--On October 10, 2012 7:12:19 AM -0400 Wietse Venema <wie...@porcupine.org>
wrote:
The Stovebolt Geek:
Recently I found out about postscreen on this list. After reading about
it, I implemented it in pretty much the default configuration (copied
below.)
postscreen_bare_newline_action = ignore
postscreen_bare_newline_enable = no
postscreen_blacklist_action = ignore
postscreen_dnsbl_action = ignore
postscreen_greet_action = ignore
postscreen_non_smtp_command_action = drop
postscreen_non_smtp_command_enable = no
postscreen_pipelining_action = enforce
postscreen_pipelining_enable = no
This means postscreen blocks nothing. All it does is send half a
greeting banner and wait 6s. I would not expect that to make
a major difference in the amount of mail handled by your server.
Did you actually look at the maillog file? You should see lots
of clients hanging up without sending mail.
I looked at the maillog and didn't see anything out of the ordinary.
Here's an egrep of the log:
# egrep '(error|fail|warn)' /var/log/maillog
Oct 10 00:16:09 mail postfix/smtpd[71817]: warning: hostname
tail.rpdevco.com does not resolve to address 173.232.29.122
Oct 10 00:16:12 mail postfix/smtpd[71817]: warning: hostname
tail.rpdevco.com does not resolve to address 173.232.29.122
Oct 10 00:20:30 mail postfix/smtpd[71827]: warning: hostname
dynamic-ip-adsl-190.186.20.68.cotas.com.bo does not resolve to address
190.186.20.68: hostname nor servname provided, or not known
Oct 10 01:20:35 mail postfix/smtpd[72056]: warning: hostname tw7.com7.tw
does not resolve to address 184.82.169.124: hostname nor servname provided,
or not known
Oct 10 01:25:12 mail postfix/policyd-weight[6870]: decided action=550
temporarily blocked because of previous errors - retrying too fast.
penalty: 30 seconds x 0 retries.; <client=unknown[220.152.169.130]>
<helo=126.com> <from=rtyrdudthfffx...@126.com>
<to=fromfrontp...@stovebolt.com>; delay: 0s
Oct 10 01:25:12 mail postfix/smtpd[72085]: NOQUEUE: reject: RCPT from
unknown[220.152.169.130]: 550 5.7.1 <fromfrontp...@stovebolt.com>:
Recipient address rejected: temporarily blocked because of previous errors
- retrying too fast. penalty: 30 seconds x 0 retries.;
from=<rtyrdudthfffx...@126.com> to=<fromfrontp...@stovebolt.com>
proto=ESMTP helo=<126.com>
Oct 10 01:33:02 mail postfix/smtpd[72115]: warning: hostname
177.132.27.90.dynamic.adsl.gvt.net.br does not resolve to address
177.132.27.90: hostname nor servname provided, or not known
Oct 10 01:51:51 mail postfix/smtpd[72146]: warning: hostname
190-51-206-57.speedy.com.ar does not resolve to address 190.51.206.57:
hostname nor servname provided, or not known
Oct 10 01:53:53 mail postfix/smtpd[72146]: warning: hostname
190-51-206-57.speedy.com.ar does not resolve to address 190.51.206.57:
hostname nor servname provided, or not known
Oct 10 01:53:55 mail postfix/policyd-weight[6870]: decided action=550
temporarily blocked because of previous errors - retrying too fast.
penalty: 30 seconds x 0 retries.; <client=unknown[190.51.206.57]>
<helo=[190.51.206.57]> <from=nathanaelfeint...@optusnet.com.au>
<to=edi...@stovebolt.com>; delay: 0s
Oct 10 01:53:55 mail postfix/smtpd[72146]: NOQUEUE: reject: RCPT from
unknown[190.51.206.57]: 550 5.7.1 <edi...@stovebolt.com>: Recipient address
rejected: temporarily blocked because of previous errors - retrying too
fast. penalty: 30 seconds x 0 retries.;
from=<nathanaelfeint...@optusnet.com.au> to=<edi...@stovebolt.com>
proto=ESMTP helo=<[190.51.206.57]>
Oct 10 01:58:51 mail postfix/smtpd[72181]: warning: hostname
190-51-206-57.speedy.com.ar does not resolve to address 190.51.206.57:
hostname nor servname provided, or not known
Oct 10 02:00:33 mail postfix/smtpd[72181]: warning: hostname
customer-187-157-143-94-sta.uninet-ide.com.mx does not resolve to address
187.157.143.94: hostname nor servname provided, or not known
Oct 10 02:33:33 mail postfix/smtp[72330]: warning: numeric domain name in
resource data of MX record for bettynbud.com: 76.167.181.36
Oct 10 02:45:48 mail postfix/smtpd[72379]: warning: hostname
35.30.32.125.adsl-pool.jlccptt.net.cn does not resolve to address
125.32.30.35: hostname nor servname provided, or not known
Oct 10 03:05:33 mail postfix/smtpd[72525]: warning: hostname
Charls-60-10.pacenet-india.com does not resolve to address 210.89.60.10:
hostname nor servname provided, or not known
Oct 10 03:06:28 mail postfix/smtpd[72525]: warning: hostname
static.23.40.64.95.buh.evh.ro does not resolve to address 95.64.40.23:
hostname nor servname provided, or not known
Oct 10 04:16:28 mail postfix/smtpd[78621]: warning: hostname
box01.nflk1ck0ff.com does not resolve to address 94.242.224.77: hostname
nor servname provided, or not known
Oct 10 04:26:22 mail postfix/smtpd[78660]: warning: hostname
server-plesk.lumomm.nl does not resolve to address 195.184.64.30
Oct 10 04:33:45 mail postfix/smtpd[78700]: warning: hostname
static.23.40.64.95.buh.evh.ro does not resolve to address 95.64.40.23:
hostname nor servname provided, or not known
Oct 10 05:14:47 mail postfix/smtpd[78851]: warning: hostname
184-82-187-247.static.hostnoc.net does not resolve to address
184.82.187.247: hostname nor servname provided, or not known
Oct 10 05:44:42 mail postfix/smtpd[78937]: warning: hostname
www.semtoolroom.com does not resolve to address 72.22.65.82
Oct 10 08:57:14 mail postfix/smtpd[79473]: warning: hostname
web1.flightsimdemo.com does not resolve to address 108.178.59.78: hostname
nor servname provided, or not known
Oct 10 10:44:24 mail postfix/smtpd[79748]: warning: hostname
173.244.206.149.static.ctohome.com does not resolve to address
173.244.206.149: hostname nor servname provided, or not known
Oct 10 10:53:01 mail postfix/smtpd[79761]: warning: hostname
121.245.20.77.cdma-hyderabad.vsnl.net.in does not resolve to address
121.245.20.77: hostname nor servname provided, or not known
Oct 10 10:53:13 mail postfix/smtpd[79761]: warning: hostname
121.245.20.77.cdma-hyderabad.vsnl.net.in does not resolve to address
121.245.20.77: hostname nor servname provided, or not known
Oct 10 11:13:58 mail postfix/smtpd[79854]: warning: hostname
host.colocrossing.com does not resolve to address 198.144.187.214
Oct 10 11:17:06 mail postfix/smtpd[79874]: warning: hostname
host.galagiftsandarrangements.com does not resolve to address 66.171.178.163
Oct 10 11:23:37 mail postfix/smtpd[79906]: warning: hostname
web2.flightsimdemo.com does not resolve to address 198.143.133.158:
hostname nor servname provided, or not known
Oct 10 11:24:49 mail postfix/smtpd[79906]: warning: hostname
ip-69.65.13.3.servernap.net does not resolve to address 69.65.13.3:
hostname nor servname provided, or not known
Oct 10 11:35:33 mail postfix/smtpd[79949]: warning: hostname
199.195.194.101.static.midphase.com does not resolve to address
199.195.194.101: hostname nor servname provided, or not known
Oct 10 11:42:59 mail postfix/smtpd[79960]: warning: hostname
host147.kvchosting.com does not resolve to address 173.214.191.177:
hostname nor servname provided, or not known
Oct 10 11:43:59 mail postfix/policyd-weight[6870]: decided action=550
temporarily blocked because of previous errors - retrying too fast.
penalty: 30 seconds x 0 retries.; <client=unknown[173.214.191.177]>
<helo=host146.kvchosting.com> <from=i...@youngindiachangeindia.com>
<to=frie...@friendshipforest.com>; delay: 0s
Oct 10 11:43:59 mail postfix/smtpd[79960]: NOQUEUE: reject: RCPT from
unknown[173.214.191.177]: 550 5.7.1 <frie...@friendshipforest.com>:
Recipient address rejected: temporarily blocked because of previous errors
- retrying too fast. penalty: 30 seconds x 0 retries.;
from=<i...@youngindiachangeindia.com> to=<frie...@friendshipforest.com>
proto=ESMTP helo=<host146.kvchosting.com>
Oct 10 12:16:02 mail postfix/smtpd[80093]: warning: hostname tw68.com5.tw
does not resolve to address 184.82.169.123: hostname nor servname provided,
or not known
Oct 10 13:17:19 mail postfix/smtpd[80285]: warning: hostname
ip-69.65.40.65.servernap.net does not resolve to address 69.65.40.65:
hostname nor servname provided, or not known
Oct 10 13:32:39 mail postfix/smtpd[80323]: warning: hostname
host.colocrossing.com does not resolve to address 198.144.187.210
Oct 10 13:39:49 mail postfix/smtpd[80373]: warning: hostname
server1.youthbasketballlessons.biz does not resolve to address
94.242.224.107: hostname nor servname provided, or not known
Oct 10 14:00:00 mail postfix/smtpd[80451]: warning: hostname
173-208-33-2.rdns.ubiquityservers.com does not resolve to address
173.208.33.2: hostname nor servname provided, or not known
Oct 10 14:01:55 mail postfix/smtpd[80476]: warning: hostname
web1.flightsimdemo.com does not resolve to address 108.178.59.77: hostname
nor servname provided, or not known
Oct 10 14:14:42 mail postfix/smtpd[80527]: warning: hostname
hosted-by.altushost.com does not resolve to address 79.142.79.104: hostname
nor servname provided, or not known
Oct 10 14:17:09 mail postfix/smtpd[80527]: warning: hostname
198.105.209.244.static.midphase.com does not resolve to address
198.105.209.244: hostname nor servname provided, or not known
Oct 10 14:22:59 mail postfix/smtpd[80562]: warning: hostname static.kpn.net
does not resolve to address 92.71.230.81: hostname nor servname provided,
or not known
Oct 10 14:26:51 mail postfix/smtpd[80570]: warning: hostname
64-120-168-166.static.hostnoc.net does not resolve to address
64.120.168.166: hostname nor servname provided, or not known
For completeness, here's postconf -n
# postconf -n
alias_database = hash:/usr/local/etc/postfix/aliases
alias_maps = hash:/usr/local/etc/postfix/aliases
hash:/usr/local/mailman/data/aliases
allow_mail_to_commands = alias,forward
allow_mail_to_files = alias,forward
allow_percent_hack = no
anvil_status_update_time = 1d
biff = no
body_checks = pcre:$config_directory/body-checks.pcre
broken_sasl_auth_clients = yes
command_directory = /usr/local/sbin
config_directory = /usr/local/etc/postfix
daemon_directory = /usr/local/libexec/postfix
data_directory = /var/db/postfix
debug_peer_level = 2
debug_peer_list = 127.0.0.1
debugger_command = PATH=/usr/bin: xxgdb $daemon_directory/$process_name
$process_id & sleep 5
default_privs = nobody
default_process_limit = 75
delay_warning_time = 1d
header_checks = pcre:$config_directory/header-checks.pcre
home_mailbox = Maildir/
html_directory = /usr/local/share/doc/postfix
inet_interfaces = all
inet_protocols = ipv4
lmtp_destination_recipient_limit = 3000
lmtp_sasl_auth_enable = no
local_destination_concurrency_limit = 2
local_destination_recipient_limit = 100
local_recipient_maps = unix:passwd.byname $alias_maps
mail_owner = postfix
mailbox_size_limit = 104857600
maildrop_destination_recipient_limit = 1
mailq_path = /usr/local/bin/mailq
manpage_directory = /usr/local/man
maximal_queue_lifetime = 5d
mydestination = $myhostname, localhost.$mydomain, localhost mail.$mydomain,
www.$mydomain, lists.$mydomain, $mydomain
mydomain = stovebolt.com
myhostname = mail.$mydomain
mynetworks = 127.0.0.0/8,216.58.158.170/32
myorigin = $mydomain
newaliases_path = /usr/local/bin/newaliases
owner_request_special = no
postscreen_access_list = permit_mynetworks
postscreen_bare_newline_action = ignore
postscreen_bare_newline_enable = no
postscreen_bare_newline_ttl = 30d
postscreen_blacklist_action = ignore
postscreen_cache_cleanup_interval = 12h
postscreen_cache_map = btree:$data_directory/postscreen_cache
postscreen_cache_retention_time = 7d
postscreen_client_connection_count_limit =
$smtpd_client_connection_count_limit
postscreen_command_count_limit = 20
postscreen_command_filter =
postscreen_command_time_limit = ${stress?10}${stress:300}s
postscreen_disable_vrfy_command = $disable_vrfy_command
postscreen_discard_ehlo_keyword_address_maps =
$smtpd_discard_ehlo_keyword_address_maps
postscreen_discard_ehlo_keywords = $smtpd_discard_ehlo_keywords
postscreen_dnsbl_action = ignore
postscreen_dnsbl_reply_map =
postscreen_dnsbl_sites = bl.spamcop.net, zen.spamhaus.org, dnsbl.sorbs.net
postscreen_dnsbl_threshold = 1
postscreen_dnsbl_ttl = 1h
postscreen_enforce_tls = $smtpd_enforce_tls
postscreen_expansion_filter = $smtpd_expansion_filter
postscreen_forbidden_commands = $smtpd_forbidden_commands
postscreen_greet_action = ignore
postscreen_greet_banner = $smtpd_banner
postscreen_greet_ttl = 1d
postscreen_greet_wait = ${stress?2}${stress:6}s
postscreen_helo_required = $smtpd_helo_required
postscreen_non_smtp_command_action = drop
postscreen_non_smtp_command_enable = no
postscreen_non_smtp_command_ttl = 30d
postscreen_pipelining_action = enforce
postscreen_pipelining_enable = no
postscreen_pipelining_ttl = 30d
postscreen_post_queue_limit = $default_process_limit
postscreen_pre_queue_limit = $default_process_limit
postscreen_reject_footer = $smtpd_reject_footer
postscreen_tls_security_level = $smtpd_tls_security_level
postscreen_use_tls = $smtpd_use_tls
postscreen_watchdog_timeout = 10s
postscreen_whitelist_interfaces = static:all
queue_directory = /var/spool/postfix
readme_directory = /usr/local/share/doc/postfix
recipient_delimiter = +
relay_domains = $mydestination, www.stovebolt.com, server1.stovebolt.com
sample_directory = /usr/local/etc/postfix
sendmail_path = /usr/local/sbin/sendmail
setgid_group = maildrop
smtpd_delay_reject = yes
smtpd_helo_restrictions = permit_mynetworks reject_invalid_hostname
smtpd_junk_command_limit = 5
smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated
reject_unauth_destination check_client_access hash:$config_directory/access
reject_unauth_pipelining reject_non_fqdn_sender reject_non_fqdn_recipient
reject_unknown_sender_domain check_recipient_access
hash:$config_directory/policyd_weight_recipient_whitelist
check_client_access hash:$config_directory/policyd_weight_client_whitelist
check_policy_service inet:127.0.0.1:12525 permit
smtpd_sasl_auth_enable = yes
smtpd_sasl_local_domain = $myhostname
smtpd_sasl_security_options = noanonymous
smtpd_tls_CAfile = /usr/local/etc/postfix/server.pem
smtpd_tls_cert_file = /usr/local/etc/postfix/server.pem
smtpd_tls_key_file = /usr/local/etc/postfix/server.pem
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
smtpd_use_tls = yes
soft_bounce = no
tls_random_source = dev:/dev/urandom
unknown_local_recipient_reject_code = 550
virtual_alias_domains = friendshipforest.com fieldoftrees.com
txantimedia.com
virtual_alias_maps = hash:/usr/local/etc/postfix/virtual
--
Paul Schmehl (g...@stovebolt.com)
The Stovebolt Geek
The Net's Oldest and Most Complete
Resource for Antique Chevy and GM Trucks
http://www.stovebolt.com
