Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I see a lot of the time that the same settings can be specified in both main.cf, and also in master.cf using the -o prefix.

My question is, does one override the other, and if so, which file is given priority if the same setting (with a different value) is found in both?

For instance, if

smtpd_tls_auth_only=yes

was specified in main.cf, but

-o smtpd_tls_auth_only=no 

was specified in master.cf, which one would postfix pay attention to?

share|improve this question

2 Answers 2

up vote 5 down vote accepted

As documented,

-o name=value
                 Override  the  named  main.cf  configuration
                 parameter.

main.cf sets the default values used by all services defined in master.cf; -o options in master.cf can override these on a per-service basis.

share|improve this answer
    
Aha! So it is in black and white. I just didn't read far enough in to it. :-/ –  FoxInSocks Jan 4 '13 at 10:55

Basically settings in main.cf are valid and used globally unless they are overridden in master.cf for specific Postfix daemons (smtpd, trivial-rewrite, cleanup, pickup, ...). You may specify, for example, smtp_tls_security_level = may in main.cf and disable it for the submission port bound to localhost for the smtpd daemon:

localhost:submission inet n       -       -       -       -       smtpd
  -o smtpd_tls_security_level=none

But for the submission port on an external IP address you may enforce encryption:

1.2.3.4:submission inet n       -       -       -       -       smtpd
  -o smtpd_tls_security_level=encrypt
  -o ...

In certain situations you might have to override a global setting, for example when using Amavisd, address mappings (alias expansion, etc) need to be disabled when sending mail through the Amavisd smtpd daemon. Otherwise recipients might receive duplicate messages:

127.0.0.1:10025 inet    n       -       -       -       -       smtpd
  -o content_filter=
  -o ...
  -o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_address_mappings
  -o ...

Of course, during regular operation, outside of Amavis, you want address mappings, so by default they are enabled in main.cf.

share|improve this answer
1  
You cannot simply set a new IP:port for a service; this creates a second instance of the service, with the same name (potentially confusing), and is more than likely outside the OPs purview. If you do duplicate services, always set -o syslog_name=secondservice to distinguish the service in your logs. –  adaptr Jan 4 '13 at 10:43
    
Thanks for the comment, but I am well aware of that. Multiple instances of services are necessary when hosting multiple domains with different SSL certificates and therefore different IP addresses. I simply gave a real-world example where one would override settings from main.cf in master.cf. –  daff Jan 4 '13 at 12:36
    
It didn't answer the OP's question, and did not include the syslog_name change I explained above. I'd not consider this "real-world" and fail to see where "SSL certificates" enter into it. –  adaptr Jan 4 '13 at 14:10
    
I answerd OP's question in my first sentence. And yes, it is a real-world example, taken from one of our Postfix servers hosting 18 domains. "SSL certificates" enter into it since there is no such thing as SSL name-based virtual hosting in Postfix (in practice), so one needs to assign one IP address per domain. Otherwise there is no way to present correct SSL certificates to clients. To do that multiple instances of the smtpd service are needed, each with different settings for myhostname, smtpd_tls_key_file, smtpd_tls_cert_file and so on. Those settings are overrides of main.cf. –  daff Jan 4 '13 at 15:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.