Postfix - antispam and relay package

mauricioniñoavella

Hello everyone following took help of our partner Marcello Coutinho.

No solution had written, excuse me for not having done so before. This is the step by step solution

Marcello Coutinho,

Thanks for all the hard work!

sasl on postfix?

x64
missing dependencies for saslpasswd2 (place it on /usr/lib/ dir)
http://e-sac.siteseguro.ws/pfsense/8/amd64/All/ldd/
additional package for sasl
http://e-sac.siteseguro.ws/pfsense/8/amd64/All/cyrus-sasl-saslauthd-2.1.25.tbz

i386
missing dependencies for saslpasswd2 (place it on /usr/lib/ dir)
http://e-sac.siteseguro.ws/pfsense/8/All/ldd/
additional package for sasl
http://e-sac.siteseguro.ws/pfsense/8/All/cyrus-sasl-saslauthd-2.1.25.tbz

=====================================================================================

Configuration postfix sasl pfsense x64

1. I check dependencies for saslpasswd2

[2.0.1-RELEASE]/root(1): ldd /usr/local/sbin/saslpasswd2
/usr/local/sbin/saslpasswd2:

libsasl2.so.2 => /usr/local/lib/libsasl2.so.2 (0x800647000)
libcrypto.so.6 => /lib/libcrypto.so.6 (0x800761000)
libgssapi.so.10 => not found (0x0)
libheimntlm.so.10 => not found (0x0)
libkrb5.so.10 => not found (0x0)
libhx509.so.10 => not found (0x0)
libcom_err.so.5 => /usr/lib/libcom_err.so.5 (0x8009fb000)
libasn1.so.10 => not found (0x0)
libroken.so.10 => not found (0x0)
libcrypt.so.5 => /lib/libcrypt.so.5 (0x800afd000)
libopie.so.6 => /usr/lib/libopie.so.6 (0x800c16000)
libc.so.7 => /lib/libc.so.7 (0x800d1f000)
libmd.so.5 => /lib/libmd.so.5 (0x800f5b000)

2. Download dependencies for saslpasswd2 and copied in /usr/lib/

link dependencies for saslpasswd2 http://e-sac.siteseguro.ws/pfsense/8/amd64/All/ldd/

libgssapi.so.10
libheimntlm.so.10
libhx509.so.10
libkrb5.so.10
libroken.so.10

3. I copy these files to the following path /usr/lib/

[2.0.1-RELEASE]/root(1): ls
libasn1.so.10 libgssapi.so.10 libheimntlm.so.10 libhx509.so.10 libkrb5.so.10 libroken.so.10

[2.0.1-RELEASE]/root(1): cp *.10 /usr/lib/

libasn1.so.10
libgssapi.so.10
libheimntlm.so.10
libhx509.so.10
libkrb5.so.10
libroken.so.10

4. Download additional package for sasl (cyrus-sasl-saslauthd-2.1.25.tbz)

link Download additional package for sasl http://e-sac.siteseguro.ws/pfsense/8/amd64/All/cyrus-sasl-saslauthd-2.1.25.tbz

5. Install the package with the command pkg_add cyrus-sasl-saslauthd-2.1.25.tbz

link Install packages frebsd

http://www.freebsd.org/doc/es/books/handbook/packages-using.html
http://docs.freebsd.org/doc/4.9-RELEASE/usr/share/doc/es/books/handbook/packages-using.html

[2.0.1-RELEASE]/root(1): pkg_add cyrus-sasl-saslauthd-2.1.25.tbz

To run saslauthd from startup, add saslauthd_enable="YES" in your
/etc/rc.conf.

6. I check dependencies for saslpasswd2

[2.0.1-RELEASE]/root(1): ldd /usr/local/sbin/saslpasswd2
/usr/local/sbin/saslpasswd2:
libsasl2.so.2 => /usr/local/lib/libsasl2.so.2 (0x800647000)
libcrypto.so.6 => /lib/libcrypto.so.6 (0x800761000)
libgssapi.so.10 => /usr/lib/libgssapi.so.10 (0x8009fb000)
libheimntlm.so.10 => /usr/lib/libheimntlm.so.10 (0x800b04000)
libkrb5.so.10 => /usr/lib/libkrb5.so.10 (0x800c09000)
libhx509.so.10 => /usr/lib/libhx509.so.10 (0x800d76000)
libcom_err.so.5 => /usr/lib/libcom_err.so.5 (0x800eb5000)
libasn1.so.10 => /usr/lib/libasn1.so.10 (0x800fb7000)
libroken.so.10 => /usr/lib/libroken.so.10 (0x801136000)
libcrypt.so.5 => /lib/libcrypt.so.5 (0x801247000)
libopie.so.6 => /usr/lib/libopie.so.6 (0x801360000)
libc.so.7 => /lib/libc.so.7 (0x801469000)
libmd.so.5 => /lib/libmd.so.5 (0x8016a5000)

7. Dependencies and additional package for sasl. are already

Thanks. :) Marcello Coutinho,

Mauricio Niño.

mauricioniñoavella

@mauricioniñoavella:

This is for
Forum and BSD developers pfSense
I do not understand why people who work in this great project, such as pfSense, stop the publication of a package, which is not compatible with pfSense.
Please do not degrade this great software such as pfSense without offending anyone, first of all congratulate marcelloc and Postfix antispam and relay package has problems.
But I do recommend working to improve, and we who belong to the family of pfSense, are the ones who try and give them guidelines for improving pfSense.
PfSense do not compare with other systems or software firewalls, for there is but I have reviewed (ClearOs Linux), and has a very simple setup SMTP Relay with Authentication. (relay host)
I hope this is taken into account
regards

excuse me to everyone in the forum especially Marcello Coutinho, so writing here

Mauricio Niño

Dragyn

Postfix relay and 2.0.2

I recently upgraded to 2.0.2 and now postfix will not start, I scanned the forums and this thread for anything similar but I didn't see anything.

After upgrade reboot, postfix didn't even appear, I uninstalled and reinstalled and now it shows up under services but it will not start. When I SSH into the console and try to start it I get:

[2.0.2-RELEASE][peter@]/usr(13): /usr/local/etc/rc.d/mailscanner start
eval: cannot open /var/run/MailScanner.pid: Permission denied
Starting mailscanner.
Can't call method "close" on an undefined value at /usr/local/libexec/MailScanner/mailscanner_create_locks line 69.
Error: Attempt to create locks in /var/spool/MailScanner/incoming/Locks failed!
Can't set GID 125 at /usr/local/sbin/mailscanner line 1541.
/usr/local/etc/rc.d/mailscanner: WARNING: failed to start mailscanner
[2.0.2-RELEASE][peter@]/usr(14):

Any help with this would be appreciated, I love using this to relay my mail.

marcelloc

Mailscanner runs with postfix user, check it user exists on pfsense and then try to reinstall mailscanner.

Dragyn

Sorry I didn't post full info, I am running postfix as well, and the user is there. This all worked fine under 2.0.1 so it has to do with whatever changes came with 2.0.2 to pfSense. I am also getting log entries of:
mailscanner: Cannot write pid file /var/run/MailScanner.pid, Permission denied
in the system log when trying to call mailscanner from the command prompt.

marcelloc

try to create these missing folders and permissions.

chris32lr

Marcelloc,

Thank you so much for taking the time to put this package together and help so many of us. Being new to PFSense, I just want to make sure I configure it properly because this is our only firewall. Here's what I'm a little concerned about:

1. Right now I have a NAT Port Forward configured as:
Interface: WAN
Protocol: TCP
Destination: WAN Address
Destination Port: SMTP
Redirect Target IP: My internal exchange server IP
Redirect Target Port: SMTP
- I read here: http://forum.pfsense.org/index.php/topic,46196.0.html you say "remember to remove nat from port 25 and allow access on wan firewall rules to postfix." So I delete this port forward? If so, can you tell me how to properly configure the rule such as the Interface, Protocol, Source, Destination, etc.?

Thanks again!!

marcelloc

Just take a look on current rule your nat has created and replace internal destination IP to wan address.

Make sure your Postfix is configured and running before using it with real traffic.

chris32lr

@marcelloc:

Just take a look on current rule your nat has created and replace internal destination IP to wan address.

Make sure your Postfix is configured and running before using it with real traffic.

Thank you! :)

Ludo

Hi,

I have Pfsense version 2.0.1 and I just installed postfix package.
I do that because i need a relay smtp.
I have many temporary users on my network. They all have an Internet access provider different (Orange, Free, etc …).
I can not change the configuration in their smtp mailer.
This is why I would like to add a rule on my router so they can all go through the SMTP server of my ISP.
Can you do it with your package postfix?
Thank you in advance.

@marcelloc:

Hi all,

I've just finished postfix package version 2.3.

Postfix is an amazing mail forwarder that really keep away any misconfigured server or server trying to forge email.
Postfix Forwarder package at pfsense has many antispam features but for now, no SASL support for remote authentication.

Zombie blocker (postscreen)

Header chekcs

Body checks

Access lists

RBL checks

SPF checks

Dashboard widgets with mail stats

Sqlite logs support

Sqlite logs forward to use only one box to search mail

Package permissions to allow users to just search mail or view queue

Search mail tool

view postfix queue in gui

And you can also use an third part antispam engine like mailscanner or policyd v2 for a complete antispam solution.

note: NEVER try to install policydv2 freebsd package, it will break out your pfsense.
if you plan to use policydv2 you must put it on other server or in a jail.

The mailscanner tutorial(or package) is under development, for now you can configure by hand using pkg_add -r MailScanner.

att,
Marcello Coutinho

marcelloc

@Ludo:

This is why I would like to add a rule on my router so they can all go through the SMTP server of my ISP.
Can you do it with your package postfix?

I think you will need authentication for these clients.

You can manually install and configure sasl as current version does not has this integrations on gui.

Ludo

@marcelloc:

@Ludo:

This is why I would like to add a rule on my router so they can all go through the SMTP server of my ISP.
Can you do it with your package postfix?

I think you will need authentication for these clients.

You can manually install and configure sasl as current version does not has this integrations on gui.

ok, thank you!

Redtooth

Hi

I've just installed postfix, everything is working fine except an error keeps feeling my logs..

Jan 17 19:20:26
postfix/smtpd[25463]: D17FD62D47C: client=addmail.nu[212.247.84.186]
Jan 17 19:20:26
postfix/cleanup[28013]: D17FD62D47C: message-id=729443A7-32CE-41B4-A908-11E46BA2CBD9@site.se
Jan 17 19:20:26
postfix/qmgr[46843]: D17FD62D47C: from=firstname.lastname@site.se, size=1225, nrcpt=1 (queue active)
Jan 17 19:20:27
postfix/smtp[28014]: D17FD62D47C: to=myname@mydomain.org, relay=10.10.1.100[10.10.1.100]:25, delay=0.2, delays=0.03/0.01/0.02/0.13, dsn=2.0.0, status=sent (250 Queued (0.016 seconds))
Jan 17 19:20:27
postfix/qmgr[46843]: D17FD62D47C: removed
Jan 17 19:20:31
postfix/smtpd[25463]: warning: connect to private/anvil: Connection refused
Jan 17 19:20:31
postfix/smtpd[25463]: warning: problem talking to server private/anvil: Connection refused
Jan 17 19:20:32
postfix/smtpd[25463]: warning: connect to private/anvil: Connection refused
Jan 17 19:20:32
postfix/smtpd[25463]: warning: problem talking to server private/anvil: Connection refused
Jan 17 19:20:32
postfix/smtpd[25463]: disconnect from addmail.nu[212.247.84.186]

Any clue how to fix this?

** SOLVED **
Had to have Anvil Daemon enabled in Postfix Forwarder under AntiSpam for the problem to go away./myname@mydomain.org /firstname.lastname@site.se

RChadwick

Can you tell me if this can forward to a port besides 25? I have pfsense at work, and I run an email server at home, but Comcast just decided to block port 25. Was hoping to configure the mx records to point to my office, and it would forward all mail to my home email server.

marcelloc

@RChadwick:

Can you tell me if this can forward to a port besides 25? I have pfsense at work, and I run an email server at home, but Comcast just decided to block port 25. Was hoping to configure the mx records to point to my office, and it would forward all mail to my home email server.

It will not filter based ou source ip as all your mail will have your comany address as source.

vbela

@mrfairsquare:

ISSUE:
–-----
The postfix log db file is empty, and postfix does not or can not write to the db file.

Location i'm looking at: /var/db/postfix

I have the same problem.

Loggin is turned on
Destination /var/log/maillog
Update Sqlite Every minute
/^Subject:/ WARN is in the right place

But mail search is not working. DB is created, but it's empty ((

Pfsense ver 2.0.2 i386

marcelloc

@vbela:

But mail search is not working. DB is created, but it's empty ((

What you get on postfix logs? Can you see the subject warn message on logs and postfix database script on cron?

biggsy

I've set up a new VM to try and test Postfix and some other packages.

2.1-BETA1 (amd64) built on Tue Apr 2 16:21:22 EDT 2013 + Postfix 2.8.7,1 pkg v.2.3.4_1

Two things noticed so far:

Still need to copy files as per this post: http://forum.pfsense.org/index.php/topic,50519.msg270803.html#msg270803
When restarting the ESXi host and pfSense VM, Postfix doesn't pick up a change of WAN IP address. Given error is: postfix/master[32735]: fatal: bind <old wan="" ip="">port 25: Can't assign requested address. Probably because master.cf is being updated in /usr/local/etc/postfix/ not /usr/pbi/postfix-amd64/etc/postfix</old>

Edit: one more thing at start of package:

postfix/postfix-script[55357]: warning: not owned by root: /var/spool/postfix

biggsy

The two main problems noted above now seem to be fixed with the latest version for pfSense 2.1 (amd64).
Thank you marcelloc.

The last point, about /var/spool/postfix is still there but never caused any problems.

Just as an aside, I also discovered that I could copy the /var/db/postfix/postscreen_cache.db file from the existing 32-bit 2.0.2 install to the new 64-bit 2.1 Beta1 install.

To avoid delayed delivery of all those "once every few weeks emails", I have a custom main.cf entry:```
postscreen_cache_retention_time = 30d


Copying the postscreen_cache file saves having the new install re-learn all the whitelisted SMTP client IPs that the existing install knew about.

marcelloc

biggsy,

Thanks for your feedback :)