From 3f1e07dd89d4448acca8b874a9e2ebcc88579ec8 Mon Sep 17 00:00:00 2001 From: Michal Konecny Date: Wed, 22 Apr 2026 12:42:17 +0200 Subject: [PATCH] [postfix] Obfuscate the IP on smtp-auth server This will update configuration to clean Received header from e-mail forwarded by smtp-auth-iso01 server to prevent leaking of internal IPs. See https://forge.fedoraproject.org/infra/tickets/issues/12835 Signed-off-by: Michal Konecny --- .../postfix/header_checks_submission.smtp-auth | 2 ++ ...aster.cf.smtp-auth-iso01.rdu3.fedoraproject.org | 5 +++++ roles/base/tasks/postfix.yml | 14 ++++++++++++++ 3 files changed, 21 insertions(+) create mode 100644 roles/base/files/postfix/header_checks_submission.smtp-auth diff --git a/roles/base/files/postfix/header_checks_submission.smtp-auth b/roles/base/files/postfix/header_checks_submission.smtp-auth new file mode 100644 index 0000000000..54be7b608e --- /dev/null +++ b/roles/base/files/postfix/header_checks_submission.smtp-auth @@ -0,0 +1,2 @@ +# Remove the received header before forwarding e-mail +/^Received: .*/ IGNORE diff --git a/roles/base/files/postfix/master.cf/master.cf.smtp-auth-iso01.rdu3.fedoraproject.org b/roles/base/files/postfix/master.cf/master.cf.smtp-auth-iso01.rdu3.fedoraproject.org index fc602a7f78..13b4d0f81e 100644 --- a/roles/base/files/postfix/master.cf/master.cf.smtp-auth-iso01.rdu3.fedoraproject.org +++ b/roles/base/files/postfix/master.cf/master.cf.smtp-auth-iso01.rdu3.fedoraproject.org @@ -11,9 +11,14 @@ submission inet n - n - - smtpd -o smtpd_enforce_tls=yes -o smtpd_sasl_auth_enable=yes -o smtpd_client_restrictions=permit_sasl_authenticated,reject + -o cleanup_service_name=ascleanup #628 inet n - n - - qmqpd pickup fifo n - n 60 1 pickup cleanup unix n - n - 0 cleanup +ascleanup unix n - y - 0 cleanup + -o header_checks=pcre:/etc/postfix/header_checks_submission + -o mime_header_checks= + -o nested_header_checks= qmgr fifo n - n 300 1 qmgr #qmgr fifo n - n 300 1 oqmgr tlsmgr unix - - n 1000? 1 tlsmgr diff --git a/roles/base/tasks/postfix.yml b/roles/base/tasks/postfix.yml index 156064cf18..6f4dcf57f2 100644 --- a/roles/base/tasks/postfix.yml +++ b/roles/base/tasks/postfix.yml @@ -4,6 +4,7 @@ state: present name: - postfix + - postfix-pcre tags: - postfix @@ -69,6 +70,19 @@ - config - base +- name: Install /etc/postfix/header_checks_submission file + ansible.builtin.copy: + src: postfix/header_checks_submission.smtp-auth + dest: /etc/postfix/header_checks_submission + mode: "0644" + when: inventory_hostname.startswith("smtp-auth") + notify: + - Restart postfix + tags: + - postfix + - config + - base + - name: Deploy sender_access file ansible.builtin.copy: src: "{{ private }}/files/smtpd/sender_access.{{ postfix_group }}"