Postfix - antispam and relay package
-
marcelloc
regards
what a pity to disturb, look I'm working and making changes to the cfg and Services: Postfix relay and spam, but not working.
not to do just what I want is a postfix relay host, that I may have a serviodor forwarder external mail, which is in zimbra
using a generic account with authentication and security is, with STARTTLS
as I have written before I had the problems that no longer do.
thanks
for your collaboration -
mauricioniñoavella,
As we saw in ermal post, package cyrrus has a missing dependencie in pfsense. Its not a missing compile arg, so there is nothing I can do to Fix it.
For now, postfix Forwarder Does not has SASL option.
If you want a quick solution for that, buy some commercial support hours as ask pfsense team to Fix it.
If you google for you problem, you will find that openldap client requires cyrrus too.
good luck on your trouble shooting.
-
marcelloc
then you confirm that the problem is not yours, rom problems pfSense team, then you spor angry about this that you wroteI see you work for us.
many thanks for your collaboration
-
marcelloc
then you confirm that the problem is not yours, rom problems pfSense team, then you spor angry about this that you wroteI see you work for us.
many thanks for your collaboration
mauricioniñoavella,
you must understand one thing.
pfsense's team released version 2.0 with no need of cyrrus-sasl library, so the problem is not with pfsense's team.
Packages are contributions and almost created and maintained by community, so when a package has a problem, the problem is not on pfsense2.0.
When somebody builds a package, all ports compilation is done by pfsense team BUT it does not means that is fully supported by them.
Pfsense is one thing, packages is another thing completely apart of base project.
if you don't like the way libraries are missing on pfsense, try installing freebsd packages on labs.
I'm not angry about anything in pfsense's project, its perfect to me.
-
marcelloc
To my pfSense also is an excellent project.
In fact I think it is good to realize this problem, as I have experienced that served to improve your package. And that the community forum to find out.
It is very important to account for other versions as I could incorporate cyrrus-sasl library, I hope you will contribute to have been able to let you know this,
Thank you very much for your input.
To think this forum, to share and we want this project. As is pfSense, and do not take as a destructive criticism but a constructive criticism.
I hope you take it in practice because it is a benefit to all who participated in this forum, showing the possible problems that arise in the project, to improve it.
The Free BSD Project was born to be a complete Unix-like operating system free software, software that respects your freedom. and best of all and for all.I will be working to bring you the package for continuous improvement in your work is excellent, because I think an excellent system, and wait when you merge with relay host including cyrrus-sasl.
thanks
Mauricio
- 10 days later
-
HI all,
I've just released package version 2.2 with:
-
Sqlite database log support
-
Widget for dashboard with mail stats
-
Search email tool for diagnostics
-
checkbox to enable or not smtp_valid_hostname_check
-
few more help info for easier setup
-
-
Awsome news. I hope this corrects my issue. I will post something here in a bit that I have encountered.
-
OK, so the rejects that I have been getting seems to occure when the remote host excepts e-mail on a different public IP than the one it sends from. I discovered this by talking with some IT people that I have been getting all these legitamite e-mail rejects on the helo host not found. They have something like an ironport or barracuda acting as a mail gateway behind a firewall in bound SMTP on a particular IP and then their mail server has a statis 1-to-1 NAT rule that translates outbound sending of mail on a different IP.
I have not idea how to even resolve this since it tries the verify back to an IP that does not listen or forward mail back to the internal mail server.
Please let me know if this is not a clear enough write up on what I am saying.
Thanks for all you do marcelloc
-
The helo smtp info can be easily configured by email admins, including Micro$oft. The default option is something internal like hostname.local if you do not use any server for relay to internet.
Unckeck this option and see how postfix deals with your spammers.
On my clients networks, I do only accept mail from server that are not misconfigured.
-
on your check box for helo check. I see it says checked for default. So if I check it, I am assuming it will check helo and if it is unchecked it will not check helo?
Thanks,
-
ahhh, I think your updated package has worked. I am starting to recieve these e-mails now. I just recieved the ones from earlier today.
This makes me feel so much better.
Thanks marcelloc
-
Great news. In few days you will have many logs on Database. Take a look on dashboard postfix widget and on search mail.
-
I am currently looking into it. Great work marcelloc.
-
This is odd. I am getting an error when trying to go to avalible packages. Are you getting this?
-
This is the error I am getting. It was just working???
Unable to communicate with www.pfsense.com. Please verify DNS and interface configuration, and that pfSense has functional Internet connectivity.
-
It was SNORT HTTP inspect causing the issue.
Anyways, I have a question about the logs. I am not seeing anything showing up yet. I followed the instructions, but don't understand the last line that I highlighted below in red.
Choose how often pfSense will transfer log files to Sqlite database.
To use Diagnostics -> Search mail you need to:
Select Loggin Destination to /var/log/maillog
Select update Sqlite frequency
Inlcude /^Subject:/ WARN line in Acl Headers after all your Subject rules.Thanks,
-
Go to acls tab and include the subject line in header option.
-
OK, got it. I am starting to see data coming into the logs.
You have done an excellent job on this package. Thanks for all your hard work.
Thanks,
-
I posted a question to the pfSense mailing list and was directed to look at the Postfix relay package. I saw a posting asking if SMTP out was an option, but I didn't see a clear answer to this.
Let me explain my issue…
After converting a network of computers to use a fairly popular 3rd party email service (not my decision unfortunately), users are experiencing very odd issues with email (POP and SMTP based). The 3rd party says we should try different ports, increase timeouts, etc… and they sometimes take days to admit they themselves have an issue (after we have jumped through their hoops).
One of the issues is email taking a while to be sent out of the network to the 3rd party SMTP servers… in many cases, items sit in Outlook… with recipients complaining that they received multiple copies of the same email.
My thought was to see if there was an SMTP server that can run on pfSense 2.0? I would like to be able to monitor the queue, etc… My hope is that the client computers would stop failing/timing out/multiple deliveries and that pfSense would just act as the active sender SMTP server... basically to send out emails from the network directly to the recipient's mailserver... But I need to be able to manage and monitor it easily in real-time and after the fact on specific dates/times to see what is happening with a specific email problem.
Any advice or suggestions? Does the replay package allow this? Or is it simply for inbound emails only?
Regards,
Chuck
-
If you have static ip on your internet connection and if you could include this ip as a Spf record on your internet dns domain, then you could configure your smtp client option to this package.
I suggest you to change pop3 to imap. It's much better.
Smtp auth with SASL is not working on current version because a missing dependencie in cyrrus-SASL package.
-
So basically just install the package, create spf record for the public IP and point the clients to use the internal firewall IP as their SMTP server. That sound right?
-
Yes. That's it.
On package, try this configurarion:
-
listen only in localhost and lan
-
disable postscreen
-
choose basic header verification
-
do not check Helo valid hostname
-
at acls, include your internal network on client access list
-
-
does this package have a option for users to manage there whitelist/blacklist or any other options they need to configure under there own login page?
-
This package act as a relay for internal smtp server. Postfix on pfsense has no client accounts or user page.
-
marcelloc,
Any word on the postfix AV and anti-spam add-on? Your latest release fixed all the issues I was having. Great package. I am excited to see what will come next.
Thanks Again,
-
The upcoming version 2.3 improves maillog Database and fixes some minor bugs.
Mailscanner maybe released in december.
-
That is excellent news. Keep up the great work.
Thanks Again,
MDP
-
Hi all,
Postfix compilation on x64 now includes cyrus-SASL2 and TLS.
who need or want to test it, reinstall or remove/install postfix package.
No changes in gui for this option. Include all your SASL and/or TLS config in custom main.cf options
att,
Marcello CoutinhoHi Marcello and everyone else
can anyone help me out I would like to send mail from internal to exturnal though this fantastic packege but can't get passed "smtpd_recipient_restrictions = reject_unauth_destination" have tried "smtpd_recipient_restrictions = permit_mynetworks reject_unauth_destination" in custom but it will not override the defaults, tried SASL but don't know how to install it on pfsense, have spent a week doing this before postting so sorry if its in a post elswere, any help or point to any posts that could help or how to override the default would be grateful
Mick
-
mince69meat,
I'ts included in upcoming version 2.3. I'm finished coding and now I'm testing before publishing.
The not so good news is that 2.2 sqlite database is not compatible with 2.3.
-
mince69meat,
I'ts included in upcoming version 2.3. I'm finished coding and now I'm testing before publishing.
The not so good news is that 2.2 sqlite database is not compatible with 2.3.
Love you man, im up all though the night as I was just about to build a bsd VM to get around the problem till your fantastic package was more.. if you want I have a fresh PF without postfix just finnished installing if you need a tester :-) before release. dont know what to do now wait or carry on with the bsd VM, dont know if I can help any more than being a user tester but know a little about coding and postfix, great work - respect
-
to patch 2.2 to accept mynetworks,BACKUP /usr/local/pkg/postfix.inc to /root dir and then edit /usr/local/pkg/postfix.inc to modify postfix declaration.
Do not backup postfix.inc file on same dir, it will break your boot.
look for 'postscreen_access_list=' and include permit_mynetworks:
postscreen_access_list = permit_mynetworks,\n\t\t\tcidr:/usr/local/etc/postfix/cal_cidr\n"look for 'smtpd_recipient_restrictions=' (02 times in file) and include permit_mynetworks
smtpd_recipient_restrictions = permit_mynetworks,reject_unauth_destination,save file, Go to custom options in gui, declare 'mynetworks' list save config and check main.cf file in view configuration tab
Examples: mynetworks = 127.0.0.0/8 168.100.189.0/28 mynetworks = !192.168.0.1, 192.168.0.0/28 mynetworks = 127.0.0.0/8 168.100.189.0/28 [::1]/128 [2001:240:587::]/64 "mynetworks_style = host" "mynetworks_style = subnet" "mynetworks_style = class"
reference: http://www.postfix.org/postconf.5.html
-
to patch 2.2 to accept mynetworks,BACKUP /usr/local/pkg/postfix.inc to /root dir and then edit /usr/local/pkg/postfix.inc to modify postfix declaration.
Do not backup postfix.inc file on same dir, it will break your boot.
look for 'postscreen_access_list=' and include permit_mynetworks:
postscreen_access_list = permit_mynetworks,\n\t\t\tcidr:/usr/local/etc/postfix/cal_cidr\n"look for 'smtpd_recipient_restrictions=' (02 times in file) and include permit_mynetworks
smtpd_recipient_restrictions = permit_mynetworks,reject_unauth_destination,save file, Go to custom options in gui, declare 'mynetworks' list save config and check main.cf file in view configuration tab
Examples: mynetworks = 127.0.0.0/8 168.100.189.0/28 mynetworks = !192.168.0.1, 192.168.0.0/28 mynetworks = 127.0.0.0/8 168.100.189.0/28 [::1]/128 [2001:240:587::]/64 "mynetworks_style = host" "mynetworks_style = subnet" "mynetworks_style = class"
reference: http://www.postfix.org/postconf.5.html
Hi marcelloc, knew to edit postfix.inc (would have missed postscreen_access_list, thanks), did not want to edit this file as I'm worried about braking the package on updates, can you comfirm this will not brake anything on update? was looking for a way to override just by the "custom main.cf options" to keep the package as you made it :-) and not cause problems on upgrades as I have boken things in the past by doing things my way and not the matainers way lol
some info for you, installing postfix on x64 I see that cyrus-sasl-2.1.25_1.tbz is installed as dependencie but on a x86 system it is not installed, don't know if you know that, also for the rest of the community pkg_add will not install it properly on x86 :-(
nice work and brill post about adding mynetworks, should help more on here out than just me
respect
-
The postfix in 32 bit version is not compilled every day just like 64bits. This may be something related to 2.1 working. The cyrrus-SASL has a missing dependencie that was not fixed yet, So you can only use unauth outgoing smtp for now.
About the postfix.inc, if you do the way I described, it will not broke any package update. Just insert the update on file and do not remove anything.
Package update will update postfix.inc
Do it with caution.
I'll send a line to core team asking 32bits updates.
Postix is on 2.8.7 on 64 bits and 2.8.5 on 32. -
How would you use unauth outgoing smtp and get passed the "reject_unauth_destination" or is the only wayto edit /usr/local/pkg/postfix.inc as you said a few posts back?
-
to patch 2.2 to accept mynetworks,BACKUP /usr/local/pkg/postfix.inc to /root dir and then edit /usr/local/pkg/postfix.inc to modify postfix declaration.
Do not backup postfix.inc file on same dir, it will break your boot.
look for 'postscreen_access_list=' and include permit_mynetworks:
postscreen_access_list = permit_mynetworks,\n\t\t\tcidr:/usr/local/etc/postfix/cal_cidr\n"look for 'smtpd_recipient_restrictions=' (02 times in file) and include permit_mynetworks
smtpd_recipient_restrictions = permit_mynetworks,reject_unauth_destination,save file, Go to custom options in gui, declare 'mynetworks' list save config and check main.cf file in view configuration tab
Examples: mynetworks = 127.0.0.0/8 168.100.189.0/28 mynetworks = !192.168.0.1, 192.168.0.0/28 mynetworks = 127.0.0.0/8 168.100.189.0/28 [::1]/128 [2001:240:587::]/64 "mynetworks_style = host" "mynetworks_style = subnet" "mynetworks_style = class"
reference: http://www.postfix.org/postconf.5.html
is this line right the middle part (tcidr) just don't seem right?
postscreen_access_list = permit_mynetworks,\n\t\t\tcidr:/usr/local/etc/postfix/cal_cidr\n" -
hope someone can help with this one, have multi wan and want postfix to send mail out of non default wan gateway, tried smtp_bind_address = xxx.xxx.xxx.xxx and it works sendding out but then incoming mail will not forward to internal mail server, any hint want to try either on pf firewall or postfix would be great
Mince
-
Did you created a wan rule to accept incoming traffic on this ip?
Another way to do it is listening postfix on loopback and then create inbound and outbound nat to your ip aliases or carp.
is this line right the middle part (tcidr) just don't seem right?
postscreen_access_list = permit_mynetworks,\n\t\t\tcidr:/usr/local/etc/postfix/cal_cidr\n"Just include the 'permit_mynetworks,' at The beginning of postscreen_access_list.
-
Hi everybody,
I've just published package version 2.3 with many improvements. check first post for screen shots
main improvements:
-
sqlite export option to allow multiple box admins to search mail in only one box
-
new database structure
-
queue gui tab
-
more search options
-
wildcard support in search
-
postfix version 2.8.7 for x64bits
-
widget options to prevent memory limit reach in dashboard
-
apply permissions to non adminis users, so they can only search mail or view queue
-
include mynetworks to allow internal clients/hosts to send mail through postfix forwarder
-
-
hi all, first off, fantastic work on 2.3 :-)
now on a PF x86 box we have
Downloading http://files.pfsense.org/packages/8/All/perl-5.12.4_3.tbz … could not download from there or http://ftp2.FreeBSD.org/pub/FreeBSD/ports/i386/packages-8.1-release/All/perl-5.12.4_3.tbz.
of perl-5.12.4_3 failed!x64 box all seens fine so far will play alot more and report back soon, hopping the above error is just waitting for the ports to update
Mince
-
mince69meat,
thanks for your feedback.
I've just fixed 32bits perl version. try again in 15minutes.