Postfix - antispam and relay package

hcoin

For me, postfix+friends on pfsense a major administrative convenience. And, it is in keeping with the spirit of what is is a 'firewall' does (if only in an expanded sense). Most of the spam traffic won't even succeed in connecting, the ones that do cause internet 'internet spam service check' requests to leave from the firewall without having to take up bandwidth on the lan, and most of the evil attachments never make it past the firewall either. It also (I hope still will) allow one 'clamav' install to manage scanning web traffic for the squid suite and also the mailscanner/email.

Also, having the 'postfix and associated packages" stack in PF allows me to leverage pf's certificate management, destination email domain routing, failover, load balancing for email. That internal domain routing bit is a security plus as traffic for domain X never travels lan segments used by those on domains A, B and C, an obvious security plus. Also it allows the internal smtp world to be very fast and lean as it needs minimal security and no need for the add-on 'nasty-checking' packages.

Remember one of the main spam defences is having the mail exchanger's reverse dns match the common name in the ssl certificate. Anytime information can be kept in one place and closer to where it's used is an admin win.

Last, the postfix config for the lan side can use the lmtp protocol which is a major overhead saver (no per message setups/teardowns).

It calls for a multiprocessor setup, lots of ram and lots of disk. I know that is not exactly what comes to mind using the word 'embedded', but the above is my $0.02 on why it's worth it.

If it were to be removed, I'd have to create not just port forward to a new subnet but a vlan just to isolate incoming email traffic, then – well, it would result in an economic bonanza for the people who sell those coffee thingys.

biggsy

@Bismarck:

Sadly SPF is broken now:

Bismarck, have you been able to install from Available Packages? I missed a few days of 2.3 updates but haven't seen the postfix package listed.

Bismarck

Hi biggsy,

the packages should still be there:

http://files.pfsense.org/packages/10/All/postfix-2.11.3_2-amd64.pbi

HowTo: Install packages

regards

marcelloc

The pull request still needs to be aproved first.

Bismarck

Hello marcelloc,

since 2.2.x Postfix doesn't write spam logs to the sqlite database, thus you can't search for spam and the widget doesn't display any spam records.

This makes it really hard to track false positives. :'(

Please help!

//edit

when I execute it via putty after I send a spam test, it does write the spam record to the database file!?

[root@pfsense~]$ /usr/local/bin/php -q /usr/local/www/postfix.php 01min

/usr/bin/grep '^Jan 15 09:25.*\(MailScanner\|postfix.cleanup\|postfix.smtp\|postfix.error\|postfix.qmgr\)' /var/log/maillog
Found logs to 2016-01-15.db

#######################################
SPAM:SpamAssassin (nicht zwischen gespeichert, Wertung=1004.701, benoetigt 3, FSL_HELO_NON_FQDN_1 0.00, GTUBE 1000.00, HTML_MESSAGE 0.00, PYZOR_CHECK 1.98, RDNS_NONE 0.00, TVD_RCVD_SINGLE 1.21, ZONK_PHISH_BODY 1.50)5E1EA1C2B99zonk
#######################################

#######################################
SPAM:SpamAssassin (nicht zwischen gespeichert, Wertung=1004.701, benoetigt 3, FSL_HELO_NON_FQDN_1 0.00, GTUBE 1000.00, HTML_MESSAGE 0.00, PYZOR_CHECK 1.98, RDNS_NONE 0.00, TVD_RCVD_SINGLE 1.21, ZONK_PHISH_BODY 1.50)4E48D1C2BFBzonk
#######################################
writing to database...writing to database... writing to local db 2016-01-15...ok

maybe a timeing problem?

biggsy

@marcelloc:

The pull request still needs to be aproved first.

Thank you for working on this, Marcello. Is there any news?

Bismarck

FYI

I did a fresh install of pfSense 2.2.6 last week and the Postfix package did work out of the box, expect the search mail & widget sqlite bug, wich can be fixed by fetching the postfix.php/postfix.widget.php from:

fetch -o /usr/local/www/postfix.php http://e-sac.siteseguro.ws/px22/postfix.txt
fetch -o /usr/local/www/widgets/widgets/postfix.widget.php http://e-sac.siteseguro.ws/px22/postfix.widget.txt

So NO need to delete Postfix and install it via pkgng!

Regards ;)

marcelloc

@biggsy:

Thank you for working on this, Marcello. Is there any news?

yes, I'll need to change the syslog function that enables /var/log/maillog.

marcelloc

@Bismarck:

So NO need to delete Postfix and install it via pkgng!

It just started up or it's running and filtering email? on 2.2 I got a lot of missing libs erros on postfix subprocesses.

Bismarck

@marcelloc:

@Bismarck:

So NO need to delete Postfix and install it via pkgng!

It just started up or it's running and filtering email? on 2.2 I got a lot of missing libs erros on postfix subprocesses.

Yes it's filtering email, spam and viruses with MailScanner, I run it as my productive system since 2 weeks now, no lib errors or crashes.

Thank you for your hard work, much appreciated!

LinuxCuba

Hi Marcello, I'm trying pfsense 2.3 beta, and one of the essential
packages for me is postfix, but the same does not appear in the list
of available packages, you had said at the forum, which would sit in
this package postfix for version 2.3 . As it would be possible to
install that version of package postfix in pfsense 2.3 beta. Greetings
and thank you very much for the excellent work he has done. Excuse the
bad English.

Bismarck

@biggsy:

postfix 2.11 was released in January and, among other things, it contains the following enhancement:

A new postscreen_dnsbl_whitelist_threshold feature to allow
clients to skip postscreen tests based on their DNSBL score.
This can eliminate email delays due to "after 220 greeting"
protocol tests, which otherwise require that a client reconnects
before it can deliver mail. Some providers such as Google don't
retry from the same IP address, and that can result in large
email delivery delays.

Any chance of an updated package based on postfix 2.11?

Hi Biggsy, this is working with the current package Postfix 2.11.3/pfSense 2.2.6.

To enable:

postscreen_dnsbl_whitelist_threshold=-1

edit /usr/local/pkg/postfix.inc around line 629 and add this:

$postfix_main .= "postscreen_dnsbl_whitelist_threshold=-1\n";

and restart the Postfix service.

So no more hardcodeed IPs in Client Access List / CDIR needed, for google outbound mail server etc. ;)

marcelloc, maybe you can make this a option in the Postfix menu?

Bismarck

Hello marcelloc,

I found 2 bug in postfix.php, related to the log to sqlite file.

The result of loglines populated to slqlite file differs by the time period chosen tin the Genaral tab > Logging > Update Sqlite, it always missing around 50% of what has been really logged, eg. if we choose Every Minute. I found a workaround by adding a second cronjob, which executes every 10m as well and no longline is missing anymore.

Second, this is related to spam status is not updated to the sqlite file on month days with just one digit (1 - 9), because postfix logs the date like:

Feb  6 16:25:21 pfsense postfix/dnsblog[27506]: addr 193.189.117.150 listed by domain zen.spamhaus.org as 127.0.0.2

and MailScanner like:

Feb 06 16:24:50 pfsense MailScanner[20367]: Delivery of nonspam: message 604671C2F69.A240D from
``` 
I guess there is something like a regex pattern mismatch, because on month days with 2 digits (10 - 31) the spam status is updated to sqlite file just fine.

Regards

Bismarck

When you use Postfix/TLS, you should fix the DROWN Attack vulnerability:

openssl dhparam -out /usr/pbi/postfix-amd64/etc/postfix/dh2048.pem 2048

and add this, below your TLS config in the custom main.cf options:

# Whenever the built-in defaults are sufficient, let the built-in
# defaults stand by deleting any explicit overrides.

# Disable deprecated SSL protocol versions.  See:
# http://www.postfix.org/postconf.5.html#smtp_tls_protocols
# http://www.postfix.org/postconf.5.html#smtpd_tls_protocols
#
# Default in all supported stable Postfix releases since July 2015.
# Defaults for the mandatory variants never allowed SSLv2.
#
smtpd_tls_protocols = !SSLv2, !SSLv3
smtp_tls_protocols = !SSLv2, !SSLv3
lmtp_tls_protocols = !SSLv2, !SSLv3
tlsproxy_tls_protocols = $smtpd_tls_protocols
#
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
smtp_tls_mandatory_protocols = !SSLv2, !SSLv3
lmtp_tls_mandatory_protocols = !SSLv2, !SSLv3
tlsproxy_tls_mandatory_protocols = $smtpd_tls_mandatory_protocols

# Disable export and low-grade ciphers.  See:
# http://www.postfix.org/postconf.5.html#smtpd_tls_ciphers
# http://www.postfix.org/postconf.5.html#smtp_tls_ciphers
#
# Default in all supported stable Postfix releases since July 2015.
#
smtpd_tls_ciphers = medium
smtp_tls_ciphers = medium

# Enable forward-secrecy with a 2048-bit prime and the P-256 EC curve. See
# http://www.postfix.org/FORWARD_SECRECY_README.html#server_fs
# http://www.postfix.org/postconf.5.html#smtpd_tls_dh1024_param_file
# http://www.postfix.org/postconf.5.html#smtpd_tls_eecdh_grade
#
# The default DH parameters use a 2048-bit strong prime as of Postfix 3.1.0.
#
smtpd_tls_dh1024_param_file=${config_directory}/dh2048.pem
smtpd_tls_eecdh_grade = strong

# Trimmed cipherlist improves interoperability with old Exchange servers
# and reduces exposure to obsolete and rarely used crypto.  See:
# http://www.postfix.org/postconf.5.html#smtp_tls_exclude_ciphers
# http://www.postfix.org/postconf.5.html#smtpd_tls_exclude_ciphers
#
smtp_tls_exclude_ciphers = EXPORT, LOW, MD5, aDSS, kECDHe, kECDHr, kDHd, kDHr, SEED, IDEA, RC2
smtpd_tls_exclude_ciphers = EXPORT, LOW, MD5, SEED, IDEA, RC2

Source: https://drownattack.com/postfix.html
DROWN Test: https://test.drownattack.com/
Postfix/TLS: http://www.checktls.com/perl/TestReceiver.pl
SSL Labs Test: https://dev.ssllabs.com/ssltest/

Regards

dannyboy1121

Hi - any news for Postfix on 2.3? I see that it's not currently in the package list for the Beta.

biggsy

Perhaps Marcello is very busy but I'm hoping we will hear some news too.

marcelloc

I've sent two updates today and one is missing to complete changes requested by renato

https://github.com/pfsense/FreeBSD-ports/pull/23
https://github.com/pfsense/pfsense/pull/2844

dannyboy1121

Many thanks for the update and also your hard work.

elundquist

Postfix Forwarder 2.4.6 on pfSense 2.2.6 (amd64)

Based on my reading of this thread the above combination works without modification… is this correct?

Enable LDAP fetch: Installing the LDAP pkg don't work based on (hint: /usr/sbin/pkg_add -r p5-perl-ldap) as listed on the GUI?

pkg_add -r p5-perl-ldap Results: pkg_add: Command not Found

pkg add -r p5-perl-ldap Results: No Such File: -r

pkg add p5-perl-ldap Results: No Such File: p5-perl-ldap

What is it that I am missing?

Bismarck

@elundquist:

Postfix Forwarder 2.4.6 on pfSense 2.2.6 (amd64)

Based on my reading of this thread the above combination works without modification… is this correct?

Enable LDAP fetch: Installing the LDAP pkg don't work based on (hint: /usr/sbin/pkg_add -r p5-perl-ldap) as listed on the GUI?

pkg_add -r p5-perl-ldap Results: pkg_add: Command not Found

pkg add -r p5-perl-ldap Results: No Such File: -r

pkg add p5-perl-ldap Results: No Such File: p5-perl-ldap

What is it that I am missing?

pkg install p5-perl-ldap

pkg help

For more information on the different commands see 'pkg help <command></command>'.

https://wiki.freebsd.org/pkgng

Cheers.