1 1.1 tron <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" 2 1.1.1.9 christos "https://www.w3.org/TR/html4/loose.dtd"> 3 1.1 tron 4 1.1 tron <head> 5 1.1 tron 6 1.1 tron <title>Postfix Postscreen Howto</title> 7 1.1 tron 8 1.1.1.7 christos <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> 9 1.1.1.8 christos <link rel='stylesheet' type='text/css' href='postfix-doc.css'> 10 1.1 tron 11 1.1 tron </head> 12 1.1 tron 13 1.1 tron <body> 14 1.1 tron 15 1.1 tron <h1><img src="postfix-logo.jpg" width="203" height="98" ALT="">Postfix Postscreen Howto</h1> 16 1.1 tron 17 1.1 tron <hr> 18 1.1 tron 19 1.1 tron <h2> <a name="intro">Introduction</a> </h2> 20 1.1 tron 21 1.1.1.3 tron <p> This document describes features that are available in Postfix 22 1.1.1.7 christos 3.6 and later. See <a href="POSTSCREEN_3_5_README.html"> 23 1.1.1.7 christos POSTSCREEN_3_5_README.html</a> for Postfix versions 2.8 - 3.5. </p> 24 1.1.1.3 tron 25 1.1.1.3 tron <p> The Postfix <a href="postscreen.8.html">postscreen(8)</a> daemon provides additional protection 26 1.1.1.3 tron against mail server overload. One <a href="postscreen.8.html">postscreen(8)</a> process handles 27 1.1.1.3 tron multiple inbound SMTP connections, and decides which clients may 28 1.1.1.3 tron talk to a Postfix SMTP server process. By keeping spambots away, 29 1.1.1.3 tron <a href="postscreen.8.html">postscreen(8)</a> leaves more SMTP server processes available for 30 1.1.1.3 tron legitimate clients, and delays the onset of <a 31 1.1.1.3 tron href="STRESS_README.html">server overload</a> conditions. </p> 32 1.1.1.3 tron 33 1.1.1.3 tron <p> <a href="postscreen.8.html">postscreen(8)</a> should not be used on SMTP ports that receive 34 1.1.1.3 tron mail from end-user clients (MUAs). In a typical deployment, 35 1.1.1.3 tron <a href="postscreen.8.html">postscreen(8)</a> handles the MX service on TCP port 25, while MUA 36 1.1.1.3 tron clients submit mail via the submission service on TCP port 587 which 37 1.1.1.3 tron requires client authentication. Alternatively, a site could set up 38 1.1.1.3 tron a dedicated, non-postscreen, "port 25" server that provides submission 39 1.1.1.3 tron service and client authentication, but no MX service. </p> 40 1.1 tron 41 1.1.1.7 christos <p> <a href="postscreen.8.html">postscreen(8)</a> maintains a temporary allowlist for clients that 42 1.1.1.7 christos pass its tests; by allowing allowlisted clients to skip tests, 43 1.1.1.2 tron <a href="postscreen.8.html">postscreen(8)</a> minimizes its impact on legitimate email traffic. 44 1.1.1.2 tron </p> 45 1.1.1.2 tron 46 1.1 tron <p> <a href="postscreen.8.html">postscreen(8)</a> is part of a multi-layer defense. <p> 47 1.1 tron 48 1.1 tron <ul> 49 1.1 tron 50 1.1 tron <li> <p> As the first layer, <a href="postscreen.8.html">postscreen(8)</a> blocks connections from 51 1.1 tron zombies and other spambots that are responsible for about 90% of 52 1.1 tron all spam. It is implemented as a single process to make this defense 53 1.1.1.3 tron as inexpensive as possible. </p> 54 1.1 tron 55 1.1 tron <li> <p> The second layer implements more complex SMTP-level access 56 1.1.1.3 tron checks with <a href="SMTPD_ACCESS_README.html">Postfix SMTP servers</a>, 57 1.1.1.3 tron <a href="SMTPD_POLICY_README.html">policy daemons</a>, and 58 1.1.1.3 tron <a href="MILTER_README.html">Milter applications</a>. </p> 59 1.1 tron 60 1.1 tron <li> <p> The third layer performs light-weight content inspection 61 1.1 tron with the Postfix built-in <a href="postconf.5.html#header_checks">header_checks</a> and <a href="postconf.5.html#body_checks">body_checks</a>. This can 62 1.1 tron block unacceptable attachments such as executable programs, and 63 1.1 tron worms or viruses with easy-to-recognize signatures. </p> 64 1.1 tron 65 1.1 tron <li> <p> The fourth layer provides heavy-weight content inspection 66 1.1.1.3 tron with external content filters. Typical examples are <a 67 1.1.1.9 christos href="https://www.ijs.si/software/amavisd/">Amavisd-new</a>, <a 68 1.1.1.9 christos href="https://spamassassin.apache.org/">SpamAssassin</a>, and <a 69 1.1.1.3 tron href="MILTER_README.html">Milter applications</a>. </p> 70 1.1 tron 71 1.1 tron </ul> 72 1.1 tron 73 1.1 tron <p> Each layer reduces the spam volume. The general strategy is to 74 1.1 tron use the less expensive defenses first, and to use the more expensive 75 1.1.1.2 tron defenses only for the spam that remains. </p> 76 1.1 tron 77 1.1 tron <p> Topics in this document: </p> 78 1.1 tron 79 1.1 tron <ul> 80 1.1 tron 81 1.1 tron <li> <a href="#intro">Introduction</a> 82 1.1 tron 83 1.1 tron <li> <a href="#basic">The basic idea behind postscreen(8)</a> 84 1.1 tron 85 1.1 tron <li> <a href="#general"> General operation </a> 86 1.1 tron 87 1.1 tron <li> <a href="#quick">Quick tests before everything else</a> 88 1.1 tron 89 1.1 tron <li> <a href="#before_220"> Tests before the 220 SMTP server greeting </a> 90 1.1 tron 91 1.1 tron <li> <a href="#after_220">Tests after the 220 SMTP server greeting</a> 92 1.1 tron 93 1.1 tron <li> <a href="#other_error">Other errors</a> 94 1.1 tron 95 1.1 tron <li> <a href="#victory">When all tests succeed</a> 96 1.1 tron 97 1.1 tron <li> <a href="#config"> Configuring the postscreen(8) service</a> 98 1.1 tron 99 1.1 tron <li> <a href="#historical"> Historical notes and credits </a> 100 1.1 tron 101 1.1 tron </ul> 102 1.1 tron 103 1.1 tron <h2> <a name="basic">The basic idea behind postscreen(8)</a> </h2> 104 1.1 tron 105 1.1 tron <p> Most email is spam, and most spam is sent out by zombies (malware 106 1.1 tron on compromised end-user computers). Wietse expects that the zombie 107 1.1 tron problem will get worse before things improve, if ever. Without a 108 1.1 tron tool like <a href="postscreen.8.html">postscreen(8)</a> that keeps the zombies away, Postfix would be 109 1.1 tron spending most of its resources not receiving email. </p> 110 1.1 tron 111 1.1.1.6 christos <p> The main challenge for <a href="postscreen.8.html">postscreen(8)</a> is to make an is-a-zombie 112 1.1 tron decision based on a single measurement. This is necessary because 113 1.1.1.2 tron many zombies try to fly under the radar and avoid spamming the same 114 1.1.1.2 tron site repeatedly. Once <a href="postscreen.8.html">postscreen(8)</a> decides that a client is 115 1.1.1.7 christos not-a-zombie, it allowlists the client temporarily to avoid further 116 1.1.1.2 tron delays for legitimate mail. </p> 117 1.1 tron 118 1.1 tron <p> Zombies have challenges too: they have only a limited amount 119 1.1.1.7 christos of time to deliver spam before their IP address becomes denylisted. 120 1.1 tron To speed up spam deliveries, zombies make compromises in their SMTP 121 1.1 tron protocol implementation. For example, they speak before their turn, 122 1.1 tron or they ignore responses from SMTP servers and continue sending 123 1.1.1.9 christos commands even when the server tells them to go away. </p> 124 1.1 tron 125 1.1 tron <p> <a href="postscreen.8.html">postscreen(8)</a> uses a variety of measurements to recognize 126 1.1 tron zombies. First, <a href="postscreen.8.html">postscreen(8)</a> determines if the remote SMTP client 127 1.1.1.7 christos IP address is denylisted. Second, <a href="postscreen.8.html">postscreen(8)</a> looks for protocol 128 1.1 tron compromises that are made to speed up delivery. These are good 129 1.1.1.6 christos indicators for making is-a-zombie decisions based on single 130 1.1 tron measurements. </p> 131 1.1 tron 132 1.1 tron <p> <a href="postscreen.8.html">postscreen(8)</a> does not inspect message content. Message content 133 1.1 tron can vary from one delivery to the next, especially with clients 134 1.1 tron that (also) send legitimate email. Content is not a good indicator 135 1.1.1.6 christos for making is-a-zombie decisions based on single measurements, 136 1.1 tron and that is the problem that <a href="postscreen.8.html">postscreen(8)</a> is focused on. </p> 137 1.1 tron 138 1.1 tron <h2> <a name="general"> General operation </a> </h2> 139 1.1 tron 140 1.1.1.3 tron <p> For each connection from an SMTP client, <a href="postscreen.8.html">postscreen(8)</a> performs 141 1.1.1.3 tron a number of tests 142 1.1 tron in the order as described below. Some tests introduce a delay of 143 1.1.1.7 christos a few seconds. <a href="postscreen.8.html">postscreen(8)</a> maintains a temporary allowlist for 144 1.1.1.7 christos clients that pass its tests; by allowing allowlisted clients to 145 1.1.1.2 tron skip tests, <a href="postscreen.8.html">postscreen(8)</a> minimizes its impact on legitimate email 146 1.1.1.2 tron traffic. </p> 147 1.1.1.2 tron 148 1.1.1.2 tron <p> By default, <a href="postscreen.8.html">postscreen(8)</a> hands off all connections to a Postfix 149 1.1.1.2 tron SMTP server process after logging its findings. This mode is useful 150 1.1.1.2 tron for non-destructive testing. </p> 151 1.1 tron 152 1.1 tron <p> In a typical production setting, <a href="postscreen.8.html">postscreen(8)</a> is configured 153 1.1 tron to reject mail from clients that fail one or more tests, after 154 1.1 tron logging the helo, sender and recipient information. </p> 155 1.1 tron 156 1.1 tron <p> Note: <a href="postscreen.8.html">postscreen(8)</a> is not an SMTP proxy; this is intentional. 157 1.1 tron The purpose is to keep zombies away from Postfix, with minimal 158 1.1 tron overhead for legitimate clients. </p> 159 1.1 tron 160 1.1 tron <h2> <a name="quick">Quick tests before everything else</a> </h2> 161 1.1 tron 162 1.1.1.9 christos <p> Before engaging in SMTP-level tests, <a href="postscreen.8.html">postscreen(8)</a> queries a 163 1.1.1.7 christos number of local deny and allowlists. These tests speed up the 164 1.1 tron handling of known clients. </p> 165 1.1 tron 166 1.1 tron <ul> 167 1.1 tron 168 1.1.1.7 christos <li> <a href="#perm_allow_deny"> Permanent allow/denylist test </a> 169 1.1 tron 170 1.1.1.7 christos <li> <a href="#temp_allow"> Temporary allowlist test </a> 171 1.1 tron 172 1.1.1.7 christos <li> <a href="#allow_veto"> MX Policy test </a> 173 1.1.1.2 tron 174 1.1 tron </ul> 175 1.1 tron 176 1.1.1.7 christos <h3> <a name="perm_allow_deny"> Permanent allow/denylist test </a> </h3> 177 1.1 tron 178 1.1 tron <p> The <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> parameter (default: <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>) 179 1.1 tron specifies a permanent access list for SMTP client IP addresses. Typically 180 1.1.1.7 christos one would specify something that allowlists local networks, followed 181 1.1.1.7 christos by a CIDR table for selective allow- and denylisting. </p> 182 1.1 tron 183 1.1 tron <p> Example: </p> 184 1.1 tron 185 1.1 tron <pre> 186 1.1 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 187 1.1 tron <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, 188 1.1 tron <a href="cidr_table.5.html">cidr</a>:/etc/postfix/postscreen_access.cidr 189 1.1 tron 190 1.1 tron /etc/postfix/postscreen_access.<a href="cidr_table.5.html">cidr</a>: 191 1.1 tron # Rules are evaluated in the order as specified. 192 1.1.1.7 christos # Denylist 192.168.* except 192.168.0.1. 193 1.1 tron 192.168.0.1 permit 194 1.1 tron 192.168.0.0/16 reject 195 1.1 tron </pre> 196 1.1 tron 197 1.1 tron <p> See the <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> manpage documentation for more 198 1.1 tron details. </p> 199 1.1 tron 200 1.1 tron <p> When the SMTP client address matches a "permit" action, 201 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> logs this with the client address and port number as: 202 1.1 tron </p> 203 1.1 tron 204 1.1.1.7 christos <blockquote> 205 1.1 tron <pre> 206 1.1.1.7 christos <b>ALLOWLISTED</b> <i>[address]:port</i> 207 1.1 tron </pre> 208 1.1.1.7 christos </blockquote> 209 1.1.1.7 christos 210 1.1.1.7 christos <blockquote> <p> Use the <a href="postconf.5.html#respectful_logging">respectful_logging</a> configuration parameter to 211 1.1.1.7 christos select a deprecated form of this logging. </p> </blockquote> 212 1.1 tron 213 1.1.1.7 christos <p> The allowlist action is not configurable: immediately hand off the 214 1.1 tron connection to a Postfix SMTP server process. </p> 215 1.1 tron 216 1.1 tron <p> When the SMTP client address matches a "reject" action, 217 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> logs this with the client address and port number as: 218 1.1 tron </p> 219 1.1 tron 220 1.1.1.7 christos <blockquote> 221 1.1 tron <pre> 222 1.1.1.7 christos <b>DENYLISTED</b> <i>[address]:port</i> 223 1.1 tron </pre> 224 1.1.1.7 christos </blockquote> 225 1.1 tron 226 1.1.1.7 christos <blockquote> <p> Use the <a href="postconf.5.html#respectful_logging">respectful_logging</a> configuration parameter to 227 1.1.1.7 christos select a deprecated form of this logging. </p> </blockquote> 228 1.1.1.7 christos 229 1.1.1.7 christos <p> The <a href="postconf.5.html#postscreen_denylist_action">postscreen_denylist_action</a> parameter specifies the action 230 1.1 tron that is taken next. See "<a href="#fail_before_220">When tests 231 1.1 tron fail before the 220 SMTP server greeting</a>" below. </p> 232 1.1 tron 233 1.1.1.7 christos <h3> <a name="temp_allow"> Temporary allowlist test </a> </h3> 234 1.1 tron 235 1.1 tron <p> The <a href="postscreen.8.html">postscreen(8)</a> daemon maintains a <i>temporary</i> 236 1.1.1.7 christos allowlist for SMTP client IP addresses that have passed all 237 1.1 tron the tests described below. The <a href="postconf.5.html#postscreen_cache_map">postscreen_cache_map</a> parameter 238 1.1.1.7 christos specifies the location of the temporary allowlist. The 239 1.1.1.7 christos temporary allowlist is not used for SMTP client addresses 240 1.1.1.2 tron that appear on the <i>permanent</i> access list. </p> 241 1.1.1.2 tron 242 1.1.1.7 christos <p> By default the temporary allowlist is not shared with other 243 1.1.1.7 christos <a href="postscreen.8.html">postscreen(8)</a> daemons. See 244 1.1.1.7 christos <a href="#temp_allow_sharing"> Sharing 245 1.1.1.7 christos the temporary allowlist </a> below for alternatives. </p> 246 1.1 tron 247 1.1 tron <p> When the SMTP client address appears on the temporary 248 1.1.1.7 christos allowlist, <a href="postscreen.8.html">postscreen(8)</a> logs this with the client address and port 249 1.1 tron number as: </p> 250 1.1 tron 251 1.1 tron <pre> 252 1.1 tron <b>PASS OLD</b> <i>[address]:port</i> 253 1.1 tron </pre> 254 1.1 tron 255 1.1 tron <p> The action is not configurable: immediately hand off the 256 1.1 tron connection to a Postfix SMTP server process. The client is 257 1.1.1.7 christos excluded from further tests until its temporary allowlist 258 1.1 tron entry expires, as controlled with the postscreen_*_ttl 259 1.1 tron parameters. Expired entries are silently renewed if possible. </p> 260 1.1 tron 261 1.1.1.7 christos <h3> <a name="allow_veto"> MX Policy test </a> </h3> 262 1.1.1.2 tron 263 1.1.1.2 tron <p> When the remote SMTP client is not on the static access list 264 1.1.1.7 christos or temporary allowlist, <a href="postscreen.8.html">postscreen(8)</a> can implement a number of 265 1.1.1.7 christos allowlist tests, before it grants the client a temporary allowlist 266 1.1.1.2 tron status that allows it to talk to a Postfix SMTP server process. </p> 267 1.1.1.2 tron 268 1.1.1.3 tron <p> When <a href="postscreen.8.html">postscreen(8)</a> is configured to monitor all primary and 269 1.1.1.7 christos backup MX addresses, it can refuse to allowlist clients that connect 270 1.1.1.3 tron to a backup MX address only (an old spammer trick to take advantage 271 1.1.1.3 tron of backup MX hosts with weaker anti-spam policies than primary MX 272 1.1.1.2 tron hosts). </p> 273 1.1.1.2 tron 274 1.1.1.3 tron <blockquote> <p> NOTE: The following solution is for small sites. 275 1.1.1.3 tron Larger sites would have to share the <a href="postscreen.8.html">postscreen(8)</a> cache between 276 1.1.1.3 tron primary and backup MTAs, which would introduce a common point of 277 1.1.1.3 tron failure. </p> </blockquote> 278 1.1.1.3 tron 279 1.1.1.2 tron <ul> 280 1.1.1.2 tron 281 1.1.1.2 tron <li> <p> First, configure the host to listen on both primary and 282 1.1.1.7 christos backup MX addresses. Use the appropriate <tt>ifconfig</tt> or <tt>ip</tt> 283 1.1.1.7 christos command for the local operating system, or update the appropriate 284 1.1.1.7 christos configuration files and "refresh" the network protocol stack. </p> 285 1.1.1.2 tron 286 1.1.1.3 tron <p> <p> Second, configure Postfix to listen on the new IP address 287 1.1.1.3 tron (this step is needed when you have specified <a href="postconf.5.html#inet_interfaces">inet_interfaces</a> in 288 1.1.1.3 tron <a href="postconf.5.html">main.cf</a>). </p> 289 1.1.1.3 tron 290 1.1.1.7 christos <li> <p> Then, configure <a href="postscreen.8.html">postscreen(8)</a> to deny the temporary allowlist 291 1.1.1.2 tron status on the backup MX address(es). An example for Wietse's 292 1.1.1.2 tron server is: </p> 293 1.1.1.2 tron 294 1.1.1.2 tron <pre> 295 1.1.1.2 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 296 1.1.1.7 christos <a href="postconf.5.html#postscreen_allowlist_interfaces">postscreen_allowlist_interfaces</a> = !168.100.189.8 <a href="DATABASE_README.html#types">static</a>:all 297 1.1.1.2 tron </pre> 298 1.1.1.2 tron 299 1.1.1.7 christos <p> Translation: allow clients to obtain the temporary allowlist 300 1.1.1.2 tron status on all server IP addresses except 168.100.189.8, which is a 301 1.1.1.2 tron backup MX address. </p> 302 1.1.1.2 tron 303 1.1.1.2 tron </ul> 304 1.1.1.2 tron 305 1.1.1.7 christos <p> When a non-allowlisted client connects the backup MX address, 306 1.1.1.2 tron <a href="postscreen.8.html">postscreen(8)</a> logs this with the client address and port number as: 307 1.1.1.2 tron </p> 308 1.1.1.2 tron 309 1.1.1.7 christos <blockquote> <pre> 310 1.1.1.7 christos <b>CONNECT from</b> <i>[address]:port</i> <b>to [168.100.189.8]:25</b> 311 1.1.1.7 christos <b>ALLOWLIST VETO</b> <i>[address]:port</i> 312 1.1.1.7 christos </pre> </blockquote> 313 1.1.1.7 christos 314 1.1.1.7 christos <blockquote> <p> Use the <a href="postconf.5.html#respectful_logging">respectful_logging</a> configuration parameter to 315 1.1.1.7 christos select a deprecated form of this logging. </p> </blockquote> 316 1.1.1.2 tron 317 1.1.1.2 tron <p> Translation: the client at <i>[address]:port</i> connected to 318 1.1.1.7 christos the backup MX address 168.100.189.8 while it was not allowlisted. 319 1.1.1.7 christos The client will not be granted the temporary allowlist status, even 320 1.1.1.7 christos if passes all the allowlist tests described below. </p> 321 1.1.1.2 tron 322 1.1 tron <h2> <a name="before_220"> Tests before the 220 SMTP server greeting </a> </h2> 323 1.1 tron 324 1.1 tron <p> The <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> parameter specifies a short time 325 1.1 tron interval before the "220 <i>text</i>..." server greeting, where 326 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> can run a number of tests in parallel. </p> 327 1.1 tron 328 1.1 tron <p> When a good client passes these tests, and no "<a 329 1.1.1.7 christos href="#after_220">deep protocol tests</a>" 330 1.1.1.7 christos are configured, <a href="postscreen.8.html">postscreen(8)</a> 331 1.1.1.7 christos adds the client to the temporary allowlist and hands off the "live" 332 1.1 tron connection to a Postfix SMTP server process. The client can then 333 1.1 tron continue as if <a href="postscreen.8.html">postscreen(8)</a> never even existed (except of course 334 1.1 tron for the short <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> delay). </p> 335 1.1 tron 336 1.1 tron <ul> 337 1.1 tron 338 1.1 tron <li> <a href="#pregreet"> Pregreet test </a> 339 1.1 tron 340 1.1.1.7 christos <li> <a href="#dnsbl"> DNS Allow/denylist test </a> 341 1.1 tron 342 1.1 tron <li> <a href="#fail_before_220">When tests fail before the 220 SMTP server greeting</a> 343 1.1 tron 344 1.1 tron </ul> 345 1.1 tron 346 1.1 tron <h3> <a name="pregreet"> Pregreet test </a> </h3> 347 1.1 tron 348 1.1 tron <p> The SMTP protocol is a classic example of a protocol where the 349 1.1 tron server speaks before the client. <a href="postscreen.8.html">postscreen(8)</a> detects zombies 350 1.1 tron that are in a hurry and that speak before their turn. This test is 351 1.1 tron enabled by default. </p> 352 1.1 tron 353 1.1 tron <p> The <a href="postconf.5.html#postscreen_greet_banner">postscreen_greet_banner</a> parameter specifies the <i>text</i> 354 1.1 tron portion of a "220-<i>text</i>..." teaser banner (default: $<a href="postconf.5.html#smtpd_banner">smtpd_banner</a>). 355 1.1 tron Note that this becomes the first part of a multi-line server greeting. 356 1.1 tron The <a href="postscreen.8.html">postscreen(8)</a> daemon sends this before the <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> 357 1.1 tron timer is started. The purpose of the teaser banner is to confuse 358 1.1 tron zombies so that they speak before their turn. It has no effect on 359 1.1 tron SMTP clients that correctly implement the protocol. </p> 360 1.1 tron 361 1.1 tron <p> To avoid problems with poorly-implemented SMTP engines in network 362 1.1 tron appliances or network testing tools, either exclude them from all 363 1.1 tron tests with the <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> feature or else specify 364 1.1 tron an empty teaser banner: </p> 365 1.1 tron 366 1.1 tron <pre> 367 1.1 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 368 1.1.1.7 christos # Exclude broken clients by allowlisting. Clients in <a href="postconf.5.html#mynetworks">mynetworks</a> 369 1.1.1.7 christos # should always be allowlisted. 370 1.1 tron <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, 371 1.1 tron <a href="cidr_table.5.html">cidr</a>:/etc/postfix/postscreen_access.cidr 372 1.1 tron 373 1.1 tron /etc/postfix/postscreen_access.<a href="cidr_table.5.html">cidr</a>: 374 1.1 tron 192.168.254.0/24 permit 375 1.1 tron </pre> 376 1.1 tron 377 1.1 tron <pre> 378 1.1 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 379 1.1.1.7 christos # Disable the teaser banner (try allowlisting first if you can). 380 1.1 tron <a href="postconf.5.html#postscreen_greet_banner">postscreen_greet_banner</a> = 381 1.1 tron </pre> 382 1.1 tron 383 1.1 tron <p> When an SMTP client sends a command before the 384 1.1 tron <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> time has elapsed, <a href="postscreen.8.html">postscreen(8)</a> logs this as: 385 1.1 tron </p> 386 1.1 tron 387 1.1 tron <pre> 388 1.1 tron <b>PREGREET</b> <i>count</i> <b>after</b> <i>time</i> <b>from</b> <i>[address]:port text...</i> 389 1.1 tron </pre> 390 1.1 tron 391 1.1 tron <p> Translation: the client at <i>[address]:port</i> sent <i>count</i> 392 1.1 tron bytes before its turn to speak. This happened <i>time</i> seconds 393 1.1 tron after the <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> timer was started. The <i>text</i> 394 1.1 tron is what the client sent (truncated to 100 bytes, and with non-printable 395 1.1 tron characters replaced with C-style escapes such as \r for carriage-return 396 1.1 tron and \n for newline). </p> 397 1.1 tron 398 1.1 tron <p> The <a href="postconf.5.html#postscreen_greet_action">postscreen_greet_action</a> parameter specifies the action that 399 1.1 tron is taken next. See "<a href="#fail_before_220">When tests fail 400 1.1 tron before the 220 SMTP server greeting</a>" below. </p> 401 1.1 tron 402 1.1.1.7 christos <h3> <a name="dnsbl"> DNS Allow/denylist test </a> </h3> 403 1.1 tron 404 1.1 tron <p> The <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> parameter (default: empty) specifies 405 1.1 tron a list of DNS blocklist servers with optional filters and weight 406 1.1.1.7 christos factors (positive weights for denylisting, negative for allowlisting). 407 1.1 tron These servers will be queried in parallel with the reverse client 408 1.1 tron IP address. This test is disabled by default. </p> 409 1.1 tron 410 1.1 tron <blockquote> 411 1.1 tron <p> 412 1.1 tron CAUTION: when postscreen rejects mail, its SMTP reply contains the 413 1.1 tron DNSBL domain name. Use the <a href="postconf.5.html#postscreen_dnsbl_reply_map">postscreen_dnsbl_reply_map</a> feature to 414 1.1 tron hide "password" information in DNSBL domain names. 415 1.1 tron </p> 416 1.1 tron </blockquote> 417 1.1 tron 418 1.1 tron <p> When the <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> time has elapsed, and the combined 419 1.1 tron DNSBL score is equal to or greater than the <a href="postconf.5.html#postscreen_dnsbl_threshold">postscreen_dnsbl_threshold</a> 420 1.1 tron parameter value, <a href="postscreen.8.html">postscreen(8)</a> logs this as: </p> 421 1.1 tron 422 1.1 tron <pre> 423 1.1 tron <b>DNSBL rank</b> <i>count</i> <b>for</b> <i>[address]:port</i> 424 1.1 tron </pre> 425 1.1 tron 426 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> has a combined 427 1.1 tron DNSBL score of <i>count</i>. </p> 428 1.1 tron 429 1.1 tron <p> The <a href="postconf.5.html#postscreen_dnsbl_action">postscreen_dnsbl_action</a> parameter specifies the action that 430 1.1 tron is taken when the combined DNSBL score is equal to or greater than 431 1.1 tron the threshold. See "<a href="#fail_before_220">When tests fail 432 1.1 tron before the 220 SMTP server greeting</a>" below. </p> 433 1.1 tron 434 1.1 tron <h3> <a name="fail_before_220">When tests fail before the 220 SMTP server greeting</a> </h3> 435 1.1 tron 436 1.1.1.7 christos <p> When the client address matches the permanent denylist, or 437 1.1 tron when the client fails the pregreet or DNSBL tests, the action is 438 1.1.1.7 christos specified with <a href="postconf.5.html#postscreen_denylist_action">postscreen_denylist_action</a>, <a href="postconf.5.html#postscreen_greet_action">postscreen_greet_action</a>, 439 1.1 tron or <a href="postconf.5.html#postscreen_dnsbl_action">postscreen_dnsbl_action</a>, respectively. </p> 440 1.1 tron 441 1.1 tron <dl> 442 1.1 tron 443 1.1 tron <dt> <b>ignore</b> (default) </dt> 444 1.1 tron 445 1.1 tron <dd> Ignore the failure of this test. Allow other tests to complete. 446 1.1 tron Repeat this test the next time the client connects. This option 447 1.1 tron is useful for testing and collecting statistics without blocking 448 1.1 tron mail. </dd> 449 1.1 tron 450 1.1 tron <dt> <b>enforce</b> </dt> 451 1.1 tron 452 1.1 tron <dd> Allow other tests to complete. Reject attempts to deliver mail 453 1.1 tron with a 550 SMTP reply, and log the helo/sender/recipient information. 454 1.1 tron Repeat this test the next time the client connects. </dd> 455 1.1 tron 456 1.1 tron <dt> <b>drop</b> </dt> 457 1.1 tron 458 1.1 tron <dd> Drop the connection immediately with a 521 SMTP reply. Repeat 459 1.1 tron this test the next time the client connects. </dd> 460 1.1 tron 461 1.1 tron </dl> 462 1.1 tron 463 1.1 tron <h2> <a name="after_220">Tests after the 220 SMTP server greeting</a> </h2> 464 1.1 tron 465 1.1 tron <p> In this phase of the protocol, <a href="postscreen.8.html">postscreen(8)</a> implements a 466 1.1 tron number of "deep protocol" tests. These tests use an SMTP protocol 467 1.1 tron engine that is built into the <a href="postscreen.8.html">postscreen(8)</a> server. </p> 468 1.1 tron 469 1.1.1.4 tron <p> Important note: these protocol tests are disabled by default. 470 1.1 tron They are more intrusive than the pregreet and DNSBL tests, and they 471 1.1 tron have limitations as discussed next. </p> 472 1.1 tron 473 1.1 tron <ul> 474 1.1 tron 475 1.1.1.4 tron <li> <p> The main limitation of "after 220 greeting" tests is that 476 1.1.1.4 tron a new client must disconnect after passing these tests (reason: 477 1.1.1.4 tron postscreen is not a proxy). Then the client must reconnect from 478 1.1.1.4 tron the same IP address before it can deliver mail. The following 479 1.1.1.4 tron measures may help to avoid email delays: </p> 480 1.1 tron 481 1.1.1.4 tron <ul> 482 1.1.1.4 tron 483 1.1.1.4 tron <li> <p> Allow "good" clients to skip tests with the 484 1.1.1.7 christos <a href="postconf.5.html#postscreen_dnsbl_allowlist_threshold">postscreen_dnsbl_allowlist_threshold</a> feature. This is especially effective 485 1.1.1.7 christos for large providers that usually don't retry from the same IP 486 1.1.1.7 christos address. </p> 487 1.1.1.4 tron 488 1.1.1.4 tron <li> <p> Small sites: Configure <a href="postscreen.8.html">postscreen(8)</a> to listen on multiple 489 1.1.1.4 tron IP addresses, published in DNS as different IP addresses for the 490 1.1.1.4 tron same MX hostname or for different MX hostnames. This avoids mail 491 1.1.1.4 tron delivery delays with clients that reconnect immediately from the 492 1.1.1.4 tron same IP address. </p> 493 1.1.1.4 tron 494 1.1.1.4 tron <li> <p> Large sites: Share the <a href="postscreen.8.html">postscreen(8)</a> cache between different 495 1.1.1.4 tron Postfix MTAs with a large-enough <a href="memcache_table.5.html">memcache_table(5)</a>. Again, this 496 1.1.1.4 tron avoids mail delivery delays with clients that reconnect immediately 497 1.1.1.4 tron from the same IP address. </p> 498 1.1 tron 499 1.1 tron </ul> 500 1.1 tron 501 1.1.1.4 tron <li> <p> <a href="postscreen.8.html">postscreen(8)</a>'s built-in SMTP engine does not implement the 502 1.1.1.4 tron AUTH, XCLIENT, and XFORWARD features. If you need to make these 503 1.1.1.4 tron services available on port 25, then do not enable the tests after 504 1.1.1.4 tron the 220 server greeting. </p> 505 1.1.1.4 tron 506 1.1.1.4 tron <li> <p> End-user clients should connect directly to the submission 507 1.1 tron service, so that they never have to deal with <a href="postscreen.8.html">postscreen(8)</a>'s tests. 508 1.1 tron </p> 509 1.1 tron 510 1.1.1.4 tron </ul> 511 1.1.1.4 tron 512 1.1.1.4 tron <p> The following "after 220 greeting" tests are available: </p> 513 1.1.1.4 tron 514 1.1 tron <ul> 515 1.1 tron 516 1.1 tron <li> <a href="#pipelining">Command pipelining test</a> 517 1.1 tron 518 1.1 tron <li> <a href="#non_smtp">Non-SMTP command test</a> 519 1.1 tron 520 1.1 tron <li> <a href="#barelf">Bare newline test</a> 521 1.1 tron 522 1.1 tron <li> <a href="#fail_after_220">When tests fail after the 220 SMTP server greeting</a> 523 1.1 tron 524 1.1 tron </ul> 525 1.1 tron 526 1.1 tron <h3> <a name="pipelining">Command pipelining test</a> </h3> 527 1.1 tron 528 1.1 tron <p> By default, SMTP is a half-duplex protocol: the sender and 529 1.1 tron receiver send one command and one response at a time. Unlike the 530 1.1 tron Postfix SMTP server, <a href="postscreen.8.html">postscreen(8)</a> does not announce support 531 1.1 tron for ESMTP command pipelining. Therefore, clients are not allowed 532 1.1.1.7 christos to send multiple commands. <a href="postscreen.8.html">postscreen(8)</a>'s 533 1.1.1.7 christos <a href="#after_220">deep 534 1.1 tron protocol test</a> for this is disabled by default. </p> 535 1.1 tron 536 1.1 tron <p> With "<a href="postconf.5.html#postscreen_pipelining_enable">postscreen_pipelining_enable</a> = yes", <a href="postscreen.8.html">postscreen(8)</a> detects 537 1.1 tron zombies that send multiple commands, instead of sending one command 538 1.1 tron and waiting for the server to reply. </p> 539 1.1 tron 540 1.1 tron <p> This test is opportunistically enabled when <a href="postscreen.8.html">postscreen(8)</a> has 541 1.1 tron to use the built-in SMTP engine anyway. This is to make <a href="postscreen.8.html">postscreen(8)</a> 542 1.1 tron logging more informative. </p> 543 1.1 tron 544 1.1 tron <p> When a client sends multiple commands, <a href="postscreen.8.html">postscreen(8)</a> logs this 545 1.1 tron as: </p> 546 1.1 tron 547 1.1 tron <pre> 548 1.1.1.2 tron <b>COMMAND PIPELINING from</b> <i>[address]:port</i> <b>after</b> <i>command</i>: <i>text</i> 549 1.1 tron </pre> 550 1.1 tron 551 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> sent 552 1.1 tron multiple SMTP commands, instead of sending one command and then 553 1.1 tron waiting for the server to reply. This happened after the client 554 1.1.1.2 tron sent <i>command</i>. The <i>text</i> shows part of the input that 555 1.1.1.2 tron was sent too early; it is not logged with Postfix 2.8. </p> 556 1.1 tron 557 1.1 tron <p> The <a href="postconf.5.html#postscreen_pipelining_action">postscreen_pipelining_action</a> parameter specifies the action 558 1.1 tron that is taken next. See "<a href="#fail_after_220">When tests fail 559 1.1 tron after the 220 SMTP server greeting</a>" below. </p> 560 1.1 tron 561 1.1 tron <h3> <a name="non_smtp">Non-SMTP command test</a> </h3> 562 1.1 tron 563 1.1 tron <p> Some spambots send their mail through open proxies. A symptom 564 1.1 tron of this is the usage of commands such as CONNECT and other non-SMTP 565 1.1 tron commands. Just like the Postfix SMTP server's <a href="postconf.5.html#smtpd_forbidden_commands">smtpd_forbidden_commands</a> 566 1.1 tron feature, <a href="postscreen.8.html">postscreen(8)</a> has an equivalent <a href="postconf.5.html#postscreen_forbidden_commands">postscreen_forbidden_commands</a> 567 1.1.1.7 christos feature to block these clients. <a href="postscreen.8.html">postscreen(8)</a>'s 568 1.1.1.7 christos <a href="#after_220">deep 569 1.1 tron protocol test</a> for this is disabled by default. </p> 570 1.1 tron 571 1.1 tron <p> With "<a href="postconf.5.html#postscreen_non_smtp_command_enable">postscreen_non_smtp_command_enable</a> = yes", <a href="postscreen.8.html">postscreen(8)</a> 572 1.1 tron detects zombies that send commands specified with the 573 1.1 tron <a href="postconf.5.html#postscreen_forbidden_commands">postscreen_forbidden_commands</a> parameter. This also detects commands 574 1.1 tron with the syntax of a message header label. The latter is a symptom 575 1.1 tron that the client is sending message content after ignoring all the 576 1.1 tron responses from <a href="postscreen.8.html">postscreen(8)</a> that reject mail. </p> 577 1.1 tron 578 1.1 tron <p> This test is opportunistically enabled when <a href="postscreen.8.html">postscreen(8)</a> has 579 1.1 tron to use the built-in SMTP engine anyway. This is to make <a href="postscreen.8.html">postscreen(8)</a> 580 1.1 tron logging more informative. </p> 581 1.1 tron 582 1.1 tron <p> When a client sends non-SMTP commands, <a href="postscreen.8.html">postscreen(8)</a> logs this 583 1.1 tron as: </p> 584 1.1 tron 585 1.1 tron <pre> 586 1.1.1.3 tron <b>NON-SMTP COMMAND from</b> <i>[address]:port</i> <b>after</b> <i>command: text</i> 587 1.1 tron </pre> 588 1.1 tron 589 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> sent a 590 1.1.1.3 tron command that matches the <a href="postconf.5.html#postscreen_forbidden_commands">postscreen_forbidden_commands</a> 591 1.1.1.3 tron parameter, or that has the syntax of a message header label (text 592 1.1.1.3 tron followed by optional space and ":"). 593 1.1.1.3 tron The "<tt><b>after</b> <i>command</i></tt>" portion is logged with 594 1.1.1.3 tron Postfix 2.10 and later. </p> 595 1.1 tron 596 1.1 tron <p> The <a href="postconf.5.html#postscreen_non_smtp_command_action">postscreen_non_smtp_command_action</a> parameter specifies 597 1.1 tron the action that is taken next. See "<a href="#fail_after_220">When 598 1.1 tron tests fail after the 220 SMTP server greeting</a>" below. </p> 599 1.1 tron 600 1.1 tron <h3> <a name="barelf">Bare newline test</a> </h3> 601 1.1 tron 602 1.1 tron <p> SMTP is a line-oriented protocol: lines have a limited length, 603 1.1 tron and are terminated with <CR><LF>. Lines ending in a 604 1.1 tron "bare" <LF>, that is newline not preceded by carriage return, 605 1.1.1.7 christos are not allowed in SMTP. <a href="postscreen.8.html">postscreen(8)</a>'s 606 1.1.1.7 christos <a href="#after_220">deep 607 1.1 tron protocol test</a> for this is disabled by default. </p> 608 1.1 tron 609 1.1 tron <p> With "<a href="postconf.5.html#postscreen_bare_newline_enable">postscreen_bare_newline_enable</a> = yes", <a href="postscreen.8.html">postscreen(8)</a> 610 1.1 tron detects clients that send lines ending in bare newline characters. 611 1.1 tron </p> 612 1.1 tron 613 1.1 tron <p> This test is opportunistically enabled when <a href="postscreen.8.html">postscreen(8)</a> has 614 1.1 tron to use the built-in SMTP engine anyway. This is to make <a href="postscreen.8.html">postscreen(8)</a> 615 1.1 tron logging more informative. </p> 616 1.1 tron 617 1.1 tron <p> When a client sends bare newline characters, <a href="postscreen.8.html">postscreen(8)</a> logs 618 1.1 tron this as: 619 1.1 tron </p> 620 1.1 tron 621 1.1 tron <pre> 622 1.1.1.3 tron <b>BARE NEWLINE from</b> <i>[address]:port</i> <b>after</b> <i>command</i> 623 1.1 tron </pre> 624 1.1 tron 625 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> sent a bare 626 1.1 tron newline character, that is newline not preceded by carriage 627 1.1.1.3 tron return. 628 1.1.1.3 tron The "<tt><b>after</b> <i>command</i></tt>" portion is logged with 629 1.1.1.3 tron Postfix 2.10 and later. </p> 630 1.1 tron 631 1.1 tron <p> The <a href="postconf.5.html#postscreen_bare_newline_action">postscreen_bare_newline_action</a> parameter specifies the 632 1.1 tron action that is taken next. See "<a href="#fail_after_220">When 633 1.1 tron tests fail after the 220 SMTP server greeting</a>" below. </p> 634 1.1 tron 635 1.1 tron <h3> <a name="fail_after_220">When tests fail after the 220 SMTP server greeting</a> </h3> 636 1.1 tron 637 1.1 tron <p> When the client fails the pipelining, non-SMTP command or bare 638 1.1 tron newline tests, the action is specified with <a href="postconf.5.html#postscreen_pipelining_action">postscreen_pipelining_action</a>, 639 1.1 tron <a href="postconf.5.html#postscreen_non_smtp_command_action">postscreen_non_smtp_command_action</a> or <a href="postconf.5.html#postscreen_bare_newline_action">postscreen_bare_newline_action</a>, 640 1.1 tron respectively. </p> 641 1.1 tron 642 1.1 tron <dl> 643 1.1 tron 644 1.1 tron <dt> <b>ignore</b> (default for bare newline) </dt> 645 1.1 tron 646 1.1 tron <dd> Ignore the failure of this test. Allow other tests to complete. 647 1.1 tron Do NOT repeat this test before the result from some other test 648 1.1 tron expires. 649 1.1 tron 650 1.1 tron This option is useful for testing and collecting statistics without 651 1.1 tron blocking mail permanently. </dd> 652 1.1 tron 653 1.1 tron <dt> <b>enforce</b> (default for pipelining) </dt> 654 1.1 tron 655 1.1 tron <dd> Allow other tests to complete. Reject attempts to deliver 656 1.1 tron mail with a 550 SMTP reply, and log the helo/sender/recipient 657 1.1 tron information. Repeat this test the next time the client connects. 658 1.1 tron </dd> 659 1.1 tron 660 1.1 tron <dt> <b>drop</b> (default for non-SMTP commands) </dt> 661 1.1 tron 662 1.1 tron <dd> Drop the connection immediately with a 521 SMTP reply. Repeat 663 1.1 tron this test the next time the client connects. This action is 664 1.1 tron compatible with the Postfix SMTP server's <a href="postconf.5.html#smtpd_forbidden_commands">smtpd_forbidden_commands</a> 665 1.1 tron feature. </dd> 666 1.1 tron 667 1.1 tron </dl> 668 1.1 tron 669 1.1 tron <h2> <a name="other_error">Other errors</a> </h2> 670 1.1 tron 671 1.1.1.2 tron <p> When an SMTP client hangs up unexpectedly, <a href="postscreen.8.html">postscreen(8)</a> logs 672 1.1.1.2 tron this as: </p> 673 1.1 tron 674 1.1 tron <pre> 675 1.1 tron <b>HANGUP after</b> <i>time</i> <b>from</b> <i>[address]:port</i> <b>in</b> <i>test name</i> 676 1.1 tron </pre> 677 1.1 tron 678 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> disconnected 679 1.1 tron unexpectedly, <i>time</i> seconds after the start of the 680 1.1 tron test named <i>test name</i>. </p> 681 1.1 tron 682 1.1.1.2 tron <p> There is no punishment for hanging up. A client that hangs up 683 1.1.1.2 tron without sending the QUIT command can still pass all <a href="postscreen.8.html">postscreen(8)</a> 684 1.1.1.2 tron tests. </p> 685 1.1.1.2 tron 686 1.1 tron <!-- 687 1.1 tron 688 1.1 tron <p> While an unexpired penalty is in effect, an SMTP client is not 689 1.1 tron allowed to pass any tests, and <a href="postscreen.8.html">postscreen(8)</a> logs each connection 690 1.1 tron with the remaining amount of penalty time as: </p> 691 1.1 tron 692 1.1 tron <pre> 693 1.1 tron <b>PENALTY</b> <i>time</i> <b>for</b> <i>[address]:port</i> 694 1.1 tron </pre> 695 1.1 tron 696 1.1 tron <p> During this time, all attempts by the client to deliver mail 697 1.1 tron will be deferred with a 450 SMTP status. </p> 698 1.1 tron 699 1.1 tron --> 700 1.1 tron 701 1.1 tron <p> The following errors are reported by the built-in SMTP engine. 702 1.1 tron This engine never accepts mail, therefore it has per-session limits 703 1.1 tron on the number of commands and on the session length. </p> 704 1.1 tron 705 1.1 tron <pre> 706 1.1.1.3 tron <b>COMMAND TIME LIMIT</b> <b>from</b> <i>[address]:port</i> <b>after</b> <i>command</i> 707 1.1 tron </pre> 708 1.1 tron 709 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> reached the 710 1.1 tron per-command time limit as specified with the <a href="postconf.5.html#postscreen_command_time_limit">postscreen_command_time_limit</a> 711 1.1.1.3 tron parameter. The session is terminated immediately. 712 1.1.1.3 tron The "<tt><b>after</b> <i>command</i></tt>" portion is logged with 713 1.1.1.3 tron Postfix 2.10 and later. </p> 714 1.1 tron 715 1.1 tron <pre> 716 1.1.1.3 tron <b>COMMAND COUNT LIMIT from</b> <i>[address]:port</i> <b>after</b> <i>command</i> 717 1.1 tron </pre> 718 1.1 tron 719 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> reached the 720 1.1 tron per-session command count limit as specified with the 721 1.1 tron <a href="postconf.5.html#postscreen_command_count_limit">postscreen_command_count_limit</a> parameter. The session is terminated 722 1.1.1.3 tron immediately. 723 1.1.1.3 tron The "<tt><b>after</b> <i>command</i></tt>" portion is logged with 724 1.1.1.3 tron Postfix 2.10 and later. </p> 725 1.1 tron 726 1.1 tron <pre> 727 1.1.1.3 tron <b>COMMAND LENGTH LIMIT from</b> <i>[address]:port</i> <b>after</b> <i>command</i> 728 1.1 tron </pre> 729 1.1 tron 730 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> reached the 731 1.1 tron per-command length limit, as specified with the <a href="postconf.5.html#line_length_limit">line_length_limit</a> 732 1.1.1.3 tron parameter. The session is terminated immediately. 733 1.1.1.3 tron The "<tt><b>after</b> <i>command</i></tt>" portion is logged with 734 1.1.1.3 tron Postfix 2.10 and later. </p> 735 1.1 tron 736 1.1 tron <p> When an SMTP client makes too many connections at the same time, 737 1.1.1.6 christos <a href="postscreen.8.html">postscreen(8)</a> rejects the connection with a 421 status code and logs: </p> 738 1.1 tron 739 1.1 tron <pre> 740 1.1 tron <b>NOQUEUE: reject: CONNECT from</b> <i>[address]:port</i><b>: too many connections</b> 741 1.1.1.6 christos </pre> 742 1.1.1.6 christos 743 1.1.1.6 christos <p> The <a href="postconf.5.html#postscreen_client_connection_count_limit">postscreen_client_connection_count_limit</a> parameter controls this limit. </p> 744 1.1.1.6 christos 745 1.1.1.6 christos <p> When an SMTP client connects after <a href="postscreen.8.html">postscreen(8)</a> has reached a 746 1.1.1.6 christos connection count limit, <a href="postscreen.8.html">postscreen(8)</a> rejects the connection with 747 1.1.1.6 christos a 421 status code and logs: </p> 748 1.1.1.6 christos 749 1.1.1.6 christos <pre> 750 1.1.1.6 christos <b>NOQUEUE: reject: CONNECT from</b> <i>[address]:port</i><b>: all screening ports busy</b> 751 1.1 tron <b>NOQUEUE: reject: CONNECT from</b> <i>[address]:port</i><b>: all server ports busy</b> 752 1.1 tron </pre> 753 1.1 tron 754 1.1.1.6 christos <p> The <a href="postconf.5.html#postscreen_pre_queue_limit">postscreen_pre_queue_limit</a> and <a href="postconf.5.html#postscreen_post_queue_limit">postscreen_post_queue_limit</a> 755 1.1.1.6 christos parameters control these limits. </p> 756 1.1 tron 757 1.1 tron <h2> <a name="victory">When all tests succeed</a> </h2> 758 1.1 tron 759 1.1.1.7 christos <p> When a new SMTP client passes all tests (i.e. it is not allowlisted 760 1.1 tron via some mechanism), <a href="postscreen.8.html">postscreen(8)</a> logs this as: </p> 761 1.1 tron 762 1.1 tron <pre> 763 1.1 tron <b>PASS NEW</b> <i>[address]:port</i> 764 1.1 tron </pre> 765 1.1 tron 766 1.1 tron <p> Where <i>[address]:port</i> are the client IP address and port. 767 1.1 tron Then, <a href="postscreen.8.html">postscreen(8)</a> 768 1.1.1.7 christos creates a temporary allowlist entry that excludes the client IP 769 1.1.1.7 christos address from further tests until the temporary allowlist entry 770 1.1 tron expires, as controlled with the postscreen_*_ttl parameters. </p> 771 1.1 tron 772 1.1 tron <p> When no "<a href="#after_220">deep protocol tests</a>" are 773 1.1 tron configured, <a href="postscreen.8.html">postscreen(8)</a> hands off the "live" connection to a Postfix 774 1.1 tron SMTP server process. The client can then continue as if <a href="postscreen.8.html">postscreen(8)</a> 775 1.1 tron never even existed (except for the short <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> delay). 776 1.1 tron </p> 777 1.1 tron 778 1.1 tron <p> When any "<a href="#after_220">deep protocol tests</a>" are 779 1.1 tron configured, <a href="postscreen.8.html">postscreen(8)</a> cannot hand off the "live" connection to 780 1.1 tron a Postfix SMTP server process in the middle of the session. Instead, 781 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> defers mail delivery attempts with a 4XX status, logs 782 1.1 tron the helo/sender/recipient information, and waits for the client to 783 1.1 tron disconnect. The next time the client connects it will be allowed 784 1.1 tron to talk to a Postfix SMTP server process to deliver its mail. 785 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> mitigates the impact of this limitation by giving 786 1.1 tron <a href="#after_220">deep protocol tests</a> a long expiration 787 1.1 tron time. </p> 788 1.1 tron 789 1.1 tron <h2> <a name="config"> Configuring the postscreen(8) service</a> 790 1.1 tron </h2> 791 1.1 tron 792 1.1 tron <p> <a href="postscreen.8.html">postscreen(8)</a> has been tested on FreeBSD [4-8], Linux 2.[4-6] 793 1.1 tron and Solaris 9 systems. </p> 794 1.1 tron 795 1.1 tron <ul> 796 1.1 tron 797 1.1 tron <li> <a href="#enable"> Turning on postscreen(8) without blocking 798 1.1 tron mail</a> 799 1.1 tron 800 1.1 tron <li> <a href="#starttls"> postscreen(8) TLS configuration </a> 801 1.1 tron 802 1.1 tron <li> <a href="#blocking"> Blocking mail with postscreen(8) </a> 803 1.1 tron 804 1.1 tron <li> <a href="#turnoff"> Turning off postscreen(8) </a> 805 1.1 tron 806 1.1.1.7 christos <li> <a href="#temp_allow_sharing"> Sharing the temporary allowlist 807 1.1.1.4 tron </a> 808 1.1.1.4 tron 809 1.1 tron </ul> 810 1.1 tron 811 1.1 tron <h3> <a name="enable"> Turning on postscreen(8) without blocking mail</a> </h3> 812 1.1 tron 813 1.1 tron <p> To enable the <a href="postscreen.8.html">postscreen(8)</a> service and log client information 814 1.1 tron without blocking mail: </p> 815 1.1 tron 816 1.1 tron <ol> 817 1.1 tron 818 1.1 tron <li> <p> Make sure that local clients and systems with non-standard 819 1.1 tron SMTP implementations are excluded from any <a href="postscreen.8.html">postscreen(8)</a> tests. The 820 1.1 tron default is to exclude all clients in <a href="postconf.5.html#mynetworks">mynetworks</a>. To exclude additional 821 1.1 tron clients, for example, third-party performance monitoring tools (these 822 1.1 tron tend to have broken SMTP implementations): </p> 823 1.1 tron 824 1.1 tron <pre> 825 1.1 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 826 1.1.1.7 christos # Exclude broken clients by allowlisting. Clients in <a href="postconf.5.html#mynetworks">mynetworks</a> 827 1.1.1.7 christos # should always be allowlisted. 828 1.1 tron <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, 829 1.1 tron <a href="cidr_table.5.html">cidr</a>:/etc/postfix/postscreen_access.cidr 830 1.1 tron 831 1.1 tron /etc/postfix/postscreen_access.<a href="cidr_table.5.html">cidr</a>: 832 1.1 tron 192.168.254.0/24 permit 833 1.1 tron </pre> 834 1.1 tron 835 1.1 tron <li> <p> Comment out the "<tt>smtp inet ... smtpd</tt>" service 836 1.1 tron in <a href="master.5.html">master.cf</a>, including any "<tt>-o parameter=value</tt>" entries 837 1.1 tron that follow. </p> 838 1.1 tron 839 1.1 tron <pre> 840 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 841 1.1 tron #smtp inet n - n - - smtpd 842 1.1 tron # -o parameter=value ... 843 1.1 tron </pre> 844 1.1 tron 845 1.1 tron <li> <p> Uncomment the new "<tt>smtpd pass ... smtpd</tt>" service 846 1.1 tron in <a href="master.5.html">master.cf</a>, and duplicate any "<tt>-o parameter=value</tt>" entries 847 1.1 tron from the smtpd service that was commented out in the previous step. 848 1.1 tron </p> 849 1.1 tron 850 1.1 tron <pre> 851 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 852 1.1 tron smtpd pass - - n - - smtpd 853 1.1 tron -o parameter=value ... 854 1.1 tron </pre> 855 1.1 tron 856 1.1 tron <li> <p> Uncomment the new "<tt>smtp inet ... postscreen</tt>" 857 1.1 tron service in <a href="master.5.html">master.cf</a>. </p> 858 1.1 tron 859 1.1 tron <pre> 860 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 861 1.1 tron smtp inet n - n - 1 postscreen 862 1.1 tron </pre> 863 1.1 tron 864 1.1 tron <li> <p> Uncomment the new "<tt>tlsproxy unix ... tlsproxy</tt>" 865 1.1 tron service in <a href="master.5.html">master.cf</a>. This service implements STARTTLS support for 866 1.1 tron <a href="postscreen.8.html">postscreen(8)</a>. </p> 867 1.1 tron 868 1.1 tron <pre> 869 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 870 1.1 tron tlsproxy unix - - n - 0 tlsproxy 871 1.1 tron </pre> 872 1.1 tron 873 1.1 tron <li> <p> Uncomment the new "<tt>dnsblog unix ... dnsblog</tt>" 874 1.1 tron service in <a href="master.5.html">master.cf</a>. This service does DNSBL lookups for <a href="postscreen.8.html">postscreen(8)</a> 875 1.1 tron and logs results. </p> 876 1.1 tron 877 1.1 tron <pre> 878 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 879 1.1 tron dnsblog unix - - n - 0 dnsblog 880 1.1 tron </pre> 881 1.1 tron 882 1.1 tron <li> <p> To enable DNSBL lookups, list some DNS blocklist sites in 883 1.1 tron <a href="postconf.5.html">main.cf</a>, separated by whitespace. Different sites can have different 884 1.1 tron weights. For example: 885 1.1 tron 886 1.1 tron <pre> 887 1.1 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 888 1.1 tron <a href="postconf.5.html#postscreen_dnsbl_threshold">postscreen_dnsbl_threshold</a> = 2 889 1.1 tron <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> = zen.spamhaus.org*2 890 1.1 tron bl.spamcop.net*1 b.barracudacentral.org*1 891 1.1 tron </pre> 892 1.1 tron 893 1.1 tron <p> Note: if your DNSBL queries have a "secret" in the domain name, 894 1.1 tron you must censor this information from the <a href="postscreen.8.html">postscreen(8)</a> SMTP replies. 895 1.1 tron For example: </p> 896 1.1 tron 897 1.1 tron <pre> 898 1.1 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 899 1.1.1.2 tron <a href="postconf.5.html#postscreen_dnsbl_reply_map">postscreen_dnsbl_reply_map</a> = <a href="DATABASE_README.html#types">texthash</a>:/etc/postfix/dnsbl_reply 900 1.1 tron </pre> 901 1.1 tron 902 1.1 tron <pre> 903 1.1 tron /etc/postfix/dnsbl_reply: 904 1.1.1.5 christos # Secret DNSBL name Name in <a href="postscreen.8.html">postscreen(8)</a> replies 905 1.1.1.5 christos secret.zen.dq.spamhaus.net zen.spamhaus.org 906 1.1 tron </pre> 907 1.1 tron 908 1.1.1.4 tron <p> The <a href="DATABASE_README.html#types">texthash</a>: format is similar to <a href="DATABASE_README.html#types">hash</a>: except that there is 909 1.1 tron no need to run <a href="postmap.1.html">postmap(1)</a> before the file can be used, and that it 910 1.1 tron does not detect changes after the file is read. It is new with 911 1.1 tron Postfix version 2.8. </p> 912 1.1 tron 913 1.1 tron <li> <p> Read the new configuration with "<tt>postfix reload</tt>". 914 1.1 tron </p> 915 1.1 tron 916 1.1 tron </ol> 917 1.1 tron 918 1.1 tron <p> Notes: </p> 919 1.1 tron 920 1.1 tron <ul> 921 1.1 tron 922 1.1 tron <li> <p> Some <a href="postscreen.8.html">postscreen(8)</a> configuration parameters implement 923 1.1 tron stress-dependent behavior. This is supported only when the default 924 1.1.1.2 tron value is stress-dependent (that is, "postconf -d <i>parametername</i>" 925 1.1.1.7 christos output shows 926 1.1.1.7 christos "<i>parametername</i> = ${stress?<i>something</i>}${stress:<i>something</i>}" or 927 1.1.1.7 christos "<i>parametername</i> = ${stress?{<i>something</i>}:{<i>something</i>}}"). 928 1.1 tron Other parameters always evaluate as if the stress value is the empty 929 1.1 tron string. </p> 930 1.1 tron 931 1.1 tron <li> <p> See "<a href="#before_220">Tests before the 220 SMTP server 932 1.1.1.7 christos greeting</a>" for details about the logging from these 933 1.1.1.7 christos <a href="postscreen.8.html">postscreen(8)</a> tests. </p> 934 1.1 tron 935 1.1 tron <li> <p> If you run Postfix 2.6 or earlier you must stop and start 936 1.1 tron the master daemon ("<tt>postfix stop; postfix start</tt>"). This 937 1.1 tron is needed because the Postfix "pass" master service type did not 938 1.1 tron work reliably on all systems. </p> 939 1.1 tron 940 1.1 tron </ul> 941 1.1 tron 942 1.1 tron <h3> <a name="starttls"> postscreen(8) TLS configuration </a> </h3> 943 1.1 tron 944 1.1 tron <p> <a href="postscreen.8.html">postscreen(8)</a> TLS support is available for remote SMTP clients 945 1.1.1.7 christos that aren't allowlisted, including clients that need to renew their 946 1.1.1.7 christos temporary allowlist status. When a remote SMTP client requests TLS 947 1.1 tron service, <a href="postscreen.8.html">postscreen(8)</a> invisibly hands off the connection to a 948 1.1 tron <a href="tlsproxy.8.html">tlsproxy(8)</a> process. Then, <a href="tlsproxy.8.html">tlsproxy(8)</a> encrypts and decrypts the 949 1.1 tron traffic between <a href="postscreen.8.html">postscreen(8)</a> and the remote SMTP client. One 950 1.1 tron <a href="tlsproxy.8.html">tlsproxy(8)</a> process can handle multiple SMTP sessions. The number 951 1.1 tron of <a href="tlsproxy.8.html">tlsproxy(8)</a> processes slowly increases with server load, but it 952 1.1 tron should always be much smaller than the number of <a href="postscreen.8.html">postscreen(8)</a> TLS 953 1.1 tron sessions. </p> 954 1.1 tron 955 1.1 tron <p> TLS support for <a href="postscreen.8.html">postscreen(8)</a> and <a href="tlsproxy.8.html">tlsproxy(8)</a> uses the same 956 1.1 tron parameters as with <a href="smtpd.8.html">smtpd(8)</a>. We recommend that you keep the relevant 957 1.1 tron configuration parameters in <a href="postconf.5.html">main.cf</a>. If you must specify "-o 958 1.1 tron smtpd_mumble=value" parameter overrides in <a href="master.5.html">master.cf</a> for a 959 1.1 tron postscreen-protected <a href="smtpd.8.html">smtpd(8)</a> service, then you should specify those 960 1.1 tron same parameter overrides for the <a href="postscreen.8.html">postscreen(8)</a> and <a href="tlsproxy.8.html">tlsproxy(8)</a> 961 1.1 tron services. </p> 962 1.1 tron 963 1.1 tron <h3> <a name="blocking"> Blocking mail with postscreen(8) </a> </h3> 964 1.1 tron 965 1.1 tron <p> For compatibility with <a href="smtpd.8.html">smtpd(8)</a>, <a href="postscreen.8.html">postscreen(8)</a> implements the 966 1.1 tron <a href="postconf.5.html#soft_bounce">soft_bounce</a> safety feature. This causes Postfix to reject mail with 967 1.1 tron a "try again" reply code. </p> 968 1.1 tron 969 1.1 tron <ul> 970 1.1 tron 971 1.1 tron <li> <p> To turn this on for all of Postfix, specify "<tt><a href="postconf.5.html#soft_bounce">soft_bounce</a> 972 1.1 tron = yes</tt>" in <a href="postconf.5.html">main.cf</a>. </p> 973 1.1 tron 974 1.1 tron <li> <p> To turn this on for <a href="postscreen.8.html">postscreen(8)</a> only, append "<tt>-o 975 1.1 tron <a href="postconf.5.html#soft_bounce">soft_bounce</a>=yes</tt>" (note: NO SPACES around '=') to the postscreen 976 1.1 tron entry in <a href="master.5.html">master.cf</a>. <p> 977 1.1 tron 978 1.1 tron </ul> 979 1.1 tron 980 1.1 tron <p> Execute "<tt>postfix reload</tt>" to make the change effective. </p> 981 1.1 tron 982 1.1 tron <p> After testing, do not forget to remove the <a href="postconf.5.html#soft_bounce">soft_bounce</a> feature, 983 1.1 tron otherwise senders won't receive their non-delivery notification 984 1.1 tron until many days later. </p> 985 1.1 tron 986 1.1 tron <p> To use the <a href="postscreen.8.html">postscreen(8)</a> service to block mail, edit <a href="postconf.5.html">main.cf</a> and 987 1.1 tron specify one or more of: </p> 988 1.1 tron 989 1.1 tron <ul> 990 1.1 tron 991 1.1 tron <li> <p> "<tt><a href="postconf.5.html#postscreen_dnsbl_action">postscreen_dnsbl_action</a> = enforce</tt>", to reject 992 1.1 tron clients that are on DNS blocklists, and to log the helo/sender/recipient 993 1.1 tron information. With good DNSBLs this reduces the amount of load on 994 1.1 tron Postfix SMTP servers dramatically. </p> 995 1.1 tron 996 1.1 tron <li> <p> "<tt><a href="postconf.5.html#postscreen_greet_action">postscreen_greet_action</a> = enforce</tt>", to reject 997 1.1 tron clients that talk before their turn, and to log the helo/sender/recipient 998 1.1 tron information. This stops over half of all known-to-be illegitimate 999 1.1 tron connections to Wietse's mail server. It is backup protection for 1000 1.1.1.7 christos zombies that haven't yet been denylisted. </p> 1001 1.1 tron 1002 1.1 tron <li> <p> You can also enable "<a href="#after_220">deep protocol 1003 1.1 tron tests</a>", but these are more intrusive than the pregreet or DNSBL 1004 1.1 tron tests. </p> 1005 1.1 tron 1006 1.1 tron <p> When a good client passes the "<a href="#after_220">deep 1007 1.1.1.7 christos protocol tests</a>", 1008 1.1.1.7 christos <a href="postscreen.8.html">postscreen(8)</a> adds the client to the temporary 1009 1.1.1.7 christos allowlist but it cannot hand off the "live" connection to a Postfix 1010 1.1 tron SMTP server process in the middle of the session. Instead, <a href="postscreen.8.html">postscreen(8)</a> 1011 1.1 tron defers mail delivery attempts with a 4XX status, logs the 1012 1.1 tron helo/sender/recipient information, and waits for the client to 1013 1.1 tron disconnect. </p> 1014 1.1 tron 1015 1.1 tron <p> When the good client comes back in a later session, it is allowed 1016 1.1.1.5 christos to talk directly to a Postfix SMTP server. See "<a href="#after_220">Tests 1017 1.1.1.5 christos after the 220 SMTP server greeting</a>" above for limitations with 1018 1.1.1.5 christos AUTH and other features that clients may need. </p> 1019 1.1 tron 1020 1.1 tron <p> An unexpected benefit from "<a href="#after_220">deep protocol 1021 1.1 tron tests</a>" is that some "good" clients don't return after the 4XX 1022 1.1.1.5 christos reply; these clients were not so good after all. </p> 1023 1.1.1.5 christos 1024 1.1.1.5 christos <p> Unfortunately, some senders will retry requests from different 1025 1.1.1.7 christos IP addresses, and may never get allowlisted. For this reason, 1026 1.1.1.5 christos Wietse stopped using "<a href="#after_220">deep protocol tests</a>" 1027 1.1.1.5 christos on his own internet-facing mail server. </p> 1028 1.1 tron 1029 1.1.1.7 christos <li> <p> There is also support for permanent denylisting and 1030 1.1.1.7 christos allowlisting; see the description of the <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> 1031 1.1 tron parameter for details. </p> 1032 1.1 tron 1033 1.1 tron </ul> 1034 1.1 tron 1035 1.1 tron <h3> <a name="turnoff"> Turning off postscreen(8) </a> </h3> 1036 1.1 tron 1037 1.1 tron <p> To turn off <a href="postscreen.8.html">postscreen(8)</a> and handle mail directly with Postfix 1038 1.1 tron SMTP server processes: </p> 1039 1.1 tron 1040 1.1 tron <ol> 1041 1.1 tron 1042 1.1 tron <li> <p> Comment out the "<tt>smtp inet ... postscreen</tt>" service 1043 1.1 tron in <a href="master.5.html">master.cf</a>, including any "<tt>-o parameter=value</tt>" entries 1044 1.1 tron that follow. </p> 1045 1.1 tron 1046 1.1 tron <pre> 1047 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 1048 1.1 tron #smtp inet n - n - 1 postscreen 1049 1.1 tron # -o parameter=value ... 1050 1.1 tron </pre> 1051 1.1 tron 1052 1.1 tron <li> <p> Comment out the "<tt>dnsblog unix ... dnsblog</tt>" service 1053 1.1 tron in <a href="master.5.html">master.cf</a>. </p> 1054 1.1 tron 1055 1.1 tron <pre> 1056 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 1057 1.1 tron #dnsblog unix - - n - 0 dnsblog 1058 1.1 tron </pre> 1059 1.1 tron 1060 1.1 tron <li> <p> Comment out the "<tt>smtpd pass ... smtpd</tt>" service 1061 1.1 tron in <a href="master.5.html">master.cf</a>, including any "<tt>-o parameter=value</tt>" entries 1062 1.1 tron that follow. </p> 1063 1.1 tron 1064 1.1 tron <pre> 1065 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 1066 1.1 tron #smtpd pass - - n - - smtpd 1067 1.1 tron # -o parameter=value ... 1068 1.1 tron </pre> 1069 1.1 tron 1070 1.1 tron <li> <p> Comment out the "<tt>tlsproxy unix ... tlsproxy</tt>" 1071 1.1 tron service in <a href="master.5.html">master.cf</a>, including any "<tt>-o parameter=value</tt>" 1072 1.1 tron entries that follow. </p> 1073 1.1 tron 1074 1.1 tron <pre> 1075 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 1076 1.1 tron #tlsproxy unix - - n - 0 tlsproxy 1077 1.1 tron # -o parameter=value ... 1078 1.1 tron </pre> 1079 1.1 tron 1080 1.1 tron <li> <p> Uncomment the "<tt>smtp inet ... smtpd</tt>" service in 1081 1.1 tron <a href="master.5.html">master.cf</a>, including any "<tt>-o parameter=value</tt>" entries that 1082 1.1 tron may follow. </p> 1083 1.1 tron 1084 1.1 tron <pre> 1085 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 1086 1.1 tron smtp inet n - n - - smtpd 1087 1.1 tron -o parameter=value ... 1088 1.1 tron </pre> 1089 1.1 tron 1090 1.1 tron <li> <p> Read the new configuration with "<tt>postfix reload</tt>". 1091 1.1 tron </p> 1092 1.1 tron 1093 1.1 tron </ol> 1094 1.1 tron 1095 1.1.1.7 christos <h3> <a name="temp_allow_sharing"> Sharing the temporary allowlist </a> </h3> 1096 1.1.1.4 tron 1097 1.1.1.7 christos <p> By default, the temporary allowlist is not shared between 1098 1.1.1.4 tron multiple <a href="postscreen.8.html">postscreen(8)</a> daemons. To enable sharing, choose one 1099 1.1.1.4 tron of the following options: </p> 1100 1.1.1.4 tron 1101 1.1.1.4 tron <ul> 1102 1.1.1.4 tron 1103 1.1.1.7 christos <li> <p> A non-persistent <a href="memcache_table.5.html">memcache</a>: temporary allowlist can be shared 1104 1.1.1.4 tron between <a href="postscreen.8.html">postscreen(8)</a> daemons on the same host or different 1105 1.1.1.4 tron hosts. Disable cache cleanup (<a href="postconf.5.html#postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a> 1106 1.1.1.6 christos = 0) in all <a href="postscreen.8.html">postscreen(8)</a> daemons because <a href="memcache_table.5.html">memcache</a>: has no 1107 1.1.1.6 christos first-next API (but see example 4 below for <a href="memcache_table.5.html">memcache</a>: with 1108 1.1.1.4 tron persistent backup). This requires Postfix 2.9 or later. </p> 1109 1.1.1.4 tron 1110 1.1.1.4 tron <pre> 1111 1.1.1.7 christos # Example 1: non-persistent <a href="memcache_table.5.html">memcache</a>: allowlist. 1112 1.1.1.4 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 1113 1.1.1.4 tron <a href="postconf.5.html#postscreen_cache_map">postscreen_cache_map</a> = <a href="memcache_table.5.html">memcache</a>:/etc/postfix/postscreen_cache 1114 1.1.1.4 tron <a href="postconf.5.html#postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a> = 0 1115 1.1.1.4 tron 1116 1.1.1.4 tron /etc/postfix/postscreen_cache: 1117 1.1.1.4 tron memcache = inet:127.0.0.1:11211 1118 1.1.1.4 tron key_format = postscreen:%s 1119 1.1.1.4 tron </pre> 1120 1.1.1.4 tron 1121 1.1.1.4 tron <li> <p> 1122 1.1.1.7 christos A persistent <a href="lmdb_table.5.html">lmdb</a>: temporary allowlist can be shared between 1123 1.1.1.4 tron <a href="postscreen.8.html">postscreen(8)</a> daemons that run under the same <a href="master.8.html">master(8)</a> daemon, 1124 1.1.1.4 tron or under different <a href="master.8.html">master(8)</a> daemons on the same host. Disable 1125 1.1.1.4 tron cache cleanup (<a href="postconf.5.html#postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a> = 0) in all 1126 1.1.1.4 tron <a href="postscreen.8.html">postscreen(8)</a> daemons except one that is responsible for cache 1127 1.1.1.4 tron cleanup. This requires Postfix 2.11 or later. </p> 1128 1.1.1.4 tron 1129 1.1.1.4 tron <pre> 1130 1.1.1.7 christos # Example 2: persistent <a href="lmdb_table.5.html">lmdb</a>: allowlist. 1131 1.1.1.4 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 1132 1.1.1.4 tron <a href="postconf.5.html#postscreen_cache_map">postscreen_cache_map</a> = <a href="lmdb_table.5.html">lmdb</a>:$<a href="postconf.5.html#data_directory">data_directory</a>/postscreen_cache 1133 1.1.1.4 tron # See note 1 below. 1134 1.1.1.4 tron # <a href="postconf.5.html#postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a> = 0 1135 1.1.1.4 tron </pre> 1136 1.1.1.4 tron 1137 1.1.1.7 christos <li> <p> Other kinds of persistent temporary allowlist can be shared 1138 1.1.1.4 tron only between <a href="postscreen.8.html">postscreen(8)</a> daemons that run under the same 1139 1.1.1.7 christos <a href="master.8.html">master(8)</a> daemon. In this case, temporary allowlist access must 1140 1.1.1.4 tron be shared through the <a href="proxymap.8.html">proxymap(8)</a> daemon. This requires Postfix 1141 1.1.1.4 tron 2.9 or later. </p> 1142 1.1.1.4 tron 1143 1.1.1.4 tron <pre> 1144 1.1.1.7 christos # Example 3: proxied <a href="DATABASE_README.html#types">btree</a>: allowlist. 1145 1.1.1.4 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 1146 1.1.1.4 tron <a href="postconf.5.html#postscreen_cache_map">postscreen_cache_map</a> = 1147 1.1.1.4 tron <a href="proxymap.8.html">proxy</a>:<a href="DATABASE_README.html#types">btree</a>:/var/lib/postfix/postscreen_cache 1148 1.1.1.4 tron # See note 1 below. 1149 1.1.1.4 tron # <a href="postconf.5.html#postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a> = 0 1150 1.1.1.4 tron 1151 1.1.1.7 christos # Example 4: proxied <a href="DATABASE_README.html#types">btree</a>: allowlist with <a href="memcache_table.5.html">memcache</a>: accelerator. 1152 1.1.1.4 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 1153 1.1.1.4 tron <a href="postconf.5.html#postscreen_cache_map">postscreen_cache_map</a> = <a href="memcache_table.5.html">memcache</a>:/etc/postfix/postscreen_cache 1154 1.1.1.4 tron <a href="postconf.5.html#proxy_write_maps">proxy_write_maps</a> = 1155 1.1.1.4 tron <a href="proxymap.8.html">proxy</a>:<a href="DATABASE_README.html#types">btree</a>:/var/lib/postfix/postscreen_cache 1156 1.1.1.4 tron ... other proxied tables ... 1157 1.1.1.4 tron # See note 1 below. 1158 1.1.1.4 tron # <a href="postconf.5.html#postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a> = 0 1159 1.1.1.4 tron 1160 1.1.1.4 tron /etc/postfix/postscreen_cache: 1161 1.1.1.4 tron # Note: the $<a href="postconf.5.html#data_directory">data_directory</a> macro is not defined in this context. 1162 1.1.1.4 tron memcache = inet:127.0.0.1:11211 1163 1.1.1.4 tron backup = <a href="proxymap.8.html">proxy</a>:<a href="DATABASE_README.html#types">btree</a>:/var/lib/postfix/postscreen_cache 1164 1.1.1.4 tron key_format = postscreen:%s 1165 1.1.1.4 tron </pre> 1166 1.1.1.4 tron 1167 1.1.1.4 tron <p> Note 1: disable cache cleanup (<a href="postconf.5.html#postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a> 1168 1.1.1.4 tron = 0) in all <a href="postscreen.8.html">postscreen(8)</a> daemons except one that is responsible 1169 1.1.1.4 tron for cache cleanup. </p> 1170 1.1.1.4 tron 1171 1.1.1.4 tron <p> Note 2: <a href="postscreen.8.html">postscreen(8)</a> cache sharing via <a href="proxymap.8.html">proxymap(8)</a> requires Postfix 1172 1.1.1.4 tron 2.9 or later; earlier <a href="proxymap.8.html">proxymap(8)</a> implementations don't support 1173 1.1.1.4 tron cache cleanup. </p> 1174 1.1.1.4 tron 1175 1.1.1.4 tron </ul> 1176 1.1.1.4 tron 1177 1.1 tron <h2> <a name="historical"> Historical notes and credits </a> </h2> 1178 1.1 tron 1179 1.1 tron <p> Many ideas in <a href="postscreen.8.html">postscreen(8)</a> were explored in earlier work by 1180 1.1 tron Michael Tokarev, in OpenBSD spamd, and in MailChannels Traffic 1181 1.1 tron Control. </p> 1182 1.1 tron 1183 1.1 tron <p> Wietse threw together a crude prototype with pregreet and dnsbl 1184 1.1 tron support in June 2009, because he needed something new for a Mailserver 1185 1.1 tron conference presentation in July. Ralf Hildebrandt ran this code on 1186 1.1 tron several servers to collect real-world statistics. This version used 1187 1.1 tron the <a href="dnsblog.8.html">dnsblog(8)</a> ad-hoc DNS client program. </p> 1188 1.1 tron 1189 1.1 tron <p> Wietse needed new material for a LISA conference presentation 1190 1.1 tron in November 2010, so he added support for DNSBL weights and filters 1191 1.1 tron in August, followed by a major code rewrite, deep protocol tests, 1192 1.1 tron helo/sender/recipient logging, and stress-adaptive behavior in 1193 1.1 tron September. Ralf Hildebrandt ran this code on several servers to 1194 1.1 tron collect real-world statistics. This version still used the embarrassing 1195 1.1 tron <a href="dnsblog.8.html">dnsblog(8)</a> ad-hoc DNS client program. </p> 1196 1.1 tron 1197 1.1 tron <p> Wietse added STARTTLS support in December 2010. This makes 1198 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> usable for sites that require TLS support. The 1199 1.1 tron implementation introduces the <a href="tlsproxy.8.html">tlsproxy(8)</a> event-driven TLS proxy 1200 1.1 tron that decrypts/encrypts the sessions for multiple SMTP clients. </p> 1201 1.1 tron 1202 1.1.1.3 tron <p> The <a href="tlsproxy.8.html">tlsproxy(8)</a> implementation led to the discovery of a "new" 1203 1.1.1.3 tron class of vulnerability (<a 1204 1.1.1.9 christos href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0411" 1205 1.1.1.3 tron >CVE-2011-0411</a>) that affected multiple implementations of SMTP, 1206 1.1.1.3 tron POP, IMAP, NNTP, and FTP over TLS. </p> 1207 1.1.1.3 tron 1208 1.1.1.3 tron <p> <a href="postscreen.8.html">postscreen(8)</a> was officially released as part of the Postfix 1209 1.1.1.3 tron 2.8 stable release in January 2011.</p> 1210 1.1.1.3 tron 1211 1.1.1.7 christos <p> Noel Jones helped with the Postfix 3.6 transition towards respectful 1212 1.1.1.7 christos documentation. </p> 1213 1.1 tron 1214 1.1.1.7 christos </body> 1215 1.1 tron </html> 1216
Indexes created Sun Jun 07 00:24:08 UTC 2026