Postfix - antispam and relay package

marcelloc

biggsy,

Thanks for your feedback :)

ics

Hi All,

I've just updated package mailscanner-dev to v4.84.5_3 and upgraded pFsense to v2.0.3.
Now memory usage is very high. I don't know if it's due to package or pfsense update.
Postfix processes take very high memory (screen captures of sys activity in old and new version attached).

Do have an idea ?

Thanks

new_sys.png_thumb

old_sys.png_thumb

marcelloc

It's a normal behavior. You have low memory machines.

ics

Thank you Marcelloc

Indeed I have 1024MB.
But why processes use so much memory now ?
This is a huge difference !

biggsy

A strange new problem today with postfix forwarder on 2.1BETA amd64 test system. Config hadn't changed.

Received the following error:


postfix/smtpd[1783]: error: open /usr/local/etc/postfix/helo_check: No such file or directory
postfix/smtpd[1783]: connect from [i]mailserver.myisp[/i].com[[i]x.y.z.231]
postfix/smtpd[1783]: warning: pcre:/usr/local/etc/postfix/helo_check is unavailable. open /usr/local/etc/postfix/helo_check: No such file or directory
postfix/smtpd[1783]: warning: pcre:/usr/local/etc/postfix/helo_check: table lookup problem

~~EDIT: looks like it should be "helo_check_s_"~~

dhatz

Is the per process memory usage of 200M+ normal ?

I haven't used mailscanner before (just visited their website and they list some impressive installations), but for the past 6-7 years I have been running several Postfix systems using amavis to interface with antispam (spamassassin) and antiviruses (e.g. clamav) and postgrey and the overall memory usage is nowhere near those numbers …

biggsy

Regarding my post above about /usr/local/etc/postfix/helo_check

I created a plain text file with one line similar to this:

/^my.domain.com/ REJECT

The error has gone away and postfix is forwarding mail again. I have no idea why this file was suddenly wanted by postfix but it almost certainly happened after an upgrade to the latest 2.1 snap and the subsequent re-install of postfix.

I also suspect the file should probably have been looked for in: /usr/pbi/postfix-amd64/etc/postfix/

(The code above also stops remote SMTP clients from trying to claim they are part of my own domain.)

marcelloc

@biggsy:

Regarding my post above about /usr/local/etc/postfix/helo_check
The error has gone away and postfix is forwarding mail again. I have no idea why this file was suddenly wanted by postfix but it almost certainly happened after an upgrade to the latest 2.1 snap and the subsequent re-install of postfix.

I also suspect the file should probably have been looked for in: /usr/pbi/postfix-amd64/etc/postfix/

(The code above also stops remote SMTP clients from trying to claim they are part of my own domain.)

I've included this helo check on latest version, but forgot to include folder check on it.

It's fixed now.

Thanks for your feedback. :)

biggsy

It's fixed now.

Indeed it is.

Thank you once again marcelloc :)

r00tm4n

Hello Marcello,

Very nice work (um trabalho extraordinario!), congrats!

I would like to migrate my smtp proxy to something that
is able to count emails per user per minutes or hours and
be able to limit that.
Can pfSense do that?

marcelloc

@r00tm4n:

Very nice work (um trabalho extraordinario!), congrats!

Thanks!:)

@r00tm4n:

I would like to migrate my smtp proxy to something that
is able to count emails per user per minutes or hours and
be able to limit that.
Can pfSense do that?

Not on current version, but postfwd can do that.

http://www.postfix.org/SMTPD_POLICY_README.html
http://postfwd.org/

biggsy

Here's another one for you marcelloc:

I just noticed that postfix forwarder on 2.1 BETA 1 amd64 does not pick up descriptive names (e.g., "DMZ") for OPT interfaces. It does on my 2.0.2 install.

Also, the package description is "Not available" under Status > Services.

Both of the above are only cosmetic changes but you may not have noticed them. :)

![2013-05-16 19-51-31.png](/public/imported_attachments/1/2013-05-16 19-51-31.png)
![2013-05-16 19-51-31.png_thumb](/public/imported_attachments/1/2013-05-16 19-51-31.png_thumb)

ics

I have an Exchange Server that sends outgoing emails through pfSense.
The recipient can see the local hostname and private IP address of the Exchange server in the header of the email.
Is there a way to hide this ?

Thanks

dhatz

@ics:

I have an Exchange Server that sends outgoing emails through pfSense.
The recipient can see the local hostname and private IP address of the Exchange server in the header of the email.
Is there a way to hide this ?

It's not such as big deal, in fact even Google's Gmail "reveals" its internal IPs / hostnames in the Received headers.

Anyway, if you really want to remove all traces of your local hostnames & IPs, you can use Postfix's
header_checks =
to instruct Postfix to ignore (i.e. delete when forwarding mail) certain "Received: " lines.
However I don't know if pfSense's Postfix package allows you to configure this feature from the webGUI.

Btw could someone please comment on my question a few days ago: "Is the per process memory usage of 200M+ normal ?"

ics

@dhatz:

It's not such as big deal, in fact even Google's Gmail "reveals" its internal IPs / hostnames in the Received headers.

Anyway, if you really want to remove all traces of your local hostnames & IPs, you can use Postfix's
header_checks =
to instruct Postfix to ignore (i.e. delete when forwarding mail) certain "Received: " lines.
However I don't know if pfSense's Postfix package allows you to configure this feature from the webGUI.

Btw could someone please comment on my question a few days ago: "Is the per process memory usage of 200M+ normal ?"

Thanks, I'll try that.

For me it's not normal that the process takes more than 200M as it was not the case in the previous version of pFsense.
But Marcello said that it's a normal behavior with low memory machines.
Then I added RAM up to 2GB and the process indeed takes about 68MB…

So now the process takes less RAM but for that I had to increase server RAM...Weird !

virusbcn

Hello Marcelo, i have one question, i have a mail server behind a pfsense, one postfix mail server with 20 domains and 200 users aprox, if i install this package what is the more easy way to config this, to make my first level barrier of spam in pfsense ¿??? i don't want put all domains or users or ldap sync with my server :-( It is this possible ??

biggsy

…one postfix mail server with 20 domains and 200 users...

If you are running a postfix mailserver I doubt that you get much benefit from running the postfix forwarder in pfSense. (You didn't mention postfix in your other post.) Maybe you just need to configure the postfix mailserver to do what you need.

marcelloc

@virusbcn:

what is the more easy way to config this, to make my first level barrier of spam in pfsense ¿???

Follow default options on gui, it will be easy :)

@virusbcn:

I don't want put all domains or users or ldap sync with my server :-( It is this possible ??

you have to configure it on pfsense to filter unknow domains, mailboxes, spf, forged sender domains, etc, etc ,etc during message header. this way, you save bandwidth while rejecting most spams before they send data.

DQM

Dear Marcello,

Thank you once again for the package ! My mail gateway is running well.

I have some questions:

Did you updated it to 2.10.0 version? Is that correct? Because I saw on the Package Management of my pfsense box (pls see the attached file for more details).
Does new version work smoothly? Does it has any new features? (Ex: SMTP Relay server by authentication or Trusted IPs methods)

Looking forward to hearing from you soon.

Best regards,
DQM

postfix.jpg_thumb

marcelloc

@DQM:

Did you updated it to 2.10.0 version? Is that correct? Because I saw on the Package Management of my pfsense box (pls see the attached file for more details).

Yes. 2.10 is the latest stable version.

@DQM:

Does new version work smoothly? Does it has any new features? (Ex: SMTP Relay server by authentication or Trusted IPs methods)

Yes. The new feature on gui is an helo acl and new sync code and also working on pfsense 2.1 .
I'll include some thay mem cache for postscreen. I'm running my antispam boxes without issues with postfix 2.10.