Postfix - antispam and relay package

Bittone66

Hello Guys,
I have been using Postfix Forwarder for more than a year with great success.
Now I moved the Pfsense VM to another server, upgraded to 2.1 and I have this problem:


Mar  5 18:38:08 pfsense postfix/smtpd[25953]: connect from www.archidata.it[87.241.18.18]
Mar  5 18:38:08 pfsense postfix/smtpd[25953]: warning: connect to private/anvil: Connection refused
Mar  5 18:38:08 pfsense postfix/smtpd[25953]: warning: problem talking to server private/anvil: Connection refused
Mar  5 18:38:09 pfsense postfix/smtpd[25953]: warning: connect to private/anvil: Connection refused
Mar  5 18:38:09 pfsense postfix/smtpd[25953]: warning: problem talking to server private/anvil: Connection refused
Mar  5 18:38:09 pfsense postfix/smtpd[25953]: NOQUEUE: reject: RCPT from www.archidata.it[87.241.18.18]: 450 4.1.1 <xxxx@alfa.it>: Recipient address rejected: unverified address: connect to 172.16.16.20[172.16.16.20]:25: Operation timed out; from= <xxxxxx@archidata.it>to= <xxxxxx@alfa.it>proto=ESMTP helo= <www.archidata.it>Mar  5 18:38:09 pfsense postfix/smtpd[25953]: warning: connect to private/anvil: Connection refused
Mar  5 18:38:09 pfsense postfix/smtpd[25953]: warning: problem talking to server private/anvil: Connection refused
Mar  5 18:38:10 pfsense postfix/smtpd[25953]: warning: connect to private/anvil: Connection refused
Mar  5 18:38:10 pfsense postfix/smtpd[25953]: warning: problem talking to server private/anvil: Connection refused
Mar  5 18:38:10 pfsense postfix/smtpd[25953]: disconnect from www.archidata.it[87.241.18.18]</www.archidata.it></xxxxxx@alfa.it></xxxxxx@archidata.it></xxxx@alfa.it>

Looks similar to a previous problem in this forum flow, so I tried forwarding to localhost and setting Postifx to listen on localhost but the error remains.

Now I'm forwarding directly to the DMZ in order to have email delivered (yes, the real mail server listens and works on 172.16.16.20:25).
I did not setup the LDAP verification of recipient since I'll leave it to the mail server (no problem with load).
One more thing: I disabled anvil and always get the anvil communication error.
I already removed and re-installed the forwarder 3 times with no success.
Thanks for your kind attention and support

Alberto

Bittone66

Hello,
I took a alook at the enrated main.cf and, as far as I know, the entire section on smtpd_recipient_restrictions should not be there since my reicipient tab is empty and this is just a relay server.

Is there a way to tell the package not to write the whole section?
Thanks

Alberto

marcelloc

@Bittone66:

this is just a relay server.

Inbound or outbound?

@Bittone66:

Is there a way to tell the package not to write the whole section?

you can edit snort.inc and comment this part.

tfjelde

Hi all

I'm trying to get the mail search to work with no luck.

All setting are correct as fare as i know

Loggin Destination to /var/log/maillog
Update Sqlite frequency every minute
and i have inlcude /^Subject:/ WARN line in Acl Headers

doing a tail -f /var/log/maillog shows lines like this
postfix/cleanup[22445]: 9249F114D0: warning: header Subject: test from mail.####.no

But no other db files than postscreen_cache.db and verify_cache.db
is showing up in /var/db/postfix

2.1-RELEASE (i386)
built on Wed Sep 11 18:16:22 EDT 2013
FreeBSD 8.3-RELEASE-p11
Postfix 2.10.2 pkg v.2.3.7

Any suggestions on what to try next ?

Bittone66

Hi Marcello,
thanks for your kind attention.
It's juts an inboud relay to block spammers, I'm not uysing it as outbound relay.
One update: I removed the recipient section by editing postfx.inc file, still the problem of postfix not being able to communicate to the destination server on port 25 remains.
So I used the portforward to localhost and everything started working again.
Would you accept a "feature request" here like adding a "Don't verify recipients" checkbox to the interface in order not to generate thet part of the main.cf?
Bye

Alberto

JJYVON

Hi

Thanks Marcello for this great package.

someone can help me with the mail search function ?
I have made the configuration

To use Diagnostics -> Search mail you need to:
Select Loggin Destination to /var/log/maillog (done)
Select update Sqlite frequency (every minute)
Inlcude /^Subject:/ WARN line in Acl Headers after all your Subject rules (done)

.

In my var log i have the WARN for header

Apr 10 09:35:32 disbox-utm postfix/cleanup[9968]: D117313C4F4: warning: header Subject:

and some NOQUEUE

Apr 10 09:35:52 disbox-utm postfix/postscreen[8797]: NOQUEUE: reject: RCPT

yyyy-mm-dd.db are created in /var/db/postfix/ but they are empty

I dont understand what i'm doing wrong

Thanks for your help !

marcelloc

check if cron is set and try to run it on console.

JJYVON

Hi marcelloc
@marcelloc:

check if cron is set and try to run it on console.

My cron is empty

where is the commande i need to run in console

I have another question can i modify the message add to every mail

Ce message a été vérifié par MailScanner
pour des virus ou des polluriels et rien de
suspect n'a été trouvé.
MailScanner remercie transtec pour son soutien.

[update]

I have found the command normaly created with the GUI
I have found where i can edit the MailScanner
I think i have an issue with the interface when i modify something in the configuration, nothing change
I have add the LDAP in recipients no cron was created

My version of pfSENSE is : 2.1.2-RELEASE (amd64)
with this packages:

Postfixe Forwarder is 2.10.2 pkg v.2.3.7
MailScanner 4.84.6 pkg v.0.2.4
HAVP Antivirus 0.91_1 pkg v1.01
Squid3 0.91_1 pkg v1.01
squidGuard-squid3 1.4_4 pkg v.1.9.5

I think i have an issu with the GUI

Thanks.

dneuhaeuser

Hi,

I think I found a small bug in the current version of the postfix forwarder package.

If I set postfix to only listen on my WAN interface, I get a not working configuration:

The connection to my internal mailserver is refused, although everything else is configured right and the mailserver is in fact reachable!
The log states "relay=none" (??)

–--
Apr 18 17:41:03 fw postfix/smtp[40257]: connect to 192.168.135.10[192.168.135.10]:25: Connection refused
Apr 18 17:41:03 fw postfix/smtp[40257]: 8FAAE3C04BA: to=administrator@mydomain.de, relay=none, delay=566, delays=566/0.01/0.02/0, dsn=4.4.1, status=deferred (connect to 192.168.135.10[192.168.135.10]:25: Connection refused)
–--

If I select "Listen on all interfaces/ip addresses" instead, it starts working and the mails are delivered:

–--
Apr 18 17:50:53 fw postfix/postfix-script[921]: refreshing the Postfix mail system
Apr 18 17:50:53 fw postfix/master[9869]: reload – version 2.10.2, configuration /usr/pbi/postfix-i386/etc/postfix
Apr 18 17:50:53 fw postfix/master[9869]: warning: service 25: ignoring inet_interfaces change
Apr 18 17:50:53 fw postfix/master[9869]: warning: to change inet_interfaces, stop and start Postfix
Apr 18 17:50:53 fw postfix/qmgr[1595]: 8FAAE3C04BA: from=the@sender.de, size=236, nrcpt=1 (queue active)
Apr 18 17:50:54 fw postfix/smtp[2007]: 8FAAE3C04BA: to=administrator@mydomain.de, relay=192.168.135.10[192.168.135.10]:25, delay=1156, delays=1156/0.01/0.03/0.51, dsn=2.6.0, status=sent (250 2.6.0 0a3df1d7-0ec3-4338-ad9d-7bdd1509cc6f@SBS2011.company.local [InternalId=7375] Queued mail for delivery)
–--

BUT only until the next RESTART of postfix service!

Then I get this error:

–---
Apr 18 17:53:07 fw postfix/postfix-script[26351]: starting the Postfix mail system
Apr 18 17:53:07 fw postfix/master[26926]: fatal: /usr/pbi/postfix-i386/etc/postfix/master.cf: line 1: no valid IP address found: 25
Apr 18 17:53:08 fw postfix/master[26649]: fatal: daemon initialization failure
Apr 18 17:53:09 fw postfix/postfix-script[27153]: fatal: mail system startup failed
–---

The problem could be that the parameter "inet_interfaces" in main.cf is set to an empty value.
Shouldn't this be set to "all" in this case?

A currently working setup for me is to select all three "LAN + WAN + loopback" as listen interfaces!

In an older version of postfix package this wasn't necessary.

Regards
Dennis/administrator@mydomain.de /the@sender.de /administrator@mydomain.de

brokendash

I too am having the same issue after upgrading to 2.1.2 i386, gathering info for more detailed post.

biggsy

Listen on loopback instead.

Have a read of this: https://forum.pfsense.org/index.php?topic=70541.0

brokendash

How do you handle IPv6? My setup must listen on ipv6 as well as the IP4 addresses, not sure why things strayed from normal behavior of master.cf. If you specify multiple postscreen master.cf entries as is done when selecting multiple interfaces in the gui in the past would produce errors if multiple postscreen processes trying to hit a single runtime db. So unless someone can suggest an alternative I think that restoring the master.cf functionality to what was previously no issue is t

biggsy

postfix 2.11 was released in January and, among other things, it contains the following enhancement:

A new postscreen_dnsbl_whitelist_threshold feature to allow
clients to skip postscreen tests based on their DNSBL score.
This can eliminate email delays due to "after 220 greeting"
protocol tests, which otherwise require that a client reconnects
before it can deliver mail. Some providers such as Google don't
retry from the same IP address, and that can result in large
email delivery delays.

Any chance of an updated package based on postfix 2.11?

Bismarck

@biggsy:

postfix 2.11 was released in January and, among other things, it contains the following enhancement:

A new postscreen_dnsbl_whitelist_threshold feature to allow
clients to skip postscreen tests based on their DNSBL score.
This can eliminate email delays due to "after 220 greeting"
protocol tests, which otherwise require that a client reconnects
before it can deliver mail. Some providers such as Google don't
retry from the same IP address, and that can result in large
email delivery delays.

Any chance of an updated package based on postfix 2.11?

Oh yes please!

childrenofsolium

Hello

Is there any way to configure ssl authentication on the relay server? my mail server is configured to listen on port 465 with ssl and I don't know how to relay the messages to that port

Best regards, ChildrenOfSolium

dsy

Hello

I would like to disable all anti-spam in postfix because I use a custom Milter plugin.
How can I disable reject_unknown_sender_domain or smtpd_helo_required ?

Thank you.

Parameters in "custom mail.cf" field are not applied because of precedence as you can see:

mynetworks = /usr/pbi/postfix-i386/etc/postfix/mynetwork_table
mynetworks_style = host
access_map_reject_code= 554
access_map_defer_code = 451
unverified_recipient_reject_code = 550
unknown_client_reject_code = 550
unknown_hostname_reject_code = 550
smtpd_sender_restrictions = permit # not applied!
smtpd_milters = inet:<milter ip="">:7830
milter_default_action = reject
show_user_unknown_table_name = no
smtpd_helo_required = no # not applied!
bounce_queue_lifetime = 0d
relay_domains = mydomain.com
transport_maps = hash:/usr/pbi/postfix-i386/etc/postfix/transport
local_recipient_maps =
relay_recipient_maps = hash:/usr/pbi/postfix-i386/etc/postfix/relay_recipients
mydestination =
mynetworks_style = host
message_size_limit = 10240000
default_process_limit = 100
#Just reject after helo,sender,client,recipient tests
smtpd_delay_reject = yes

# Don't talk to mail systems that don't know their own hostname.
smtpd_helo_required = yes

smtpd_sender_restrictions = reject_unknown_sender_domain,
				permit</milter>

yaboc

@Bismarck:

@biggsy:

postfix 2.11 was released in January and, among other things, it contains the following enhancement:

A new postscreen_dnsbl_whitelist_threshold feature to allow
clients to skip postscreen tests based on their DNSBL score.
This can eliminate email delays due to "after 220 greeting"
protocol tests, which otherwise require that a client reconnects
before it can deliver mail. Some providers such as Google don't
retry from the same IP address, and that can result in large
email delivery delays.

Any chance of an updated package based on postfix 2.11?

Oh yes please!

second that!

biggsy

Sorry, yaboc, Bismarck is second. You'll have to go third :)

If Google is your main problem and you missed this post, give it a try.

It is a bit of a "broad brush" but it's been working well for me.

wawawawa

Hi All

I have the postfix package all set up and working, forwarding all incoming mail to a next hop internal MTA.

I would also like to BCC all mail to an address used by an external mail scanning system.

As far as I understand, this should be as easy as adding the following line to the custom main.cf section in the pfSense WebUI:

always_bcc = archive@ <internal ip="" of="" mta="">However… It's not working.

Does anyone have any suggestions to troubleshoot this or an alternate way to achieve the same end-result.

Many thanks for your time!

Cheers</internal>

malteG

Hi Guys,

i am just new here although i am using pfsense since a while for different purposes in a vmware environment.
So far i am really happy.

But i have one concern & problem i discovered today around the postfix-forwarder package :

Domains added in the "forward" tab shouldn't be added to relay_domains in main.cf per default.
Since transports and relay_domains are two totally different things.

I'd suggest to run a regex over the aggregated relay_recipients and filter out the domain parts and include those automatically
or make a checkbox next to each domain to include it in relay_domains.
But still this doesn't make much sense and i cannot see the reason in defining a specific transport - and then delivery to these domains fails since the recipients in that domain are not listed in relay_recipients…

And yes it makes sense, to separate, just think about having several vpn connections - so you want to send mail from i.e. branch offices to main offices to the internal mail server via vpn, without knowing who is a valid recipient there.
Otherwise callback verify should be enabled, so on delivery attempts to domains in the transport section postfix runs a test against the defined mail server to check if that one is accepting mail for that recipient.

Anyway some might say this should be properly solved with DNS - but i tend to disagree since this is rendering the transports useless.

What do you guys think ?
For now, i fixed it by putting my actual relay_domains into postfix.inc and commented out the part where it adds the transport domains to relay_domains.