Chris Turan a écrit :
> Hey All,
>
> Thanks to all for the suggestions so far. I've enabled RBL looks on my
> MX gateways using the the tips so far. I have to report an overwhelming
> success. Nearly all of my spam is blocked in the SMTP transaction. Very
> few spams make it past smtp and spamassassin cleans up the rest.
>
> I'd like to ask for a few more tips. Here's my config:
>
> smtpd_helo_restrictions =
> permit_mynetworks,
> reject_invalid_helo_hostname,
> reject_non_fqdn_helo_hostname,
> permit
> smtpd_client_restrictions =
> permit_mynetworks,
> reject_non_fqdn_hostname,
> permit
> smtpd_sender_restrictions =
> permit_mynetworks,
> reject_non_fqdn_sender,
> reject_unknown_sender_domain,
> permit
> smtpd_recipient_restrictions =
> permit_mynetworks,
> reject_unauth_destination,
> reject_unlisted_recipient,
> reject_non_fqdn_recipient,
> reject_rbl_client zen.spamhaus.org,
> permit
> smtpd_data_restrictions =
> permit_mynetworks,
> reject_unauth_pipelining,
> permit
>
> Here are the questions I have:
>
> 1) I have permit_mynetworks defined in each of the restrictions. I'm
> not entirely sure how these are parsed so I put them in all. Should I
> have it in all of them or just pick one.
>
> 2) I stuck a reject_unlisted_recipient in my recipient restrictions to
> cut down on unneeded RBL lookups on non-existant addresses. Any other
> recommendations to keep from going out to the RBL servers excessively?
>
> 3) I'd like to turn off rbl lookups on a few specific recipient
> addresses. Specifically, I'd like to allow e-mail to postmaster@ and to
> abuse@ regardless of who sends it. Any suggestions on a good way to do
> this? I'm thinking of using check_recipient_access.
>
> 4) I'm using both Pyzor and Razor in my spamassassin config. Are there
> any other recommended RBL I can consider for use either in postfix or
> spamassassin?
>
here is an example setup (I insist on "example").
smtpd_client_restrictions =
smtpd_helo_restrictions =
smtpd_sender_restrictions =
smtpd_recipient_restrictions =
reject_non_fqdn_recipient
reject_non_fqdn_sender
permit_mynetworks
reject_unauth_destination
### address format check
check_recipient_access pcre:/etc/postfix/access_address
check_sender_access pcre:/etc/postfix/access_address
### address validation
reject_unlisted_recipient
reject_unlisted_sender
### recipient preferences
check_recipient_access hash:/etc/postfix/access_recipient
### client acl
check_client_access cidr:/etc/postfix/access_client
### sender acl
#check_sender_access hash:/etc/postfix/access_sender
### DNSWL
check_client_access cidr:/var/db/dnswl/postfix-dnswl-permit
### helo checks
reject_invalid_helo_hostname
reject_non_fqdn_helo_hostname
check_helo_access hash:/etc/postfix/access_helo
check_helo_access pcre:/etc/postfix/access_helo.pcre
### "host" checks
check_helo_access hash:/etc/postfix/access_host
check_reverse_client_hostname_access hash:/etc/postfix/access_host
### sender NS/MX
reject_unknown_sender_domain
check_sender_mx_access cidr:/etc/postfix/access_sender_mx
### DNSBL
reject_rbl_client zen.spamhaus.org
### other DNSBLs
warn_if_reject reject_rbl_client bl.spamcop.net
warn_if_reject reject_rbl_client psbl.surriel.com
warn_if_reject reject_rbl_client b.barracudacentral.org
warn_if_reject reject_rbl_client safe.dnsbl.sorbs.net
warn_if_reject reject_rbl_client korea.services.net
### log accepted transaction
check_reverse_client_hostname_access pcre:/etc/postfix/access_log
smtpd_restriction_classes =
...
greylist
...
greylist =
check_policy_service inet:127.0.0.1:12345
smtpd_data_restrictions =
reject_unauth_pipelining
Example files below. but few notes before that:
- check_reverse_client_hostname_access requires a recent postfix. if
your doesn't support it, replace with check_client_access (but don't put
an OK in the map).
- the last check (access_log) will generate a log for accepted
transactions. This log will include the HELO argument, so you can later
check if you can harden your helo checks safely or not. if you have
check_reverse_client_hostname_access, it will also log the PTR so that
you don't need to search for it otherwise (you can actually find it in
other warning logs).
- Don't ask me my opinion about the DNSBLs above except zen. use them
with warn_if_reject for some time and you'll see if they are worth the
trouble...
- this is an example, nothing more than an example. you need to
understand what every check does and see if you want to use it.
== access_address:
#[^[:ascii:]]/ REJECT Invalid address (non ascii)
#/^(trappatt...@example\.com)$/ PREPEND X-Trap: trap hit ($1)
== access_recipient
[email protected] OK
[email protected] OK
[email protected] OK
== access_client
# whitelisted networks:
192.0.2.0/24 OK
# blacklisted networks
10.1.2.3 REJECT client blacklisted blah blah
# clients we want to greylist
192.0.2.0/24 greylist
== access_sender
# sender ACLs are not recommended. They require maintenance and
# the sender address is easily forged...
# whitelisting
# WARNING sender address is easily forged.
# only use if really necessary
[email protected] OK
# blacklist
[email protected] REJECT sender blocked
== access_helo
[192.0.2.3] REJECT helo with my own IP ([192.0.2.3]
example.com REJECT helo with my own domain (example.com)
.example.com REJECT helo with my own domain (*.example.com)
== access_helo.pcre
/^\[/ reject_unknown_client
#/^\[/ reject_unknown_client, greylist
#/^\[/ REJECT literal IP no more accepted
#/^\d+([-\.]\d+){3}/ REJECT dynamic-like helo name
#...
== access_host
#.dynamic.hinet.net REJECT Domain blocked
#.dynamic.163data.com.cn REJECT Domain blocked
#.dynamic.seed.net.tw REJECT Domain blocked
#.dynamic.tfn.net.tw REJECT Domain blocked
#.dyn.etb.net.co REJECT Domain blocked
#.dyn.centurytel.net REJECT Domain blocked
#.revip2.asianet.co.th REJECT Domain blocked
#.dip0.t-ipconnect.de REJECT Domain blocked
#.user.veloxzone.com.br REJECT Domain blocked
#.dialup.mgts.by REJECT Domain blocked
...
== access_sender_mx
10.0.0.0/8 REJECT bad MX (10/8)
192.168.0.0/16 REJECT bad MX (192.168/16)
172.16.0.0/12 REJECT bad MX (172.16/12)
169.254.0.0/16 REJECT bad MX (169/254/16)
127.0.0.0/8 REJECT bad MX (127/8)
0.0.0.0/8 REJECT bad MX (0/8)
224.0.0.0/4 REJECT bad MX (224/4)
#
#192.0.2.0/24 REJECT MX of known spammer
== /var/db/dnswl/postfix-dnswl-permit
use rsync to get this. see www.dnswl.org
== access_log
/(.*)/ WARN Transaction logged: PTR=$1
