Postfix - antispam and relay package
-
Tried this… First time I did only the helo lines, did not work, even after reboot. Nothing changed in main.cf
Did the other lines, rebooted, then it reverted with ownership errors on the database files :P
Ideas?1. You need to manually edit /usr/local/pkg/postfix.inc this will keep your changes after a postfix reload but needs to be re edited after a package update. eg.:
…
smtpd_helo_restrictions = check_helo_access pcre:{$pf_dir}/etc/postfix/helo_check,
reject_unknown_helo_hostname,
reject_invalid_helo_hostname,
reject_non_fqdn_helo_hostname,
reject_rhsbl_helo hostkarma.junkemailfilter.com=127.0.0.2,
** reject_rhsbl_helo dbl.spamhaus.org,**
permit
…
...
smtpd_sender_restrictions = reject_non_fqdn_sender,
reject_unknown_sender_domain,
reject_unauth_pipelining,
reject_multi_recipient_bounce,
** reject_rhsbl_sender dbl.spamhaus.org, **
permit
…
...
smtpd_client_restrictions = permit_mynetworks,
reject_unauth_destination,
check_client_access pcre:{$pf_dir}/etc/postfix/cal_pcre,
check_client_access cidr:{$pf_dir}/etc/postfix/cal_cidr,
reject_unknown_client_hostname,
reject_unauth_pipelining,
reject_multi_recipient_bounce,
reject_rhsbl_reverse_client hostkarma.junkemailfilter.com=127.0.0.2,
reject_rhsbl_reverse_client dbl.spamhaus.org,
permit
…And I guess this is highly ineffective, since Postscreen and RBL server List already reject almost everything and its safer, because you can combine as many rbl lists you like.
http://www.postfix.org/SMTPD_ACCESS_README.html
http://www.postfix.org/POSTSCREEN_README.html
2. You missing a dot before the asterisk and add always a comment to the REJECT, easier to identify false/positives:
/^From:.@__.__.download/ REJECT Spam Rule #20191
3. see 1. & 2.
Here a few commands to check your postfix rules if they match:
postmap -q - regexp:/usr/pbi/postfix-amd64/etc/postfix/body_check < /root/mail.txt
postmap -q - regexp:/usr/pbi/postfix-amd64/etc/postfix/header_check < /root/mail.txt
postmap -q - regexp:/usr/pbi/postfix-amd64/etc/postfix/mime_check < /root/mail.txt
postmap -q - regexp:/usr/pbi/postfix-amd64/etc/postfix/helo_check < /root/mail.txt
Just copy the full mail with the header etc. into mail.txt file before execute.
Usefull: http://www.regexr.com/
Best practice is a well configurated Postfix + Mailscanner + sa-updater-custom-channels.sh + clamav-unofficial-sigs.sh = Spam > 1%.
Cheers! ;)
-
I ma wondering if I did not have the right section, since I have the header verification box set to basic? After stepping through the PHP should I be putting it here?
Original:
Don't talk to mail systems that don't know their own hostname.
smtpd_helo_required = yes
{$reject_unknown_helo_hostname}smtpd_sender_restrictions = reject_unknown_sender_domain,
RBLRBLRBLAllow connections from specified local clients and rbl check everybody else if rbl check are set.
smtpd_client_restrictions = permit_mynetworks,
reject_unauth_destination,
check_sender_access hash:{$pf_dir}/etc/postfix/sender_access,
check_client_access pcre:{$pf_dir}/etc/postfix/cal_pcre,
check_client_access cidr:{$pf_dir}/etc/postfix/cal_cidr
RBLRBLRBLWhitelisting: local clients may specify any destination domain.
#,
smtpd_recipient_restrictions = permit_mynetworks,
reject_unauth_destination,
check_sender_access hash:{$pf_dir}/etc/postfix/sender_access,
check_client_access pcre:{$pf_dir}/etc/postfix/cal_pcre,
check_client_access cidr:{$pf_dir}/etc/postfix/cal_cidr,
SPFSPFSPFRBLRBLRBLModified:
Don't talk to mail systems that don't know their own hostname.
smtpd_helo_required = yes
{$reject_unknown_helo_hostname}smtpd_sender_restrictions = reject_unknown_sender_domain,
reject_rhsbl_reverse_client dbl.spamhaus.org,
RBLRBLRBLAllow connections from specified local clients and rbl check everybody else if rbl check are set.
smtpd_client_restrictions = permit_mynetworks,
reject_unauth_destination,
check_sender_access hash:{$pf_dir}/etc/postfix/sender_access,
check_client_access pcre:{$pf_dir}/etc/postfix/cal_pcre,
check_client_access cidr:{$pf_dir}/etc/postfix/cal_cidr <–------- I see a missing , in the INC, put it in?
RBLRBLRBLWhitelisting: local clients may specify any destination domain.
#,
smtpd_recipient_restrictions = permit_mynetworks,
reject_unauth_destination,
check_sender_access hash:{$pf_dir}/etc/postfix/sender_access,
check_client_access pcre:{$pf_dir}/etc/postfix/cal_pcre,
check_client_access cidr:{$pf_dir}/etc/postfix/cal_cidr,
reject_rhsbl_reverse_client dbl.spamhaus.org,
reject_rhsbl_sender dbl.spamhaus.org,
reject_rhsbl_client dbl.spamhaus.org,
SPFSPFSPFRBLRBLRBLI would be using MailScanner, but I am running PFSense 2.2.4 and they say mailscanner does not work, or there is something we need to do to install it right, but my other thread went unanswered to see if it is working :P
-
I tried your format
/^From:.@..eu/ REJECT Spam Rule #20191
and is KINDA works…It does block the .eu TLD, but also hits on addresses like From:bill@mail.eugene.ca.gov
This behavior is expected, since we are starting at the front of the screen. When I do it the right way: /^From:.@..eu$/ (with the $ to match the end for .eu), the PCRE simulators all work fine. It catches only the .eu TLD.
But when I put it in Postfix with the $ in it, it blocks nothing :P
Am I missing something?And thanks for the other guides. I am looking at them now :)
In case someone else was having the same issue, I found a work around for PostFix not recognizing both the ^ (begin) and the $ (end) for an entry in the access list.
Instead of
/^From:.@..eu/ which would hit on things like bill@ci.eureka.ca.gov as well as bill@sample.eu, which is NOT what we want.
New way using word boundary
/^From:.@..eu\b/ only hits on bill.sample.eu
Now we can reject senders from certain TLDs properly :D
(The reason I did not use HELO is A: It never worked for me, and B: (BIG one) spammers are using US servers to spoof .eu in the from address so the HELO does not match).
:) -
Marceloc are you the one I talk to about patches for PF sense postfix?
I am working on a patch to implement the DNS blacklist to the package through a patch with its own list section, but it would be nice if we can add it right to the next version.
Once tested, can I send the patch to you to see what you think?Also is there a official place to get full documentation on how the patchfile syntax?
-
So, for anyone here who's not given up yet and is having issues with https://redmine.pfsense.org/issues/4420 - there's v2.4.5 out. If someone's wiling to undo the manual hacks (stuff like cyrus-sasl2/libspf2 installed via pkg, symlinks etc.) and report back, it'd be appreciated.
Hi,
I did uninstall the postfix package and undo any manual fixes and patches.
Then I did firmware upgrade from 2.2.4 to 2.2.5 and postfix package reinstall.
This time, things look better but I still had to do some tweak to the postfix.inc file to make it work.- had to do the following procedure, except for the 2 first line "fetch…" because I believe those file are now obsolete and will break things, since the package has been updated.
Reposting update guide for pfsense 2.2.x only:
Install package via gui
execute code below via console/sshfetch -o /usr/local/www/postfix.php http://e-sac.siteseguro.ws/px22/postfix.txt fetch -o /usr/local/www/widgets/widgets/postfix.widget.php http://e-sac.siteseguro.ws/px22/postfix.widget.txt pbi_delete postfix-2.11.3_2-amd64 rm -f /usr/pbi/bin/libexec/postfix rm -f /usr/local/etc/postfix rm -f /var/spool/postfix rm -f /var/mail/postfix rm -f /var/db/postfix pkg install postfixfix postfix.inc file with this patch via system patcher package
add this patch via package system patcher
**description:**postfix_inc
patch:--- postfix.orig.inc 2015-08-18 08:15:00.000000000 +0000 +++ postfix.inc 2015-08-18 08:18:10.000000000 +0000 @@ -36,11 +36,11 @@ require_once("globals.inc"); $pfs_version = substr(trim(file_get_contents("/etc/version")),0,3); -if ($pfs_version == "2.1" || $pfs_version == "2.2") { - define('POSTFIX_LOCALBASE', '/usr/pbi/postfix-' . php_uname("m")); -} else { +//if ($pfs_version == "2.1" || $pfs_version == "2.2") { +// define('POSTFIX_LOCALBASE', '/usr/pbi/postfix-' . php_uname("m")); +//} else { define('POSTFIX_LOCALBASE','/usr/local'); -} +//} $uname=posix_uname(); if ($uname['machine']=='amd64')directory:/usr/local/pkg/
- had to manually patch the file /usr/local/www/postfix_view_config.php, to fix the path for config files to allow displaying the config file correctly under the "view config" tab.
Guys, you did a great job to make that package work on pfsense 2.2.x !
-
Any ETA on a "Install and Go" fix without needing to manually edit things?
-
Any ETA on a "Install and Go" fix without needing to manually edit things?
ETA = never. The package is gone from pfSense 2.3.
-
Any ETA on a "Install and Go" fix without needing to manually edit things?
ETA = never. The package is gone from pfSense 2.3.
Mmm… Then I must ask what mail forwarder is pfsense going to replace it with? Surely many people make use of pfsense for dual web and mail filtering and other general firewall purpouses. Scrapping postfix without a replacement would force people to look at other next generation firewalls.
-
Mmm… Then I must ask what mail forwarder is pfsense going to replace it with?
I don't believe any replacement is planned for this. https://redmine.pfsense.org/issues/5374
-
Mmm… Then I must ask what mail forwarder is pfsense going to replace it with?
I don't believe any replacement is planned for this. https://redmine.pfsense.org/issues/5374
Does that also mean all the other mail apps like mailscanner, spamassasin, clamav ect will be falling away? Last I checked the Postfix was a MTA that sent all emails to 127.0.0.1 on the pfsense box were they were then scanned and filtered accordingly, PostFix would then send them on there way when they were done. Unless I am understanding wrong, how would I filter my mail now without PostFix?
-
Unless I am understanding wrong, how would I filter my mail now without PostFix?
On your mailserver perhaps? I don't get the idea of running postfix, spam filters and co. on a firewall… Regardless, take this with pfSense developers, I'm not one.
-
Unless I am understanding wrong, how would I filter my mail now without PostFix?
On your mailserver perhaps? I don't get the idea of running postfix, spam filters and co. on a firewall… Regardless, take this with pfSense developers, I'm not one.
Meant how would I filter my mail without PostFix "On pfSense", but I appreciate your honest replies. What a pity I liked pfSense. Cheers.
-
I'm migrating the package for 2.3.
If you use pfsense as an UTM, packages postfix, varnish, squid, mailscanner give it layer 7 ability on these protocols.
For me it's really usefull.
-
I'm migrating the package for 2.3.
If you use pfsense as an UTM, packages postfix, varnish, squid, mailscanner give it layer 7 ability on these protocols.
For me it's really usefull.
Now that is some good news for a change. PostFix "IS" one of the best used packages on pfSense. To scrap it would be going backwards. Happy days :)
-
-
Sadly SPF is broken now:
unused parameter: spf_mark_only=yes
This was a very useful option to fight sender address forgery.
Any idea how to fix?
//Edit
This could be a option?py27-postfix-policyd-spf-python works great and easy to setup! :)$ pkg install py27-postfix-policyd-spf-python Updating FreeBSD repository catalogue... FreeBSD repository is up-to-date. All repositories are up-to-date. The following 6 package(s) will be affected (of 0 checked): New packages to be INSTALLED: py27-postfix-policyd-spf-python: 1.3.2 py27-authres: 0.800 py27-spf: 2.0.12_1 py27-dns: 2.3.6_1 python2: 2_3 py27-ipaddr: 2.1.10_1 The process will require 856 KiB more space. 152 KiB to be downloaded. Proceed with this action? [y/N]: y Fetching py27-postfix-policyd-spf-python-1.3.2.txz: 100% 38 KiB 38.5kB/s 00:01 Fetching py27-authres-0.800.txz: 100% 26 KiB 26.7kB/s 00:01 Fetching py27-spf-2.0.12_1.txz: 100% 34 KiB 35.0kB/s 00:01 Fetching py27-dns-2.3.6_1.txz: 100% 31 KiB 32.0kB/s 00:01 Fetching python2-2_3.txz: 100% 1 KiB 1.1kB/s 00:01 Fetching py27-ipaddr-2.1.10_1.txz: 100% 22 KiB 22.1kB/s 00:01 Checking integrity... done (0 conflicting) [1/6] Installing python2-2_3... [1/6] Extracting python2-2_3: 100% [2/6] Installing py27-dns-2.3.6_1... [2/6] Extracting py27-dns-2.3.6_1: 100% [3/6] Installing py27-authres-0.800... [3/6] Extracting py27-authres-0.800: 100% [4/6] Installing py27-spf-2.0.12_1... [4/6] Extracting py27-spf-2.0.12_1: 100% [5/6] Installing py27-ipaddr-2.1.10_1... [5/6] Extracting py27-ipaddr-2.1.10_1: 100% [6/6] Installing py27-postfix-policyd-spf-python-1.3.2... [6/6] Extracting py27-postfix-policyd-spf-python-1.3.2: 100% Message from py27-postfix-policyd-spf-python-1.3.2: # # To configure Postfix # This package must be integrated with Postfix to be effective: 1\. Add to your postfix master.cf: policyd-spf unix - n n - 0 spawn user=nobody argv=/usr/local/bin/policyd-spf 2\. Configure the Postfix policy service in your main.cf so that the "smtpd_recipient_restrictions" includes a call to the policyd-spf policy filter. If you already have a "smtpd_recipient_restrictions" line, you can add the "check_policy_service" command anywhere *after* the line which reads "reject_unauth_destination" (otherwise you're system can become an open relay). smtpd_recipient_restrictions = ... reject_unauth_destination check_policy_service unix:private/policyd-spf ... policyd-spf_time_limit = 3600 3\. Please consult the postfix documentation for more information on these and other settings you may wish to have in the "smtpd_recipient_restrictions" configuration. 4\. Reload postfix.
-
For me, postfix+friends on pfsense a major administrative convenience. And, it is in keeping with the spirit of what is is a 'firewall' does (if only in an expanded sense). Most of the spam traffic won't even succeed in connecting, the ones that do cause internet 'internet spam service check' requests to leave from the firewall without having to take up bandwidth on the lan, and most of the evil attachments never make it past the firewall either. It also (I hope still will) allow one 'clamav' install to manage scanning web traffic for the squid suite and also the mailscanner/email.
Also, having the 'postfix and associated packages" stack in PF allows me to leverage pf's certificate management, destination email domain routing, failover, load balancing for email. That internal domain routing bit is a security plus as traffic for domain X never travels lan segments used by those on domains A, B and C, an obvious security plus. Also it allows the internal smtp world to be very fast and lean as it needs minimal security and no need for the add-on 'nasty-checking' packages.
Remember one of the main spam defences is having the mail exchanger's reverse dns match the common name in the ssl certificate. Anytime information can be kept in one place and closer to where it's used is an admin win.
Last, the postfix config for the lan side can use the lmtp protocol which is a major overhead saver (no per message setups/teardowns).
It calls for a multiprocessor setup, lots of ram and lots of disk. I know that is not exactly what comes to mind using the word 'embedded', but the above is my $0.02 on why it's worth it.
If it were to be removed, I'd have to create not just port forward to a new subnet but a vlan just to isolate incoming email traffic, then – well, it would result in an economic bonanza for the people who sell those coffee thingys.
-
Sadly SPF is broken now:
Bismarck, have you been able to install from Available Packages? I missed a few days of 2.3 updates but haven't seen the postfix package listed.
-
Hi biggsy,
the packages should still be there:
http://files.pfsense.org/packages/10/All/postfix-2.11.3_2-amd64.pbi
regards
-
The pull request still needs to be aproved first.
