Hardening postfix by default

Kosta

Hello,

Can I suggest 2 lines of code to be added to main.cf file as default when we provision mail role to our servers please, so out of the box to be hardened the security on mail servers by default
I was trying to pass PCI dss and I’ve been told to put this codes…

Thanks

disable_vrfy = yes
disable_expn = yes

franco

To disable in Ubuntu 24.04 just run:

postconf -e disable_vrfy_command=yes
sudo postfix reload

Kosta

franco I know! I don’t need this I need secure mail role provision out of the box! I am not with enhance to be all day long into the terminals!
Read again what I am suggesting!

Kosta

franco and I believe need to be used systemctl restart!

franco

Kosta

disable_vrfy = yes
disable_expn = yes

The disable_expn parameter does not exist in Postfix 3.8.6. It will have no effect and may generate an error message, since Postfix does not recognize this parameter.

The correct parameter in Postfix is disable_vrfy_command, not disable_vrfy

And stop being ignorant. I'm just trying to help, horse.

Kosta

franco
After running postconf -e disable_vrfy_command=yes and restart postfix the following gets added into main.cf

myorigin = $myhostname
mydomain = $myhostname
disable_vrfy = yes

Kosta

franco one like would help more than not reading or not understanding my post!