Skip to content

Commit 709aed2

Browse files
jnorelljnorell
committed
add smtpd_helo_restrictions
1 parent bc3a775 commit 709aed2

File tree

7 files changed

+106
-0
lines changed

7 files changed

+106
-0
lines changed

‎install/lib/installer_base.lib.php‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -903,6 +903,7 @@ public function configure_postfix($options = '') {
903903
'{rbl_list}' => $rbl_list,
904904
'{greylisting}' => $greylisting,
905905
'{reject_slm}' => $reject_sender_login_mismatch,
906+
'{myhostname}' => $conf['hostname'],
906907
);
907908

908909
$postconf_tpl = rfsel($conf['ispconfig_install_dir'].'/server/conf-custom/install/debian_postfix.conf.master', 'tpl/debian_postfix.conf.master');
@@ -933,6 +934,27 @@ public function configure_postfix($options = '') {
933934
if(!is_file('/var/lib/mailman/data/transport-mailman')) touch('/var/lib/mailman/data/transport-mailman');
934935
exec('/usr/sbin/postmap /var/lib/mailman/data/transport-mailman');
935936

937+
//* Create auxillary postfix conf files
938+
$configfile = 'helo_access';
939+
if(is_file($config_dir.'/'.$configfile)) {
940+
copy($config_dir.'/'.$configfile, $config_dir.'/'.$configfile.'~');
941+
}
942+
chmod($config_dir.'/'.$configfile.'~', 0400);
943+
$content = rfsel($conf['ispconfig_install_dir'].'/server/conf-custom/install/'.$configfile.'.master', 'tpl/'.$configfile.'.master');
944+
$content = strtr($content, $postconf_placeholders);
945+
# todo: look up this server's ip addrs and loop through each
946+
# todo: look up domains hosted on this server and loop through each
947+
wf($config_dir.'/'.$configfile, $content);
948+
949+
$configfile = 'blacklist_helo';
950+
if(is_file($config_dir.'/'.$configfile)) {
951+
copy($config_dir.'/'.$configfile, $config_dir.'/'.$configfile.'~');
952+
}
953+
chmod($config_dir.'/'.$configfile.'~', 0400);
954+
$content = rfsel($conf['ispconfig_install_dir'].'/server/conf-custom/install/'.$configfile.'.master', 'tpl/'.$configfile.'.master');
955+
$content = strtr($content, $postconf_placeholders);
956+
wf($config_dir.'/'.$configfile, $content);
957+
936958
//* Make a backup copy of the main.cf file
937959
copy($config_dir.'/main.cf', $config_dir.'/main.cf~');
938960

‎install/tpl/blacklist_helo.master‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
# blacklist_helo - after permit_sasl, used to stop common spammers/misconfigurations
2+
#
3+
# probably just put REJECT lines in here,
4+
# as OK lines will bypass a lot of other checks you may want done
5+
# (use DUNNO instead of OK)
6+
#
7+
8+
# common for spammers (check https://data.iana.org/TLD/tlds-alpha-by-domain.txt and remove valid tld's occasionally)
9+
/.*\.administrator$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
10+
/.*\.admin$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
11+
/.*\.adsl$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
12+
/.*\.arpa$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
13+
/.*\.bac$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
14+
/.*\.coma$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
15+
/.*\.dhcp$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
16+
/.*\.dlink$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
17+
/.*\.dns$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
18+
/.*\.domain$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
19+
/.*\.dynamic$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
20+
/.*\.dyndns\.org$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
21+
/.*\.dyn$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
22+
/.*\.firewall$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
23+
/.*\.gateway$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
24+
/.*\.home$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
25+
/.*\.internal$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
26+
/.*\.intern$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
27+
/.*\.janak$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
28+
/.*\.kornet$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
29+
/.*\.lab$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
30+
/.*\.lan$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
31+
/.*\.localdomain$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
32+
/.*\.localhost$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
33+
34+
# .local is used by spammers a lot, but too many otherwise legit servers hit it
35+
# (instead of REJECT, should send to greylisting)
36+
#/.*\.local$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
37+
38+
/.*\.loc$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
39+
/.*\.lokal$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
40+
/.*\.mail$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
41+
/.*\.nat$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
42+
/.*\.netzwerk$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
43+
/.*\.pc$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
44+
/.*\.privat$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
45+
/.*\.private$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
46+
/.*\.router$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
47+
/.*\.setup$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
48+
49+
/.*\.119$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
50+
/.*\.beeline$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
51+
/.*\.cici$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
52+
/.*\.gt_3g$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
53+
/.*\.gt-3g$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
54+
/.*\.hananet$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
55+
/.*\.skbroadband$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
56+
/.*\.tbroad$/ REJECT HELO hostname is using a top level domain that does not exist. See RFC 2821 section 3.6.
57+

‎install/tpl/debian_postfix.conf.master‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@ relay_domains = mysql:{config_dir}/mysql-virtual_relaydomains.cf
2424
relay_recipient_maps = mysql:{config_dir}/mysql-virtual_relayrecipientmaps.cf
2525
smtpd_sender_login_maps = proxy:mysql:{config_dir}/mysql-virtual_sender_login_maps.cf
2626
proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $sender_bcc_maps $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $smtpd_sender_login_maps
27+
smtpd_helo_required = yes
28+
smtpd_helo_restrictions = reject_invalid_helo_hostname, permit_mynetworks, check_helo_access regexp:{config_dir}/helo_access, permit_sasl_authenticated, reject_non_fqdn_helo_hostname, check_helo_access regexp:{config_dir}/blacklist_helo, warn_if_reject reject_unknown_helo_hostname, permit
2729
smtpd_sender_restrictions = check_sender_access mysql:{config_dir}/mysql-virtual_sender.cf regexp:{config_dir}/tag_as_originating.re{reject_slm}, permit_mynetworks, check_sender_access regexp:{config_dir}/tag_as_foreign.re
2830
smtpd_client_restrictions = check_client_access mysql:{config_dir}/mysql-virtual_client.cf
2931
smtpd_client_message_rate_limit = 100

‎install/tpl/fedora_postfix.conf.master‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,8 @@ relay_domains = mysql:{config_dir}/mysql-virtual_relaydomains.cf
2121
relay_recipient_maps = mysql:{config_dir}/mysql-virtual_relayrecipientmaps.cf
2222
smtpd_sender_login_maps = proxy:mysql:{config_dir}/mysql-virtual_sender_login_maps.cf
2323
proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $sender_bcc_maps $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $smtpd_sender_login_maps
24+
smtpd_helo_required = yes
25+
smtpd_helo_restrictions = reject_invalid_helo_hostname, permit_mynetworks, check_helo_access regexp:{config_dir}/helo_access, permit_sasl_authenticated, reject_non_fqdn_helo_hostname, check_helo_access regexp:{config_dir}/blacklist_helo, warn_if_reject reject_unknown_helo_hostname, permit
2426
smtpd_sender_restrictions = check_sender_access mysql:{config_dir}/mysql-virtual_sender.cf regexp:{config_dir}/tag_as_originating.re{reject_slm}, permit_mynetworks, check_sender_access regexp:{config_dir}/tag_as_foreign.re
2527
smtpd_client_restrictions = check_client_access mysql:{config_dir}/mysql-virtual_client.cf
2628
smtpd_client_message_rate_limit = 100

‎install/tpl/gentoo_postfix.conf.master‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,8 @@ relay_domains = mysql:{config_dir}/mysql-virtual_relaydomains.cf
2020
relay_recipient_maps = mysql:{config_dir}/mysql-virtual_relayrecipientmaps.cf
2121
smtpd_sender_login_maps = proxy:mysql:{config_dir}/mysql-virtual_sender_login_maps.cf
2222
proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $smtpd_sender_login_maps
23+
smtpd_helo_required = yes
24+
smtpd_helo_restrictions = reject_invalid_helo_hostname, permit_mynetworks, check_helo_access regexp:{config_dir}/helo_access, permit_sasl_authenticated, reject_non_fqdn_helo_hostname, check_helo_access regexp:{config_dir}/blacklist_helo, warn_if_reject reject_unknown_helo_hostname, permit
2325
smtpd_sender_restrictions = check_sender_access mysql:{config_dir}/mysql-virtual_sender.cf regexp:{config_dir}/tag_as_originating.re{reject_slm}, permit_mynetworks, check_sender_access regexp:{config_dir}/tag_as_foreign.re
2426
smtpd_client_restrictions = check_client_access mysql:{config_dir}/mysql-virtual_client.cf
2527
smtpd_client_message_rate_limit = 100

‎install/tpl/helo_access.master‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# helo_access - before permit_sasl
2+
# be sure to list your own hostname(s), domain(s) and IP address(es) here
3+
4+
# Reject others identifying with this machine's hostnames and IP addresses
5+
{myhostname} REJECT
6+
#/^((smtp|mx|mail)\.domain1\.com$/ REJECT
7+
#/^mail\.domain2\.com$/ REJECT
8+
9+
# TODO: this server's ip addr loop here
10+
#/^\[?1\.2\.3\.4\]?$/ REJECT
11+
#/^\[?12\.34\.56\.78\]?$/ REJECT
12+
#/^\[?123\.234\.123\.234\]?$/ REJECT
13+
14+
# Reject others identifying as domains we host
15+
# TODO: this server's hosted mail domains loop here
16+
#/^domain1\.com$/ REJECT
17+
#/^domain2\.com$/ REJECT
18+
#/^domain3\.net$/ REJECT
19+

‎install/tpl/opensuse_postfix.conf.master‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@ relay_domains = mysql:{config_dir}/mysql-virtual_relaydomains.cf
2323
relay_recipient_maps = mysql:{config_dir}/mysql-virtual_relayrecipientmaps.cf
2424
smtpd_sender_login_maps = proxy:mysql:{config_dir}/mysql-virtual_sender_login_maps.cf
2525
proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $sender_bcc_maps $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $smtpd_sender_login_maps
26+
smtpd_helo_required = yes
27+
smtpd_helo_restrictions = reject_invalid_helo_hostname, permit_mynetworks, check_helo_access regexp:{config_dir}/helo_access, permit_sasl_authenticated, reject_non_fqdn_helo_hostname, check_helo_access regexp:{config_dir}/blacklist_helo, warn_if_reject reject_unknown_helo_hostname, permit
2628
smtpd_sender_restrictions = check_sender_access mysql:{config_dir}/mysql-virtual_sender.cf regexp:{config_dir}/tag_as_originating.re{reject_slm}, permit_mynetworks, check_sender_access regexp:{config_dir}/tag_as_foreign.re
2729
smtpd_client_restrictions = check_client_access mysql:{config_dir}/mysql-virtual_client.cf
2830
smtpd_client_message_rate_limit = 100

0 commit comments

Comments
 (0)