Postfix - antispam and relay package

BenKenobe

No not using mailscanner - is it something worth using.

I currently have 'SpamD -> Postfix -> Mail Server' and it seems to be keeping the spammers at bay, has also stopped brute force attacks to port 25. I wish I didn't need SpamD because of the delays it creates with 'unknown' senders but I've not seen a single 'spammer' in any inbox today and only one brute force attempt to a mail port that I've since closed (I've now closed all NONE TLS ports except 25 - and that's routed through the filters)

I've got the mail server pretty well hardened, just need to resolve the reject message IP address now …

mschiek01

In the postix gui go to view config -> master cf and check and make sure you have this in the config

/sender_access,
reject_non_fqdn_helo_hostname,
reject_unknown_recipient_domain,
reject_non_fqdn_recipient,
reject_multi_recipient_bounce,
–-----> reject_unverified_recipient,
permit

also in client access list / my networks you only have your internal ip range listed correct?

BenKenobe

Only internal IP's correct, I commented out the 'reject' because I don't want it rejected - although it still gets rejected somehow - I even tried modifying the reject codes to 450 instead but it still returns the 550.1.1 which tells me it is using what the mail server sends back and not what I want it to. I've tried also the various SMTP privacy filters but it is hard to know which file to build them into - doesn't work in the custom commands for sure.

Remember I'm trying to stop spammers figuring out which address's exist by sending many e-mails each to a different username - the reject message is a dead giveaway - I want the offender tarpit'd and messed about as much as possible.

mschiek01

This may be your problem although I am not even sure what you are trying to do will work.

In the postfix gui ->"Domains to Forward" did you put information in here ?

In the postfix gui -> "Recipients" did you put information here ?

If you did both that is most likely your problem.

Postfix is receiving an email connection request and the first thing it is doing is checking the relay domain table and contacting the server which is saying not a good address and that is what postfix is replying. It doesn't matter what you put in the address verification as this is a second step not first.

You are basically using both methods. Which obviously will not work for what you are trying to do. Remove the information from the domains to forward and see what happens.

You will need to add a relayhost = [an.ip.add.ress] to the config.

garthk

I've installed the Postfix package and all seems to be working fine. I then installed the Postfix widget and, while the PF widget bar shows up on the dashboard, there's no data displayed at all.

What did I do wrong?

Thanx,
GarthK

mschiek01

@garthk:

I've installed the Postfix package and all seems to be working fine. I then installed the Postfix widget and, while the PF widget bar shows up on the dashboard, there's no data displayed at all.

What did I do wrong?

Thanx,
GarthK

Got to services/postfix/general at the bottom of the page
Widgets set

postfix.jpg_thumb

garthk

Thanx for the reply. I did what you suggested and even waited three days just to see if that would make a diff but no luck. The Postfix bar is there but no data is displayed. I also reinstalled it but no change.

Anything else I need to do?

marcelloc

Widget works when you set logs to /var/log/maillog

garthk

That took care of it!

Thanx Much,
Garth

sbillmann

Hi guys,

I am using this package for a few days now and am very happy with it because the amount of spam was reduced drastically.

So first of all thank you for your work here, marcelloc.

I just encountered two problems which I couldn't solve for myself.

1. The "Search mail" function doesn't work for me. Probably because postfix can't find a sqlite database. Reinstallation of postfix didn't help.

2. Some mails take a very long time to get delivered to my actual mail server. I guess this is because some bigger companies with multiple mail servers send mails out through a different server once the message isn't accpeted instantly by postfix. (gmail or hrs for example)
Is there a way to accept e-mails faster even if the initial sender ip differs from the current sender ip in postfix?

And again thank you (in advance)

Many apologies if this has been asked and answered before.

garthk

Works great but I have a question. There is a company sending us email with a single MX record, say mail.company.com, but the email is actually being sent by one of multiple servers, mail1.company.com, mail2.company.com, and so on. None of these servers has a DNS record so can not be found by PF after the RCPT TO: is received. This causes the email to be rejected, correctly IMHO, but I need to figure out how to let this email thru. Can I whitelist these servers and, if so, how?

Thanx,
Garth

garthk

Sorry to reply to my own post but… the initial HELO is from mail.company.com and is resolvable. Prob is, that's not the server that actually sends the email and those servers are not resolvable.

Thanx,
Garth

biggsy

If you can tell whether they're in the same subnet you can whitelist that subnet under Access Lists > CIDR

Like:

10.20.30.0/24 permit

Bismarck

@garthk:

Sorry to reply to my own post but… the initial HELO is from mail.company.com and is resolvable. Prob is, that's not the server that actually sends the email and those servers are not resolvable.

Thanx,
Garth

https://forum.pfsense.org/index.php?topic=40622.msg428403#msg428403

Bismarck

@sbillmann:

2. Some mails take a very long time to get delivered to my actual mail server. I guess this is because some bigger companies with multiple mail servers send mails out through a different server once the message isn't accpeted instantly by postfix. (gmail or hrs for example)
Is there a way to accept e-mails faster even if the initial sender ip differs from the current sender ip in postfix?

And again thank you (in advance)

Many apologies if this has been asked and answered before.

https://forum.pfsense.org/index.php?topic=40622.msg425790#msg425790

azekiel

Is the postscreen cache now persistent (normally it would be deleted after a restart of the service)?

If not, why not use postgrey then? This one works the same way as postscreen does and the persistent cache does work!

Greets

azekiel

another question: how to disable the recipient check? i remove the part from smtpd_recipient_restrictions but is there a way in the gui?

dene14

Pretty nice module! Thanks for your great work…

+1 for CertManager's certificate support for STARTTLS... It looks a bit strange when you have to generate SelfSigned with certmanager, download cert + key, and upload them by scp to router... Also this conf doesn't survives reinstalls from backup :(

However it seems I've found a bug in current version:
when I select "listen on all Interfaces/IPs"
this line appears in main.cf. unfortunately, it isn't valid
"inet_interfaces = "

to fix that we need to bind that selection to
"inet_interfaces = all"

Thanks!

sandroditommaso

Hi, I'm using this nice package for a few months without major problems.
Just one thing…
Every day I find some incoming emails in the "incoming" state that are not delivered .
Why?

Bismarck

Hello marcelloc, will

/usr/sbin/pkg_add -r p5-perl-ldap

still work with 2.2/10.1? If I remember right there is no pkg_add anymore with FreeBSD 10.1 and what wil happen with packages that have been installed via pkg_add on 8.3 FreeBSD and upgraded to FreeBSD 10.1, will they sill work?

Thanks for all.