Postfix - antispam and relay package

[marcelloc]

I'm migrating the package for 2.3.

If you use pfsense as an UTM, packages postfix, varnish, squid, mailscanner give it layer 7 ability on these protocols.

For me it's really usefull.

[MadCatZA]

@marcelloc:

I'm migrating the package for 2.3.

If you use pfsense as an UTM, packages postfix, varnish, squid, mailscanner give it layer 7 ability on these protocols.

For me it's really usefull.

Now that is some good news for a change. PostFix "IS" one of the best used packages on pfSense. To scrap it would be going backwards. Happy days :)

[marcelloc]

@MadCatZA:

PostFix "IS" one of the best used packages on pfSense.

Pull request sent

[Bismarck]

Sadly SPF is broken now:

unused parameter: spf_mark_only=yes

This was a very useful option to fight sender address forgery.

Any idea how to fix?

//Edit

This could be a option? py27-postfix-policyd-spf-python works great and easy to setup! :)

$ pkg install py27-postfix-policyd-spf-python
Updating FreeBSD repository catalogue...
FreeBSD repository is up-to-date.
All repositories are up-to-date.
The following 6 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
        py27-postfix-policyd-spf-python: 1.3.2
        py27-authres: 0.800
        py27-spf: 2.0.12_1
        py27-dns: 2.3.6_1
        python2: 2_3
        py27-ipaddr: 2.1.10_1

The process will require 856 KiB more space.
152 KiB to be downloaded.

Proceed with this action? [y/N]: y
Fetching py27-postfix-policyd-spf-python-1.3.2.txz: 100%   38 KiB  38.5kB/s    00:01
Fetching py27-authres-0.800.txz: 100%   26 KiB  26.7kB/s    00:01
Fetching py27-spf-2.0.12_1.txz: 100%   34 KiB  35.0kB/s    00:01
Fetching py27-dns-2.3.6_1.txz: 100%   31 KiB  32.0kB/s    00:01
Fetching python2-2_3.txz: 100%    1 KiB   1.1kB/s    00:01
Fetching py27-ipaddr-2.1.10_1.txz: 100%   22 KiB  22.1kB/s    00:01
Checking integrity... done (0 conflicting)
[1/6] Installing python2-2_3...
[1/6] Extracting python2-2_3: 100%
[2/6] Installing py27-dns-2.3.6_1...
[2/6] Extracting py27-dns-2.3.6_1: 100%
[3/6] Installing py27-authres-0.800...
[3/6] Extracting py27-authres-0.800: 100%
[4/6] Installing py27-spf-2.0.12_1...
[4/6] Extracting py27-spf-2.0.12_1: 100%
[5/6] Installing py27-ipaddr-2.1.10_1...
[5/6] Extracting py27-ipaddr-2.1.10_1: 100%
[6/6] Installing py27-postfix-policyd-spf-python-1.3.2...
[6/6] Extracting py27-postfix-policyd-spf-python-1.3.2: 100%
Message from py27-postfix-policyd-spf-python-1.3.2:
#
# To configure Postfix
#

This package must be integrated with Postfix to be effective:

 1\. Add to your postfix master.cf:

        policyd-spf  unix  -       n       n       -       0       spawn
            user=nobody argv=/usr/local/bin/policyd-spf

 2\. Configure the Postfix policy service in your main.cf so that the
    "smtpd_recipient_restrictions" includes a call to the policyd-spf policy
    filter.  If you already have a "smtpd_recipient_restrictions" line, you can
    add the "check_policy_service" command anywhere *after* the line which
    reads "reject_unauth_destination" (otherwise you're system can become an
    open relay).

        smtpd_recipient_restrictions =
            ...
            reject_unauth_destination
            check_policy_service unix:private/policyd-spf
            ...

        policyd-spf_time_limit = 3600

  3\. Please consult the postfix documentation for more information on these and
     other settings you may wish to have in the "smtpd_recipient_restrictions"
     configuration.

  4\. Reload postfix.

[hcoin]

For me, postfix+friends on pfsense a major administrative convenience. And, it is in keeping with the spirit of what is is a 'firewall' does (if only in an expanded sense). Most of the spam traffic won't even succeed in connecting, the ones that do cause internet 'internet spam service check' requests to leave from the firewall without having to take up bandwidth on the lan, and most of the evil attachments never make it past the firewall either. It also (I hope still will) allow one 'clamav' install to manage scanning web traffic for the squid suite and also the mailscanner/email.

Also, having the 'postfix and associated packages" stack in PF allows me to leverage pf's certificate management, destination email domain routing, failover, load balancing for email. That internal domain routing bit is a security plus as traffic for domain X never travels lan segments used by those on domains A, B and C, an obvious security plus. Also it allows the internal smtp world to be very fast and lean as it needs minimal security and no need for the add-on 'nasty-checking' packages.

Remember one of the main spam defences is having the mail exchanger's reverse dns match the common name in the ssl certificate. Anytime information can be kept in one place and closer to where it's used is an admin win.

Last, the postfix config for the lan side can use the lmtp protocol which is a major overhead saver (no per message setups/teardowns).

It calls for a multiprocessor setup, lots of ram and lots of disk. I know that is not exactly what comes to mind using the word 'embedded', but the above is my $0.02 on why it's worth it.

If it were to be removed, I'd have to create not just port forward to a new subnet but a vlan just to isolate incoming email traffic, then – well, it would result in an economic bonanza for the people who sell those coffee thingys.

[biggsy]

@Bismarck:

Sadly SPF is broken now:

Bismarck, have you been able to install from Available Packages?  I missed a few days of 2.3 updates but haven't seen the postfix package listed.

[Bismarck]

Hi biggsy,

the packages should still be there:

http://files.pfsense.org/packages/10/All/postfix-2.11.3_2-amd64.pbi

HowTo: Install packages

regards

[marcelloc]

The pull request still needs to be aproved first.

[Bismarck]

Hello marcelloc,

since 2.2.x Postfix doesn't write spam logs to the sqlite database, thus you can't search for spam and the widget doesn't display any spam records.

This makes it really hard to track false positives.  :'(

Please help!

//edit

when I execute it via putty after I send a spam test, it does write the spam record to the database file!?

[root@pfsense~]$ /usr/local/bin/php -q /usr/local/www/postfix.php 01min

/usr/bin/grep '^Jan 15 09:25.*\(MailScanner\|postfix.cleanup\|postfix.smtp\|postfix.error\|postfix.qmgr\)' /var/log/maillog
Found logs to 2016-01-15.db

#######################################
SPAM:SpamAssassin (nicht zwischen gespeichert, Wertung=1004.701, benoetigt 3, FSL_HELO_NON_FQDN_1 0.00, GTUBE 1000.00, HTML_MESSAGE 0.00, PYZOR_CHECK 1.98, RDNS_NONE 0.00, TVD_RCVD_SINGLE 1.21, ZONK_PHISH_BODY 1.50)5E1EA1C2B99zonk
#######################################

#######################################
SPAM:SpamAssassin (nicht zwischen gespeichert, Wertung=1004.701, benoetigt 3, FSL_HELO_NON_FQDN_1 0.00, GTUBE 1000.00, HTML_MESSAGE 0.00, PYZOR_CHECK 1.98, RDNS_NONE 0.00, TVD_RCVD_SINGLE 1.21, ZONK_PHISH_BODY 1.50)4E48D1C2BFBzonk
#######################################
writing to database...writing to database... writing to local db 2016-01-15...ok

maybe a timeing problem?

[biggsy]

@marcelloc:

The pull request still needs to be aproved first.

Thank you for working on this, Marcello.  Is there any news?

[Bismarck]

FYI

I did a fresh install of pfSense 2.2.6 last week and the Postfix package did work out of the box, expect the search mail & widget sqlite bug, wich can be fixed by fetching the postfix.php/postfix.widget.php from:

fetch -o /usr/local/www/postfix.php http://e-sac.siteseguro.ws/px22/postfix.txt
fetch -o /usr/local/www/widgets/widgets/postfix.widget.php http://e-sac.siteseguro.ws/px22/postfix.widget.txt

So NO need to delete Postfix and install it via pkgng!

Regards  ;)

[marcelloc]

@biggsy:

Thank you for working on this, Marcello.  Is there any news?

yes, I'll need to change the syslog function that enables /var/log/maillog.

[marcelloc]

@Bismarck:

So NO need to delete Postfix and install it via pkgng!

It just started up or it's running and filtering email? on 2.2 I got a lot of missing libs erros on postfix subprocesses.

[Bismarck]

@marcelloc:

@Bismarck:

So NO need to delete Postfix and install it via pkgng!

It just started up or it's running and filtering email? on 2.2 I got a lot of missing libs erros on postfix subprocesses.

Yes it's filtering email, spam and viruses with MailScanner, I run it as my productive system since 2 weeks now, no lib errors or crashes.

Thank you for your hard work, much appreciated!

[LinuxCuba]

Hi Marcello, I'm trying pfsense 2.3 beta, and one of the essential
packages for me is postfix, but the same does not appear in the list
of available packages, you had said at the forum, which would sit in
this package postfix for version 2.3 . As it would be possible to
install that version of package postfix in pfsense 2.3 beta. Greetings
and thank you very much for the excellent work he has done. Excuse the
bad English.

[Bismarck]

@biggsy:

postfix 2.11 was released in January and, among other things, it contains the following enhancement:

• A new postscreen_dnsbl_whitelist_threshold feature to allow
      clients to skip postscreen tests based on their DNSBL score.
      This can eliminate email delays due to "after 220 greeting"
      protocol tests, which otherwise require that a client reconnects
      before it can deliver mail. Some providers such as Google don't
      retry from the same IP address, and that can result in large
      email delivery delays.

Any chance of an updated package based on postfix 2.11?

Hi Biggsy, this is working with the current package Postfix 2.11.3/pfSense 2.2.6.

To enable:

postscreen_dnsbl_whitelist_threshold=-1

edit /usr/local/pkg/postfix.inc around line 629 and add this:

$postfix_main .= "postscreen_dnsbl_whitelist_threshold=-1\n";

and restart the Postfix service.

So no more hardcodeed IPs in Client Access List / CDIR needed, for google outbound mail server etc.  ;)

marcelloc, maybe you can make this a option in the Postfix menu?

[Bismarck]

Hello marcelloc,

I found 2 bug in postfix.php, related to the log to sqlite file.

The result of loglines populated to slqlite file differs by the time period chosen tin the Genaral tab > Logging > Update Sqlite, it always missing around 50% of what has been really logged, eg. if we choose Every Minute. I found a workaround by adding a second cronjob, which executes every 10m as well and no longline is missing anymore.

Second, this is related to spam status is not updated to the sqlite file on month days with just one digit (1 - 9), because postfix logs the date like:

Feb  6 16:25:21 pfsense postfix/dnsblog[27506]: addr 193.189.117.150 listed by domain zen.spamhaus.org as 127.0.0.2

and MailScanner like:

Feb 06 16:24:50 pfsense MailScanner[20367]: Delivery of nonspam: message 604671C2F69.A240D from
``` 
I guess there is something like a regex pattern mismatch, because on month days with 2 digits (10 - 31) the spam status is updated to sqlite file just fine.

Regards

[Bismarck]

When you use Postfix/TLS, you should fix the DROWN Attack vulnerability:

openssl dhparam -out /usr/pbi/postfix-amd64/etc/postfix/dh2048.pem 2048

and add this, below your TLS config in the custom main.cf options:

# Whenever the built-in defaults are sufficient, let the built-in
# defaults stand by deleting any explicit overrides.

# Disable deprecated SSL protocol versions.  See:
# http://www.postfix.org/postconf.5.html#smtp_tls_protocols
# http://www.postfix.org/postconf.5.html#smtpd_tls_protocols
#
# Default in all supported stable Postfix releases since July 2015.
# Defaults for the mandatory variants never allowed SSLv2.
#
smtpd_tls_protocols = !SSLv2, !SSLv3
smtp_tls_protocols = !SSLv2, !SSLv3
lmtp_tls_protocols = !SSLv2, !SSLv3
tlsproxy_tls_protocols = $smtpd_tls_protocols
#
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
smtp_tls_mandatory_protocols = !SSLv2, !SSLv3
lmtp_tls_mandatory_protocols = !SSLv2, !SSLv3
tlsproxy_tls_mandatory_protocols = $smtpd_tls_mandatory_protocols

# Disable export and low-grade ciphers.  See:
# http://www.postfix.org/postconf.5.html#smtpd_tls_ciphers
# http://www.postfix.org/postconf.5.html#smtp_tls_ciphers
#
# Default in all supported stable Postfix releases since July 2015.
#
smtpd_tls_ciphers = medium
smtp_tls_ciphers = medium

# Enable forward-secrecy with a 2048-bit prime and the P-256 EC curve. See
# http://www.postfix.org/FORWARD_SECRECY_README.html#server_fs
# http://www.postfix.org/postconf.5.html#smtpd_tls_dh1024_param_file
# http://www.postfix.org/postconf.5.html#smtpd_tls_eecdh_grade
#
# The default DH parameters use a 2048-bit strong prime as of Postfix 3.1.0.
#
smtpd_tls_dh1024_param_file=${config_directory}/dh2048.pem
smtpd_tls_eecdh_grade = strong

# Trimmed cipherlist improves interoperability with old Exchange servers
# and reduces exposure to obsolete and rarely used crypto.  See:
# http://www.postfix.org/postconf.5.html#smtp_tls_exclude_ciphers
# http://www.postfix.org/postconf.5.html#smtpd_tls_exclude_ciphers
#
smtp_tls_exclude_ciphers = EXPORT, LOW, MD5, aDSS, kECDHe, kECDHr, kDHd, kDHr, SEED, IDEA, RC2
smtpd_tls_exclude_ciphers = EXPORT, LOW, MD5, SEED, IDEA, RC2

Source: https://drownattack.com/postfix.html
DROWN Test: https://test.drownattack.com/
Postfix/TLS: http://www.checktls.com/perl/TestReceiver.pl
SSL Labs Test: https://dev.ssllabs.com/ssltest/

Regards

[dannyboy1121]

Hi - any news for Postfix on 2.3? I see that it's not currently in the package list for the Beta.

[biggsy]

Perhaps Marcello is very busy but I'm hoping we will hear some news too.