PostFix forwarder - LDAP lookup



  • Firstly marcelloc - kudos on a great package, and I'm quite excited about your mailscanner work

    As the topic states, I would like to use the ldap lookup function to keep a up to date list of accepted email addresses. When I try to fetch the package as stated in the hint, I get the following -

     /usr/sbin/pkg_add -r p5-perl-ldap
    Error: Unable to get ftp://ftp.freebsd.org/pub/FreeBSD/ports/amd64/packages-8.1-release/Latest/p5-perl-ldap.tbz: File unavailable (e.g., file not found, no access)
    pkg_add: unable to fetch 'ftp://ftp.freebsd.org/pub/FreeBSD/ports/amd64/packages-8.1-release/Latest/p5-perl-ldap.tbz' by URL
    
    

    Any idea what I can do? (I did browse the ftp manually - no 'packages-8.1-release' directory)





  • Awesome thanks - it installed.

    Does the function have a log/indicator somewhere to see it is working?



  • Go on view configurarion files and click valid recipients.



  • I still had trouble getting this to work - thankfully marcelloc was able to point me in the right direction :)

    For reference:
    At the time of writing, you have to modify line 1 in the file /usr/local/etc/postfix/adexport.pl and change it to

    #!/usr/local/bin/perl5.12.4 -w
    

    You can then manually run

    /usr/local/bin/php -q /usr/local/www/postfix_recipients.php
    

    to see if it works.

    More references as to why it is needed can be found here http://forum.pfsense.org/index.php/topic,45143.msg235361.html#msg235361

    Tested OK on Windows Server 2008 R2



  • @marcelloc:

    you can try to fetch from here

    i386
    pkg_add -r http://e-sac.siteseguro.ws/packages/8/All/p5-perl-ldap-0.4300.tbz

    amd64
    pkg_add -r http://e-sac.siteseguro.ws/packages/amd64/8/All/p5-perl-ldap-0.4300.tbz

    Dear marcelloc,

    I have downloaded your tbz file, but I got some errors when install. Please see the lines below:

    [2.0.1-RELEASE][root@pfsense02.abc.com]/root(2): pkg_add p5-perl-ldap-0.4300.tbz
    pkg_add: could not find package p5-XML-NamespaceSupport-1.11 !
    pkg_add: could not find package p5-XML-SAX-0.96 !
    pkg_add: could not find package p5-XML-Filter-BufferText-1.01 !
    pkg_add: could not find package p5-XML-SAX-Writer-0.53 !
    pkg_add: could not find package p5-GSSAPI-0.28 !
    pkg_add: could not find package p5-Net-SSLeay-1.42 !
    pkg_add: could not find package p5-IO-Socket-SSL-1.53 !
    pkg_add: could not find package p5-URI-1.59 !
    pkg_add: could not find package p5-Digest-HMAC-1.03 !
    pkg_add: could not find package p5-Authen-SASL-2.15 !
    pkg_add: could not find package p5-Convert-ASN1-0.22 !

    Could you please help to solve it? I did not have experience with FeeBSD.
    May I know when does PfSense team release the p5-perl-ldap package that we can install online?

    Many thanks for your support,
    DQM



  • @r4iden:

    Awesome thanks - it installed.

    Does the function have a log/indicator somewhere to see it is working?

    Dear r4iden,

    Could you please share your experiences about installation here?

    Thanks a lot,
    DQM



  • Dear all,

    I have just installed p5-perl-ldap on the link above of Marcelloc successful. I am going to configure it and feedback the result soon.

    Thank you,
    DQM



  • Dear all,

    I have configured the Postfix Forwarder to export account from AD (Windows 2003) on following:

    hostname: server01.abc.com
    domain: dc=abc,dc=com
    username: cn=antispam,cn=abc (abc is OU which antispam account is placed)

    But when I run command to test, I did not get any account from AD, pls see the error below:

    extracting from server01.abc.com…(0)
    Total ldap recipients:0 unique:0

    Any advise to great with Postfix Forwarder?

    Many thanks,
    DQM



  • @DQM:

    Any advise to great with Postfix Forwarder?

    It looks fine, can you try with a user at cn Users?



  • @marcelloc:

    @DQM:

    Any advise to great with Postfix Forwarder?

    It looks fine, can you try with a user at cn Users?

    Same result, marcelloc !  >:( Any advise?

    Thanks,
    DQM



  • I've just had a bash at this with pfsense 2.1_x64 and windows 2008 r2 and it works fine. wouldn't work with some username though eg Administrator etc

    Slightly off topic but is there any advantage to using this apart from the mail not hitting the exchange server at all?



  • @louis-m:

    Slightly off topic but is there any advantage to using this apart from the mail not hitting the exchange server at all?

    It's reduces exchange server load and external link bandwidth as it rejects the email on header checks.



  • @DQM:

    Same result, marcelloc ! Any advise?

    Are you sure your password is correct? Is there special characters on it?



  • @marcelloc:

    @DQM:

    Same result, marcelloc ! Any advise?

    Are you sure your password is correct? Is there special characters on it?

    Dear marcelloc,

    I am sure password is correct. Doest it require Exchange server must be installed already in the Actice Directory org?

    Thanks,



  • @DQM:

    I am sure password is correct. Doest it require Exchange server must be installed already in the Actice Directory org?

    The script extracts email public information from users at AD. if email address is included by exchange server, then it requires Exchange server.

    att,
    Marcello Coutinho



  • Having the same issues binding to LDAP. Any ideas guys? 2008 R2 Domain Controller

    Thanks



  • @marcelloc:

    @DQM:

    I am sure password is correct. Doest it require Exchange server must be installed already in the Actice Directory org?

    The script extracts email public information from users at AD. if email address is included by exchange server, then it requires Exchange server.

    att,
    Marcello Coutinho

    Hi Marcello,

    After installing Exchange server, it is working well now. But another issue is SPF feature does not work.
    I have created TXT record for abc.com(PfSense was able to resolve TXT record of abc.com). After that, I telnet to send mail by smtp command (user1@abc.com send to user1@abc.com), and I can push phishing emails to Postfix Forwarder.

    Any advise?

    Thanks,
    DQM



  • Dear Marcello,

    I'd like to mention the list of task that I did on the Postfix Forwarder on following:

    • I cannot insert the customise "smtpd_banner" into main.cf. It seens does not allow saving after reboot the Pfsense box. It only allow saving if don't reboot the box. Right?
    • SPF doesn't work once selected "Strong" at Header verification, only work if select "Basic"
    • Any changes in the Antispam tab wouldn't send mail to it and got an error message like "501 5.1.7 Bad sender address syntax". After change to "Basic" at Header verification, everything will be ok again.

    Could you please help to explain in more details?

    Thank you,
    DQM



  • ive tried and tried to get this to ldap scrape from my DC and it doesnt work. I can connect from 50 ldap clients with the same username as password and it works 100%

    can anyone share their configs etc - 2008 R2 Domain Controller.

    Is the a guide or document to set this up?

    Thanks



  • @voona:

    ive tried and tried to get this to ldap scrape from my DC and it doesnt work. I can connect from 50 ldap clients with the same username as password and it works 100%

    can anyone share their configs etc - 2008 R2 Domain Controller.

    Is the a guide or document to set this up?

    Thanks

    Hi voona,

    Please follow up the guide below:

    Step 1: Install p5-perl-ldap by run command below

    i386
    pkg_add -r http://e-sac.siteseguro.ws/packages/8/All/p5-perl-ldap-0.4300.tbz

    amd64
    pkg_add -r http://e-sac.siteseguro.ws/packages/amd64/8/All/p5-perl-ldap-0.4300.tbz

    Step 2: Modify adexport.pl file at /usr/local/etc/postfix/adexport.pl

    Change the first line of this file to #!/usr/local/bin/perl5.12.4 -w

    Step 3: Run command below for testing result
    /usr/local/bin/php -q /usr/local/www/postfix_recipients.php

    If you get number of recipient from LDAP, then it is working well

    P/S: Make sure that Exchange server or any Mail server which is able to public email address attribute of users to LDAP server was installed on your system.

    GL,
    DQM



  • Ok LDAP is working now i had a space in the username and it didn't like it.

    Still seem to be errors when installing the mailscanner package.. clamav doesnt install properly can someone point me in the right direction

    Cheers



  • @louis-m:

    Slightly off topic but is there any advantage to using this apart from the mail not hitting the exchange server at all?

    @marcelloc:

    It's reduces exchange server load and external link bandwidth as it rejects the email on header checks.

    In addition this feature is very valuable as it prevents backscatter.

    Backscatter is when a spammer sends emails to an invalid address at your domain with a spoofed sender address. The intended result of this is to spam the intended recipient i.e the spoofed sender with NDR's from your mail server.

    If postfix is configured without this check, it will relay every email it receives that passes other enabled checks to your mail server. When your mail server realises it does not know of a valid recipient/mailbox to deliver the mail to, it should send an NDR to the spoofed sender.

    NDR's can be disabled, but this is against RFC2821.



  • @DQM:

    I'd like to mention the list of task that I did on the Postfix Forwarder on following:

    • I cannot insert the customise "smtpd_banner" into main.cf. It seens does not allow saving after reboot the Pfsense box. It only allow saving if don't reboot the box. Right?

    Did you tried to include this option on postfix custom options field on gui?

    @DQM:

    • SPF doesn't work once selected "Strong" at Header verification, only work if select "Basic"
    • Any changes in the Antispam tab wouldn't send mail to it and got an error message like "501 5.1.7 Bad sender address syntax". After change to "Basic" at Header verification, everything will be ok again.

    I have strong header set and it looks like spf is working, do you have any error message or log you detected it.
    If it's a bug during package save settings, I can fix next week.



  • @marcelloc:

    @DQM:

    I'd like to mention the list of task that I did on the Postfix Forwarder on following:

    • I cannot insert the customise "smtpd_banner" into main.cf. It seens does not allow saving after reboot the Pfsense box. It only allow saving if don't reboot the box. Right?

    Did you tried to include this option on postfix custom options field on gui?

    @DQM:

    • SPF doesn't work once selected "Strong" at Header verification, only work if select "Basic"
    • Any changes in the Antispam tab wouldn't send mail to it and got an error message like "501 5.1.7 Bad sender address syntax". After change to "Basic" at Header verification, everything will be ok again.

    I have strong header set and it looks like spf is working, do you have any error message or log you detected it.
    If it's a bug during package save settings, I can fix next week.

    Dear Marcello,

    I have tried to insert the customise "smtpd_banner" by GUI and it is well now. But SPF and any change in the Antispam tab still did not work when "Strong" was selected (I perform testing by SMTP command - telnet to send mail, I did not test by other SMTP server). Does has problem with sending email by command?

    Thanks,
    DQM



  • check config files with basic and strong header check enabled to see if spf options are included or not.



  • Dear Marcello,

    Now I have one more problem. It is RBL feature on the PF, it does not work. Below is content of my config file:

    /usr/local/etc/postfix/main.cf
    #main.cf
    #Part of the Postfix package for pfSense
    #Copyright (C) 2010 Erik Fonnesbeck
    #Copyright (C) 2011 Marcello Coutinho
    #All rights reserved.
    #DO NOT EDIT THIS FILE

    mynetworks = /usr/local/etc/postfix/mynetwork_table
    mynetworks_style = host
    smtpd_banner = mail-gw-01.abc.com ESMTP
    relay_domains = abc.com
    transport_maps = hash:/usr/local/etc/postfix/transport
    local_recipient_maps =
    mydestination =
    mynetworks_style = host
    message_size_limit = 10240000
    default_process_limit = 100
    #Just reject after helo,sender,client,recipient tests
    smtpd_delay_reject = yes

    Don't talk to mail systems that don't know their own hostname.

    smtpd_helo_required = yes
    smtpd_helo_restrictions =

    smtpd_sender_restrictions = reject_unknown_sender_domain,
    permit

    Allow connections from specified local clients and rbl check everybody else if rbl check are set.

    smtpd_client_restrictions = permit_mynetworks,
    reject_unauth_destination,
    check_sender_access hash:/usr/local/etc/postfix/sender_access,
    check_client_access pcre:/usr/local/etc/postfix/cal_pcre,
    check_client_access cidr:/usr/local/etc/postfix/cal_cidr
    permit

    Whitelisting: local clients may specify any destination domain.

    #,
    smtpd_recipient_restrictions = permit_mynetworks,
    reject_unauth_destination,
    check_sender_access hash:/usr/local/etc/postfix/sender_access,
    check_client_access pcre:/usr/local/etc/postfix/cal_pcre,
    check_client_access cidr:/usr/local/etc/postfix/cal_cidr,
    reject_spf_invalid_sender,
    permit

    soft_bounce = yes
    postscreen_greet_wait = ${stress?2}${stress:6}s
    postscreen_greet_action = enforce
    postscreen_access_list = permit_mynetworks,
    cidr:/usr/local/etc/postfix/cal_cidr
    postscreen_dnsbl_action= enforce
    postscreen_blacklist_action= enforce
    postscreen_dnsbl_sites=zen.spamhaus.org, bl.spamcop.net
    postscreen_dnsbl_threshold=2

    Does my config file has any issues? Could you please help to solve it?

    Thank you for your support,
    DQM



  • Are you sure it's not working?

    the setup is fine and rbl lists are applied on postscreen daemon

    postscreen_greet_wait = ${stress?2}${stress:6}s
    postscreen_greet_action = enforce
    postscreen_access_list = permit_mynetworks,
             cidr:/usr/local/etc/postfix/cal_cidr
    postscreen_dnsbl_action= enforce
    postscreen_blacklist_action= enforce
    postscreen_dnsbl_sites=zen.spamhaus.org, bl.spamcop.net
    postscreen_dnsbl_threshold=2
    

    This last arg says that a hostname must be on both lists to get blocked



  • Are you sure it's not working?

    I'm sure. Because I have tested by telnet from an IP address which is listed on zen.spamhaus.org (I have checked with another SMTP server) but RBL feature on the PF didn't action. So, I am able to push a lot of messages to it.

    This last arg says that a hostname must be on both lists to get blocked

    This means the IP address which perform sending email must be listed on both zen.spamhaus.org and bl.spamcop.net then RBL feature would action? Right?
    Could you please help to explain in details?

    Thanks,
    DQM



  • @DQM:

    This means the IP address which perform sending email must be listed on both zen.spamhaus.org and bl.spamcop.net then RBL feature would action? Right?
    Could you please help to explain in details?

    change RBL threshold to 1 on antispam tab, apply config  and test again



  • Hi Marcello,

    I have checked log of PF and I would like to show you as below:

    relay=192.168.1.100[192.168.1.100]:25, delay=36, delays=31/0/0/5, dsn=5.7.1, status=bounced (host 192.168.1.100[192.168.1.100] said: 550 5.7.1 IP address 115.73.183.198 has been blocked by the RBL provider zen.spamhaus.org due to rule (Spamhaus). Please check http://www.spamhaus.org/query/bl?ip=115.73.183.198 for further detail. (in reply to end of DATA command))

    Highlighted is message that is generated by my Exchange server (not PF) after PF forward the message to it.

    Based on the log above, seems the RBL on my PF is working. Correct? But I have a question that why does not PF perform an action (drop, rejetc) spams and generate a message same as my Exchange server? Could you please help on this?

    Thanks for your help,
    DQM



  • the man says that postscreen_dnsbl_action set to enforce, logs and rejects the message.
    On my config file (postfix forwarder -> view config -> main.cf) is set to enforce.
    Can you check on yours config file?

    ignore (default)
    Ignore the failure of this test. Allow other tests to complete. Repeat this test the next time the client connects. This option is useful for testing and collecting statistics without blocking mail.
    enforce
    Allow other tests to complete. Reject attempts to deliver mail with a 550 SMTP reply, and log the helo/sender/recipient information. Repeat this test the next time the client connects.
    drop
    Drop the connection immediately with a 521 SMTP reply. Repeat this test the next time the client connects.
    This feature is available in Postfix 2.8.



  • Thanks for your support, Marcello. The RBL feature is working well now. But I have one more problem with the log of PF. Once I restart the PF and got log content as below:

    Sep 22 10:27:00 fglbh-gw-01 postfix/postfix-script[58210]: warning: not owned by postfix: /var/db/postfix/./2012-09-22.db
    Sep 22 10:27:00 fglbh-gw-01 postfix/postfix-script[58529]: warning: not owned by postfix: /var/db/postfix/./2012-09-20.db
    Sep 22 10:27:00 fglbh-gw-01 postfix/postfix-script[58872]: warning: not owned by postfix: /var/db/postfix/./2012-09-17.db

    So, I couldn't search any incomming messages.

    Could you please help to solve on this?

    Thank you,
    DQM



  • These files ate not used by postfix daemon, just by package gui.
    You can ignore this warning. :)



  • Dear Marcello,

    But I couldn't search any incomming messages on the GUI, bc it bases on maillog databases.

    One more question, Marcello. How about limit size of maillog file and how does it work? Will it split to maillog1, maillog2, …? (/var/log/maillog)
    Can I push the log of PF to syslog server?

    Thanks,
    DQM



  • @DQM:

    One more question, Marcello. How about limit size of maillog file and how does it work? Will it split to maillog1, maillog2, …? (/var/log/maillog)

    Not on current version.
    LinuxTracker did a how to for logrotate, maybe it's userfull for you.
    http://forum.pfsense.org/index.php/topic,51412.msg287633.html#msg287633

    @DQM:

    Can I push the log of PF to syslog server?

    Yes, you need just to change log settings on package gui.

    without maillog, you will not have database search too.


Locked