Re: Postfix restricting local mail locally.
Le 04/06/2011 04:06, Jeroen Geilman a écrit : On 06/04/2011 02:50 AM, Kendrick wrote: I am trying to make it so that postfix takes specific actions when spam from my domian externally arrives. smtpd_recipient_restrictions / reject_unknown_... looked prommising but I dont see how to work it with the information given. When a new message arrives with [from: somt...@mydomain.com] [to:somt...@mydomain.com] and sender ip address does not = $mynetworks i want to send connecting pc's ip to external scripts if possible and the least reject the message. reverse dns lookup from my internal dns server would work as well. eventually I may be interested in having tls or something authenticate external users to send from mydomian but that is not a big concern right now. If need be vpn will solve that need. any suggestions are appriciated. If I missed a how-to or something I appriciate the links. I dont always figure the best key words to find these things. In main.cf: smtpd_recipient_restrictions = permit_mynetworks, check_sender_access hash:/etc/postfix/my_own_domains, reject_unauth_destination Using check_*_access before reject_unauth_destination is discouraged. it may (accidentally) lead to open relay should someone add an entry that returns OK. better use: smtpd_recipient_restrictions = permit_sasl_authenticated permit_myneyworks reject_unauth_destination check_sender_access hash:/etc/postfix/access_sender == access_sender: techsoft3d.com REJECT .techsoft3d.com REJECT Note to OP: this rejects mail with a sender in your domain unless it comes from mynetworks or is authenticated (SASL). a better setup is to separate inbound mail service (MX) and submission service (MSA), for example by using port 587 for submission. then you wouldn't need to create exception (reject unless). and in my_own_domains: techsoft3d.com REJECT etc. Or one of the other possible actions; there are quite a few, read the man page for details: http://www.postfix.org/access.5.html he could start with http://www.postfix.org/SMTPD_ACCESS_README.html http://www.postfix.org/RESTRICTION_CLASS_README.html
Re: Postfix restricting local mail locally.
On 06/04/2011 05:06 AM, mouss wrote: Using check_*_access before reject_unauth_destination is discouraged. it may (accidentally) lead to open relay should someone add an entry that returns OK. better use: smtpd_recipient_restrictions = permit_sasl_authenticated permit_myneyworks reject_unauth_destination check_sender_access hash:/etc/postfix/access_sender == access_sender: techsoft3d.com REJECT .techsoft3d.com REJECT That makes sense now that I see an example. Lists of options like the documentation tend to just confuse me. Note to OP: this rejects mail with a sender in your domain unless it comes from mynetworks or is authenticated (SASL). a better setup is to separate inbound mail service (MX) and submission service (MSA), for example by using port 587 for submission. then you wouldn't need to create exception (reject unless). he could start with http://www.postfix.org/SMTPD_ACCESS_README.html http://www.postfix.org/RESTRICTION_CLASS_README.html If i understand this right. for the mx side I could put smtpd_recipient_restrictions = permit_sasl_authenticated or should it be smtpd_sender_restrictions = check_sender_access hash:/etc/postfix/access_sender == access_sender: techsoft3d.com REJECT .techsoft3d.com REJECT and on the internal side it would accept all with no restrictions? the way the documentation is worded it confuses me which one would apply here. does smtpd_sender... = out going mail or the from: box? thanks Kendrick
Re: Postfix restricting local mail locally.
On Sat, Jun 04, 2011 at 10:25:37AM -0400, Kendrick wrote: smtpd_recipient_restrictions = permit_sasl_authenticated No, this won't work, rather: smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination, check_sender_access hash:/etc/postfix/access_sender # Optional final permit, just to make it clear permit or should it be smtpd_sender_restrictions = check_sender_access hash:/etc/postfix/access_sender == access_sender: techsoft3d.com REJECT .techsoft3d.com REJECT and on the internal side it would accept all with no restrictions? You list authorized clients in mynetworks. -- Viktor.
Re: Postfix restricting local mail locally.
Le 04/06/2011 16:25, Kendrick a écrit : On 06/04/2011 05:06 AM, mouss wrote: Using check_*_access before reject_unauth_destination is discouraged. it may (accidentally) lead to open relay should someone add an entry that returns OK. better use: smtpd_recipient_restrictions = permit_sasl_authenticated permit_myneyworks reject_unauth_destination check_sender_access hash:/etc/postfix/access_sender == access_sender: techsoft3d.com REJECT .techsoft3d.com REJECT That makes sense now that I see an example. Lists of options like the documentation tend to just confuse me. Note to OP: this rejects mail with a sender in your domain unless it comes from mynetworks or is authenticated (SASL). a better setup is to separate inbound mail service (MX) and submission service (MSA), for example by using port 587 for submission. then you wouldn't need to create exception (reject unless). he could start with http://www.postfix.org/SMTPD_ACCESS_README.html http://www.postfix.org/RESTRICTION_CLASS_README.html If i understand this right. for the mx side I could put smtpd_recipient_restrictions = permit_sasl_authenticated No. - the default in all smtpd_*_restrictions is OK - open relay is checked in smtpd_recipient_restrictions so the latter should have a reject_something. in general: reject_unauth_destination (which rejects open relay). or should it be smtpd_sender_restrictions = check_sender_access hash:/etc/postfix/access_sender == access_sender: techsoft3d.com REJECT .techsoft3d.com REJECT and on the internal side it would accept all with no restrictions? yes if you have an internal side. do you? the way the documentation is worded it confuses me which one would apply here. does smtpd_sender... = out going mail or the from: box? the way you word it confuses me:) all smtpd checks apply to the SMTP commands such as HELO/EHLO, MAIL FROM, RCPT TO. smtpd checks do not apply to headers (Subject:, Date: From:, To:, Cc:, ... etc). you need to udnderstand how smtp works. smtp is a transport protocol that is used to convey messages. smtp has commands: HELO/EHLO, MAIL FROM, RCPT TO, DATA, QUIT, ... etc. the messages it convey have headers (such as Received, Date, Subject, From, To, Cc, ... etc) and a body (which may itself contain multiple MIME parts, sometimes called attachments).
Re: Postfix restricting local mail locally.
On 06/04/2011 05:50 PM, mouss wrote: yes if you have an internal side. do you? I have 3+ sides. External, wired and wireless. I may eventually add a dmz or include the dmz with wireless. Wired and wireless both go through the server to external but don't know the other exists. putting the internal on different ports is not a problem if you cant specify different settings for the different sides of the server specifically. the way the documentation is worded it confuses me which one would apply here. does smtpd_sender... = out going mail or the from: box? the way you word it confuses me:) Havent studied much on mail servers before. until a year or 2 agao my systems hadent seen much spam. Some one used my domain in the from box for a bunch of spam and now i get alot of junk. On 06/04/2011 02:04 PM, Victor Duchovni wrote: On Sat, Jun 04, 2011 at 10:25:37AM -0400, Kendrick wrote: smtpd_recipient_restrictions = permit_sasl_authenticated No, this won't work, rather: smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination, check_sender_access hash:/etc/postfix/access_sender # Optional final permit, just to make it clear permit Does that apply to multi homed machines or is it possible to specify things per network? or would i be better off having a mail server instance specifically for external mail and a 2nd server that is for the internal clients?
Postfix restricting local mail locally.
I am trying to make it so that postfix takes specific actions when spam from my domian externally arrives. smtpd_recipient_restrictions / reject_unknown_... looked prommising but I dont see how to work it with the information given. When a new message arrives with [from: somt...@mydomain.com] [to:somt...@mydomain.com] and sender ip address does not = $mynetworks i want to send connecting pc's ip to external scripts if possible and the least reject the message. reverse dns lookup from my internal dns server would work as well. eventually I may be interested in having tls or something authenticate external users to send from mydomian but that is not a big concern right now. If need be vpn will solve that need. any suggestions are appriciated. If I missed a how-to or something I appriciate the links. I dont always figure the best key words to find these things. Kendrick
Re: Postfix restricting local mail locally.
On 06/04/2011 02:50 AM, Kendrick wrote: I am trying to make it so that postfix takes specific actions when spam from my domian externally arrives. smtpd_recipient_restrictions / reject_unknown_... looked prommising but I dont see how to work it with the information given. When a new message arrives with [from: somt...@mydomain.com] [to:somt...@mydomain.com] and sender ip address does not = $mynetworks i want to send connecting pc's ip to external scripts if possible and the least reject the message. reverse dns lookup from my internal dns server would work as well. eventually I may be interested in having tls or something authenticate external users to send from mydomian but that is not a big concern right now. If need be vpn will solve that need. any suggestions are appriciated. If I missed a how-to or something I appriciate the links. I dont always figure the best key words to find these things. In main.cf: smtpd_recipient_restrictions = permit_mynetworks, check_sender_access hash:/etc/postfix/my_own_domains, reject_unauth_destination and in my_own_domains: techsoft3d.com REJECT etc. Or one of the other possible actions; there are quite a few, read the man page for details: http://www.postfix.org/access.5.html -- J.
