Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Postfix - antispam and relay package

    Scheduled Pinned Locked Moved
    pfSense Packages
    136
    855
    925.9k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      biggsy
      last edited by

      Regarding my post above about /usr/local/etc/postfix/helo_check

      I created a plain text file with one line similar to this:

      /^my.domain.com/ REJECT

      The error has gone away and postfix is forwarding mail again.  I have no idea why this file was suddenly wanted by postfix but it almost certainly happened after an upgrade to the latest 2.1 snap and the subsequent re-install of postfix.

      I also suspect the file should probably have been looked for in: /usr/pbi/postfix-amd64/etc/postfix/

      (The code above also stops remote SMTP clients from trying to claim they are part of my own domain.)

      1 Reply Last reply Reply Quote 0
      • marcellocM
        marcelloc
        last edited by

        @biggsy:

        Regarding my post above about /usr/local/etc/postfix/helo_check
        The error has gone away and postfix is forwarding mail again.  I have no idea why this file was suddenly wanted by postfix but it almost certainly happened after an upgrade to the latest 2.1 snap and the subsequent re-install of postfix.

        I also suspect the file should probably have been looked for in: /usr/pbi/postfix-amd64/etc/postfix/

        (The code above also stops remote SMTP clients from trying to claim they are part of my own domain.)

        I've included this helo check on latest version, but forgot to include folder check on it.

        It's fixed now.

        Thanks for your feedback. :)

        Treinamentos de Elite: http://sys-squad.com

        Help a community developer! ;D

        1 Reply Last reply Reply Quote 0
        • B
          biggsy
          last edited by

          It's fixed now.

          Indeed it is.

          Thank you once again marcelloc  :)

          1 Reply Last reply Reply Quote 0
          • R
            r00tm4n
            last edited by

            Hello Marcello,

            Very nice work (um trabalho extraordinario!), congrats!

            I would like to migrate my smtp proxy to something that
            is able to count emails per user per minutes or hours and
            be able to limit that.
            Can pfSense do that?

            1 Reply Last reply Reply Quote 0
            • marcellocM
              marcelloc
              last edited by

              @r00tm4n:

              Very nice work (um trabalho extraordinario!), congrats!

              Thanks!:)

              @r00tm4n:

              I would like to migrate my smtp proxy to something that
              is able to count emails per user per minutes or hours and
              be able to limit that.
              Can pfSense do that?

              Not on current version, but postfwd can do that.

              http://www.postfix.org/SMTPD_POLICY_README.html
              http://postfwd.org/

              Treinamentos de Elite: http://sys-squad.com

              Help a community developer! ;D

              1 Reply Last reply Reply Quote 0
              • B
                biggsy
                last edited by

                Here's another one for you marcelloc:

                I just noticed that postfix forwarder on 2.1 BETA 1 amd64 does not pick up descriptive names (e.g., "DMZ") for OPT interfaces. It does on my 2.0.2 install.

                Also, the package description is "Not available" under Status > Services.

                Both of the above are only cosmetic changes but you may not have noticed them.  :)

                ![2013-05-16 19-51-31.png](/public/imported_attachments/1/2013-05-16 19-51-31.png)
                ![2013-05-16 19-51-31.png_thumb](/public/imported_attachments/1/2013-05-16 19-51-31.png_thumb)

                1 Reply Last reply Reply Quote 0
                • I
                  ics
                  last edited by

                  I have an Exchange Server that sends outgoing emails through pfSense.
                  The recipient can see the local hostname and private IP address of the Exchange server in the header of the email.
                  Is there a way to hide this ?

                  Thanks

                  1 Reply Last reply Reply Quote 0
                  • D
                    dhatz
                    last edited by

                    @ics:

                    I have an Exchange Server that sends outgoing emails through pfSense.
                    The recipient can see the local hostname and private IP address of the Exchange server in the header of the email.
                    Is there a way to hide this ?

                    It's not such as big deal, in fact even Google's Gmail "reveals" its internal IPs / hostnames in the Received headers.

                    Anyway, if you really want to remove all traces of your local hostnames & IPs, you can use Postfix's
                    header_checks =
                    to instruct Postfix to ignore (i.e. delete when forwarding mail) certain "Received: " lines.
                    However I don't know if pfSense's Postfix package allows you to configure this feature from the webGUI.

                    Btw could someone please comment on my question a few days ago: "Is the per process memory usage of 200M+ normal ?"

                    1 Reply Last reply Reply Quote 0
                    • I
                      ics
                      last edited by

                      @dhatz:

                      It's not such as big deal, in fact even Google's Gmail "reveals" its internal IPs / hostnames in the Received headers.

                      Anyway, if you really want to remove all traces of your local hostnames & IPs, you can use Postfix's
                      header_checks =
                      to instruct Postfix to ignore (i.e. delete when forwarding mail) certain "Received: " lines.
                      However I don't know if pfSense's Postfix package allows you to configure this feature from the webGUI.

                      Btw could someone please comment on my question a few days ago: "Is the per process memory usage of 200M+ normal ?"

                      Thanks, I'll try that.

                      For me it's not normal that the process takes more than 200M as it was not the case in the previous version of pFsense.
                      But Marcello said that it's a normal behavior with low memory machines.
                      Then I added RAM up to 2GB and the process indeed takes about 68MB…

                      So now the process takes less RAM but for that I had to increase server RAM...Weird !

                      1 Reply Last reply Reply Quote 0
                      • V
                        virusbcn
                        last edited by

                        Hello Marcelo, i have one question, i have a mail server behind a pfsense, one postfix mail server with 20 domains and 200 users aprox, if i install this package what is the more easy way to config this, to make my first level barrier of spam in pfsense ¿???  i don't want put all domains or users or ldap sync with my server :-(  It is this possible ??

                        1 Reply Last reply Reply Quote 0
                        • B
                          biggsy
                          last edited by

                          …one postfix mail server with 20 domains and 200 users...

                          If you are running a postfix mailserver I doubt that you get much benefit from running the postfix forwarder in pfSense. (You didn't mention postfix in your other post.)  Maybe you just need to configure the postfix mailserver to do what you need.

                          1 Reply Last reply Reply Quote 0
                          • marcellocM
                            marcelloc
                            last edited by

                            @virusbcn:

                            what is the more easy way to config this, to make my first level barrier of spam in pfsense ¿???

                            Follow default options on gui, it will be easy  :)

                            @virusbcn:

                            I don't want put all domains or users or ldap sync with my server :-(   It is this possible ??

                            you have to configure it on pfsense to filter unknow domains, mailboxes, spf, forged sender domains, etc, etc ,etc during message header. this way, you save bandwidth while rejecting most spams before they send data.

                            Treinamentos de Elite: http://sys-squad.com

                            Help a community developer! ;D

                            1 Reply Last reply Reply Quote 0
                            • D
                              DQM
                              last edited by

                              Dear Marcello,

                              Thank you once again for the package ! My mail gateway is running well.

                              I have some questions:

                              • Did you updated it to 2.10.0 version? Is that correct? Because I saw on the Package Management of my pfsense box (pls see the attached file for more details).
                              • Does new version work smoothly? Does it has any new features? (Ex: SMTP Relay server by authentication or Trusted IPs methods)

                              Looking forward to hearing from you soon.

                              Best regards,
                              DQM

                              postfix.jpg
                              postfix.jpg_thumb

                              1 Reply Last reply Reply Quote 0
                              • marcellocM
                                marcelloc
                                last edited by

                                @DQM:

                                • Did you updated it to 2.10.0 version? Is that correct? Because I saw on the Package Management of my pfsense box (pls see the attached file for more details).

                                Yes. 2.10 is the latest stable version.

                                @DQM:

                                • Does new version work smoothly? Does it has any new features? (Ex: SMTP Relay server by authentication or Trusted IPs methods)

                                Yes. The new feature on gui is an helo acl and new sync code and also working on pfsense 2.1 .
                                I'll include some thay mem cache for postscreen. I'm running my antispam boxes without issues with postfix 2.10.

                                Treinamentos de Elite: http://sys-squad.com

                                Help a community developer! ;D

                                1 Reply Last reply Reply Quote 0
                                • D
                                  DQM
                                  last edited by

                                  @marcelloc:

                                  @DQM:

                                  • Did you updated it to 2.10.0 version? Is that correct? Because I saw on the Package Management of my pfsense box (pls see the attached file for more details).

                                  Yes. 2.10 is the latest stable version.

                                  @DQM:

                                  • Does new version work smoothly? Does it has any new features? (Ex: SMTP Relay server by authentication or Trusted IPs methods)

                                  Yes. The new feature on gui is an helo acl and new sync code and also working on pfsense 2.1 .
                                  I'll include some thay mem cache for postscreen. I'm running my antispam boxes without issues with postfix 2.10.

                                  Thanks for your information, Marcello !

                                  1 Reply Last reply Reply Quote 0
                                  • V
                                    virusbcn
                                    last edited by

                                    @marcelloc:

                                    @virusbcn:

                                    what is the more easy way to config this, to make my first level barrier of spam in pfsense ¿???

                                    Follow default options on gui, it will be easy  :)

                                    @virusbcn:

                                    I don't want put all domains or users or ldap sync with my server :-(   It is this possible ??

                                    you have to configure it on pfsense to filter unknow domains, mailboxes, spf, forged sender domains, etc, etc ,etc during message header. this way, you save bandwidth while rejecting most spams before they send data.

                                    Thank you Marcelo i try to search some information to sync ldap with my postfix server and try to make some tests, and search for get some free time :-(

                                    1 Reply Last reply Reply Quote 0
                                    • B
                                      biggsy
                                      last edited by

                                      I decided to auto-start my test pfSense 2.1 VM when booting ESXi - postfix failed to start and left the following log entries:

                                      User.Error	192.168.111.51	May 24 16:35:28 php: : Stopping postfix
User.Error	192.168.111.51	May 24 16:35:28 php: : Stopping postfix
Mail.Critical	192.168.111.51	May 24 16:35:28 postfix/postfix-script[17736]: fatal: the Postfix mail system is not running
User.Error	192.168.111.51	May 24 16:35:28 php: : The command '/usr/local/etc/rc.d/postfix.sh stop' returned exit code '1', the output was '/usr/pbi/postfix-amd64/sbin/postconf: warning: /usr/pbi/postfix-amd64/etc/postfix/master.cf: unused parameter: user=postfix'
Mail.Critical	192.168.111.51	May 24 16:35:28 postfix/postfix-script[17885]: fatal: the Postfix mail system is not running
User.Error	192.168.111.51	May 24 16:35:28 php: : The command '/usr/local/etc/rc.d/postfix.sh stop' returned exit code '1', the output was '/usr/pbi/postfix-amd64/sbin/postconf: warning: /usr/pbi/postfix-amd64/etc/postfix/master.cf: unused parameter: user=postfix'
Syslog.Error	192.168.111.51	May 24 16:35:29 syslogd: exiting on signal 15
Kernel.Info	192.168.111.51	May 24 16:35:30 syslogd: kernel boot file is /boot/kernel/kernel
User.Error	192.168.111.51	May 24 16:35:29 php: : Writing out configuration
Syslog.Error	192.168.111.51	May 24 16:35:30 syslogd: exiting on signal 15
Kernel.Info	192.168.111.51	May 24 16:35:30 syslogd: kernel boot file is /boot/kernel/kernel
User.Error	192.168.111.51	May 24 16:35:30 php: : Writing out configuration
User.Error	192.168.111.51	May 24 16:35:32 php: : Writing rc_file
User.Error	192.168.111.51	May 24 16:35:32 php: : Writing rc_file
User.Error	192.168.111.51	May 24 16:35:33 php: : Stopping postfix
Mail.Critical	192.168.111.51	May 24 16:35:33 postfix/postfix-script[27296]: fatal: the Postfix mail system is not running
User.Error	192.168.111.51	May 24 16:35:33 php: : The command '/usr/local/etc/rc.d/postfix.sh stop' returned exit code '1', the output was '/usr/pbi/postfix-amd64/sbin/postconf: warning: /usr/pbi/postfix-amd64/etc/postfix/master.cf: unused parameter: user=postfix'
User.Error	192.168.111.51	May 24 16:35:33 php: : Stopping postfix
User.Error	192.168.111.51	May 24 16:35:34 php: : The command '/usr/local/etc/rc.d/postfix.sh stop' returned exit code '126', the output was '/usr/local/etc/rc.d/postfix.sh: Permission denied'
User.Notice	192.168.111.51	May 24 16:35:34 check_reload_status: Syncing firewall
Syslog.Error	192.168.111.51	May 24 16:35:34 syslogd: exiting on signal 15
Kernel.Info	192.168.111.51	May 24 16:35:35 syslogd: kernel boot file is /boot/kernel/kernel
User.Error	192.168.111.51	May 24 16:35:35 php: : Writing out configuration
Syslog.Error	192.168.111.51	May 24 16:35:35 syslogd: exiting on signal 15
Kernel.Info	192.168.111.51	May 24 16:35:36 syslogd: kernel boot file is /boot/kernel/kernel
User.Error	192.168.111.51	May 24 16:35:36 php: : Writing out configuration
User.Error	192.168.111.51	May 24 16:35:38 php: : Writing rc_file
User.Error	192.168.111.51	May 24 16:35:38 php: : Writing rc_file
User.Error	192.168.111.51	May 24 16:35:39 php: : Stopping postfix
User.Error	192.168.111.51	May 24 16:35:39 php: : Stopping postfix
Mail.Critical	192.168.111.51	May 24 16:35:39 postfix/postfix-script[39090]: fatal: the Postfix mail system is not running
User.Error	192.168.111.51	May 24 16:35:39 php: : The command '/usr/local/etc/rc.d/postfix.sh stop' returned exit code '1', the output was '/usr/pbi/postfix-amd64/sbin/postconf: warning: /usr/pbi/postfix-amd64/etc/postfix/master.cf: unused parameter: user=postfix'
User.Error	192.168.111.51	May 24 16:35:39 php: : The command '/usr/local/etc/rc.d/postfix.sh stop' returned exit code '126', the output was '/usr/local/etc/rc.d/postfix.sh: Permission denied'
Syslog.Error	192.168.111.51	May 24 16:35:41 syslogd: exiting on signal 15
Kernel.Info	192.168.111.51	May 24 16:35:42 syslogd: kernel boot file is /boot/kernel/kernel
User.Error	192.168.111.51	May 24 16:35:41 php: : Writing out configuration
Syslog.Error	192.168.111.51	May 24 16:35:42 syslogd: exiting on signal 15
Kernel.Info	192.168.111.51	May 24 16:35:42 syslogd: kernel boot file is /boot/kernel/kernel
User.Error	192.168.111.51	May 24 16:35:42 php: : Writing out configuration
User.Error	192.168.111.51	May 24 16:35:44 php: : Writing rc_file
User.Error	192.168.111.51	May 24 16:35:44 php: : Writing rc_file
User.Error	192.168.111.51	May 24 16:35:45 php: : Stopping postfix
User.Error	192.168.111.51	May 24 16:35:45 php: : Stopping postfix
Mail.Critical	192.168.111.51	May 24 16:35:45 postfix/postfix-script[50014]: fatal: the Postfix mail system is not running
User.Error	192.168.111.51	May 24 16:35:45 php: : The command '/usr/local/etc/rc.d/postfix.sh stop' returned exit code '1', the output was '/usr/pbi/postfix-amd64/sbin/postconf: warning: /usr/pbi/postfix-amd64/etc/postfix/master.cf: unused parameter: user=postfix'
User.Error	192.168.111.51	May 24 16:35:45 php: : The command '/usr/local/etc/rc.d/postfix.sh stop' returned exit code '126', the output was '/usr/local/etc/rc.d/postfix.sh: Permission denied'
User.Notice	192.168.111.51	May 24 16:35:46 check_reload_status: Syncing firewall
Syslog.Error	192.168.111.51	May 24 16:35:46 syslogd: exiting on signal 15
Kernel.Info	192.168.111.51	May 24 16:35:47 syslogd: kernel boot file is /boot/kernel/kernel
User.Error	192.168.111.51	May 24 16:35:47 php: : Writing out configuration
Syslog.Error	192.168.111.51	May 24 16:35:47 syslogd: exiting on signal 15
Kernel.Info	192.168.111.51	May 24 16:35:48 syslogd: kernel boot file is /boot/kernel/kernel
User.Error	192.168.111.51	May 24 16:35:47 php: : Writing out configuration
User.Error	192.168.111.51	May 24 16:35:49 php: : Writing rc_file
User.Error	192.168.111.51	May 24 16:35:49 php: : Writing rc_file
User.Error	192.168.111.51	May 24 16:35:50 php: : Stopping postfix
User.Error	192.168.111.51	May 24 16:35:50 php: : Stopping postfix
Mail.Critical	192.168.111.51	May 24 16:35:50 postfix/postfix-script[59480]: fatal: the Postfix mail system is not running
User.Error	192.168.111.51	May 24 16:35:50 php: : The command '/usr/local/etc/rc.d/postfix.sh stop' returned exit code '1', the output was '/usr/pbi/postfix-amd64/sbin/postconf: warning: /usr/pbi/postfix-amd64/etc/postfix/master.cf: unused parameter: user=postfix'
User.Error	192.168.111.51	May 24 16:35:50 php: : The command '/usr/local/etc/rc.d/postfix.sh stop' returned exit code '126', the output was '/usr/local/etc/rc.d/postfix.sh: Permission denied'
Syslog.Error	192.168.111.51	May 24 16:35:51 syslogd: exiting on signal 15
Kernel.Info	192.168.111.51	May 24 16:35:51 syslogd: kernel boot file is /boot/kernel/kernel
User.Error	192.168.111.51	May 24 16:35:51 php: : Writing out configuration
Syslog.Error	192.168.111.51	May 24 16:35:51 syslogd: exiting on signal 15
Kernel.Info	192.168.111.51	May 24 16:35:51 syslogd: kernel boot file is /boot/kernel/kernel
User.Error	192.168.111.51	May 24 16:35:53 php: : Writing rc_file
User.Error	192.168.111.51	May 24 16:35:53 php: : Writing rc_file
User.Error	192.168.111.51	May 24 16:35:54 php: : Stopping postfix
Mail.Critical	192.168.111.51	May 24 16:35:54 postfix/postfix-script[70188]: fatal: the Postfix mail system is not running
User.Error	192.168.111.51	May 24 16:35:54 php: : The command '/usr/local/etc/rc.d/postfix.sh stop' returned exit code '1', the output was '/usr/pbi/postfix-amd64/sbin/postconf: warning: /usr/pbi/postfix-amd64/etc/postfix/master.cf: unused parameter: user=postfix'
User.Error	192.168.111.51	May 24 16:35:54 php: : Stopping postfix
User.Error	192.168.111.51	May 24 16:35:54 php: : The command '/usr/local/etc/rc.d/postfix.sh stop' returned exit code '126', the output was '/usr/local/etc/rc.d/postfix.sh: Permission denied'
Kernel.Critical	192.168.111.51	May 24 16:35:56 kernel: VMware memory control driver initialized
Auth.Info	192.168.111.51	May 24 16:35:57 login: login on ttyv0 as root
System4.Notice	192.168.111.51	May 24 16:35:57 sshlockout[84092]: sshlockout/webConfigurator v3.0 starting up
Auth.Emerg	192.168.111.51	May 24 16:56:29 php: /index.php: Successful login for user 'admin' from: 192.168.111.7
Auth.Emerg	192.168.111.51	May 24 16:56:29 php: /index.php: Successful login for user 'admin' from: 192.168.111.7
Auth.Emerg	192.168.111.51	May 24 16:56:29 php: /index.php: Successful login for user 'admin' from: 192.168.111.7
User.Error	192.168.111.51	May 24 16:57:21 php: /status_services.php: The command '/usr/local/etc/rc.d/postfix.sh stop' returned exit code '126', the output was '/usr/local/etc/rc.d/postfix.sh: Permission denied'
Mail.Warning	192.168.111.51	May 24 16:57:24 postfix/postfix-script[62930]: warning: not owned by root: /var/spool/postfix
Mail.Info	192.168.111.51	May 24 16:57:24 postfix/postfix-script[67208]: starting the Postfix mail system
Mail.Info	192.168.111.51	May 24 16:57:24 postfix/master[67631]: daemon started -- version 2.10.0, configuration /usr/pbi/postfix-amd64/etc/postfix

                                      Started fine from the service status page though.

                                      1 Reply Last reply Reply Quote 0
                                      • B
                                        biggsy
                                        last edited by

                                        Just realized that I did an update to the latest 2.1 snap last night and forgot to re-enable postfix and pfBlocker.

                                        Why aren't these two packages re-enabled automatically after updating, if they were enabled before?

                                        1 Reply Last reply Reply Quote 0
                                        • marcellocM
                                          marcelloc
                                          last edited by

                                          @biggsy:

                                          Why aren't these two packages re-enabled automatically after updating, if they were enabled before?

                                          The uninstall process disables it.

                                          Treinamentos de Elite: http://sys-squad.com

                                          Help a community developer! ;D

                                          1 Reply Last reply Reply Quote 0
                                          • B
                                            buv
                                            last edited by

                                            Hi Marcello,

                                            first of all thank you very much for this excellent module! It makes my work much easier, since I am not really a postfix specialist.

                                            @marcelloc:

                                            I've never seen this error during package install.

                                            check if pkg_info return two postfix installs or something.

                                            EDIT:

                                            Let me know if this feature works with zimbra ldap.
                                            It's written for Active directory ldap search.

                                            att,
                                            Marcello Coutinho

                                            I am using the package in combination with the Zimbra mail server. When I try to do the recipient retrival via LDAP, I come to a limitation which has its cause in the different LDAP structure of Zimbra compared to MS AD. Looking at the query your module submits, I see that it is expecting a SAMAccount. This entity is not present in the Zimbra LDAP. The Zimbra LDAP structure looks like the following:

                                            dc=tld
                                                dc=mydomain
                                                  ou=people
                                                    uid= <user id1="">mail=u1@b.c
                                                      mail=u1_alias1@b.c
                                                      mail=u1_alias2@b.c
                                                      …
                                                    uid= <user id2="">mail=u2@b.c
                                                      mail=u2_alias1@b.c
                                                      ...

                                            uid is of types inetOrgPerson, zimbraAccount and amavisAccount. Is it possible for me to modify the query in one of the config files, or does it require a change in the source code? Would you be interested in extending the LDAP part to include Zimbra queries? If so, I could prepare the query and provide it to you.

                                            Greetings,
                                            Burkhard</user></user>

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post