Postfix Hardening

Make sure the Postfix is running with non-root account:
root@Philip:~#ps aux | grep postfix | grep -v ‘^root’

Change permissions and ownership on the destinations below:
root@Philip:~#chmod 755 /etc/postfix
root@Philip:~#chmod 644 /etc/postfix/*.cf
root@Philip:~#chmod 755 /etc/postfix/postfix-script*
root@Philip:~#chmod 755 /var/spool/postfix
root@Philip:~#chown root:root /var/log/mail*
root@Philip:~#chmod 600 /var/log/mail*

Edit file /etc/postfix/main.cf and add if necessary check & make the following changes:Modify the myhostname value to correspond to the external fully qualified domain name (FQDN) of the Postfix server, for example:
myhostname = mx.kanyakonil.com


Configure network interface addresses that the Postfix service should listen on, for example:
inet_interfaces = 192.168.1.1

Configure Trusted Networks, for example:
mynetworks = 10.0.0.0/16, 192.168.1.0/24, 127.0.0.1

Configure the SMTP server to masquerade outgoing emails as coming from your DNS domain, for example:
myorigin = kanyakonil.com

Configure the SMTP domain destination, for example:
mydomain = kanyakonil.com

Configure to which SMTP domains to relay messages to, for example:
relay_domains = kanyakonil.com

Configure SMTP Greeting Banner:
smtpd_banner = $myhostname

Limit Denial of Service Attacks:
default_process_limit = 100
smtpd_client_connection_count_limit = 10
smtpd_client_connection_rate_limit = 30
queue_minfree = 20971520
header_size_limit = 51200
message_size_limit = 10485760
smtpd_recipient_limit = 100

Restart the Postfix daemon:
service postfix restart

This entry was posted in Linux, Mail server, Postfix and tagged , . Bookmark the permalink.

Leave a Reply

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.