Re: RBL checks seem to be failing

[Thijssen]

On Mon, Jul 21, 2014 at 5:51 PM, Noel Jones <njo...@megan.vbhcs.org> wrote:
> On 7/21/2014 10:34 AM, Thijssen wrote:

>> smtpd_recipient_restrictions =
>>     reject_invalid_hostname,
>>     reject_unknown_recipient_domain,
>>     reject_unauth_pipelining,
>>      permit_mynetworks,
>>      permit_sasl_authenticated,
>>      check_client_access hash:/etc/postfix/whitelist,
>
> Danger! any client you OK in this whitelist also gets relay
> permission.  This should be below reject_unauth_destination.
>
> If this is a list of clients you intend to give relay access to, it
> should be renamed to make its function clear to prevent accidents --
> maybe relay_clients.
>
>>     reject_unauth_destination,
>
> Ok, now rejecting unauth destinations.
>
>>     reject_non_fqdn_recipient,
>>     reject_non_fqdn_sender,
>>     reject_unknown_sender_domain,
>>      permit_auth_destination,
>
> And here you permit auth destinations.  There's no mail left after
> this; none of the rules below will ever fire.

Thanks Noel! Been puzzling for this quite a while. I think I also
finally understand the reject-permit process, this just woke me up on
that.

I changed it to:

smtpd_recipient_restrictions =
    reject_invalid_hostname,
    reject_unknown_recipient_domain,
    reject_unauth_pipelining,
     permit_mynetworks,
     permit_sasl_authenticated,
    reject_unauth_destination,
    reject_non_fqdn_recipient,
    reject_non_fqdn_sender,
    reject_unknown_sender_domain,
     check_client_access hash:/etc/postfix/whitelist,
     permit_dnswl_client hostkarma.junkemailfilter.com=127.0.0.1,
     permit_dnswl_client hostkarma.junkemailfilter.com=127.0.0.5,
    reject_rbl_client badconf.rhsbl.sorbs.net,
    reject_rbl_client new.spam.dnsbl.sorbs.net,
    reject_rbl_client hostkarma.junkemailfilter.com=127.0.0.2,
    reject_rbl_client b.barracudacentral.org,
    reject_rbl_client all.s5h.net,
    reject_rbl_client bl.blocklist.de,
    reject_rbl_client dnsbl.inps.de,
    reject_rbl_client ubl.unsubscore.com,
    reject_rbl_client virbl.dnsbl.bit.nl,
    reject_rbl_client mail-abuse.blacklist.jippg.org,
     permit

Thanks again, the blocked spam is appearing in the logs immediately
after a reload.

Julius