I am setting up a new VPS server with LEMP. The only piece missing now is the mail server. Do I need to do something special to make it secure? or it is already secured when the installation is completed?

I think the right term is hardening postfix, does it make sense?

up vote 23 down vote accepted

There are a lot of guides online regarding the config and steps for 'hardening' postfix.

This one courtesy of http://security-24-7.com/hardening-guide-for-postfix-2-x/

Hardening guide for Postfix 2.x

Make sure the Postfix is running with non-root account:

ps aux | grep postfix | grep -v '^root'

Change permissions and ownership on the destinations below:

chmod 755 /etc/postfix
chmod 644 /etc/postfix/*.cf
chmod 755 /etc/postfix/postfix-script*
chmod 755 /var/spool/postfix
chown root:root /var/log/mail*
chmod 600 /var/log/mail*

Edit using nano or vi, the file /etc/postfix/main.cf and add make the following changes: Modify the myhostname value to correspond to the external fully qualified domain name (FQDN) of the Postfix server, for example:

myhostname = myserver.example.com

Configure network interface addresses that the Postfix service should listen on, for example:

inet_interfaces = 192.168.1.1

Configure Trusted Networks, for example:

mynetworks = 10.0.0.0/16, 192.168.1.0/24, 127.0.0.1

Configure the SMTP server to masquerade outgoing emails as coming from your DNS domain, for example:

myorigin = example.com

Configure the SMTP domain destination, for example:

mydomain = example.com

Configure to which SMTP domains to relay messages to, for example:

relay_domains = example.com

Configure SMTP Greeting Banner:

smtpd_banner = $myhostname

Limit Denial of Service Attacks:

default_process_limit = 100
smtpd_client_connection_count_limit = 10
smtpd_client_connection_rate_limit = 30
queue_minfree = 20971520
header_size_limit = 51200
message_size_limit = 10485760
smtpd_recipient_limit = 100

Restart the Postfix daemon:

service postfix restart
  • 1
    very impressive, tks – Timmy Feb 8 '14 at 23:59
  • 5
    I also think that you should include disabling the VRFY command so that usernames cannot be easily enumerated. postconf -ev disable_vrfy_command=yes – Mark S. Jan 29 '15 at 17:28
  • 1
    Note that /usr/lib/postfix/sbin/master process can run as root and that's ok - see security.stackexchange.com/questions/71922 – Jan Żankowski Jun 19 '17 at 7:13

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.