Skip to content

Commit 6d2d410

Browse files
jnorelljnorell
committed
add server config select list for unknown (dns) rejection
1 parent 08d936a commit 6d2d410

33 files changed

+256
-24
lines changed

‎install/lib/installer_base.lib.php‎

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1077,14 +1077,23 @@ public function configure_postfix($options = '') {
10771077
}
10781078

10791079
$reject_sender_login_mismatch = '';
1080-
if(isset($server_ini_array['mail']['reject_sender_login_mismatch']) && ($server_ini_array['mail']['reject_sender_login_mismatch'] == 'y')) {
1080+
if (isset($server_ini_array['mail']['reject_sender_login_mismatch']) && ($server_ini_array['mail']['reject_sender_login_mismatch'] == 'y')) {
10811081
$reject_sender_login_mismatch = ',reject_sender_login_mismatch,';
10821082
}
10831083

10841084
# placeholder includes comment char
10851085
$stress_adaptive_placeholder = '#{stress_adaptive}';
10861086
$stress_adaptive = (isset($server_ini_array['mail']['stress_adaptive']) && ($server_ini_array['mail']['stress_adaptive'] == 'y')) ? '' : $stress_adaptive_placeholder;
10871087

1088+
$reject_unknown_client_hostname='';
1089+
if (isset($server_ini_array['mail']['reject_unknown']) && ($server_ini_array['mail']['reject_unknown'] == 'client' || $server_ini_array['mail']['reject_unknown'] == 'client_helo')) {
1090+
$reject_unknown_client_hostname=',reject_unknown_client_hostname';
1091+
}
1092+
$reject_unknown_helo_hostname='';
1093+
if ((!isset($server_ini_array['mail']['reject_unknown'])) || $server_ini_array['mail']['reject_unknown'] == 'helo' || $server_ini_array['mail']['reject_unknown'] == 'client_helo') {
1094+
$reject_unknown_helo_hostname=',reject_unknown_helo_hostname';
1095+
}
1096+
10881097
unset($server_ini_array);
10891098

10901099
$tmp = str_replace('.','\.',$conf['hostname']);
@@ -1098,6 +1107,8 @@ public function configure_postfix($options = '') {
10981107
'{reject_slm}' => $reject_sender_login_mismatch,
10991108
'{myhostname}' => $tmp,
11001109
$stress_adaptive_placeholder => $stress_adaptive,
1110+
'{reject_unknown_client_hostname}' => $reject_unknown_client_hostname,
1111+
'{reject_unknown_helo_hostname}' => $reject_unknown_helo_hostname,
11011112
);
11021113

11031114
$postconf_tpl = rfsel($conf['ispconfig_install_dir'].'/server/conf-custom/install/debian_postfix.conf.master', 'tpl/debian_postfix.conf.master');
@@ -1684,14 +1695,12 @@ public function configure_rspamd() {
16841695
$options = explode(", ", exec("postconf -h smtpd_sender_restrictions"));
16851696
$new_options = array();
16861697
foreach ($options as $key => $value) {
1687-
if ($value == '') {
1688-
continue;
1689-
}
1698+
if (trim($value) == '') continue;
16901699
if (preg_match('/tag_as_(originating|foreign)\.re/', $value)) {
16911700
continue;
16921701
}
16931702
if (!preg_match('/reject_(authenticated_)?sender_login_mismatch/', $value)) {
1694-
$new_options[] = $value;
1703+
$new_options[] = trim($value);
16951704
}
16961705
}
16971706
if ($mail_config['reject_sender_login_mismatch'] == 'y') {

‎install/tpl/debian_postfix.conf.master‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,9 @@ relay_recipient_maps = mysql:{config_dir}/mysql-virtual_relayrecipientmaps.cf
2626
smtpd_sender_login_maps = proxy:mysql:{config_dir}/mysql-virtual_sender_login_maps.cf
2727
proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $sender_bcc_maps $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $smtpd_sender_login_maps $smtpd_recipient_restrictions
2828
smtpd_helo_required = yes
29-
smtpd_helo_restrictions = reject_invalid_helo_hostname, permit_mynetworks, check_helo_access regexp:{config_dir}/helo_access, permit_sasl_authenticated, reject_non_fqdn_helo_hostname, check_helo_access regexp:{config_dir}/blacklist_helo, reject_unknown_helo_hostname, permit
29+
smtpd_helo_restrictions = reject_invalid_helo_hostname, permit_mynetworks, check_helo_access regexp:{config_dir}/helo_access, permit_sasl_authenticated, reject_non_fqdn_helo_hostname, check_helo_access regexp:{config_dir}/blacklist_helo, {reject_unknown_helo_hostname}, permit
3030
smtpd_sender_restrictions = {reject_slm} check_sender_access regexp:{config_dir}/tag_as_originating.re, permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_sender, check_sender_access regexp:{config_dir}/tag_as_foreign.re, check_sender_access mysql:{config_dir}/mysql-virtual_sender.cf
31-
smtpd_client_restrictions = check_client_access mysql:{config_dir}/mysql-virtual_client.cf
31+
smtpd_client_restrictions = check_client_access mysql:{config_dir}/mysql-virtual_client.cf, permit_inet_interfaces, permit_mynetworks, permit_sasl_authenticated, reject_unauth_pipelining {reject_unknown_client_hostname}, permit
3232
smtpd_etrn_restrictions = permit_mynetworks, reject
3333
smtpd_data_restrictions = permit_mynetworks, reject_unauth_pipelining, reject_multi_recipient_bounce, permit
3434
smtpd_client_message_rate_limit = 100

‎install/tpl/fedora_postfix.conf.master‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,9 @@ relay_recipient_maps = mysql:{config_dir}/mysql-virtual_relayrecipientmaps.cf
2222
smtpd_sender_login_maps = proxy:mysql:{config_dir}/mysql-virtual_sender_login_maps.cf
2323
proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $sender_bcc_maps $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $smtpd_sender_login_maps $smtpd_recipient_restrictions
2424
smtpd_helo_required = yes
25-
smtpd_helo_restrictions = reject_invalid_helo_hostname, permit_mynetworks, check_helo_access regexp:{config_dir}/helo_access, permit_sasl_authenticated, reject_non_fqdn_helo_hostname, check_helo_access regexp:{config_dir}/blacklist_helo, reject_unknown_helo_hostname, permit
25+
smtpd_helo_restrictions = reject_invalid_helo_hostname, permit_mynetworks, check_helo_access regexp:{config_dir}/helo_access, permit_sasl_authenticated, reject_non_fqdn_helo_hostname, check_helo_access regexp:{config_dir}/blacklist_helo, {reject_unknown_helo_hostname}, permit
2626
smtpd_sender_restrictions = {reject_slm} check_sender_access regexp:{config_dir}/tag_as_originating.re, permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_sender, check_sender_access regexp:{config_dir}/tag_as_foreign.re, check_sender_access mysql:{config_dir}/mysql-virtual_sender.cf
27-
smtpd_client_restrictions = check_client_access mysql:{config_dir}/mysql-virtual_client.cf
27+
smtpd_client_restrictions = check_client_access mysql:{config_dir}/mysql-virtual_client.cf, permit_inet_interfaces, permit_mynetworks, permit_sasl_authenticated, reject_unauth_pipelining {reject_unknown_client_hostname}, permit
2828
smtpd_etrn_restrictions = permit_mynetworks, reject
2929
smtpd_data_restrictions = permit_mynetworks, reject_unauth_pipelining, reject_multi_recipient_bounce, permit
3030
smtpd_client_message_rate_limit = 100

‎install/tpl/gentoo_postfix.conf.master‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,9 +21,9 @@ relay_recipient_maps = mysql:{config_dir}/mysql-virtual_relayrecipientmaps.cf
2121
smtpd_sender_login_maps = proxy:mysql:{config_dir}/mysql-virtual_sender_login_maps.cf
2222
proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $smtpd_sender_login_maps $smtpd_recipient_restrictions
2323
smtpd_helo_required = yes
24-
smtpd_helo_restrictions = reject_invalid_helo_hostname, permit_mynetworks, check_helo_access regexp:{config_dir}/helo_access, permit_sasl_authenticated, reject_non_fqdn_helo_hostname, check_helo_access regexp:{config_dir}/blacklist_helo, reject_unknown_helo_hostname, permit
24+
smtpd_helo_restrictions = reject_invalid_helo_hostname, permit_mynetworks, check_helo_access regexp:{config_dir}/helo_access, permit_sasl_authenticated, reject_non_fqdn_helo_hostname, check_helo_access regexp:{config_dir}/blacklist_helo, {reject_unknown_helo_hostname}, permit
2525
smtpd_sender_restrictions = {reject_slm} check_sender_access regexp:{config_dir}/tag_as_originating.re, permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_sender, check_sender_access regexp:{config_dir}/tag_as_foreign.re, check_sender_access mysql:{config_dir}/mysql-virtual_sender.cf
26-
smtpd_client_restrictions = check_client_access mysql:{config_dir}/mysql-virtual_client.cf
26+
smtpd_client_restrictions = check_client_access mysql:{config_dir}/mysql-virtual_client.cf, permit_inet_interfaces, permit_mynetworks, permit_sasl_authenticated, reject_unauth_pipelining {reject_unknown_client_hostname}, permit
2727
smtpd_etrn_restrictions = permit_mynetworks, reject
2828
smtpd_data_restrictions = permit_mynetworks, reject_unauth_pipelining, reject_multi_recipient_bounce, permit
2929
smtpd_client_message_rate_limit = 100

‎install/tpl/opensuse_postfix.conf.master‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,9 +24,9 @@ relay_recipient_maps = mysql:{config_dir}/mysql-virtual_relayrecipientmaps.cf
2424
smtpd_sender_login_maps = proxy:mysql:{config_dir}/mysql-virtual_sender_login_maps.cf
2525
proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $sender_bcc_maps $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $smtpd_sender_login_maps $smtpd_recipient_restrictions
2626
smtpd_helo_required = yes
27-
smtpd_helo_restrictions = reject_invalid_helo_hostname, permit_mynetworks, check_helo_access regexp:{config_dir}/helo_access, permit_sasl_authenticated, reject_non_fqdn_helo_hostname, check_helo_access regexp:{config_dir}/blacklist_helo, reject_unknown_helo_hostname, permit
27+
smtpd_helo_restrictions = reject_invalid_helo_hostname, permit_mynetworks, check_helo_access regexp:{config_dir}/helo_access, permit_sasl_authenticated, reject_non_fqdn_helo_hostname, check_helo_access regexp:{config_dir}/blacklist_helo, {reject_unknown_helo_hostname}, permit
2828
smtpd_sender_restrictions = {reject_slm} check_sender_access regexp:{config_dir}/tag_as_originating.re, permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_sender, check_sender_access regexp:{config_dir}/tag_as_foreign.re, check_sender_access mysql:{config_dir}/mysql-virtual_sender.cf
29-
smtpd_client_restrictions = check_client_access mysql:{config_dir}/mysql-virtual_client.cf
29+
smtpd_client_restrictions = check_client_access mysql:{config_dir}/mysql-virtual_client.cf, permit_inet_interfaces, permit_mynetworks, permit_sasl_authenticated, reject_unauth_pipelining {reject_unknown_client_hostname}, permit
3030
smtpd_etrn_restrictions = permit_mynetworks, reject
3131
smtpd_data_restrictions = permit_mynetworks, reject_unauth_pipelining, reject_multi_recipient_bounce, permit
3232
smtpd_client_message_rate_limit = 100

‎interface/web/admin/form/server_config.tform.php‎

Lines changed: 18 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -456,11 +456,13 @@
456456
'datatype' => 'VARCHAR',
457457
'formtype' => 'TEXT',
458458
'default' => '/home/vmail/',
459-
'validators' => array( 0 => array('type' => 'NOTEMPTY',
460-
'errmsg' => 'homedir_path_error_empty'),
461-
1 => array ( 'type' => 'REGEX',
462-
'regex' => '/^\/[a-zA-Z0-9\.\-\_\/]{5,128}$/',
463-
'errmsg'=> 'homedir_path_error_regex'),
459+
'validators' => array( 0 => array ( 'type' => 'NOTEMPTY',
460+
'errmsg' => 'homedir_path_error_empty'
461+
),
462+
1 => array ( 'type' => 'REGEX',
463+
'regex' => '/^\/[a-zA-Z0-9\.\-\_\/]{5,128}$/',
464+
'errmsg'=> 'homedir_path_error_regex'
465+
),
464466
),
465467
'value' => '',
466468
'width' => '40',
@@ -638,6 +640,17 @@
638640
'default' => 'n',
639641
'value' => array(0 => 'n', 1 => 'y')
640642
),
643+
'reject_unknown' => array(
644+
'datatype' => 'VARCHAR',
645+
'formtype' => 'SELECT',
646+
'default' => 'helo',
647+
'value' => array(
648+
'helo' => 'reject_unknown_helo_txt',
649+
'client' => 'reject_unknown_client_txt',
650+
'client_helo' => 'reject_unknown_client_helo_txt',
651+
'none' => 'disabled_txt',
652+
)
653+
),
641654
'mailbox_size_limit' => array(
642655
'datatype' => 'INTEGER',
643656
'formtype' => 'TEXT',

‎interface/web/admin/lib/lang/ar_server_config.lng‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,11 @@ $wb['relayhost_txt'] = 'Relayhost';
4040
$wb['relayhost_user_txt'] = 'Relayhost User';
4141
$wb['relayhost_password_txt'] = 'Relayhost Password';
4242
$wb['reject_sender_login_mismatch_txt'] = 'Reject sender and login mismatch';
43+
$wb['reject_unknown_txt'] = 'Reject unknown hostnames';
44+
$wb['tooltip_reject_unknown_txt'] = 'Requires hostnames to pass DNS checks. Not checked for authenticated users.';
45+
$wb['reject_unknown_helo_txt'] = 'Reject unknown helo hostnames';
46+
$wb['reject_unknown_client_txt'] = 'Reject unknown client hostnames';
47+
$wb['reject_unknown_client_helo_txt'] = 'Reject unknown helo and client hostnames';
4348
$wb['mailbox_size_limit_txt'] = 'Mailbox Size Limit';
4449
$wb['message_size_limit_txt'] = 'Message Size Limit';
4550
$wb['ip_address_txt'] = 'IP Address';

‎interface/web/admin/lib/lang/bg_server_config.lng‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,11 @@ $wb['relayhost_txt'] = 'Relayhost';
3838
$wb['relayhost_user_txt'] = 'Relayhost User';
3939
$wb['relayhost_password_txt'] = 'Relayhost Password';
4040
$wb['reject_sender_login_mismatch_txt'] = 'Reject sender and login mismatch';
41+
$wb['reject_unknown_txt'] = 'Reject unknown hostnames';
42+
$wb['tooltip_reject_unknown_txt'] = 'Requires hostnames to pass DNS checks. Not checked for authenticated users.';
43+
$wb['reject_unknown_helo_txt'] = 'Reject unknown helo hostnames';
44+
$wb['reject_unknown_client_txt'] = 'Reject unknown client hostnames';
45+
$wb['reject_unknown_client_helo_txt'] = 'Reject unknown helo and client hostnames';
4146
$wb['mailbox_size_limit_txt'] = 'Mailbox Size Limit';
4247
$wb['message_size_limit_txt'] = 'Message Size Limit';
4348
$wb['ip_address_txt'] = 'IP адрес';

‎interface/web/admin/lib/lang/br_server_config.lng‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,11 @@ $wb['relayhost_txt'] = 'Servidor de retransmissão';
5151
$wb['relayhost_user_txt'] = 'Usuário de retransmissão';
5252
$wb['relayhost_password_txt'] = 'Senha do usuário de retransmissão';
5353
$wb['reject_sender_login_mismatch_txt'] = 'Rejeitar acesso com erro de usuário e/ou senha';
54+
$wb['reject_unknown_txt'] = 'Reject unknown hostnames';
55+
$wb['tooltip_reject_unknown_txt'] = 'Requires hostnames to pass DNS checks. Not checked for authenticated users.';
56+
$wb['reject_unknown_helo_txt'] = 'Reject unknown helo hostnames';
57+
$wb['reject_unknown_client_txt'] = 'Reject unknown client hostnames';
58+
$wb['reject_unknown_client_helo_txt'] = 'Reject unknown helo and client hostnames';
5459
$wb['mailbox_size_limit_txt'] = 'Limite do tamanho da conta de e-mail';
5560
$wb['message_size_limit_txt'] = 'Limite do tamanho da mensagem';
5661
$wb['ip_address_txt'] = 'Endereço IP';

‎interface/web/admin/lib/lang/ca_server_config.lng‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,11 @@ $wb['relayhost_txt'] = 'Relayhost';
5151
$wb['relayhost_user_txt'] = 'Relayhost User';
5252
$wb['relayhost_password_txt'] = 'Relayhost Password';
5353
$wb['reject_sender_login_mismatch_txt'] = 'Reject sender and login mismatch';
54+
$wb['reject_unknown_txt'] = 'Reject unknown hostnames';
55+
$wb['tooltip_reject_unknown_txt'] = 'Requires hostnames to pass DNS checks. Not checked for authenticated users.';
56+
$wb['reject_unknown_helo_txt'] = 'Reject unknown helo hostnames';
57+
$wb['reject_unknown_client_txt'] = 'Reject unknown client hostnames';
58+
$wb['reject_unknown_client_helo_txt'] = 'Reject unknown helo and client hostnames';
5459
$wb['mailbox_size_limit_txt'] = 'Mailbox Size Limit';
5560
$wb['message_size_limit_txt'] = 'Message Size Limit';
5661
$wb['ip_address_txt'] = 'IP Address';

0 commit comments

Comments
 (0)