAPS>
|
||
virtual_gid_maps = static:<VIRTUAL_GID_MAPS>
|
||
|
||
# Local delivery settings
|
||
local_transport = local
|
||
alias_maps = $alias_database
|
||
|
||
# Default Mailbox size, is set to 0 which means unlimited!
|
||
mailbox_size_limit = 0
|
||
virtual_mailbox_limit = 0
|
||
|
||
### TLS settings
|
||
###
|
||
## TLS for outgoing mails from the server to another server
|
||
smtp_tls_security_level = may
|
||
smtp_tls_note_starttls_offer = yes
|
||
## TLS for incoming connections (clients or other mail servers)
|
||
smtpd_tls_security_level = may
|
||
smtpd_tls_cert_file = <SSL_CERT_FILE>
|
||
smtpd_tls_key_file = <SSL_KEY_FILE>
|
||
#smtpd_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
|
||
smtpd_tls_loglevel = 1
|
||
smtpd_tls_received_header = yes
|
||
smtp_use_tls = yes
|
||
smtpd_use_tls = yes
|
||
smtpd_tls_session_cache_timeout = 3600s
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<include>//service[@type='smtp']/general/files[@index=0]</include>
|
||
<file name="/etc/postfix/master.cf" chown="root:root"
|
||
chmod="0644" backup="true">
|
||
<content><![CDATA[
|
||
#
|
||
# Postfix master process configuration file. For details on the format
|
||
# of the file, see the master(5) manual page (command: "man 5 master" or
|
||
# on-line: http://www.postfix.org/master.5.html).
|
||
#
|
||
# Do not forget to execute "postfix reload" after editing this file.
|
||
#
|
||
# ==========================================================================
|
||
# service type private unpriv chroot wakeup maxproc command + args
|
||
# (yes) (yes) (yes) (never) (100)
|
||
# ==========================================================================
|
||
#smtp inet n - y - - smtpd
|
||
smtp inet n - y - 1 postscreen
|
||
smtpd pass - - y - - smtpd
|
||
dnsblog unix - - y - 0 dnsblog
|
||
tlsproxy unix - - y - 0 tlsproxy
|
||
submission inet n - y - - smtpd
|
||
-o syslog_name=postfix/submission
|
||
-o smtpd_tls_security_level=encrypt
|
||
-o smtpd_sasl_auth_enable=yes
|
||
-o smtpd_reject_unlisted_recipient=no
|
||
# -o smtpd_client_restrictions=$mua_client_restrictions
|
||
# -o smtpd_helo_restrictions=$mua_helo_restrictions
|
||
# -o smtpd_sender_restrictions=$mua_sender_restrictions
|
||
# -o smtpd_recipient_restrictions=
|
||
-o smtpd_relay_restrictions=permit_sasl_authenticated,reject
|
||
-o milter_macro_daemon_name=ORIGINATING
|
||
smtps inet n - y - - smtpd
|
||
-o syslog_name=postfix/smtps
|
||
-o smtpd_tls_wrappermode=yes
|
||
-o smtpd_sasl_auth_enable=yes
|
||
-o smtpd_reject_unlisted_recipient=no
|
||
# -o smtpd_client_restrictions=$mua_client_restrictions
|
||
# -o smtpd_helo_restrictions=$mua_helo_restrictions
|
||
# -o smtpd_sender_restrictions=$mua_sender_restrictions
|
||
# -o smtpd_recipient_restrictions=
|
||
-o smtpd_relay_restrictions=permit_sasl_authenticated,reject
|
||
-o milter_macro_daemon_name=ORIGINATING
|
||
#628 inet n - y - - qmqpd
|
||
pickup unix n - y 60 1 pickup
|
||
-o content_filter=
|
||
-o receive_override_options=no_header_body_checks
|
||
cleanup unix n - y - 0 cleanup
|
||
qmgr unix n - n 300 1 qmgr
|
||
#qmgr unix n - n 300 1 oqmgr
|
||
tlsmgr unix - - y 1000? 1 tlsmgr
|
||
rewrite unix - - y - - trivial-rewrite
|
||
bounce unix - - y - 0 bounce
|
||
defer unix - - y - 0 bounce
|
||
trace unix - - y - 0 bounce
|
||
verify unix - - y - 1 verify
|
||
flush unix n - y 1000? 0 flush
|
||
proxymap unix - - n - - proxymap
|
||
proxywrite unix - - n - 1 proxymap
|
||
smtp unix - - y - - smtp
|
||
relay unix - - y - - smtp
|
||
# -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
|
||
showq unix n - y - - showq
|
||
error unix - - y - - error
|
||
retry unix - - y - - error
|
||
discard unix - - y - - discard
|
||
local unix - n n - - local
|
||
virtual unix - n n - - virtual
|
||
lmtp unix - - y - - lmtp
|
||
anvil unix - - y - 1 anvil
|
||
scache unix - - y - 1 scache
|
||
#
|
||
# ====================================================================
|
||
# Interfaces to non-Postfix software. Be sure to examine the manual
|
||
# pages of the non-Postfix software to find out what options it wants.
|
||
#
|
||
# Many of the following services use the Postfix pipe(8) delivery
|
||
# agent. See the pipe(8) man page for information about ${recipient}
|
||
# and other message envelope options.
|
||
# ====================================================================
|
||
#
|
||
# maildrop. See the Postfix MAILDROP_README file for details.
|
||
# Also specify in main.cf: maildrop_destination_recipient_limit=1
|
||
#
|
||
maildrop unix - n n - - pipe
|
||
flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
|
||
#
|
||
# ====================================================================
|
||
#
|
||
# Recent Cyrus versions can use the existing "lmtp" master.cf entry.
|
||
#
|
||
# Specify in cyrus.conf:
|
||
# lmtp cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
|
||
#
|
||
# Specify in main.cf one or more of the following:
|
||
# mailbox_transport = lmtp:inet:localhost
|
||
# virtual_transport = lmtp:inet:localhost
|
||
#
|
||
# ====================================================================
|
||
#
|
||
# Cyrus 2.1.5 (Amos Gouaux)
|
||
# Also specify in main.cf: cyrus_destination_recipient_limit=1
|
||
#
|
||
#cyrus unix - n n - - pipe
|
||
# user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
|
||
#
|
||
# ====================================================================
|
||
# Old example of delivery via Cyrus.
|
||
#
|
||
#old-cyrus unix - n n - - pipe
|
||
# flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
|
||
#
|
||
# ====================================================================
|
||
#
|
||
# See the Postfix UUCP_README file for configuration details.
|
||
#
|
||
uucp unix - n n - - pipe
|
||
flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
|
||
#
|
||
# Other external delivery methods.
|
||
#
|
||
ifmail unix - n n - - pipe
|
||
flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
|
||
bsmtp unix - n n - - pipe
|
||
flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
|
||
scalemail-backend unix - n n - 2 pipe
|
||
flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
|
||
mailman unix - n n - - pipe
|
||
flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
|
||
${nexthop} ${user}
|
||
# Dovecot LDA
|
||
dovecot unix - n n - - pipe
|
||
flags=DRhu user=vmail:vmail argv=/usr/lib/dovecot/deliver -d ${recipient}
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<include>//service[@type='smtp']/general/commands[@index=3]
|
||
</include>
|
||
</daemon>
|
||
</service>
|
||
<!-- IMAP/POP3 services -->
|
||
<service type="mail" title="{{lng.admin.configfiles.mail}}">
|
||
<!-- valid for both dovecots -->
|
||
<general>
|
||
<installs index="1">
|
||
<install><![CDATA[apt-get install dovecot-imapd dovecot-pop3d dovecot-mysql dovecot-managesieved dovecot-sieve]]></install>
|
||
</installs>
|
||
<files index="1">
|
||
<file name="/etc/dovecot/dovecot-sql.conf.ext"
|
||
chown="root:root" chmod="0600" backup="true">
|
||
<content><![CDATA[
|
||
driver = mysql
|
||
connect = "host=<SQL_HOST> dbname=<SQL_DB> user=<SQL_UNPRIVILEGED_USER> password=<SQL_UNPRIVILEGED_PASSWORD>"
|
||
#default_pass_scheme = CRYPT
|
||
user_query = SELECT CONCAT(homedir, maildir) AS home, CONCAT('maildir:', homedir, maildir) AS mail, uid, gid, CONCAT('*:storage=', quota, 'M') as quota_rule FROM mail_users WHERE (username = '%u' OR email = '%u')
|
||
password_query = SELECT username AS user, password_enc AS password, CONCAT(homedir, maildir) AS userdb_home, uid AS userdb_uid, gid AS userdb_gid, CONCAT('maildir:', homedir, maildir) AS userdb_mail, CONCAT('*:storage=', quota, 'M') as userdb_quota_rule FROM mail_users WHERE (username = '%u' OR email = '%u') AND ((imap = 1 AND '%Ls' = 'imap') OR (pop3 = 1 AND '%Ls' = 'pop3') OR ((postfix = 'Y' AND '%Ls' = 'smtp') OR (postfix = 'Y' AND '%Ls' = 'sieve')))
|
||
iterate_query = "SELECT username AS user FROM mail_users WHERE (imap = 1 OR pop3 = 1)"
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<file name="/etc/dovecot/conf.d/99-froxlor.conf" chown="root:0"
|
||
chmod="0644" backup="true">
|
||
<content><![CDATA[
|
||
disable_plaintext_auth = no
|
||
auth_mechanisms = plain login
|
||
!include auth-sql.conf.ext
|
||
mail_location = mbox:~/mail:INBOX=/var/mail/%u
|
||
|
||
namespace inbox {
|
||
inbox = yes
|
||
}
|
||
mail_privileged_group = mail
|
||
|
||
service auth {
|
||
# Postfix smtp-auth
|
||
unix_listener /var/spool/postfix/private/auth {
|
||
mode = 0660
|
||
user = postfix
|
||
group = postfix
|
||
}
|
||
# Exim4 smtp-auth
|
||
unix_listener auth-client {
|
||
mode = 0660
|
||
user = mail
|
||
#group = Debian-exim
|
||
}
|
||
}
|
||
|
||
service stats {
|
||
unix_listener stats-reader {
|
||
group = vmail
|
||
mode = 0666
|
||
}
|
||
unix_listener stats-writer {
|
||
group = vmail
|
||
mode = 0666
|
||
}
|
||
}
|
||
|
||
ssl = yes
|
||
ssl_cert = <<SSL_CERT_FILE>
|
||
ssl_key = <<SSL_KEY_FILE>
|
||
ssl_dh = </usr/share/dovecot/dh.pem
|
||
|
||
postmaster_address = postmaster@<SERVERNAME>
|
||
|
||
protocol imap {
|
||
mail_plugins = $mail_plugins quota imap_quota
|
||
}
|
||
|
||
pop3_logout_format = in=%i out=%o top=%t/%p, retr=%r/%b, del=%d/%m, size=%s
|
||
|
||
plugin {
|
||
sieve = file:~/sieve;active=~/.dovecot.sieve
|
||
sieve_dir = ~/sieve
|
||
}
|
||
|
||
plugin {
|
||
quota = maildir:User quota
|
||
}
|
||
]]>
|
||
</content>
|
||
</file>
|
||
</files>
|
||
<commands index="1">
|
||
<command><![CDATA[sed -i.bak 's/^!include auth-system.conf.ext/#!include auth-system.conf.ext/' /etc/dovecot/conf.d/10-auth.conf]]></command>
|
||
<command><![CDATA[service dovecot restart]]></command>
|
||
</commands>
|
||
</general>
|
||
<!-- Dovecot with postfix -->
|
||
<daemon name="dovecot_postfix" version="2"
|
||
title="Dovecot with postfix" default="true">
|
||
<include>//service[@type='mail']/general/installs[@index=1]
|
||
</include>
|
||
<include>//service[@type='mail']/general/files[@index=1]
|
||
</include>
|
||
<include>//service[@type='mail']/general/commands[@index=1]
|
||
</include>
|
||
</daemon>
|
||
</service>
|
||
<!-- Antispam services -->
|
||
<service type="antispam" title="Antispam">
|
||
<!-- general RSpamd commands -->
|
||
<general>
|
||
<commands index="1">
|
||
<command><![CDATA[mkdir -p /etc/apt/keyrings]]></command>
|
||
<command><![CDATA[wget -O- https://rspamd.com/apt-stable/gpg.key | gpg --dearmor | tee /etc/apt/keyrings/rspamd.gpg > /dev/null]]></command>
|
||
<command><![CDATA[echo "deb [signed-by=/etc/apt/keyrings/rspamd.gpg] http://rspamd.com/apt-stable/ bookworm main" > /etc/apt/sources.list.d/rspamd.list]]></command>
|
||
<command><![CDATA[echo "deb-src [signed-by=/etc/apt/keyrings/rspamd.gpg] http://rspamd.com/apt-stable/ bookworm main" >> /etc/apt/sources.list.d/rspamd.list]]></command>
|
||
<command><![CDATA[apt-get update]]></command>
|
||
</commands>
|
||
<installs index="1">
|
||
<install><![CDATA[DEBIAN_FRONTEND=noninteractive apt-get -yq --no-install-recommends install rspamd]]></install>
|
||
</installs>
|
||
<commands index="2">
|
||
<command><![CDATA[mkdir -p /etc/rspamd/local.d/]]></command>
|
||
<command><![CDATA[mkdir -p /etc/rspamd/override.d/]]></command>
|
||
<command><![CDATA[mkdir -p /var/lib/rspamd/dkim/]]></command>
|
||
</commands>
|
||
<files index="1">
|
||
<file name="/etc/rspamd/local.d/actions.conf"
|
||
chown="root:root" chmod="0644" backup="true">
|
||
<content><![CDATA[
|
||
# Set rewrite subject to this value (%s is replaced by the original subject)
|
||
subject = "***SPAM*** %s"
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<file name="/etc/rspamd/local.d/arc.conf"
|
||
chown="root:root" chmod="0644" backup="true">
|
||
<content><![CDATA[
|
||
try_fallback = true;
|
||
### Enable DKIM signing for alias sender addresses
|
||
allow_username_mismatch = true;
|
||
path = "/var/lib/rspamd/dkim/$domain.$selector.key";
|
||
selector_map = "/etc/rspamd/dkim_selectors.map";
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<file name="/etc/rspamd/local.d/milter_headers.conf"
|
||
chown="root:root" chmod="0644" backup="true">
|
||
<content><![CDATA[
|
||
use = ["x-spamd-bar", "x-spam-level", "authentication-results"];
|
||
authenticated_headers = ["authentication-results"];
|
||
extended_spam_headers = true
|
||
skip_local = false
|
||
skip_authenticated = false
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<file name="/etc/rspamd/local.d/replies.conf"
|
||
chown="root:root" chmod="0644" backup="true">
|
||
<content><![CDATA[
|
||
## If a user has replied to an email, don’t mark other emails in the same thread as spam
|
||
action = "no action";
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<file name="/etc/rspamd/local.d/settings.conf"
|
||
chown="root:root" chmod="0644" backup="true">
|
||
<content><![CDATA[
|
||
## Feel free to include your own settings or adjustments here, for example:
|
||
#whitelist {
|
||
# priority = low;
|
||
# rcpt = "postmaster@example.com";
|
||
# want_spam = yes;
|
||
#}
|
||
|
||
## Include froxlor generated settings
|
||
.include(try=true,priority=1,duplicate=merge) "{{settings.antispam.config_file}}"
|
||
]]>
|
||
</content>
|
||
</file>
|
||
</files>
|
||
<commands index="3">
|
||
<command><![CDATA[cp /etc/rspamd/local.d/arc.conf /etc/rspamd/local.d/dkim_signing.conf]]></command>
|
||
<command><![CDATA[postconf -e "milter_protocol = 6"]]></command>
|
||
<command><![CDATA[postconf -e "milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}"]]></command>
|
||
<command><![CDATA[postconf -e "milter_default_action = accept"]]></command>
|
||
<command><![CDATA[postconf -e "smtpd_milters = inet:127.0.0.1:11332"]]></command>
|
||
<command><![CDATA[postconf -e "non_smtpd_milters = inet:127.0.0.1:11332"]]></command>
|
||
<command><![CDATA[chown -R _rspamd:_rspamd /var/lib/rspamd/dkim]]></command>
|
||
<command><![CDATA[service rspamd restart]]></command>
|
||
<command><![CDATA[service postfix restart]]></command>
|
||
</commands>
|
||
</general>
|
||
<!-- rspamd -->
|
||
<daemon name="rspamd" title="Rspamd" default="true">
|
||
<include>//service[@type='antispam']/general/commands[@index=1]
|
||
</include>
|
||
<include>//service[@type='antispam']/general/installs[@index=1]
|
||
</include>
|
||
<include>//service[@type='antispam']/general/commands[@index=2]
|
||
</include>
|
||
<include>//service[@type='antispam']/general/files[@index=1]
|
||
</include>
|
||
<include>//service[@type='antispam']/general/commands[@index=3]
|
||
</include>
|
||
</daemon>
|
||
</service>
|
||
<!-- FTP services -->
|
||
<service type="ftp" title="{{lng.admin.configfiles.ftp}}">
|
||
<!-- Proftpd -->
|
||
<daemon name="proftpd" title="ProFTPd" default="true">
|
||
<install><![CDATA[apt-get install proftpd-basic proftpd-mod-mysql]]></install>
|
||
<file name="/etc/proftpd/create-cert.sh" chown="root:0"
|
||
chmod="0700">
|
||
<content><![CDATA[#!/bin/bash
|
||
[ -f /etc/ssl/certs/proftpd.crt ] || openssl req -new -x509 -newkey rsa:4096 -days 3650 -nodes -out /etc/ssl/certs/proftpd.crt -keyout /etc/ssl/private/proftpd.key -subj "/C=US/ST=Some-State/O=Internet Widgits Pty Ltd/CN=<SERVERNAME>"
|
||
[ -f /etc/ssl/certs/proftpd_ec.crt ] || openssl req -new -x509 -nodes -newkey ec:<(openssl ecparam -name secp521r1) -keyout /etc/ssl/private/proftpd_ec.key -out /etc/ssl/certs/proftpd_ec.crt -days 3650 -subj "/C=US/ST=Some-State/O=Internet Widgits Pty Ltd/CN=<SERVERNAME>"
|
||
chmod 0600 /etc/ssl/private/proftpd.key /etc/ssl/private/proftpd_ec.key
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<commands index="1">
|
||
<command><![CDATA[/etc/proftpd/create-cert.sh]]></command>
|
||
<command><![CDATA[rm -f /etc/proftpd/create-cert.sh]]></command>
|
||
</commands>
|
||
<file name="/etc/proftpd/proftpd.conf" chown="root:0"
|
||
chmod="0600" backup="true">
|
||
<content><![CDATA[
|
||
#
|
||
# /etc/proftpd/proftpd.conf -- This is a basic ProFTPD configuration file.
|
||
# To really apply changes, reload proftpd after modifications, if
|
||
# it runs in daemon mode. It is not required in inetd/xinetd mode.
|
||
#
|
||
|
||
# Includes DSO modules
|
||
Include /etc/proftpd/modules.conf
|
||
|
||
# Set off to disable IPv6 support which is annoying on IPv4 only boxes.
|
||
UseIPv6 on
|
||
# If set on you can experience a longer connection delay in many cases.
|
||
<IfModule mod_ident.c>
|
||
IdentLookups off
|
||
</IfModule>
|
||
|
||
ServerName "<SERVERNAME> FTP Server"
|
||
ServerType standalone
|
||
DeferWelcome off
|
||
|
||
DefaultServer on
|
||
ShowSymlinks on
|
||
|
||
TimeoutNoTransfer 600
|
||
TimeoutStalled 600
|
||
TimeoutIdle 1200
|
||
|
||
DisplayLogin welcome.msg
|
||
DisplayChdir .message true
|
||
ListOptions "-l"
|
||
|
||
DenyFilter \*.*/
|
||
|
||
# Use this to jail all users in their homes
|
||
# DefaultRoot ~
|
||
|
||
# Users require a valid shell listed in /etc/shells to login.
|
||
# Use this directive to release that constrain.
|
||
# RequireValidShell off
|
||
|
||
# Port 21 is the standard FTP port.
|
||
Port 21
|
||
|
||
# In some cases you have to specify passive ports range to by-pass
|
||
# firewall limitations. Ephemeral ports can be used for that, but
|
||
# feel free to use a more narrow range.
|
||
# PassivePorts 49152 65534
|
||
|
||
# If your host was NATted, this option is useful in order to
|
||
# allow passive transfers to work. You have to use your public
|
||
# address and opening the passive ports used on your firewall as well.
|
||
# MasqueradeAddress 1.2.3.4
|
||
|
||
# This is useful for masquerading address with dynamic IPs:
|
||
# refresh any configured MasqueradeAddress directives every 8 hours
|
||
<IfModule mod_dynmasq.c>
|
||
# DynMasqRefresh 28800
|
||
</IfModule>
|
||
|
||
# To prevent DoS attacks, set the maximum number of child processes
|
||
# to 30. If you need to allow more than 30 concurrent connections
|
||
# at once, simply increase this value. Note that this ONLY works
|
||
# in standalone mode, in inetd mode you should use an inetd server
|
||
# that allows you to limit maximum number of processes per service
|
||
# (such as xinetd)
|
||
MaxInstances 30
|
||
|
||
# Set the user and group that the server normally runs at.
|
||
User proftpd
|
||
Group nogroup
|
||
|
||
# Umask 022 is a good standard umask to prevent new files and dirs
|
||
# (second parm) from being group and world writable.
|
||
Umask 022 022
|
||
# Normally, we want files to be overwritable.
|
||
AllowOverwrite on
|
||
|
||
# Uncomment this if you are using NIS or LDAP via NSS to retrieve passwords:
|
||
# PersistentPasswd off
|
||
|
||
# This is required to use both PAM-based authentication and local passwords
|
||
# AuthOrder mod_auth_pam.c* mod_auth_unix.c
|
||
|
||
# Be warned: use of this directive impacts CPU average load!
|
||
# Uncomment this if you like to see progress and transfer rate with ftpwho
|
||
# in downloads. That is not needed for uploads rates.
|
||
#
|
||
# UseSendFile off
|
||
|
||
TransferLog /var/log/proftpd/xferlog
|
||
SystemLog /var/log/proftpd/proftpd.log
|
||
|
||
# Logging onto /var/log/lastlog is enabled but set to off by default
|
||
#UseLastlog on
|
||
|
||
# In order to keep log file dates consistent after chroot, use timezone info
|
||
# from /etc/localtime. If this is not set, and proftpd is configured to
|
||
# chroot (e.g. DefaultRoot or <Anonymous>), it will use the non-daylight
|
||
# savings timezone regardless of whether DST is in effect.
|
||
#SetEnv TZ :/etc/localtime
|
||
|
||
<IfModule mod_quotatab.c>
|
||
QuotaEngine on
|
||
</IfModule>
|
||
|
||
<IfModule mod_ratio.c>
|
||
Ratios off
|
||
</IfModule>
|
||
|
||
|
||
# Delay engine reduces impact of the so-called Timing Attack described in
|
||
# http://www.securityfocus.com/bid/11430/discuss
|
||
# It is on by default.
|
||
<IfModule mod_delay.c>
|
||
DelayEngine on
|
||
</IfModule>
|
||
|
||
<IfModule mod_ctrls.c>
|
||
ControlsEngine off
|
||
ControlsMaxClients 2
|
||
ControlsLog /var/log/proftpd/controls.log
|
||
ControlsInterval 5
|
||
ControlsSocket /var/run/proftpd/proftpd.sock
|
||
</IfModule>
|
||
|
||
<IfModule mod_ctrls_admin.c>
|
||
AdminControlsEngine off
|
||
</IfModule>
|
||
|
||
#
|
||
# Alternative authentication frameworks
|
||
#
|
||
#Include /etc/proftpd/ldap.conf
|
||
Include /etc/proftpd/sql.conf
|
||
|
||
#
|
||
# This is used for FTPS connections
|
||
#
|
||
Include /etc/proftpd/tls.conf
|
||
|
||
#
|
||
# Useful to keep VirtualHost/VirtualRoot directives separated
|
||
#
|
||
#Include /etc/proftpd/virtuals.conf
|
||
|
||
# A basic anonymous configuration, no upload directories.
|
||
|
||
# <Anonymous ~ftp>
|
||
# User ftp
|
||
# Group nogroup
|
||
# # We want clients to be able to login with "anonymous" as well as "ftp"
|
||
# UserAlias anonymous ftp
|
||
# # Cosmetic changes, all files belongs to ftp user
|
||
# DirFakeUser on ftp
|
||
# DirFakeGroup on ftp
|
||
#
|
||
# RequireValidShell off
|
||
#
|
||
# # Limit the maximum number of anonymous logins
|
||
# MaxClients 10
|
||
#
|
||
# # We want 'welcome.msg' displayed at login, and '.message' displayed
|
||
# # in each newly chdired directory.
|
||
# DisplayLogin welcome.msg
|
||
# DisplayChdir .message
|
||
#
|
||
# # Limit WRITE everywhere in the anonymous chroot
|
||
# <Directory *>
|
||
# <Limit WRITE>
|
||
# DenyAll
|
||
# </Limit>
|
||
# </Directory>
|
||
#
|
||
# # Uncomment this if you're brave.
|
||
# # <Directory incoming>
|
||
# # # Umask 022 is a good standard umask to prevent new files and dirs
|
||
# # # (second parm) from being group and world writable.
|
||
# # Umask 022 022
|
||
# # <Limit READ WRITE>
|
||
# # DenyAll
|
||
# # </Limit>
|
||
# # <Limit STOR>
|
||
# # AllowAll
|
||
# # </Limit>
|
||
# # </Directory>
|
||
#
|
||
# </Anonymous>
|
||
|
||
# Include other custom configuration files
|
||
Include /etc/proftpd/conf.d/
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<file name="/etc/proftpd/modules.conf" chown="root:0"
|
||
chmod="0644" backup="true">
|
||
<content><![CDATA[
|
||
#
|
||
# This file is used to manage DSO modules and features.
|
||
#
|
||
|
||
# This is the directory where DSO modules reside
|
||
|
||
ModulePath /usr/lib/proftpd
|
||
|
||
# Allow only user root to load and unload modules, but allow everyone
|
||
# to see which modules have been loaded
|
||
|
||
ModuleControlsACLs insmod,rmmod allow user root
|
||
ModuleControlsACLs lsmod allow user *
|
||
|
||
LoadModule mod_ctrls_admin.c
|
||
LoadModule mod_tls.c
|
||
|
||
LoadModule mod_ident.c
|
||
|
||
# Install one of proftpd-mod-mysql, proftpd-mod-pgsql or any other
|
||
# SQL backend engine to use this module and the required backend.
|
||
# This module must be mandatory loaded before anyone of
|
||
# the existent SQL backeds.
|
||
LoadModule mod_sql.c
|
||
|
||
# Install proftpd-mod-ldap to use this
|
||
#LoadModule mod_ldap.c
|
||
|
||
#
|
||
# 'SQLBackend mysql' or 'SQLBackend postgres' (or any other valid backend) directives
|
||
# are required to have SQL authorization working. You can also comment out the
|
||
# unused module here, in alternative.
|
||
#
|
||
|
||
# Install proftpd-mod-mysql and decomment the previous
|
||
# mod_sql.c module to use this.
|
||
LoadModule mod_sql_mysql.c
|
||
|
||
# Install proftpd-mod-pgsql and decomment the previous
|
||
# mod_sql.c module to use this.
|
||
#LoadModule mod_sql_postgres.c
|
||
|
||
# Install proftpd-mod-sqlite and decomment the previous
|
||
# mod_sql.c module to use this
|
||
#LoadModule mod_sql_sqlite.c
|
||
|
||
# Install proftpd-mod-odbc and decomment the previous
|
||
# mod_sql.c module to use this
|
||
#LoadModule mod_sql_odbc.c
|
||
|
||
# Install one of the previous SQL backends and decomment
|
||
# the previous mod_sql.c module to use this
|
||
#LoadModule mod_sql_passwd.c
|
||
|
||
LoadModule mod_radius.c
|
||
LoadModule mod_quotatab.c
|
||
LoadModule mod_quotatab_file.c
|
||
|
||
# Install proftpd-mod-ldap to use this
|
||
#LoadModule mod_quotatab_ldap.c
|
||
|
||
# Install one of the previous SQL backends and decomment
|
||
# the previous mod_sql.c module to use this
|
||
LoadModule mod_quotatab_sql.c
|
||
LoadModule mod_quotatab_radius.c
|
||
LoadModule mod_wrap.c
|
||
LoadModule mod_rewrite.c
|
||
LoadModule mod_load.c
|
||
LoadModule mod_ban.c
|
||
LoadModule mod_wrap2.c
|
||
LoadModule mod_wrap2_file.c
|
||
# Install one of the previous SQL backends and decomment
|
||
# the previous mod_sql.c module to use this
|
||
#LoadModule mod_wrap2_sql.c
|
||
LoadModule mod_dynmasq.c
|
||
LoadModule mod_exec.c
|
||
LoadModule mod_shaper.c
|
||
LoadModule mod_ratio.c
|
||
LoadModule mod_site_misc.c
|
||
|
||
LoadModule mod_sftp.c
|
||
LoadModule mod_sftp_pam.c
|
||
# Install one of the previous SQL backends and decomment
|
||
# the previous mod_sql.c module to use this
|
||
#LoadModule mod_sftp_sql.c
|
||
|
||
LoadModule mod_facl.c
|
||
LoadModule mod_unique_id.c
|
||
LoadModule mod_copy.c
|
||
LoadModule mod_deflate.c
|
||
LoadModule mod_ifversion.c
|
||
LoadModule mod_tls_memcache.c
|
||
|
||
# Install proftpd-mod-geoip to use the GeoIP feature
|
||
#LoadModule mod_geoip.c
|
||
|
||
# keep this module the last one
|
||
LoadModule mod_ifsession.c
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<file name="/etc/proftpd/sql.conf" chown="root:0" chmod="0600"
|
||
backup="true">
|
||
<content><![CDATA[
|
||
#
|
||
# Proftpd sample configuration for SQL-based authentication.
|
||
#
|
||
# (This is not to be used if you prefer a PAM-based SQL authentication)
|
||
#
|
||
|
||
<IfModule mod_sql.c>
|
||
|
||
DefaultRoot ~
|
||
RequireValidShell off
|
||
AuthOrder mod_sql.c
|
||
|
||
#
|
||
# Choose a SQL backend among MySQL or PostgreSQL.
|
||
# Both modules are loaded in default configuration, so you have to specify the backend
|
||
# or comment out the unused module in /etc/proftpd/modules.conf.
|
||
# Use 'mysql' or 'postgres' as possible values.
|
||
#
|
||
SQLBackend mysql
|
||
#
|
||
SQLEngine on
|
||
SQLAuthenticate on
|
||
#
|
||
# Use both an encrypted or plaintext password
|
||
SQLAuthTypes Crypt OpenSSL
|
||
|
||
SQLAuthenticate users* groups*
|
||
|
||
#
|
||
# Connection
|
||
SQLConnectInfo <SQL_DB>@<SQL_HOST> <SQL_UNPRIVILEGED_USER> <SQL_UNPRIVILEGED_PASSWORD>
|
||
#
|
||
# Describes both users/groups tables
|
||
#
|
||
SQLUserInfo ftp_users username password uid gid homedir shell
|
||
SQLGroupInfo ftp_groups groupname gid members
|
||
#
|
||
SQLUserWhereClause "login_enabled = 'y'"
|
||
|
||
SQLLog PASS login
|
||
SQLNamedQuery login UPDATE "last_login=now(), login_count=login_count+1 WHERE username='%u'" ftp_users
|
||
|
||
SQLLog RETR download
|
||
SQLNamedQuery download UPDATE "down_count=down_count+1, down_bytes=down_bytes+%b WHERE username='%u'" ftp_users
|
||
|
||
SQLLog STOR upload
|
||
SQLNamedQuery upload UPDATE "up_count=up_count+1, up_bytes=up_bytes+%b WHERE username='%u'" ftp_users
|
||
|
||
QuotaEngine on
|
||
QuotaShowQuotas on
|
||
QuotaDisplayUnits Mb
|
||
QuotaLock /var/lock/ftpd.quotatab.lock
|
||
QuotaLimitTable sql:/get-quota-limit
|
||
QuotaTallyTable sql:/get-quota-tally/update-quota-tally/insert-quota-tally
|
||
SQLNamedQuery get-quota-limit SELECT "ftp_users.username AS name, ftp_quotalimits.quota_type, ftp_quotalimits.per_session, ftp_quotalimits.limit_type, panel_customers.diskspace*1024 AS bytes_in_avail, ftp_quotalimits.bytes_out_avail, ftp_quotalimits.bytes_xfer_avail, ftp_quotalimits.files_in_avail, ftp_quotalimits.files_out_avail, ftp_quotalimits.files_xfer_avail FROM ftp_users, ftp_quotalimits, panel_customers WHERE ftp_users.username = '%{0}' AND panel_customers.loginname = SUBSTRING_INDEX('%{0}', 'ftp', 1) AND quota_type ='%{1}'"
|
||
SQLNamedQuery get-quota-tally SELECT "name, quota_type, bytes_in_used,bytes_out_used, bytes_xfer_used, files_in_used, files_out_used,files_xfer_used FROM ftp_quotatallies WHERE name = '%{0}' AND quota_type = '%{1}'"
|
||
SQLNamedQuery update-quota-tally UPDATE "bytes_in_used = bytes_in_used + %{0}, bytes_out_used = bytes_out_used + %{1}, bytes_xfer_used = bytes_xfer_used + %{2}, files_in_used = files_in_used + %{3}, files_out_used= files_out_used + %{4}, files_xfer_used = files_xfer_used + %{5} WHERE name= '%{6}' AND quota_type = '%{7}'" ftp_quotatallies
|
||
SQLNamedQuery insert-quota-tally INSERT "%{0}, %{1}, %{2}, %{3}, %{4},%{5}, %{6}, %{7}" ftp_quotatallies
|
||
</IfModule>
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<file name="/etc/proftpd/tls.conf" chown="root:root"
|
||
chmod="0644" backup="true">
|
||
<content><![CDATA[
|
||
<IfModule mod_tls.c>
|
||
TLSEngine on
|
||
TLSLog /var/log/proftpd/tls.log
|
||
TLSProtocol TLSv1.2 TLSv1.3
|
||
TLSRSACertificateFile /etc/ssl/certs/proftpd.crt
|
||
TLSRSACertificateKeyFile /etc/ssl/private/proftpd.key
|
||
TLSECCertificateFile /etc/ssl/certs/proftpd_ec.crt
|
||
TLSECCertificateKeyFile /etc/ssl/private/proftpd_ec.key
|
||
# TLSCACertificateFile
|
||
TLSOptions NoSessionReuseRequired
|
||
TLSVerifyClient off
|
||
|
||
# Are clients required to use FTP over TLS when talking to this server?
|
||
TLSRequired on
|
||
|
||
# Allow SSL/TLS renegotiations when the client requests them, but
|
||
# do not force the renegotiations. Some clients do not support
|
||
# SSL/TLS renegotiations; when mod_tls forces a renegotiation, these
|
||
# clients will close the data connection, or there will be a timeout
|
||
# on an idle data connection.
|
||
#
|
||
#TLSRenegotiate required off
|
||
</IfModule>
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<file name="/etc/proftpd/conf.d/99-froxlor-ratelimit.conf" chown="root:0"
|
||
chmod="0644">
|
||
<content><![CDATA[
|
||
<Class whitelist>
|
||
From 127.0.0.1
|
||
</Class>
|
||
|
||
MaxLoginAttempts 3
|
||
<IfModule mod_ban.c>
|
||
<IfClass whitelist>
|
||
BanEngine off
|
||
</IfClass>
|
||
<IfClass !whitelist>
|
||
BanEngine on
|
||
</IfClass>
|
||
BanLog /var/log/proftpd/ban.log
|
||
BanTable /etc/proftpd/ban.tab
|
||
BanMessage "User %u was banned."
|
||
BanOnEvent ClientConnectRate 10/00:00:02 02:00:00 "Stop connecting frequently"
|
||
BanOnEvent MaxLoginAttempts 3/00:30:00 12:00:00
|
||
BanOnEvent AnonRejectPasswords 1/01:00:00 99:99:99
|
||
BanControlsACLs all allow user root
|
||
</IfModule>
|
||
|
||
<IfClass whitelist>
|
||
BanEngine off
|
||
DelayEngine off
|
||
</IfClass>
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<command><![CDATA[service proftpd restart]]></command>
|
||
</daemon>
|
||
<!-- Pureftpd -->
|
||
<daemon name="pureftpd" title="PureFTPd">
|
||
<install><![CDATA[apt-get install pure-ftpd-common pure-ftpd-mysql]]></install>
|
||
<file name="/etc/pure-ftpd/create-cert.sh" chown="root:0"
|
||
chmod="0700">
|
||
<content><![CDATA[#!/bin/bash
|
||
[ -f /etc/ssl/private/pure-ftpd.pem ] || openssl req -x509 -nodes -days 7300 -newkey rsa:4096 -keyout /etc/ssl/private/pure-ftpd.pem -out /etc/ssl/private/pure-ftpd.pem -subj "/C=US/ST=Some-State/O=Internet Widgits Pty Ltd/CN=<SERVERNAME>"
|
||
openssl dhparam -out /etc/ssl/private/pure-ftpd-dhparams.pem 3072
|
||
chmod 0600 /etc/ssl/private/pure-ftpd.pem /etc/ssl/private/pure-ftpd-dhparams.pem
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<commands index="1">
|
||
<command><![CDATA[/etc/pure-ftpd/create-cert.sh]]></command>
|
||
<command><![CDATA[rm -f /etc/pure-ftpd/create-cert.sh]]></command>
|
||
</commands>
|
||
<file name="/etc/pure-ftpd/conf/TLS"
|
||
chown="root:0" chmod="0644">
|
||
<content><![CDATA[
|
||
1
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<file name="/etc/pure-ftpd/conf/MinUID" chown="root:0"
|
||
chmod="0644">
|
||
<content><![CDATA[
|
||
1000
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<file name="/etc/pure-ftpd/conf/MySQLConfigFile"
|
||
chown="root:0" chmod="0644">
|
||
<content><![CDATA[
|
||
/etc/pure-ftpd/db/mysql.conf
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<file name="/etc/pure-ftpd/conf/NoAnonymous" chown="root:0"
|
||
chmod="0644">
|
||
<content><![CDATA[
|
||
yes
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<file name="/etc/pure-ftpd/conf/MaxIdleTime" chown="root:0"
|
||
chmod="0644">
|
||
<content><![CDATA[
|
||
15
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<file name="/etc/pure-ftpd/conf/ChrootEveryone" chown="root:0"
|
||
chmod="0644">
|
||
<content><![CDATA[
|
||
yes
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<file name="/etc/pure-ftpd/conf/PAMAuthentication"
|
||
chown="root:0" chmod="0644">
|
||
<content><![CDATA[
|
||
no
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<file name="/etc/pure-ftpd/db/mysql.conf" chown="root:0"
|
||
chmod="0640" backup="true">
|
||
<content><![CDATA[
|
||
##############################################
|
||
# #
|
||
# Sample Pure-FTPd Mysql configuration file. #
|
||
# See README.MySQL for explanations. #
|
||
# #
|
||
##############################################
|
||
|
||
|
||
# Optional : MySQL server name or IP. Don't define this for unix sockets.
|
||
|
||
# MYSQLServer 127.0.0.1
|
||
|
||
|
||
# Optional : MySQL port. Don't define this if a local unix socket is used.
|
||
|
||
# MYSQLPort 3306
|
||
|
||
|
||
# Optional : define the location of mysql.sock if the server runs on this host.
|
||
|
||
MYSQLSocket /var/run/mysqld/mysqld.sock
|
||
|
||
|
||
# Mandatory : user to bind the server as.
|
||
|
||
MYSQLUser <SQL_UNPRIVILEGED_USER>
|
||
|
||
|
||
# Mandatory : user password. You must have a password.
|
||
|
||
MYSQLPassword <SQL_UNPRIVILEGED_PASSWORD>
|
||
|
||
|
||
# Mandatory : database to open.
|
||
|
||
MYSQLDatabase <SQL_DB>
|
||
|
||
|
||
# Mandatory : how passwords are stored
|
||
# Valid values are : "cleartext", "crypt", "sha1", "md5" and "password"
|
||
# ("password" = MySQL password() function)
|
||
# You can also use "any" to try "crypt", "sha1", "md5" *and* "password"
|
||
|
||
MYSQLCrypt any
|
||
|
||
|
||
# In the following directives, parts of the strings are replaced at
|
||
# run-time before performing queries :
|
||
#
|
||
# \L is replaced by the login of the user trying to authenticate.
|
||
# \I is replaced by the IP address the user connected to.
|
||
# \P is replaced by the port number the user connected to.
|
||
# \R is replaced by the IP address the user connected from.
|
||
# \D is replaced by the remote IP address, as a long decimal number.
|
||
#
|
||
# Very complex queries can be performed using these substitution strings,
|
||
# especially for virtual hosting.
|
||
|
||
|
||
# Query to execute in order to fetch the password
|
||
|
||
MYSQLGetPW SELECT password FROM ftp_users WHERE username="\L" AND login_enabled="y"
|
||
|
||
|
||
# Query to execute in order to fetch the system user name or uid
|
||
|
||
MYSQLGetUID SELECT uid FROM ftp_users WHERE username="\L" AND login_enabled="y"
|
||
|
||
|
||
# Optional : default UID - if set this overrides MYSQLGetUID
|
||
|
||
#MYSQLDefaultUID 1000
|
||
|
||
|
||
# Query to execute in order to fetch the system user group or gid
|
||
|
||
MYSQLGetGID SELECT gid FROM ftp_users WHERE username="\L" AND login_enabled="y"
|
||
|
||
|
||
# Optional : default GID - if set this overrides MYSQLGetGID
|
||
|
||
#MYSQLDefaultGID 1000
|
||
|
||
|
||
# Query to execute in order to fetch the home directory
|
||
|
||
MYSQLGetDir SELECT homedir FROM ftp_users WHERE username="\L" AND login_enabled="y"
|
||
|
||
|
||
# Optional : query to get the maximal number of files
|
||
# Pure-FTPd must have been compiled with virtual quotas support.
|
||
|
||
# MySQLGetQTAFS SELECT QuotaFiles FROM users WHERE User='\L'
|
||
|
||
|
||
# Optional : query to get the maximal disk usage (virtual quotas)
|
||
# The number should be in Megabytes.
|
||
# Pure-FTPd must have been compiled with virtual quotas support.
|
||
|
||
MySQLGetQTASZ SELECT CASE WHEN panel_customers.diskspace = 0 THEN -1 WHEN panel_customers.diskspace <= -1 THEN 0 ELSE panel_customers.diskspace/1024 END AS QuotaSize FROM panel_customers, ftp_users WHERE username = "\L" AND panel_customers.loginname = SUBSTRING_INDEX('\L', 'ftp', 1)
|
||
|
||
|
||
# Optional : ratios. The server has to be compiled with ratio support.
|
||
|
||
# MySQLGetRatioUL SELECT ULRatio FROM users WHERE User='\L'
|
||
# MySQLGetRatioDL SELECT DLRatio FROM users WHERE User='\L'
|
||
|
||
|
||
# Optional : bandwidth throttling.
|
||
# The server has to be compiled with throttling support.
|
||
# Values are in KB/s .
|
||
|
||
# MySQLGetBandwidthUL SELECT ULBandwidth FROM users WHERE User='\L'
|
||
# MySQLGetBandwidthDL SELECT DLBandwidth FROM users WHERE User='\L'
|
||
|
||
# Enable ~ expansion. NEVER ENABLE THIS BLINDLY UNLESS :
|
||
# 1) You know what you are doing.
|
||
# 2) Real and virtual users match.
|
||
|
||
# MySQLForceTildeExpansion 1
|
||
|
||
|
||
# If you're using a transactionnal storage engine, you can enable SQL
|
||
# transactions to avoid races. Leave this commented if you are using the
|
||
# traditional MyIsam engine.
|
||
|
||
# MySQLTransactions On
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<file name="/etc/pure-ftpd/conf/CustomerProof" chown="root:0"
|
||
chmod="0644">
|
||
<content><![CDATA[
|
||
1
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<file name="/etc/pure-ftpd/conf/Bind" chown="root:0"
|
||
chmod="0644">
|
||
<content><![CDATA[
|
||
21
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<file name="/etc/default/pure-ftpd-common" chown="root:0"
|
||
chmod="0644" backup="true">
|
||
<content><![CDATA[
|
||
# Configuration for pure-ftpd
|
||
# (this file is sourced by /bin/sh, edit accordingly)
|
||
|
||
# STANDALONE_OR_INETD
|
||
# valid values are "standalone" and "inetd".
|
||
# Any change here overrides the setting in debconf.
|
||
STANDALONE_OR_INETD=standalone
|
||
|
||
# VIRTUALCHROOT:
|
||
# whether to use binary with virtualchroot support
|
||
# valid values are "true" or "false"
|
||
# Any change here overrides the setting in debconf.
|
||
VIRTUALCHROOT=false
|
||
|
||
# UPLOADSCRIPT: if this is set and the daemon is run in standalone mode,
|
||
# pure-uploadscript will also be run to spawn the program given below
|
||
# for handling uploads. see /usr/share/doc/pure-ftpd/README.gz or
|
||
# pure-uploadscript(8)
|
||
|
||
# example: UPLOADSCRIPT=/usr/local/sbin/uploadhandler.pl
|
||
UPLOADSCRIPT=
|
||
|
||
# if set, pure-uploadscript will spawn running as the
|
||
# given uid and gid
|
||
UPLOADUID=
|
||
UPLOADGID=
|
||
]]>
|
||
</content>
|
||
</file>
|
||
<command><![CDATA[service pure-ftpd-mysql restart]]></command>
|
||
</daemon>
|
||
</service>
|
||
<!-- System tools/services -->
|
||
<service type="system" title="{{lng.admin.configfiles.etc}}">
|
||
<!-- Webalizer -->
|
||
<daemon name="webalizer"
|
||
title="Webalizer (traffic analyzer)">
|
||
<install><![CDATA[apt-get install webalizer]]></install>
|
||
</daemon>
|
||
<!-- goaccess -->
|
||
<daemon name="goaccess"
|
||
title="goaccess (traffic analyzer)" default="true">
|
||
<install><![CDATA[apt-get install goaccess jq]]></install>
|
||
</daemon>
|
||
<!-- AWstats -->
|
||
<daemon name="awstats"
|
||
title="Awstats (traffic analyzer)">
|
||
<install><![CDATA[apt-get install awstats]]></install>
|
||
<command><![CDATA[mv {{settings.system.awstats_conf}}/awstats.conf {{settings.system.awstats_conf}}/awstats.model.conf]]></command>
|
||
<command><![CDATA[sed -i.bak 's/^DirData/# DirData/' {{settings.system.awstats_conf}}/awstats.model.conf]]></command>
|
||
<command><![CDATA[sed -i.bak 's|^\\(DirIcons=\\).*$|\\1\\"/awstats-icon\\"|' {{settings.system.awstats_conf}}/awstats.model.conf]]></command>
|
||
<command><![CDATA[rm /etc/cron.d/awstats]]></command>
|
||
<command><![CDATA[rm /etc/logrotate.d/httpd-prerotate/awstats]]></command>
|
||
</daemon>
|
||
<!-- libnss-extrausers -->
|
||
<daemon name="libnssextrausers"
|
||
title="libnss-extrausers">
|
||
<install><![CDATA[apt-get install libnss-extrausers]]></install>
|
||
<commands index="1">
|
||
<command><![CDATA[mkdir -p /var/lib/extrausers]]></command>
|
||
<command><![CDATA[touch /var/lib/extrausers/passwd]]></command>
|
||
<command><![CDATA[touch /var/lib/extrausers/group]]></command>
|
||
<command><![CDATA[touch /var/lib/extrausers/shadow]]></command>
|
||
</commands>
|
||
<file name="/etc/nsswitch.conf" backup="true">
|
||
<content><![CDATA[
|
||
# Make sure that `passwd`, `group` and `shadow` have extrausers in their lines
|
||
# You should place extrausers at the end, so that it is queried after the other mechanisams
|
||
#
|
||
passwd: compat extrausers
|
||
group: compat extrausers
|
||
shadow: compat extrausers
|
||
|
||
hosts: files dns
|
||
networks: files dns
|
||
|
||
services: db files
|
||
protocols: db files
|
||
rpc: db files
|
||
ethers: db files
|
||
netmasks: files
|
||
netgroup: files
|
||
bootparams: files
|
||
|
||
automount: files
|
||
aliases: files
|
||
]]>
|
||
</content>
|
||
</file>
|
||
</daemon>
|
||
<!-- Logrotate -->
|
||
<daemon name="logrotate" title="Logrotate">
|
||
<install><![CDATA[apt-get install logrotate]]></install>
|
||
<file name="/etc/logrotate.d/froxlor" chown="root:root"
|
||
chmod="0644">
|
||
<content><![CDATA[
|
||
#
|
||
# Froxlor logrotate snippet
|
||
#
|
||
<CUSTOMER_LOGS>*.log {
|
||
missingok
|
||
daily
|
||
rotate 7
|
||
compress
|
||
delaycompress
|
||
notifempty
|
||
create
|
||
sharedscripts
|
||
postrotate
|
||
<WEBSERVER_RELOAD_CMD> > /dev/null 2>&1 || true
|
||
endscript
|
||
}
|
||
]]>
|
||
</content>
|
||
</file>
|
||
</daemon>
|
||
<!-- FCGID -->
|
||
<daemon name="fcgid" title="FCGID">
|
||
<install><![CDATA[apt-get install apache2-suexec-pristine libapache2-mod-fcgid php-cgi]]></install>
|
||
<command><![CDATA[a2enmod suexec fcgid]]></command>
|
||
<commands index="1">
|
||
<visibility mode="true">{{settings.system.mod_fcgid_ownvhost}}
|
||
</visibility>
|
||
<command><![CDATA[groupadd -f {{settings.system.mod_fcgid_httpgroup}}]]></command>
|
||
<command><![CDATA[useradd -s /bin/false -g {{settings.system.mod_fcgid_httpgroup}} {{settings.system.mod_fcgid_httpuser}}]]></command>
|
||
<command><![CDATA[mkdir -p {{settings.system.mod_fcgid_configdir}}]]></command>
|
||
<command><![CDATA[mkdir -p {{settings.system.mod_fcgid_tmpdir}}]]></command>
|
||
<command><![CDATA[chmod 1777 {{settings.system.mod_fcgid_tmpdir}}]]></command>
|
||
<command><![CDATA[a2dismod php8.2]]></command>
|
||
</commands>
|
||
<!-- instead of just restarting apache, we let the cronjob do all the
|
||
dirty work -->
|
||
<command><![CDATA[php {{const.install_dir}}bin/froxlor-cli froxlor:cron --force]]></command>
|
||
</daemon>
|
||
<!-- PHP-FPM -->
|
||
<daemon name="php-fpm"
|
||
title="PHP-FPM">
|
||
<install>
|
||
<visibility mode="equals" value="apache2">{{settings.system.webserver}}
|
||
</visibility>
|
||
<content><![CDATA[apt-get install apache2-suexec-pristine]]></content>
|
||
</install>
|
||
<install><![CDATA[apt-get install php-fpm]]></install>
|
||
<commands index="2">
|
||
<visibility mode="equals" value="apache2">{{settings.system.webserver}}
|
||
</visibility>
|
||
<command><![CDATA[a2enmod suexec proxy_fcgi actions]]></command>
|
||
</commands>
|
||
<commands index="3">
|
||
<visibility mode="true">{{settings.phpfpm.enabled_ownvhost}}
|
||
</visibility>
|
||
<visibility mode="usernamenotexists">{{settings.phpfpm.vhost_httpuser}}
|
||
</visibility>
|
||
<command><![CDATA[groupadd -f {{settings.phpfpm.vhost_httpgroup}}]]></command>
|
||
<command><![CDATA[useradd -s /bin/false -g {{settings.phpfpm.vhost_httpgroup}} {{settings.phpfpm.vhost_httpuser}}]]></command>
|
||
</commands>
|
||
<commands index="4">
|
||
<visibility mode="equals" value="apache2">{{settings.system.webserver}}
|
||
</visibility>
|
||
<visibility mode="true">{{settings.phpfpm.enabled_ownvhost}}
|
||
</visibility>
|
||
<command><![CDATA[a2dismod php8.2]]></command>
|
||
</commands>
|
||
<commands index="5">
|
||
<visibility mode="equals" value="apache2">{{settings.system.webserver}}
|
||
</visibility>
|
||
<command><![CDATA[a2disconf php8.2-fpm]]></command>
|
||
</commands>
|
||
<!-- instead of just restarting apache, we let the cronjob do all the
|
||
dirty work -->
|
||
<command><![CDATA[php {{const.install_dir}}bin/froxlor-cli froxlor:cron --force]]></command>
|
||
</daemon>
|
||
<!-- Cronjob -->
|
||
<daemon name="cron" title="Cronjob for froxlor"
|
||
mandatory="true">
|
||
<install><![CDATA[apt-get install cron gnupg]]></install>
|
||
<command><![CDATA[[ ! -e /usr/local/bin/froxlor-cli ] && ln -s <BASE_PATH>bin/froxlor-cli /usr/local/bin/froxlor-cli]]></command>
|
||
<command><![CDATA[/usr/bin/php <BASE_PATH>bin/froxlor-cli froxlor:cron --run-task 99]]></command>
|
||
<command><![CDATA[{{settings.system.crondreload}}]]></command>
|
||
</daemon>
|
||
</service>
|
||
</services>
|
||
</distribution>
|
||
</froxlor>
|