Postfix - antispam and relay package

[expert_az]

marcelloc thank you for your great job,very userfull and helpfull package i ever used on pfsense.
any plans  DKIM(opendkim) support for outgoing mails?

[marcelloc]

@jamesc:

Do you have any updates on SASL authentication and if/when it may be included in this great package?

I would love to migrate our existing SMTP solution over to this but the lack of authentication is the only thing stopping me.

James,

To try sasl auth you need to fix some missing lib from kerberos

ldd /usr/local/sbin/saslpasswd2
/usr/local/sbin/saslpasswd2:
  libsasl2.so.2 => /usr/local/lib/libsasl2.so.2 (0x800647000)
  libcrypto.so.6 => /lib/libcrypto.so.6 (0x800761000)
  libgssapi.so.10 => not found (0x0)
  libheimntlm.so.10 => not found (0x0)
  libkrb5.so.10 => not found (0x0)
  libhx509.so.10 => not found (0x0)
  libcom_err.so.5 => /usr/lib/libcom_err.so.5 (0x8009fb000)
  libasn1.so.10 => not found (0x0)
  libroken.so.10 => not found (0x0)
  libcrypt.so.5 => /lib/libcrypt.so.5 (0x800afd000)
  libopie.so.6 => /usr/lib/libopie.so.6 (0x800c16000)
  libc.so.7 => /lib/libc.so.7 (0x800d1f000)
  libmd.so.5 => /lib/libmd.so.5 (0x800f5b000)

The missing libs to get sasl working can be fetched from this url

http://e-sac.siteseguro.ws/pfsense/8/amd64/All/ldd/

and saved on /usr/local/lib/

On amd64

cd /usr/local/lib
fetch http://e-sac.siteseguro.ws/pfsense/8/amd64/All/ldd/libasn1.so.10
fetch http://e-sac.siteseguro.ws/pfsense/8/amd64/All/ldd/libgssapi.so.10
fetch http://e-sac.siteseguro.ws/pfsense/8/amd64/All/ldd/libheimntlm.so.10
fetch http://e-sac.siteseguro.ws/pfsense/8/amd64/All/ldd/libhx509.so.10
fetch http://e-sac.siteseguro.ws/pfsense/8/amd64/All/ldd/libkrb5.so.10
fetch http://e-sac.siteseguro.ws/pfsense/8/amd64/All/ldd/libroken.so.10

On i386

cd /usr/local/lib
fetch http://e-sac.siteseguro.ws/pfsense/8/All/ldd/libasn1.so.10
fetch http://e-sac.siteseguro.ws/pfsense/8/All/ldd/libgssapi.so.10
fetch http://e-sac.siteseguro.ws/pfsense/8/All/ldd/libheimntlm.so.10
fetch http://e-sac.siteseguro.ws/pfsense/8/All/ldd/libhx509.so.10
fetch http://e-sac.siteseguro.ws/pfsense/8/All/ldd/libkrb5.so.10
fetch http://e-sac.siteseguro.ws/pfsense/8/All/ldd/libroken.so.10

after this, try to paste your sasl config com custom field at postfix configuration.

Let me know if it works  :)

[jamesc]

Thanks Marcello.

I'm very new to Postfix so I will have to do some reading before I actually attempt this.  I'm not so sure on what I use for my authentication backend.  Can you give me some pointers?

[marcelloc]

@jamesc:

Thanks Marcello.

I'm very new to Postfix so I will have to do some reading before I actually attempt this.  I'm not so sure on what I use for my authentication backend.  Can you give me some pointers?

I did not used sals on pfsense, so I do not know the best way to implement this.

try to follow official postfix how to for cyrrus SASL.

http://www.postfix.org/SASL_README.html

I've also asked mauricioniñoavella to post his successfull cyrrus SASL config here.

att,
Marcello Coutinho

[jamesc]

Thank you Marcello.

The first thing i'm trying to implement is some simple anti-spoofing checks.

For example, the Postfix server is configured to accept email for mydomain.com and then to forward on to our internal mail server located within the trusted network zone.

I want Postfix to carry out a check on the MAIL FROM and RCPT TO addresses, it should immediately drop any email where both the sender address and recipient is equal to mydomain.com because these emails would never genuinely hit the Postfix gateway.

Any ideas?

[marcelloc]

This is done on postfix antispam tab.

Set strong header verification, reject when spf fails, etc.

Almost all options has a minihelp on description and default value.

[jamesc]

Thanks.

I would like to use basic header verification and then build the rest of my config using the custom main.cf options.

Is this possible or not recommended?

If I try adding the below to my custom main.cf (when using basic header verification) I cannot get an SMTP connection into the server

disable_vrfy_command = yes
strict_rfc821_envelopes = yes

smtpd_sender_restrictions = reject_non_fqdn_sender,
reject_unauth_pipelining,
reject_multi_recipient_bounce,
permit

Any ideas?

[marcelloc]

This options are applied to header checks, it could not be alone on configuration.

Check current config file on view configuration postfix tab.

This way you can check what is applied to postfix.

[jamesc]

This is my main.cf

/usr/local/etc/postfix/main.cf
#main.cf\
#Part of the Postfix package for pfSense
#Copyright (C) 2010 Erik Fonnesbeck
#Copyright (C) 2011 Marcello Coutinho
#All rights reserved.
#DO NOT EDIT THIS FILE

mynetworks = /usr/local/etc/postfix/mynetwork_table
mynetworks_style = host
disable_vrfy_command = yes
strict_rfc821_envelopes = yes

smtpd_sender_restrictions = reject_non_fqdn_sender,
reject_unauth_pipelining,
reject_multi_recipient_bounce,
permit

smtpd_client_restrictions = reject_unknown_client_hostname,
reject_unauth_pipelining,
reject_multi_recipient_bounce,
permit
relay_domains = mydomain.com
transport_maps = hash:/usr/local/etc/postfix/transport
local_recipient_maps =
mydestination =
mynetworks_style = host
message_size_limit = 10240000
default_process_limit = 100
#Just reject after helo,sender,client,recipient tests
smtpd_delay_reject = yes

# Don't talk to mail systems that don't know their own hostname.
smtpd_helo_required = yes
smtpd_helo_restrictions = 

smtpd_sender_restrictions = reject_unknown_sender_domain,
				permit

# Allow connections from specified local clients and rbl check everybody else if rbl check are set.
smtpd_client_restrictions = check_client_access pcre:/usr/local/etc/postfix/cal_pcre,
				check_client_access cidr:/usr/local/etc/postfix/cal_cidr,
				permit

# Whitelisting: local clients may specify any destination domain.
#,
smtpd_recipient_restrictions = permit_mynetworks, 
				reject_unauth_destination,
				reject_spf_invalid_sender,
				permit

postscreen_access_list = permit_mynetworks,
			cidr:/usr/local/etc/postfix/cal_cidr
postscreen_dnsbl_action= drop
postscreen_blacklist_action= drop

As you can see, the smtpd_sender_restrictions section appears twice, one is from my custom main.cf and the second is what you get as standard with basic header verification.

Are you saying this is not a valid configuration?

[marcelloc]

I don't know how postfix handles with two smtpd_sender_restrictions on config file.

Why don't you use strong header check and configure your internal servers on acls?

[jamesc]

That seems to work, thanks.  I just like to do things from scratch because it helps me learn  :)

I'm currently logging to /var/log/maillog.  I only want to retain 30 days worth of logs, is there a way I can set this up?

Also, how can I manage 'dead messages', is it possible to delete these from the queue?

[marcelloc]

These extra steps can be done via shell/php scripts

[jamesc]

Could the .db files just be deleted from /var/db/postfix or would I need to run some SQL to perform the maintenance?

[marcelloc]

You mean per day log files in db format?

If so, just delete it to cleanup disk.

[jamesc]

Yes that's correct, e.g:

2012-03-01.db
2012-03-02.db
2012-03-03.db
2012-03-04.db

Do I just delete the .db file, simple as that?

Thanks for all your advice Marcello, you have been very helpful while i've been getting to grips with this excellent package :-)

[marcelloc]

@jamesc:

Do I just delete the .db file, simple as that?

Yes  :)

[jamesc]

Marcello, I notice when I disable the anvil daemon I get these warning messages in the log:

Mar  6 13:16:58 smtp postfix/smtpd[19050]: warning: connect to private/anvil: Connection refused
Mar  6 13:16:58 smtp postfix/smtpd[19050]: warning: problem talking to server private/anvil: Connection refused

When I run the postfix upgrade-configuration command, this is what happens:

[2.0.1-RELEASE][root@smtp.lab.local]/var/log(51): postfix upgrade-configuration
Editing /usr/local/etc/postfix/master.cf, adding missing entry for anvil service
Editing /usr/local/etc/postfix/master.cf, adding missing entry for postscreen TCP service

Then these lines are added back into master.cf:

anvil	  unix	-	-	n	-	1	anvil
#smtp      inet  n       -       n       -       1       postscreen

[marcelloc]

The disable anvil option was added to avoid delays between connections(maybe just for debug).

If you do not have this issue, leave it enabled.

[jamesc]

I have internal clients relaying directly to the Postfix box and the helper text suggests it should be disabled in this scenario?

anvil - Postfix session count and request rate control.
You can disable it if your server relays mail from internal clients to internet.

[marcelloc]

I do. :)

Take a look on mailscanner topic.