Skip to content

Commit 28184f5

Browse files
author
Marius Burkard
committed
Merge branch 'postfix' into 'stable-3.1'
 postfix: add smtpd_helo_restrictions, enable smtpd_reject_unlisted_sender add smtpd_helo_restrictions to postfix config, including helo_access and blacklist_helo config files enable smtpd_reject_unlisted_sender and stricter defaults on a few other settings See merge request !275
2 parents ad576c6 + 474b846 commit 28184f5

File tree

8 files changed

+167
-0
lines changed

8 files changed

+167
-0
lines changed

‎docs/examples/blacklist_helo.master‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
# blacklist_helo - after permit_sasl, used to stop common spammers/misconfigurations
2+
#
3+
# This file can be used to block hostnames used in smtp HELO command which are known bad.
4+
# Occasionally you will run into legitimate mail servers which are misconfigured and end
5+
# up blocked here, so this is not enabled by default, but it is useful if you are prepared
6+
# to address those cases. .local is particularly problematic, and commented out by default.
7+
#
8+
# Note that any server hitting this check is misconfigured, all of the names below are bogus
9+
# and not allowed per RFC 2821.
10+
#
11+
# If your own users are blocked by this, they are not authenticating to your server when
12+
# sending (this check is after permit_sasl, which permits authenticated senders).
13+
#
14+
# Instructions:
15+
#
16+
# Copy this file to /usr/local/ispconfig/server/conf-custom/install/blacklist_helo.master,
17+
# as well as /etc/postfix/blacklist_helo, so your changes are not overwritten with ispconfig
18+
# updates.
19+
20+
# probably just put REJECT lines in here,
21+
# as OK lines will bypass a lot of other checks you may want done
22+
# (use DUNNO instead of OK)
23+
#
24+
25+
# common for spammers (check https://data.iana.org/TLD/tlds-alpha-by-domain.txt and remove valid tld's occasionally)
26+
/.*\.administrator$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
27+
/.*\.admin$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
28+
/.*\.adsl$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
29+
/.*\.arpa$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
30+
/.*\.bac$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
31+
/.*\.coma$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
32+
/.*\.dhcp$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
33+
/.*\.dlink$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
34+
/.*\.dns$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
35+
/.*\.domain$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
36+
/.*\.dynamic$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
37+
/.*\.dyndns\.org$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
38+
/.*\.dyn$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
39+
/.*\.firewall$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
40+
/.*\.gateway$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
41+
/.*\.home$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
42+
/.*\.internal$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
43+
/.*\.intern$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
44+
/.*\.janak$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
45+
/.*\.kornet$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
46+
/.*\.lab$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
47+
/.*\.lan$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
48+
/.*\.localdomain$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
49+
/.*\.localhost$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
50+
51+
# .local is used by spammers a lot, but too many otherwise legit servers hit it
52+
# (instead of REJECT, should send to greylisting)
53+
#/.*\.local$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
54+
55+
/.*\.loc$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
56+
/.*\.lokal$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
57+
/.*\.mail$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
58+
/.*\.nat$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
59+
/.*\.netzwerk$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
60+
/.*\.pc$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
61+
/.*\.privat$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
62+
/.*\.private$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
63+
/.*\.router$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
64+
/.*\.setup$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
65+
66+
/.*\.119$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
67+
/.*\.beeline$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
68+
/.*\.cici$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
69+
/.*\.gt_3g$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
70+
/.*\.gt-3g$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
71+
/.*\.hananet$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
72+
/.*\.skbroadband$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
73+
/.*\.tbroad$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
74+

‎install/lib/installer_base.lib.php‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -896,13 +896,16 @@ public function configure_postfix($options = '') {
896896
}
897897
unset($server_ini_array);
898898

899+
$tmp = str_replace('.','\.',$conf['hostname']);
900+
899901
$postconf_placeholders = array('{config_dir}' => $config_dir,
900902
'{vmail_mailbox_base}' => $cf['vmail_mailbox_base'],
901903
'{vmail_userid}' => $cf['vmail_userid'],
902904
'{vmail_groupid}' => $cf['vmail_groupid'],
903905
'{rbl_list}' => $rbl_list,
904906
'{greylisting}' => $greylisting,
905907
'{reject_slm}' => $reject_sender_login_mismatch,
908+
'{myhostname}' => $tmp,
906909
);
907910

908911
$postconf_tpl = rfsel($conf['ispconfig_install_dir'].'/server/conf-custom/install/debian_postfix.conf.master', 'tpl/debian_postfix.conf.master');
@@ -933,6 +936,27 @@ public function configure_postfix($options = '') {
933936
if(!is_file('/var/lib/mailman/data/transport-mailman')) touch('/var/lib/mailman/data/transport-mailman');
934937
exec('/usr/sbin/postmap /var/lib/mailman/data/transport-mailman');
935938

939+
//* Create auxillary postfix conf files
940+
$configfile = 'helo_access';
941+
if(is_file($config_dir.'/'.$configfile)) {
942+
copy($config_dir.'/'.$configfile, $config_dir.'/'.$configfile.'~');
943+
chmod($config_dir.'/'.$configfile.'~', 0400);
944+
}
945+
$content = rfsel($conf['ispconfig_install_dir'].'/server/conf-custom/install/'.$configfile.'.master', 'tpl/'.$configfile.'.master');
946+
$content = strtr($content, $postconf_placeholders);
947+
# todo: look up this server's ip addrs and loop through each
948+
# todo: look up domains hosted on this server and loop through each
949+
wf($config_dir.'/'.$configfile, $content);
950+
951+
$configfile = 'blacklist_helo';
952+
if(is_file($config_dir.'/'.$configfile)) {
953+
copy($config_dir.'/'.$configfile, $config_dir.'/'.$configfile.'~');
954+
chmod($config_dir.'/'.$configfile.'~', 0400);
955+
}
956+
$content = rfsel($conf['ispconfig_install_dir'].'/server/conf-custom/install/'.$configfile.'.master', 'tpl/'.$configfile.'.master');
957+
$content = strtr($content, $postconf_placeholders);
958+
wf($config_dir.'/'.$configfile, $content);
959+
936960
//* Make a backup copy of the main.cf file
937961
copy($config_dir.'/main.cf', $config_dir.'/main.cf~');
938962

‎install/tpl/blacklist_helo.master‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# blacklist_helo - after permit_sasl, used to stop common spammers/misconfigurations
2+
#
3+
# This file can be used to block hostnames used in smtp HELO command which are known bad.
4+
# Occasionally you will run into legitimate mail servers which are misconfigured and end
5+
# up blocked here, so this is not enabled by default, but it is useful if you are prepared
6+
# to address those cases.
7+
#
8+
# See docs/extras/blacklist_helo.master from ispconfig source for a more complete example list.
9+
#
10+
# If you make changes here, also copy them to /usr/local/ispconfig/server/conf-custom/install/blacklist_helo.master,
11+
# so your changes are not overwritten with ispconfig updates.
12+
13+
14+
#/.*\.administrator$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
15+
#/.*\.admin$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
16+
#/.*\.adsl$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
17+
#/.*\.arpa$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
18+
#/.*\.dhcp$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
19+
#/.*\.dns$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
20+
#/.*\.domain$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
21+
#/.*\.dynamic$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
22+

‎install/tpl/debian_postfix.conf.master‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@ relay_domains = mysql:{config_dir}/mysql-virtual_relaydomains.cf
2424
relay_recipient_maps = mysql:{config_dir}/mysql-virtual_relayrecipientmaps.cf
2525
smtpd_sender_login_maps = proxy:mysql:{config_dir}/mysql-virtual_sender_login_maps.cf
2626
proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $sender_bcc_maps $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $smtpd_sender_login_maps
27+
smtpd_helo_required = yes
28+
smtpd_helo_restrictions = reject_invalid_helo_hostname, permit_mynetworks, check_helo_access regexp:{config_dir}/helo_access, permit_sasl_authenticated, reject_non_fqdn_helo_hostname, check_helo_access regexp:{config_dir}/blacklist_helo, warn_if_reject reject_unknown_helo_hostname, permit
2729
smtpd_sender_restrictions = check_sender_access mysql:{config_dir}/mysql-virtual_sender.cf regexp:{config_dir}/tag_as_originating.re{reject_slm}, permit_mynetworks, check_sender_access regexp:{config_dir}/tag_as_foreign.re
2830
smtpd_client_restrictions = check_client_access mysql:{config_dir}/mysql-virtual_client.cf
2931
smtpd_client_message_rate_limit = 100
@@ -41,3 +43,8 @@ smtpd_tls_protocols = !SSLv2,!SSLv3
4143
smtp_tls_protocols = !SSLv2,!SSLv3
4244
smtpd_tls_exclude_ciphers = RC4, aNULL
4345
smtp_tls_exclude_ciphers = RC4, aNULL
46+
strict_rfc821_envelopes = yes
47+
disable_vrfy_command = yes
48+
allow_percent_hack = no
49+
swap_bangpath = no
50+
smtpd_reject_unlisted_sender = yes

‎install/tpl/fedora_postfix.conf.master‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,8 @@ relay_domains = mysql:{config_dir}/mysql-virtual_relaydomains.cf
2121
relay_recipient_maps = mysql:{config_dir}/mysql-virtual_relayrecipientmaps.cf
2222
smtpd_sender_login_maps = proxy:mysql:{config_dir}/mysql-virtual_sender_login_maps.cf
2323
proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $sender_bcc_maps $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $smtpd_sender_login_maps
24+
smtpd_helo_required = yes
25+
smtpd_helo_restrictions = reject_invalid_helo_hostname, permit_mynetworks, check_helo_access regexp:{config_dir}/helo_access, permit_sasl_authenticated, reject_non_fqdn_helo_hostname, check_helo_access regexp:{config_dir}/blacklist_helo, warn_if_reject reject_unknown_helo_hostname, permit
2426
smtpd_sender_restrictions = check_sender_access mysql:{config_dir}/mysql-virtual_sender.cf regexp:{config_dir}/tag_as_originating.re{reject_slm}, permit_mynetworks, check_sender_access regexp:{config_dir}/tag_as_foreign.re
2527
smtpd_client_restrictions = check_client_access mysql:{config_dir}/mysql-virtual_client.cf
2628
smtpd_client_message_rate_limit = 100
@@ -38,3 +40,8 @@ smtpd_tls_protocols = !SSLv2,!SSLv3
3840
smtp_tls_protocols = !SSLv2,!SSLv3
3941
smtpd_tls_exclude_ciphers = RC4, aNULL
4042
smtp_tls_exclude_ciphers = RC4, aNULL
43+
strict_rfc821_envelopes = yes
44+
disable_vrfy_command = yes
45+
allow_percent_hack = no
46+
swap_bangpath = no
47+
smtpd_reject_unlisted_sender = yes

‎install/tpl/gentoo_postfix.conf.master‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,8 @@ relay_domains = mysql:{config_dir}/mysql-virtual_relaydomains.cf
2020
relay_recipient_maps = mysql:{config_dir}/mysql-virtual_relayrecipientmaps.cf
2121
smtpd_sender_login_maps = proxy:mysql:{config_dir}/mysql-virtual_sender_login_maps.cf
2222
proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $smtpd_sender_login_maps
23+
smtpd_helo_required = yes
24+
smtpd_helo_restrictions = reject_invalid_helo_hostname, permit_mynetworks, check_helo_access regexp:{config_dir}/helo_access, permit_sasl_authenticated, reject_non_fqdn_helo_hostname, check_helo_access regexp:{config_dir}/blacklist_helo, warn_if_reject reject_unknown_helo_hostname, permit
2325
smtpd_sender_restrictions = check_sender_access mysql:{config_dir}/mysql-virtual_sender.cf regexp:{config_dir}/tag_as_originating.re{reject_slm}, permit_mynetworks, check_sender_access regexp:{config_dir}/tag_as_foreign.re
2426
smtpd_client_restrictions = check_client_access mysql:{config_dir}/mysql-virtual_client.cf
2527
smtpd_client_message_rate_limit = 100
@@ -37,3 +39,8 @@ smtpd_tls_protocols = !SSLv2,!SSLv3
3739
smtp_tls_protocols = !SSLv2,!SSLv3
3840
smtpd_tls_exclude_ciphers = RC4, aNULL
3941
smtp_tls_exclude_ciphers = RC4, aNULL
42+
strict_rfc821_envelopes = yes
43+
disable_vrfy_command = yes
44+
allow_percent_hack = no
45+
swap_bangpath = no
46+
smtpd_reject_unlisted_sender = yes

‎install/tpl/helo_access.master‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# helo_access - before permit_sasl
2+
# be sure to list your own hostname(s), domain(s) and IP address(es) here
3+
4+
# Reject others identifying with this machine's hostnames and IP addresses
5+
/^{myhostname}$/ REJECT
6+
#/^((smtp|mx|mail)\.domain1\.com$/ REJECT
7+
#/^mail\.domain2\.com$/ REJECT
8+
9+
# TODO: this server's ip addr loop here
10+
#/^\[?1\.2\.3\.4\]?$/ REJECT
11+
#/^\[?12\.34\.56\.78\]?$/ REJECT
12+
#/^\[?123\.234\.123\.234\]?$/ REJECT
13+
14+
# Reject others identifying as domains we host
15+
# TODO: this server's hosted mail domains loop here
16+
#/^domain1\.com$/ REJECT
17+
#/^domain2\.com$/ REJECT
18+
#/^domain3\.net$/ REJECT
19+

‎install/tpl/opensuse_postfix.conf.master‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@ relay_domains = mysql:{config_dir}/mysql-virtual_relaydomains.cf
2323
relay_recipient_maps = mysql:{config_dir}/mysql-virtual_relayrecipientmaps.cf
2424
smtpd_sender_login_maps = proxy:mysql:{config_dir}/mysql-virtual_sender_login_maps.cf
2525
proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $sender_bcc_maps $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $smtpd_sender_login_maps
26+
smtpd_helo_required = yes
27+
smtpd_helo_restrictions = reject_invalid_helo_hostname, permit_mynetworks, check_helo_access regexp:{config_dir}/helo_access, permit_sasl_authenticated, reject_non_fqdn_helo_hostname, check_helo_access regexp:{config_dir}/blacklist_helo, warn_if_reject reject_unknown_helo_hostname, permit
2628
smtpd_sender_restrictions = check_sender_access mysql:{config_dir}/mysql-virtual_sender.cf regexp:{config_dir}/tag_as_originating.re{reject_slm}, permit_mynetworks, check_sender_access regexp:{config_dir}/tag_as_foreign.re
2729
smtpd_client_restrictions = check_client_access mysql:{config_dir}/mysql-virtual_client.cf
2830
smtpd_client_message_rate_limit = 100
@@ -40,3 +42,8 @@ smtpd_tls_protocols = !SSLv2,!SSLv3
4042
smtp_tls_protocols = !SSLv2,!SSLv3
4143
smtpd_tls_exclude_ciphers = RC4, aNULL
4244
smtp_tls_exclude_ciphers = RC4, aNULL
45+
strict_rfc821_envelopes = yes
46+
disable_vrfy_command = yes
47+
allow_percent_hack = no
48+
swap_bangpath = no
49+
smtpd_reject_unlisted_sender = yes

0 commit comments

Comments
 (0)