DEBOPS.POSTSCREEN(5)

NAME
debops.postscreen - Manage Postscreen Postfix service using Ansible

SYNOPSIS

debops run service/postscreen [--limit group,host,...] [--diff] [--check] [--tags tag1,tag2,...] [--skip-tags tag1,tag2,...] [<ansible-playbook options>] ...

DESCRIPTION

The Postscreen <http://www.postfix.org/POSTSCREEN_README.html> Postfix service can be enabled to filter out undesired SMTP clients on initial connection to the mail server. Postscreen uses certain criteria (static white/blacklist, DNS Block List queries, communication analysis) to allow or deny connections for a given SMTP client.

This role can be used to enable and configure Postscreen in a Postfix installation managed by the debops.postfix Ansible role. It does not configure Postfix directly on its own.

GETTING STARTED

  Default configuration

By default Postscreen will enable the DNS Blocklists if the host has public IPv4/IPv6 addresses. The DNS Blocklists will be disabled on private networks.

Most of the Postfix configuration is defined in the dependent variables, you can change the configuration through the inventory directly. Check the debops.postfix documentation to see how to do this.

  Example inventory

To install and configure Postscreen on a host, it needs to be present in the [debops_service_postscreen] Ansible inventory group. The Postfix server should also be configured beforehand.

[debops_service_postfix]
hostname
[debops_service_postscreen]
hostname

  Example playbook

If you are using this role without DebOps, here's an example Ansible playbook that uses the debops.postscreen role:

---
- name: Manage Postfix postscreen configuration
  collections: [ 'debops.debops', 'debops.roles01',
                 'debops.roles02', 'debops.roles03' ]
  hosts: [ 'debops_service_postscreen' ]
  become: True
  environment: '{{ inventory__environment | d({})
                   | combine(inventory__group_environment | d({}))
                   | combine(inventory__host_environment  | d({})) }}'
  pre_tasks:
    - name: Prepare postfix environment
      ansible.builtin.import_role:
        name: 'postfix'
        tasks_from: 'main_env'
      vars:
        postfix__dependent_packages:
          - '{{ postscreen__postfix__dependent_packages }}'
        postfix__dependent_maincf:
          - role: 'postscreen'
            config: '{{ postscreen__postfix__dependent_maincf }}'
        postfix__dependent_mastercf:
          - role: 'postscreen'
            config: '{{ postscreen__postfix__dependent_mastercf }}'
      tags: [ 'role::postfix', 'role::secret' ]
  roles:
    - role: secret
      tags: [ 'role::secret', 'role::postfix' ]
      secret__directories:
        - '{{ postfix__secret__directories }}'
    - role: postfix
      tags: [ 'role::postfix', 'skip::postfix' ]
      postfix__dependent_packages:
        - '{{ postscreen__postfix__dependent_packages }}'
      postfix__dependent_maincf:
        - role: 'postscreen'
          config: '{{ postscreen__postfix__dependent_maincf }}'
      postfix__dependent_mastercf:
        - role: 'postscreen'
          config: '{{ postscreen__postfix__dependent_mastercf }}'
    - role: postscreen
      tags: [ 'role::postscreen', 'skip::postscreen' ]

Keep in mind that the default Postscreen playbook does not configure firewall access for Postfix. You still need to use the Postfix playbook to configure the server instance initially.

DEFAULT VARIABLE DETAILS

some of debops.postscreen default variables have more extensive configuration than simple strings or lists, here you can find documentation and examples for them.

  postscreen__access

This is a list of IP addresses or CIDR subnets which can be statically whitelisted or blacklisted in Postscreen. Entries are processed in order of appearance. If a list entry is a string, the given entry will be whitelisted. Otherwise, you can specify an entry as a YAML dictionary with specific keys:

name, cidr
    Required. The IP address or CIDR subnet to manage in the access list.

state
    Optional. If not specified or present, a given entry will be present in the access list. If absent, a given entry will be removed from the access list.

action, value
    Optional. If permit, a given client will be immediately accepted by Postscreen. If reject, a given client will be disconnected by Postscreen. if dunno, the accept/reject decision will be left to further checks by Postscreen. If action is not specified, by default the entry use the permit action.

comment
    Optional. String or YAML text block with a comment about a given entry.

  Examples

Allow client connections from private RFC 1918 subnets, except specific addresses:

postscreen__access:
  - name: '10.0.0.1'
    action: 'dunno'
    comment: 'Local gateway'
  - '10.0.0.0/8'
  - '172.16.0.0/12'
  - '192.168.0.0/16'

  postscreen__dnsbl_reply_pcre_map

This list contains regular expressions that specify the DNS blocklists. When Postscreen checks the client's IP address against DNS blocklists and a client is blocked, Postscreen rejects the client's connection with a message. This list can be used to define what message is sent to the client after it has been blocked by Postscreen.

You can specify list entries as PCRE regular expressions, in that case they will use the default response defined in the postscreen__dnsbl_default_reply. Alternatively, you can specify entries as YAML dictionaries with specific parameters:

name, pcre
    Required. A regular expression that identifies a DNS Blocklist.

value, reply
    Optional. A string that specifies the response sent to the client when its connection is blocked by a given DNS Blocklist.

state
    Optional. If not specified or present, a given entry will be added in the configuration file. If absent, a given entry will be removed from the configuration file.

comment
    Optional. String or YAML text block with a comment for a given entry.

  Examples

Define a custom response for a RBL:

postscreen__dnsbl_reply_pcre_map:
  - pcre: '/^rbl\.example\.org$/'
    reply: 'Blocked by a DNS RBL'

AUTHOR
Maciej Delmanowski

COPYRIGHT
2014-2024, Maciej Delmanowski, Nick Janetakis, Robin Schneider and others