Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PostFix forwarder - LDAP lookup

    Scheduled Pinned Locked Moved pfSense Packages
    36 Posts 6 Posters 16.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      DQM
      last edited by

      Dear Marcello,

      Now I have one more problem. It is RBL feature on the PF, it does not work. Below is content of my config file:

      /usr/local/etc/postfix/main.cf
      #main.cf
      #Part of the Postfix package for pfSense
      #Copyright (C) 2010 Erik Fonnesbeck
      #Copyright (C) 2011 Marcello Coutinho
      #All rights reserved.
      #DO NOT EDIT THIS FILE

      mynetworks = /usr/local/etc/postfix/mynetwork_table
      mynetworks_style = host
      smtpd_banner = mail-gw-01.abc.com ESMTP
      relay_domains = abc.com
      transport_maps = hash:/usr/local/etc/postfix/transport
      local_recipient_maps =
      mydestination =
      mynetworks_style = host
      message_size_limit = 10240000
      default_process_limit = 100
      #Just reject after helo,sender,client,recipient tests
      smtpd_delay_reject = yes

      Don't talk to mail systems that don't know their own hostname.

      smtpd_helo_required = yes
      smtpd_helo_restrictions =

      smtpd_sender_restrictions = reject_unknown_sender_domain,
      permit

      Allow connections from specified local clients and rbl check everybody else if rbl check are set.

      smtpd_client_restrictions = permit_mynetworks,
      reject_unauth_destination,
      check_sender_access hash:/usr/local/etc/postfix/sender_access,
      check_client_access pcre:/usr/local/etc/postfix/cal_pcre,
      check_client_access cidr:/usr/local/etc/postfix/cal_cidr
      permit

      Whitelisting: local clients may specify any destination domain.

      #,
      smtpd_recipient_restrictions = permit_mynetworks,
      reject_unauth_destination,
      check_sender_access hash:/usr/local/etc/postfix/sender_access,
      check_client_access pcre:/usr/local/etc/postfix/cal_pcre,
      check_client_access cidr:/usr/local/etc/postfix/cal_cidr,
      reject_spf_invalid_sender,
      permit

      soft_bounce = yes
      postscreen_greet_wait = ${stress?2}${stress:6}s
      postscreen_greet_action = enforce
      postscreen_access_list = permit_mynetworks,
      cidr:/usr/local/etc/postfix/cal_cidr
      postscreen_dnsbl_action= enforce
      postscreen_blacklist_action= enforce
      postscreen_dnsbl_sites=zen.spamhaus.org, bl.spamcop.net
      postscreen_dnsbl_threshold=2

      Does my config file has any issues? Could you please help to solve it?

      Thank you for your support,
      DQM

      1 Reply Last reply Reply Quote 0
      • marcellocM
        marcelloc
        last edited by

        Are you sure it's not working?

        the setup is fine and rbl lists are applied on postscreen daemon

        postscreen_greet_wait = ${stress?2}${stress:6}s
postscreen_greet_action = enforce
postscreen_access_list = permit_mynetworks,
         cidr:/usr/local/etc/postfix/cal_cidr
postscreen_dnsbl_action= enforce
postscreen_blacklist_action= enforce
postscreen_dnsbl_sites=zen.spamhaus.org, bl.spamcop.net
postscreen_dnsbl_threshold=2

        This last arg says that a hostname must be on both lists to get blocked

        Treinamentos de Elite: http://sys-squad.com

        Help a community developer! ;D

        1 Reply Last reply Reply Quote 0
        • D
          DQM
          last edited by

          Are you sure it's not working?

          I'm sure. Because I have tested by telnet from an IP address which is listed on zen.spamhaus.org (I have checked with another SMTP server) but RBL feature on the PF didn't action. So, I am able to push a lot of messages to it.

          This last arg says that a hostname must be on both lists to get blocked

          This means the IP address which perform sending email must be listed on both zen.spamhaus.org and bl.spamcop.net then RBL feature would action? Right?
          Could you please help to explain in details?

          Thanks,
          DQM

          1 Reply Last reply Reply Quote 0
          • marcellocM
            marcelloc
            last edited by

            @DQM:

            This means the IP address which perform sending email must be listed on both zen.spamhaus.org and bl.spamcop.net then RBL feature would action? Right?
            Could you please help to explain in details?

            change RBL threshold to 1 on antispam tab, apply config  and test again

            Treinamentos de Elite: http://sys-squad.com

            Help a community developer! ;D

            1 Reply Last reply Reply Quote 0
            • D
              DQM
              last edited by

              Hi Marcello,

              I have checked log of PF and I would like to show you as below:

              relay=192.168.1.100[192.168.1.100]:25, delay=36, delays=31/0/0/5, dsn=5.7.1, status=bounced (host 192.168.1.100[192.168.1.100] said: 550 5.7.1 IP address 115.73.183.198 has been blocked by the RBL provider zen.spamhaus.org due to rule (Spamhaus). Please check http://www.spamhaus.org/query/bl?ip=115.73.183.198 for further detail. (in reply to end of DATA command))

              Highlighted is message that is generated by my Exchange server (not PF) after PF forward the message to it.

              Based on the log above, seems the RBL on my PF is working. Correct? But I have a question that why does not PF perform an action (drop, rejetc) spams and generate a message same as my Exchange server? Could you please help on this?

              Thanks for your help,
              DQM

              1 Reply Last reply Reply Quote 0
              • marcellocM
                marcelloc
                last edited by

                the man says that postscreen_dnsbl_action set to enforce, logs and rejects the message.
                On my config file (postfix forwarder -> view config -> main.cf) is set to enforce.
                Can you check on yours config file?

                ignore (default)
                Ignore the failure of this test. Allow other tests to complete. Repeat this test the next time the client connects. This option is useful for testing and collecting statistics without blocking mail.
                enforce
                Allow other tests to complete. Reject attempts to deliver mail with a 550 SMTP reply, and log the helo/sender/recipient information. Repeat this test the next time the client connects.
                drop
                Drop the connection immediately with a 521 SMTP reply. Repeat this test the next time the client connects.
                This feature is available in Postfix 2.8.

                Treinamentos de Elite: http://sys-squad.com

                Help a community developer! ;D

                1 Reply Last reply Reply Quote 0
                • D
                  DQM
                  last edited by

                  Thanks for your support, Marcello. The RBL feature is working well now. But I have one more problem with the log of PF. Once I restart the PF and got log content as below:

                  Sep 22 10:27:00 fglbh-gw-01 postfix/postfix-script[58210]: warning: not owned by postfix: /var/db/postfix/./2012-09-22.db
                  Sep 22 10:27:00 fglbh-gw-01 postfix/postfix-script[58529]: warning: not owned by postfix: /var/db/postfix/./2012-09-20.db
                  Sep 22 10:27:00 fglbh-gw-01 postfix/postfix-script[58872]: warning: not owned by postfix: /var/db/postfix/./2012-09-17.db

                  So, I couldn't search any incomming messages.

                  Could you please help to solve on this?

                  Thank you,
                  DQM

                  1 Reply Last reply Reply Quote 0
                  • marcellocM
                    marcelloc
                    last edited by

                    These files ate not used by postfix daemon, just by package gui.
                    You can ignore this warning. :)

                    Treinamentos de Elite: http://sys-squad.com

                    Help a community developer! ;D

                    1 Reply Last reply Reply Quote 0
                    • D
                      DQM
                      last edited by

                      Dear Marcello,

                      But I couldn't search any incomming messages on the GUI, bc it bases on maillog databases.

                      One more question, Marcello. How about limit size of maillog file and how does it work? Will it split to maillog1, maillog2, …? (/var/log/maillog)
                      Can I push the log of PF to syslog server?

                      Thanks,
                      DQM

                      1 Reply Last reply Reply Quote 0
                      • marcellocM
                        marcelloc
                        last edited by

                        @DQM:

                        One more question, Marcello. How about limit size of maillog file and how does it work? Will it split to maillog1, maillog2, …? (/var/log/maillog)

                        Not on current version.
                        LinuxTracker did a how to for logrotate, maybe it's userfull for you.
                        http://forum.pfsense.org/index.php/topic,51412.msg287633.html#msg287633

                        @DQM:

                        Can I push the log of PF to syslog server?

                        Yes, you need just to change log settings on package gui.

                        without maillog, you will not have database search too.

                        Treinamentos de Elite: http://sys-squad.com

                        Help a community developer! ;D

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.