26 lines
1.0 KiB
Bash
26 lines
1.0 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# Postfix policy: reject mode (hard reject)
|
|
# Requires root privileges to update main.cf and reload Postfix.
|
|
|
|
run_as_root() {
|
|
if [[ "${EUID}" -eq 0 ]]; then
|
|
"$@"
|
|
else
|
|
sudo "$@"
|
|
fi
|
|
}
|
|
|
|
echo "[INFO] Switching Postfix policy to REJECT mode (hard reject)..."
|
|
|
|
run_as_root postconf -e "smtpd_recipient_restrictions=check_sender_access regexp:/etc/postfix/sender_domain_policy.regexp, reject"
|
|
run_as_root postconf -e "sender_in_allowed_domain_gate=check_recipient_access regexp:/etc/postfix/allowed_rcpt_domains.regexp, check_sender_access hash:/etc/postfix/allowed_external_senders, reject"
|
|
run_as_root postconf -e "sender_outside_allowed_domain_gate=check_recipient_access hash:/etc/postfix/rcpt_access, check_recipient_access regexp:/etc/postfix/rcpt_domain_policy.regexp, reject"
|
|
|
|
run_as_root postfix check
|
|
run_as_root postfix reload
|
|
|
|
echo "[OK] Switched to REJECT mode."
|
|
run_as_root postconf -n | grep -E '^(smtpd_recipient_restrictions|sender_in_allowed_domain_gate|sender_outside_allowed_domain_gate) = '
|