diff -r 0ba300bdf30a -r 6539a982f682 postfix/postfix.txt --- a/postfix/postfix.txt Mon Apr 20 19:22:00 2009 +0200 +++ b/postfix/postfix.txt Mon Apr 20 19:23:01 2009 +0200 @@ -22,6 +22,9 @@ T_RELOCATED = relocated T_TRANSPORT = transport T_ALIASES = aliases +T_CLIENTS = clients +T_SENDERS = senders +T_FINGERP = fingerprints # dependency tracking TIMESTAMP = .up-to-date @@ -37,7 +40,10 @@ $(T_VIRTUAL).db \ $(T_RELOCATED).db \ $(T_TRANSPORT).db \ - $(T_ALIASES).db + $(T_ALIASES).db \ + $(T_CLIENTS).db \ + $(T_SENDERS).db \ + $(T_FINGERP).db # default target all: $(TABLES) $(TIMESTAMP) @@ -67,6 +73,12 @@ $(POSTMAP) hash:$(T_TRANSPORT) $(T_ALIASES).db: $(T_ALIASES) $(MAKEFILE) $(POSTALIAS) hash:$(T_ALIASES) +$(T_CLIENTS).db: $(T_CLIENTS) $(MAKEFILE) + $(POSTMAP) hash:$(T_CLIENTS) +$(T_SENDERS).db: $(T_SENDERS) $(MAKEFILE) + $(POSTMAP) hash:$(T_SENDERS) +$(T_FINGERP).db: $(T_FINGERP) $(MAKEFILE) + $(POSTMAP) hash:$(T_FINGERP) # cleanup target clean: @@ -116,6 +128,7 @@ scache unix - - n - 1 scache #maildrop unix - n n - - pipe flags=DRhu user=@l_nusr@ argv=@l_prefix@/bin/maildrop -d ${recipient} #cyrus unix - n n - - pipe user=@l_nusr@ argv=@l_prefix@/bin/cyrdeliver -e -r ${sender} -m ${extension} ${user} +#dovecot unix - n n - - pipe flags=DR user=opmi-r argv=/opmi/libexec/dovecot/deliver -f ${sender} -d ${user} -n -m ${extension} #uucp unix - n n - - pipe flags=Fqhu user=@l_nusr@ argv=@l_prefix@/bin/uux -r -n -z -a$sender - $nexthop!rmail ($recipient) #ifmail unix - n n - - pipe flags=F user=@l_nusr@ argv=@l_prefix@/bin/ifmail -r $nexthop ($recipient) #bsmtp unix - n n - - pipe flags=Fq. user=@l_nusr@ argv=@l_prefix@/bin/bsmtp -f $sender $nexthop $recipient @@ -338,3 +351,20 @@ # | .example.com smtp:mail.example.com + +## +## @l_prefix@/etc/postfix/fingerprints -- user identity verification +## +## Searched for user names matching TLS certificate fingerprints +## when a client responding to the MTA's client certificate request +## presents a valid (signed from proper CA) certificate. +## +## To find such fingerprints given a valid client certificate: +## @l_prefix@/bin/openssl x509 -noout -fingerprint -sha1 -in certfile.pem +## + +# Examples: +# | B8:B8:A8:AE:B8:2A:2B:74:EC:43:FF:4F:B2:B2:AC:1E:B4:CE:26:1D +# | 18:81:F5:22:18:BA:EB:15:FF:40:30:00:EA:C0:B4:2E:EC:AE:86:8E + +