Postfix - antispam and relay package

[marcelloc]

@jamesc:

I did, but no mention of the anvil daemon on there, unless i'm missing something obvious?

If you are having no issues with anvil, just leave it enabled.

[ktims]

@marcelloc:

Try to paste this options on custom field.

This works of course, a decent UI for it was just a suggestion :).

[Sn3ak]

Can this package be used as a secondary MX in it's current form? ie. No internal email servers.
My primary email server is co-located at another location then this pfsense box.

I honestly haven't installed the package yet, as I still have a bad taste in my mouth after installing
spamd once, and there being no warning that it would automatically start eatting email without it
being configured.

I've previously used the jails package and used ran a jail for email, but after being blown away for a clean
2.0 upgrade, and noticing this package, I thought it would be rather nice if it was able to do this.

I have read the thread, and searched the forum / wiki, and either this hasn't been answered, or I'm not searching
for the right phrases.

I know I could rtfm, and probably make this package do what I need, but that is not really what I am after, unless
there is a text box or some such for custom strings that will survive a package reinstall/upgrade/etc.

If it's not directly supported, could it be added to the todo list?

As a secondary question, (while cringing..)  has anyone tried this package with the spamd package? Just wondering
if a warning should be added on here about those.. I'm guessing the way spamd grabs control it wouldn't be compatible
with this package..

[marcelloc]

This package is not compatible with spamd if you want to use postfix to filter spam and bad configured/fake servers. Both need to be the fist contact from remote server.

Afaik, Spamd needs a forward mail server so That's why postfix first release was done for.

Postfix package has a lot of reports to help you identify What happened to rejected Message and postscreen(anti zombie)+ rbls + spf + header checks are very good on Message filtering.

Something this package does not act as a mail server and no plans to be, so no local mailboxes, just an inbound/outbound filter to another smtp server(s).

Mailscanner package implements more filtering options and antivirus to this MTA filtering solution.

If you are really good on postfix and believe That you have better config files to run postfix on pfsense, you can install postfix package itself and configure it by hand using filer package. This way all custom setup you have can be applied, just like I supose you did on jails.

Postfix forwarder has a custom field to save options That are not on gui.

Att,
Marcello Coutinho

[Sn3ak]

@marcelloc:

Something this package does not act as a mail server and no plans to be, so no local mailboxes, just an inbound/outbound filter to another smtp server(s).

A secondary MX wouldn't have local mailboxes (well a dedicated backup MX anyways). and is essentially the same thing, except storing the emails for
a potentially longer period of time if the primary mail server is down.

So, is the answer the same? If so, that's fine, again I can use my Jail solution, but a neat little appliance package would be cool.

[marcelloc]

Backup mx holding Messages until mx1 is back can be done wih this package. :)

I have also edited previous post while you where answering, take a look.

I think you will like postfix forwarder package. ;)

[Sn3ak]

Great, glad to hear. Actually I know very little about postfix, I've historically been a qmail guy.
Any pointers on setting it up as a backup mx? or am I going to need to add custom fields?

I think I will attempt to setup a vm (to be on the safe side) to test this with later this evening
if I get a chance.

[marcelloc]

Configure your mx1 to accept relay from mx2 and add mx1 on postfix config as an internal server.

Quite simple and full gui support for this setup. :)

Most all options has help,hints and link to oficial postfix documentation.

Just to know, I was a sendmail guy before decide to migrate this antispam solution to postfix.

[Sn3ak]

Perfect, I'll be giving it a shot. Thanks for the information.
Yeah, I used sendmail for a # of years before moving to qmail for an anti-spam solution
as amavisd wasn't really cutting it back then.

I'm tired of trying to figure out qmail logs when things break though, so I've been meaning
to try out postfix, and this is the perfect opportunity to kick the tires a little.

[Sn3ak]

Figured I would report my success. The package looks great.
It looks like Anvil Daemon is more or less required, otherwise
it spits out errors in the maillog, and seems to cause a small
connection delay as well (at least on my setup).

I turned off most of the protections, since it is a secondary
MX, and I wasn't doing any filtering previously, at least until
I have a chance to read up more as to what the settings do.

I am however however excited by the Valid recipients from clear
text url option. That will cut out a lot of the junk that gets stuck
in the secondary MX.

I'll need to read more about that, and find out the format of the
text file, and how often it polls, but that is a very nice option.

Thanks for the good work.

[marcelloc]

The format is

Email@domain.com ok
Admin@domain.com ok
.
.
.

As my active directory is on local lan, I've setup a 1h update frequecy.

[Sn3ak]

Thanks, I haven't had a chance to try that.. I do have another problem that you may be able to help me with.

It seems adding:
myhostname=mx02.example.com
smtp_helo_name=mx02.example.com

is ignored by postfix, at first it wasn't being added to main.cf, but finally that started working, however is being ignored.

postconf -d | grep example
mydomain = example.local
myhostname = pfsense.example.local

as well as smtp_helo_name =  not being respected if changed either.

I'm attempting to change the name to my correct external hostname so other email servers (including my primary) don't get
upset due to the .local address

[marcelloc]

Change pfsense host and domain info on system settings.

Did you tried to paste this config on custom field and then checking config file?

[Sn3ak]

Sorry for the late reply, as it turns out the settings did take, however postconf -d
doesn't reflect it, and, using telnet on localhost apparently uses the default and
ignores the setting.

Would it be possible to add a delete option in the queue screen, since you are already displaying the Message ID?
Command would be postsuper -d msgID. Also maybe another button at the bottom for deleting all Mailer-Daemon
emails? Command would be: mailq | grep -v "^[^0-9A-Z]" | grep MAILER-DAEMON | awk '{print $1}' | xargs postsuper -d

If nothing else, I can probably submit patches, as long as you are interested in including them.

[marcelloc]

Good to know this package is being usefull for you. :)

Did you applied postfix conf after changing machine name and domain?

Patches and improvements are welcome, let me test it first before publishing.

[Popupgbg]

Split domain mail functionality

I don´t know if this package can do this but it would be nice to have it with a GUI. I know that sometimes hosting providers is using Postfix to provide a split domain functionality on mailservice. The use Postfix to receive all mails addressed to different recipients in different domains in Postfix. They setup the possibility to forward incoming mail so that mail to a@domain.com  is sent to an POP server and mail to b@domain.com to an Exchange server. This due to the fact that all users in an organization don´t need the functionality of an Exchange server.
This is my request  :)

/Thanks

[madas]

Hello,

I'm trying to modify this part of the main.cf to remove the reject_unknown_sender_domain

–--------------
smtpd_sender_restrictions = reject_unknown_sender_domain,
permit

My server is using a remote DNS so I cannot add a A or MX record for some of my local servers so I need to remove this option (or add a permit_mynetworks above it).

I cannot seem to do this anyway in the gui.  I can do it manually but it seems to be overwritten shortly after.

Any ideas?

Thanks

M

[marcelloc]

Madas,

Include your hosts on my network acl.

[madas]

I have.  The reject_unknown_sender_domain seems to be bouncing the message before the network ACL's are checked.

[marcelloc]

@madas:

I have.  The reject_unknown_sender_domain seems to be bouncing the message before the network ACL's are checked.

It will work if you create this dummy domain on your internal dns and point pfsense to use it.