20

I see a lot of the time that the same settings can be specified in both main.cf, and also in master.cf using the -o prefix.

My question is, does one override the other, and if so, which file is given priority if the same setting (with a different value) is found in both?

For instance, if 

smtpd_tls_auth_only=yes

was specified in main.cf, but 

-o smtpd_tls_auth_only=no

was specified in master.cf, which one would postfix pay attention to?

Improve this question

2 Answers 2

Reset to default
18

As documented, 

-o name=value
                 Override  the  named  main.cf  configuration
                 parameter.

main.cf sets the default values used by all services defined in master.cf; -o options in master.cf can override these on a per-service basis.

Improve this answer
0
7

Basically settings in main.cf are valid and used globally unless they are overridden in master.cf for specific Postfix daemons (smtpd, trivial-rewrite, cleanup, pickup, ...). You may specify, for example, smtp_tls_security_level = may in main.cf and disable it for the submission port bound to localhost for the smtpd daemon:

localhost:submission inet n       -       -       -       -       smtpd
  -o smtpd_tls_security_level=none

But for the submission port on an external IP address you may enforce encryption:

1.2.3.4:submission inet n       -       -       -       -       smtpd
  -o smtpd_tls_security_level=encrypt
  -o ...

In certain situations you might have to override a global setting, for example when using Amavisd, address mappings (alias expansion, etc) need to be disabled when sending mail through the Amavisd smtpd daemon. Otherwise recipients might receive duplicate messages:

127.0.0.1:10025 inet    n       -       -       -       -       smtpd
  -o content_filter=
  -o ...
  -o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_address_mappings
  -o ...

Of course, during regular operation, outside of Amavis, you want address mappings, so by default they are enabled in main.cf.

Improve this answer
4
  • 1
    You cannot simply set a new IP:port for a service; this creates a second instance of the service, with the same name (potentially confusing), and is more than likely outside the OPs purview. If you do duplicate services, always set -o syslog_name=secondservice to distinguish the service in your logs.
    – adaptr
    Jan 4, 2013 at 10:43
  • Thanks for the comment, but I am well aware of that. Multiple instances of services are necessary when hosting multiple domains with different SSL certificates and therefore different IP addresses. I simply gave a real-world example where one would override settings from main.cf in master.cf.
    – daff
    Jan 4, 2013 at 12:36
  • It didn't answer the OP's question, and did not include the syslog_name change I explained above. I'd not consider this "real-world" and fail to see where "SSL certificates" enter into it.
    – adaptr
    Jan 4, 2013 at 14:10
  • 1
    I answerd OP's question in my first sentence. And yes, it is a real-world example, taken from one of our Postfix servers hosting 18 domains. "SSL certificates" enter into it since there is no such thing as SSL name-based virtual hosting in Postfix (in practice), so one needs to assign one IP address per domain. Otherwise there is no way to present correct SSL certificates to clients. To do that multiple instances of the smtpd service are needed, each with different settings for myhostname, smtpd_tls_key_file, smtpd_tls_cert_file and so on. Those settings are overrides of main.cf.
    – daff
    Jan 4, 2013 at 15:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .