POSTSCREEN_README.html revision 1.1
1 1.1 tron <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" 2 1.1 tron "http://www.w3.org/TR/html4/loose.dtd"> 3 1.1 tron 4 1.1 tron <head> 5 1.1 tron 6 1.1 tron <title>Postfix Postscreen Howto</title> 7 1.1 tron 8 1.1 tron <meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> 9 1.1 tron 10 1.1 tron </head> 11 1.1 tron 12 1.1 tron <body> 13 1.1 tron 14 1.1 tron <h1><img src="postfix-logo.jpg" width="203" height="98" ALT="">Postfix Postscreen Howto</h1> 15 1.1 tron 16 1.1 tron <hr> 17 1.1 tron 18 1.1 tron <h2> <a name="intro">Introduction</a> </h2> 19 1.1 tron 20 1.1 tron <p> The Postfix <a href="postscreen.8.html">postscreen(8)</a> server performs triage on multiple 21 1.1 tron inbound SMTP connections at the same time. While a single <a href="postscreen.8.html">postscreen(8)</a> 22 1.1 tron process keeps zombies away from Postfix SMTP server processes, more 23 1.1 tron Postfix SMTP server processes remain available for legitimate 24 1.1 tron clients. </p> 25 1.1 tron 26 1.1 tron <p> <a href="postscreen.8.html">postscreen(8)</a> should not be used on SMTP ports that receive 27 1.1 tron mail from end-user clients (MUAs). In a typical deployment, 28 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> is used on the "port 25" service, while MUA clients 29 1.1 tron submit mail via the submission service. </p> 30 1.1 tron 31 1.1 tron <p> <a href="postscreen.8.html">postscreen(8)</a> is part of a multi-layer defense. <p> 32 1.1 tron 33 1.1 tron <ul> 34 1.1 tron 35 1.1 tron <li> <p> As the first layer, <a href="postscreen.8.html">postscreen(8)</a> blocks connections from 36 1.1 tron zombies and other spambots that are responsible for about 90% of 37 1.1 tron all spam. It is implemented as a single process to make this defense 38 1.1 tron as cheap as possible. </p> 39 1.1 tron 40 1.1 tron <li> <p> The second layer implements more complex SMTP-level access 41 1.1 tron checks with Postfix SMTP servers, policy daemons, and Milter 42 1.1 tron applications. </p> 43 1.1 tron 44 1.1 tron <li> <p> The third layer performs light-weight content inspection 45 1.1 tron with the Postfix built-in <a href="postconf.5.html#header_checks">header_checks</a> and <a href="postconf.5.html#body_checks">body_checks</a>. This can 46 1.1 tron block unacceptable attachments such as executable programs, and 47 1.1 tron worms or viruses with easy-to-recognize signatures. </p> 48 1.1 tron 49 1.1 tron <li> <p> The fourth layer provides heavy-weight content inspection 50 1.1 tron with external content filters. Typical examples are Amavisd-new, 51 1.1 tron SpamAssassin, and Milter applications. </p> 52 1.1 tron 53 1.1 tron </ul> 54 1.1 tron 55 1.1 tron <p> Each layer reduces the spam volume. The general strategy is to 56 1.1 tron use the less expensive defenses first, and to use the more expensive 57 1.1 tron defenses for the spam that remains. </p> 58 1.1 tron 59 1.1 tron <p> Topics in this document: </p> 60 1.1 tron 61 1.1 tron <ul> 62 1.1 tron 63 1.1 tron <li> <a href="#intro">Introduction</a> 64 1.1 tron 65 1.1 tron <li> <a href="#basic">The basic idea behind postscreen(8)</a> 66 1.1 tron 67 1.1 tron <li> <a href="#general"> General operation </a> 68 1.1 tron 69 1.1 tron <li> <a href="#quick">Quick tests before everything else</a> 70 1.1 tron 71 1.1 tron <li> <a href="#before_220"> Tests before the 220 SMTP server greeting </a> 72 1.1 tron 73 1.1 tron <li> <a href="#after_220">Tests after the 220 SMTP server greeting</a> 74 1.1 tron 75 1.1 tron <li> <a href="#other_error">Other errors</a> 76 1.1 tron 77 1.1 tron <li> <a href="#victory">When all tests succeed</a> 78 1.1 tron 79 1.1 tron <li> <a href="#config"> Configuring the postscreen(8) service</a> 80 1.1 tron 81 1.1 tron <li> <a href="#historical"> Historical notes and credits </a> 82 1.1 tron 83 1.1 tron </ul> 84 1.1 tron 85 1.1 tron <h2> <a name="basic">The basic idea behind postscreen(8)</a> </h2> 86 1.1 tron 87 1.1 tron <p> Most email is spam, and most spam is sent out by zombies (malware 88 1.1 tron on compromised end-user computers). Wietse expects that the zombie 89 1.1 tron problem will get worse before things improve, if ever. Without a 90 1.1 tron tool like <a href="postscreen.8.html">postscreen(8)</a> that keeps the zombies away, Postfix would be 91 1.1 tron spending most of its resources not receiving email. </p> 92 1.1 tron 93 1.1 tron <p> The main challenge for <a href="postscreen.8.html">postscreen(8)</a> is to make an is-it-a-zombie 94 1.1 tron decision based on a single measurement. This is necessary because 95 1.1 tron many zombies avoid spamming the same site repeatedly, in an attempt 96 1.1 tron to fly under the radar. Once <a href="postscreen.8.html">postscreen(8)</a> decides that a client 97 1.1 tron is not-a-zombie, it whitelists the client temporarily to avoid 98 1.1 tron further delays for legitimate mail. </p> 99 1.1 tron 100 1.1 tron <p> Zombies have challenges too: they have only a limited amount 101 1.1 tron of time to deliver spam before their IP address becomes blacklisted. 102 1.1 tron To speed up spam deliveries, zombies make compromises in their SMTP 103 1.1 tron protocol implementation. For example, they speak before their turn, 104 1.1 tron or they ignore responses from SMTP servers and continue sending 105 1.1 tron mail even when the server tells them to go away. </p> 106 1.1 tron 107 1.1 tron <p> <a href="postscreen.8.html">postscreen(8)</a> uses a variety of measurements to recognize 108 1.1 tron zombies. First, <a href="postscreen.8.html">postscreen(8)</a> determines if the remote SMTP client 109 1.1 tron IP address is blacklisted. Second, <a href="postscreen.8.html">postscreen(8)</a> looks for protocol 110 1.1 tron compromises that are made to speed up delivery. These are good 111 1.1 tron indicators for making is-it-a-zombie decisions based on single 112 1.1 tron measurements. </p> 113 1.1 tron 114 1.1 tron <p> <a href="postscreen.8.html">postscreen(8)</a> does not inspect message content. Message content 115 1.1 tron can vary from one delivery to the next, especially with clients 116 1.1 tron that (also) send legitimate email. Content is not a good indicator 117 1.1 tron for making is-it-a-zombie decisions based on single measurements, 118 1.1 tron and that is the problem that <a href="postscreen.8.html">postscreen(8)</a> is focused on. </p> 119 1.1 tron 120 1.1 tron <h2> <a name="general"> General operation </a> </h2> 121 1.1 tron 122 1.1 tron <p> The <a href="postscreen.8.html">postscreen(8)</a> triage process involves a number of tests, 123 1.1 tron in the order as described below. Some tests introduce a delay of 124 1.1 tron a few seconds. Once a client passes a test, its IP address is 125 1.1 tron whitelisted from 24 hours for simple tests, to 1 week for complex 126 1.1 tron tests. Whitelisting minimizes the impact of <a href="postscreen.8.html">postscreen(8)</a>'s tests 127 1.1 tron on legitimate mail clients. </p> 128 1.1 tron 129 1.1 tron <p> After logging its findings, <a href="postscreen.8.html">postscreen(8)</a> by default hands off 130 1.1 tron all connections to a Postfix SMTP server process. This mode is 131 1.1 tron useful for non-destructive testing. </p> 132 1.1 tron 133 1.1 tron <p> In a typical production setting, <a href="postscreen.8.html">postscreen(8)</a> is configured 134 1.1 tron to reject mail from clients that fail one or more tests, after 135 1.1 tron logging the helo, sender and recipient information. </p> 136 1.1 tron 137 1.1 tron <p> Note: <a href="postscreen.8.html">postscreen(8)</a> is not an SMTP proxy; this is intentional. 138 1.1 tron The purpose is to keep zombies away from Postfix, with minimal 139 1.1 tron overhead for legitimate clients. </p> 140 1.1 tron 141 1.1 tron <h2> <a name="quick">Quick tests before everything else</a> </h2> 142 1.1 tron 143 1.1 tron <p> Before engaging in SMTP-level tests. <a href="postscreen.8.html">postscreen(8)</a> queries a 144 1.1 tron number of local black and whitelists. These tests speed up the 145 1.1 tron handling of known clients. </p> 146 1.1 tron 147 1.1 tron <ul> 148 1.1 tron 149 1.1 tron <li> <a href="#perm_white_black"> Permanent white/blacklist test </a> 150 1.1 tron 151 1.1 tron <li> <a href="#temp_white"> Temporary whitelist test </a> 152 1.1 tron 153 1.1 tron </ul> 154 1.1 tron 155 1.1 tron <h3> <a name="perm_white_black"> Permanent white/blacklist test </a> </h3> 156 1.1 tron 157 1.1 tron <p> The <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> parameter (default: <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>) 158 1.1 tron specifies a permanent access list for SMTP client IP addresses. Typically 159 1.1 tron one would specify something that whitelists local networks, followed 160 1.1 tron by a CIDR table for selective white- and blacklisting. </p> 161 1.1 tron 162 1.1 tron <p> Example: </p> 163 1.1 tron 164 1.1 tron <pre> 165 1.1 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 166 1.1 tron <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, 167 1.1 tron <a href="cidr_table.5.html">cidr</a>:/etc/postfix/postscreen_access.cidr 168 1.1 tron 169 1.1 tron /etc/postfix/postscreen_access.<a href="cidr_table.5.html">cidr</a>: 170 1.1 tron # Rules are evaluated in the order as specified. 171 1.1 tron # Blacklist 192.168.* except 192.168.0.1. 172 1.1 tron 192.168.0.1 permit 173 1.1 tron 192.168.0.0/16 reject 174 1.1 tron </pre> 175 1.1 tron 176 1.1 tron <p> See the <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> manpage documentation for more 177 1.1 tron details. </p> 178 1.1 tron 179 1.1 tron <p> When the SMTP client address matches a "permit" action, 180 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> logs this with the client address and port number as: 181 1.1 tron </p> 182 1.1 tron 183 1.1 tron <pre> 184 1.1 tron <b>WHITELISTED</b> <i>[address]:port</i> 185 1.1 tron </pre> 186 1.1 tron 187 1.1 tron <p> The whitelist action is not configurable: immediately hand off the 188 1.1 tron connection to a Postfix SMTP server process. </p> 189 1.1 tron 190 1.1 tron <p> When the SMTP client address matches a "reject" action, 191 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> logs this with the client address and port number as: 192 1.1 tron </p> 193 1.1 tron 194 1.1 tron <pre> 195 1.1 tron <b>BLACKLISTED</b> <i>[address]:port</i> 196 1.1 tron </pre> 197 1.1 tron 198 1.1 tron <p> The <a href="postconf.5.html#postscreen_blacklist_action">postscreen_blacklist_action</a> parameter specifies the action 199 1.1 tron that is taken next. See "<a href="#fail_before_220">When tests 200 1.1 tron fail before the 220 SMTP server greeting</a>" below. </p> 201 1.1 tron 202 1.1 tron <h3> <a name="temp_white"> Temporary whitelist test </a> </h3> 203 1.1 tron 204 1.1 tron <p> The <a href="postscreen.8.html">postscreen(8)</a> daemon maintains a <i>temporary</i> 205 1.1 tron whitelist for SMTP client IP addresses that have passed all 206 1.1 tron the tests described below. The <a href="postconf.5.html#postscreen_cache_map">postscreen_cache_map</a> parameter 207 1.1 tron specifies the location of the temporary whitelist. The 208 1.1 tron temporary whitelist is not used for SMTP client addresses 209 1.1 tron that appear on the <i>permanent</i> blacklist or whitelist. </p> 210 1.1 tron 211 1.1 tron <p> When the SMTP client address appears on the temporary 212 1.1 tron whitelist, <a href="postscreen.8.html">postscreen(8)</a> logs this with the client address and port 213 1.1 tron number as: </p> 214 1.1 tron 215 1.1 tron <pre> 216 1.1 tron <b>PASS OLD</b> <i>[address]:port</i> 217 1.1 tron </pre> 218 1.1 tron 219 1.1 tron <p> The action is not configurable: immediately hand off the 220 1.1 tron connection to a Postfix SMTP server process. The client is 221 1.1 tron excluded from further tests until its temporary whitelist 222 1.1 tron entry expires, as controlled with the postscreen_*_ttl 223 1.1 tron parameters. Expired entries are silently renewed if possible. </p> 224 1.1 tron 225 1.1 tron <h2> <a name="before_220"> Tests before the 220 SMTP server greeting </a> </h2> 226 1.1 tron 227 1.1 tron <p> The <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> parameter specifies a short time 228 1.1 tron interval before the "220 <i>text</i>..." server greeting, where 229 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> can run a number of tests in parallel. </p> 230 1.1 tron 231 1.1 tron <p> When a good client passes these tests, and no "<a 232 1.1 tron href="#after_220">deep protocol tests</a>" are configured, postscreen(8) 233 1.1 tron adds the client to the temporary whitelist and hands off the "live" 234 1.1 tron connection to a Postfix SMTP server process. The client can then 235 1.1 tron continue as if <a href="postscreen.8.html">postscreen(8)</a> never even existed (except of course 236 1.1 tron for the short <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> delay). </p> 237 1.1 tron 238 1.1 tron <ul> 239 1.1 tron 240 1.1 tron <li> <a href="#pregreet"> Pregreet test </a> 241 1.1 tron 242 1.1 tron <li> <a href="#dnsbl"> DNS White/blacklist test </a> 243 1.1 tron 244 1.1 tron <li> <a href="#fail_before_220">When tests fail before the 220 SMTP server greeting</a> 245 1.1 tron 246 1.1 tron </ul> 247 1.1 tron 248 1.1 tron <h3> <a name="pregreet"> Pregreet test </a> </h3> 249 1.1 tron 250 1.1 tron <p> The SMTP protocol is a classic example of a protocol where the 251 1.1 tron server speaks before the client. <a href="postscreen.8.html">postscreen(8)</a> detects zombies 252 1.1 tron that are in a hurry and that speak before their turn. This test is 253 1.1 tron enabled by default. </p> 254 1.1 tron 255 1.1 tron <p> The <a href="postconf.5.html#postscreen_greet_banner">postscreen_greet_banner</a> parameter specifies the <i>text</i> 256 1.1 tron portion of a "220-<i>text</i>..." teaser banner (default: $<a href="postconf.5.html#smtpd_banner">smtpd_banner</a>). 257 1.1 tron Note that this becomes the first part of a multi-line server greeting. 258 1.1 tron The <a href="postscreen.8.html">postscreen(8)</a> daemon sends this before the <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> 259 1.1 tron timer is started. The purpose of the teaser banner is to confuse 260 1.1 tron zombies so that they speak before their turn. It has no effect on 261 1.1 tron SMTP clients that correctly implement the protocol. </p> 262 1.1 tron 263 1.1 tron <p> To avoid problems with poorly-implemented SMTP engines in network 264 1.1 tron appliances or network testing tools, either exclude them from all 265 1.1 tron tests with the <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> feature or else specify 266 1.1 tron an empty teaser banner: </p> 267 1.1 tron 268 1.1 tron <pre> 269 1.1 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 270 1.1 tron # Exclude broken clients by whitelisting. Clients in <a href="postconf.5.html#mynetworks">mynetworks</a> 271 1.1 tron # should always be whitelisted. 272 1.1 tron <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, 273 1.1 tron <a href="cidr_table.5.html">cidr</a>:/etc/postfix/postscreen_access.cidr 274 1.1 tron 275 1.1 tron /etc/postfix/postscreen_access.<a href="cidr_table.5.html">cidr</a>: 276 1.1 tron 192.168.254.0/24 permit 277 1.1 tron </pre> 278 1.1 tron 279 1.1 tron <pre> 280 1.1 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 281 1.1 tron # Disable the teaser banner (try whitelisting first if you can). 282 1.1 tron <a href="postconf.5.html#postscreen_greet_banner">postscreen_greet_banner</a> = 283 1.1 tron </pre> 284 1.1 tron 285 1.1 tron <p> When an SMTP client sends a command before the 286 1.1 tron <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> time has elapsed, <a href="postscreen.8.html">postscreen(8)</a> logs this as: 287 1.1 tron </p> 288 1.1 tron 289 1.1 tron <pre> 290 1.1 tron <b>PREGREET</b> <i>count</i> <b>after</b> <i>time</i> <b>from</b> <i>[address]:port text...</i> 291 1.1 tron </pre> 292 1.1 tron 293 1.1 tron <p> Translation: the client at <i>[address]:port</i> sent <i>count</i> 294 1.1 tron bytes before its turn to speak. This happened <i>time</i> seconds 295 1.1 tron after the <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> timer was started. The <i>text</i> 296 1.1 tron is what the client sent (truncated to 100 bytes, and with non-printable 297 1.1 tron characters replaced with C-style escapes such as \r for carriage-return 298 1.1 tron and \n for newline). </p> 299 1.1 tron 300 1.1 tron <p> The <a href="postconf.5.html#postscreen_greet_action">postscreen_greet_action</a> parameter specifies the action that 301 1.1 tron is taken next. See "<a href="#fail_before_220">When tests fail 302 1.1 tron before the 220 SMTP server greeting</a>" below. </p> 303 1.1 tron 304 1.1 tron <h3> <a name="dnsbl"> DNS White/blacklist test </a> </h3> 305 1.1 tron 306 1.1 tron <p> The <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> parameter (default: empty) specifies 307 1.1 tron a list of DNS blocklist servers with optional filters and weight 308 1.1 tron factors (positive weights for blacklisting, negative for whitelisting). 309 1.1 tron These servers will be queried in parallel with the reverse client 310 1.1 tron IP address. This test is disabled by default. </p> 311 1.1 tron 312 1.1 tron <blockquote> 313 1.1 tron <p> 314 1.1 tron CAUTION: when postscreen rejects mail, its SMTP reply contains the 315 1.1 tron DNSBL domain name. Use the <a href="postconf.5.html#postscreen_dnsbl_reply_map">postscreen_dnsbl_reply_map</a> feature to 316 1.1 tron hide "password" information in DNSBL domain names. 317 1.1 tron </p> 318 1.1 tron </blockquote> 319 1.1 tron 320 1.1 tron <p> When the <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> time has elapsed, and the combined 321 1.1 tron DNSBL score is equal to or greater than the <a href="postconf.5.html#postscreen_dnsbl_threshold">postscreen_dnsbl_threshold</a> 322 1.1 tron parameter value, <a href="postscreen.8.html">postscreen(8)</a> logs this as: </p> 323 1.1 tron 324 1.1 tron <pre> 325 1.1 tron <b>DNSBL rank</b> <i>count</i> <b>for</b> <i>[address]:port</i> 326 1.1 tron </pre> 327 1.1 tron 328 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> has a combined 329 1.1 tron DNSBL score of <i>count</i>. </p> 330 1.1 tron 331 1.1 tron <p> The <a href="postconf.5.html#postscreen_dnsbl_action">postscreen_dnsbl_action</a> parameter specifies the action that 332 1.1 tron is taken when the combined DNSBL score is equal to or greater than 333 1.1 tron the threshold. See "<a href="#fail_before_220">When tests fail 334 1.1 tron before the 220 SMTP server greeting</a>" below. </p> 335 1.1 tron 336 1.1 tron <h3> <a name="fail_before_220">When tests fail before the 220 SMTP server greeting</a> </h3> 337 1.1 tron 338 1.1 tron <p> When the client address matches the permanent blacklist, or 339 1.1 tron when the client fails the pregreet or DNSBL tests, the action is 340 1.1 tron specified with <a href="postconf.5.html#postscreen_blacklist_action">postscreen_blacklist_action</a>, <a href="postconf.5.html#postscreen_greet_action">postscreen_greet_action</a>, 341 1.1 tron or <a href="postconf.5.html#postscreen_dnsbl_action">postscreen_dnsbl_action</a>, respectively. </p> 342 1.1 tron 343 1.1 tron <dl> 344 1.1 tron 345 1.1 tron <dt> <b>ignore</b> (default) </dt> 346 1.1 tron 347 1.1 tron <dd> Ignore the failure of this test. Allow other tests to complete. 348 1.1 tron Repeat this test the next time the client connects. This option 349 1.1 tron is useful for testing and collecting statistics without blocking 350 1.1 tron mail. </dd> 351 1.1 tron 352 1.1 tron <dt> <b>enforce</b> </dt> 353 1.1 tron 354 1.1 tron <dd> Allow other tests to complete. Reject attempts to deliver mail 355 1.1 tron with a 550 SMTP reply, and log the helo/sender/recipient information. 356 1.1 tron Repeat this test the next time the client connects. </dd> 357 1.1 tron 358 1.1 tron <dt> <b>drop</b> </dt> 359 1.1 tron 360 1.1 tron <dd> Drop the connection immediately with a 521 SMTP reply. Repeat 361 1.1 tron this test the next time the client connects. </dd> 362 1.1 tron 363 1.1 tron </dl> 364 1.1 tron 365 1.1 tron <h2> <a name="after_220">Tests after the 220 SMTP server greeting</a> </h2> 366 1.1 tron 367 1.1 tron <p> In this phase of the protocol, <a href="postscreen.8.html">postscreen(8)</a> implements a 368 1.1 tron number of "deep protocol" tests. These tests use an SMTP protocol 369 1.1 tron engine that is built into the <a href="postscreen.8.html">postscreen(8)</a> server. </p> 370 1.1 tron 371 1.1 tron <p> Important note: deep protocol tests are disabled by default. 372 1.1 tron They are more intrusive than the pregreet and DNSBL tests, and they 373 1.1 tron have limitations as discussed next. </p> 374 1.1 tron 375 1.1 tron <ul> 376 1.1 tron 377 1.1 tron <li> <p> When a good client passes the <a href="#after_220">deep 378 1.1 tron protocol tests</a>, postscreen(8) adds the client to the temporary 379 1.1 tron whitelist but it cannot hand off the "live" connection to a Postfix 380 1.1 tron SMTP server process in the middle of the session. Instead, <a href="postscreen.8.html">postscreen(8)</a> 381 1.1 tron defers mail delivery attempts with a 4XX status, logs the 382 1.1 tron helo/sender/recipient information, and waits for the client to 383 1.1 tron disconnect. </p> 384 1.1 tron 385 1.1 tron <p> The next time the client connects it will be allowed to talk 386 1.1 tron to a Postfix SMTP server process to deliver its mail. To minimize the 387 1.1 tron impact of this limitation, <a href="postscreen.8.html">postscreen(8)</a> gives deep protocol tests 388 1.1 tron a relatively long expiration time. </p> 389 1.1 tron 390 1.1 tron <li> <p> <a href="postscreen.8.html">postscreen(8)</a>'s built-in SMTP engine does not implement 391 1.1 tron the AUTH, XCLIENT, and XFORWARD features. AUTH support may be added 392 1.1 tron in a future version. In the mean time, if you need to make these 393 1.1 tron services available on port 25, then do not enable the tests after 394 1.1 tron the 220 server greeting. </p> 395 1.1 tron 396 1.1 tron </ul> 397 1.1 tron 398 1.1 tron <p> End-user clients should connect directly to the submission 399 1.1 tron service, so that they never have to deal with <a href="postscreen.8.html">postscreen(8)</a>'s tests. 400 1.1 tron </p> 401 1.1 tron 402 1.1 tron <ul> 403 1.1 tron 404 1.1 tron <li> <a href="#pipelining">Command pipelining test</a> 405 1.1 tron 406 1.1 tron <li> <a href="#non_smtp">Non-SMTP command test</a> 407 1.1 tron 408 1.1 tron <li> <a href="#barelf">Bare newline test</a> 409 1.1 tron 410 1.1 tron <li> <a href="#fail_after_220">When tests fail after the 220 SMTP server greeting</a> 411 1.1 tron 412 1.1 tron </ul> 413 1.1 tron 414 1.1 tron <h3> <a name="pipelining">Command pipelining test</a> </h3> 415 1.1 tron 416 1.1 tron <p> By default, SMTP is a half-duplex protocol: the sender and 417 1.1 tron receiver send one command and one response at a time. Unlike the 418 1.1 tron Postfix SMTP server, <a href="postscreen.8.html">postscreen(8)</a> does not announce support 419 1.1 tron for ESMTP command pipelining. Therefore, clients are not allowed 420 1.1 tron to send multiple commands. postscreen(8)'s <a href="#after_220">deep 421 1.1 tron protocol test</a> for this is disabled by default. </p> 422 1.1 tron 423 1.1 tron <p> With "<a href="postconf.5.html#postscreen_pipelining_enable">postscreen_pipelining_enable</a> = yes", <a href="postscreen.8.html">postscreen(8)</a> detects 424 1.1 tron zombies that send multiple commands, instead of sending one command 425 1.1 tron and waiting for the server to reply. </p> 426 1.1 tron 427 1.1 tron <p> This test is opportunistically enabled when <a href="postscreen.8.html">postscreen(8)</a> has 428 1.1 tron to use the built-in SMTP engine anyway. This is to make <a href="postscreen.8.html">postscreen(8)</a> 429 1.1 tron logging more informative. </p> 430 1.1 tron 431 1.1 tron <p> When a client sends multiple commands, <a href="postscreen.8.html">postscreen(8)</a> logs this 432 1.1 tron as: </p> 433 1.1 tron 434 1.1 tron <pre> 435 1.1 tron <b>COMMAND PIPELINING from</b> <i>[address]:port</i> <b>after</b> <i>command</i> 436 1.1 tron </pre> 437 1.1 tron 438 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> sent 439 1.1 tron multiple SMTP commands, instead of sending one command and then 440 1.1 tron waiting for the server to reply. This happened after the client 441 1.1 tron sent <i>command</i>. Postfix 2.8 does not log the input that was 442 1.1 tron sent too early. </p> 443 1.1 tron 444 1.1 tron <p> The <a href="postconf.5.html#postscreen_pipelining_action">postscreen_pipelining_action</a> parameter specifies the action 445 1.1 tron that is taken next. See "<a href="#fail_after_220">When tests fail 446 1.1 tron after the 220 SMTP server greeting</a>" below. </p> 447 1.1 tron 448 1.1 tron <h3> <a name="non_smtp">Non-SMTP command test</a> </h3> 449 1.1 tron 450 1.1 tron <p> Some spambots send their mail through open proxies. A symptom 451 1.1 tron of this is the usage of commands such as CONNECT and other non-SMTP 452 1.1 tron commands. Just like the Postfix SMTP server's <a href="postconf.5.html#smtpd_forbidden_commands">smtpd_forbidden_commands</a> 453 1.1 tron feature, <a href="postscreen.8.html">postscreen(8)</a> has an equivalent <a href="postconf.5.html#postscreen_forbidden_commands">postscreen_forbidden_commands</a> 454 1.1 tron feature to block these clients. postscreen(8)'s <a href="#after_220">deep 455 1.1 tron protocol test</a> for this is disabled by default. </p> 456 1.1 tron 457 1.1 tron <p> With "<a href="postconf.5.html#postscreen_non_smtp_command_enable">postscreen_non_smtp_command_enable</a> = yes", <a href="postscreen.8.html">postscreen(8)</a> 458 1.1 tron detects zombies that send commands specified with the 459 1.1 tron <a href="postconf.5.html#postscreen_forbidden_commands">postscreen_forbidden_commands</a> parameter. This also detects commands 460 1.1 tron with the syntax of a message header label. The latter is a symptom 461 1.1 tron that the client is sending message content after ignoring all the 462 1.1 tron responses from <a href="postscreen.8.html">postscreen(8)</a> that reject mail. </p> 463 1.1 tron 464 1.1 tron <p> This test is opportunistically enabled when <a href="postscreen.8.html">postscreen(8)</a> has 465 1.1 tron to use the built-in SMTP engine anyway. This is to make <a href="postscreen.8.html">postscreen(8)</a> 466 1.1 tron logging more informative. </p> 467 1.1 tron 468 1.1 tron <p> When a client sends non-SMTP commands, <a href="postscreen.8.html">postscreen(8)</a> logs this 469 1.1 tron as: </p> 470 1.1 tron 471 1.1 tron <pre> 472 1.1 tron <b>NON-SMTP COMMAND from</b> <i>[address]:port command</i> 473 1.1 tron </pre> 474 1.1 tron 475 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> sent a 476 1.1 tron <i>command</i> that matches the <a href="postconf.5.html#postscreen_forbidden_commands">postscreen_forbidden_commands</a> 477 1.1 tron parameter, or that has the syntax of a message header label. </p> 478 1.1 tron 479 1.1 tron <p> The <a href="postconf.5.html#postscreen_non_smtp_command_action">postscreen_non_smtp_command_action</a> parameter specifies 480 1.1 tron the action that is taken next. See "<a href="#fail_after_220">When 481 1.1 tron tests fail after the 220 SMTP server greeting</a>" below. </p> 482 1.1 tron 483 1.1 tron <h3> <a name="barelf">Bare newline test</a> </h3> 484 1.1 tron 485 1.1 tron <p> SMTP is a line-oriented protocol: lines have a limited length, 486 1.1 tron and are terminated with <CR><LF>. Lines ending in a 487 1.1 tron "bare" <LF>, that is newline not preceded by carriage return, 488 1.1 tron are not allowed in SMTP. postscreen(8)'s <a href="#after_220">deep 489 1.1 tron protocol test</a> for this is disabled by default. </p> 490 1.1 tron 491 1.1 tron <p> With "<a href="postconf.5.html#postscreen_bare_newline_enable">postscreen_bare_newline_enable</a> = yes", <a href="postscreen.8.html">postscreen(8)</a> 492 1.1 tron detects clients that send lines ending in bare newline characters. 493 1.1 tron </p> 494 1.1 tron 495 1.1 tron <p> This test is opportunistically enabled when <a href="postscreen.8.html">postscreen(8)</a> has 496 1.1 tron to use the built-in SMTP engine anyway. This is to make <a href="postscreen.8.html">postscreen(8)</a> 497 1.1 tron logging more informative. </p> 498 1.1 tron 499 1.1 tron <p> When a client sends bare newline characters, <a href="postscreen.8.html">postscreen(8)</a> logs 500 1.1 tron this as: 501 1.1 tron </p> 502 1.1 tron 503 1.1 tron <pre> 504 1.1 tron <b>BARE NEWLINE from</b> <i>[address]:port</i> 505 1.1 tron </pre> 506 1.1 tron 507 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> sent a bare 508 1.1 tron newline character, that is newline not preceded by carriage 509 1.1 tron return. </p> 510 1.1 tron 511 1.1 tron <p> The <a href="postconf.5.html#postscreen_bare_newline_action">postscreen_bare_newline_action</a> parameter specifies the 512 1.1 tron action that is taken next. See "<a href="#fail_after_220">When 513 1.1 tron tests fail after the 220 SMTP server greeting</a>" below. </p> 514 1.1 tron 515 1.1 tron <h3> <a name="fail_after_220">When tests fail after the 220 SMTP server greeting</a> </h3> 516 1.1 tron 517 1.1 tron <p> When the client fails the pipelining, non-SMTP command or bare 518 1.1 tron newline tests, the action is specified with <a href="postconf.5.html#postscreen_pipelining_action">postscreen_pipelining_action</a>, 519 1.1 tron <a href="postconf.5.html#postscreen_non_smtp_command_action">postscreen_non_smtp_command_action</a> or <a href="postconf.5.html#postscreen_bare_newline_action">postscreen_bare_newline_action</a>, 520 1.1 tron respectively. </p> 521 1.1 tron 522 1.1 tron <dl> 523 1.1 tron 524 1.1 tron <dt> <b>ignore</b> (default for bare newline) </dt> 525 1.1 tron 526 1.1 tron <dd> Ignore the failure of this test. Allow other tests to complete. 527 1.1 tron Do NOT repeat this test before the result from some other test 528 1.1 tron expires. 529 1.1 tron 530 1.1 tron This option is useful for testing and collecting statistics without 531 1.1 tron blocking mail permanently. </dd> 532 1.1 tron 533 1.1 tron <dt> <b>enforce</b> (default for pipelining) </dt> 534 1.1 tron 535 1.1 tron <dd> Allow other tests to complete. Reject attempts to deliver 536 1.1 tron mail with a 550 SMTP reply, and log the helo/sender/recipient 537 1.1 tron information. Repeat this test the next time the client connects. 538 1.1 tron </dd> 539 1.1 tron 540 1.1 tron <dt> <b>drop</b> (default for non-SMTP commands) </dt> 541 1.1 tron 542 1.1 tron <dd> Drop the connection immediately with a 521 SMTP reply. Repeat 543 1.1 tron this test the next time the client connects. This action is 544 1.1 tron compatible with the Postfix SMTP server's <a href="postconf.5.html#smtpd_forbidden_commands">smtpd_forbidden_commands</a> 545 1.1 tron feature. </dd> 546 1.1 tron 547 1.1 tron </dl> 548 1.1 tron 549 1.1 tron <h2> <a name="other_error">Other errors</a> </h2> 550 1.1 tron 551 1.1 tron <p> When an SMTP client hangs up unexpectedly during any tests, 552 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> logs this as: </p> 553 1.1 tron 554 1.1 tron <pre> 555 1.1 tron <b>HANGUP after</b> <i>time</i> <b>from</b> <i>[address]:port</i> <b>in</b> <i>test name</i> 556 1.1 tron </pre> 557 1.1 tron 558 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> disconnected 559 1.1 tron unexpectedly, <i>time</i> seconds after the start of the 560 1.1 tron test named <i>test name</i>. </p> 561 1.1 tron 562 1.1 tron <!-- 563 1.1 tron 564 1.1 tron <p> While an unexpired penalty is in effect, an SMTP client is not 565 1.1 tron allowed to pass any tests, and <a href="postscreen.8.html">postscreen(8)</a> logs each connection 566 1.1 tron with the remaining amount of penalty time as: </p> 567 1.1 tron 568 1.1 tron <pre> 569 1.1 tron <b>PENALTY</b> <i>time</i> <b>for</b> <i>[address]:port</i> 570 1.1 tron </pre> 571 1.1 tron 572 1.1 tron <p> During this time, all attempts by the client to deliver mail 573 1.1 tron will be deferred with a 450 SMTP status. </p> 574 1.1 tron 575 1.1 tron --> 576 1.1 tron 577 1.1 tron <p> The following errors are reported by the built-in SMTP engine. 578 1.1 tron This engine never accepts mail, therefore it has per-session limits 579 1.1 tron on the number of commands and on the session length. </p> 580 1.1 tron 581 1.1 tron <pre> 582 1.1 tron <b>COMMAND TIME LIMIT</b> <b>from</b> <i>[address]:port</i> 583 1.1 tron </pre> 584 1.1 tron 585 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> reached the 586 1.1 tron per-command time limit as specified with the <a href="postconf.5.html#postscreen_command_time_limit">postscreen_command_time_limit</a> 587 1.1 tron parameter. The session is terminated immediately. </p> 588 1.1 tron 589 1.1 tron <pre> 590 1.1 tron <b>COMMAND COUNT LIMIT from</b> <i>[address]:port</i> 591 1.1 tron </pre> 592 1.1 tron 593 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> reached the 594 1.1 tron per-session command count limit as specified with the 595 1.1 tron <a href="postconf.5.html#postscreen_command_count_limit">postscreen_command_count_limit</a> parameter. The session is terminated 596 1.1 tron immediately. </p> 597 1.1 tron 598 1.1 tron <pre> 599 1.1 tron <b>COMMAND LENGTH LIMIT from</b> <i>[address]:port</i> 600 1.1 tron </pre> 601 1.1 tron 602 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> reached the 603 1.1 tron per-command length limit, as specified with the <a href="postconf.5.html#line_length_limit">line_length_limit</a> 604 1.1 tron parameter. The session is terminated immediately. </p> 605 1.1 tron 606 1.1 tron <p> When an SMTP client makes too many connections at the same time, 607 1.1 tron or when all <a href="postscreen.8.html">postscreen(8)</a> ports are busy, <a href="postscreen.8.html">postscreen(8)</a> rejects the 608 1.1 tron connection with a 421 status code and logs: </p> 609 1.1 tron 610 1.1 tron <pre> 611 1.1 tron <b>NOQUEUE: reject: CONNECT from</b> <i>[address]:port</i><b>: too many connections</b> 612 1.1 tron <b>NOQUEUE: reject: CONNECT from</b> <i>[address]:port</i><b>: all server ports busy</b> 613 1.1 tron </pre> 614 1.1 tron 615 1.1 tron <p> The <a href="postconf.5.html#postscreen_client_connection_count_limit">postscreen_client_connection_count_limit</a> and 616 1.1 tron <a href="postconf.5.html#postscreen_pre_queue_limit">postscreen_pre_queue_limit</a> parameters control these limits. </p> 617 1.1 tron 618 1.1 tron <h2> <a name="victory">When all tests succeed</a> </h2> 619 1.1 tron 620 1.1 tron <p> When a new SMTP client passes all tests (i.e. it is not whitelisted 621 1.1 tron via some mechanism), <a href="postscreen.8.html">postscreen(8)</a> logs this as: </p> 622 1.1 tron 623 1.1 tron <pre> 624 1.1 tron <b>PASS NEW</b> <i>[address]:port</i> 625 1.1 tron </pre> 626 1.1 tron 627 1.1 tron <p> Where <i>[address]:port</i> are the client IP address and port. 628 1.1 tron Then, <a href="postscreen.8.html">postscreen(8)</a> 629 1.1 tron creates a temporary whitelist entry that excludes the client IP 630 1.1 tron address from further tests until the temporary whitelist entry 631 1.1 tron expires, as controlled with the postscreen_*_ttl parameters. </p> 632 1.1 tron 633 1.1 tron <p> When no "<a href="#after_220">deep protocol tests</a>" are 634 1.1 tron configured, <a href="postscreen.8.html">postscreen(8)</a> hands off the "live" connection to a Postfix 635 1.1 tron SMTP server process. The client can then continue as if <a href="postscreen.8.html">postscreen(8)</a> 636 1.1 tron never even existed (except for the short <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> delay). 637 1.1 tron </p> 638 1.1 tron 639 1.1 tron <p> When any "<a href="#after_220">deep protocol tests</a>" are 640 1.1 tron configured, <a href="postscreen.8.html">postscreen(8)</a> cannot hand off the "live" connection to 641 1.1 tron a Postfix SMTP server process in the middle of the session. Instead, 642 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> defers mail delivery attempts with a 4XX status, logs 643 1.1 tron the helo/sender/recipient information, and waits for the client to 644 1.1 tron disconnect. The next time the client connects it will be allowed 645 1.1 tron to talk to a Postfix SMTP server process to deliver its mail. 646 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> mitigates the impact of this limitation by giving 647 1.1 tron <a href="#after_220">deep protocol tests</a> a long expiration 648 1.1 tron time. </p> 649 1.1 tron 650 1.1 tron <h2> <a name="config"> Configuring the postscreen(8) service</a> 651 1.1 tron </h2> 652 1.1 tron 653 1.1 tron <p> <a href="postscreen.8.html">postscreen(8)</a> has been tested on FreeBSD [4-8], Linux 2.[4-6] 654 1.1 tron and Solaris 9 systems. </p> 655 1.1 tron 656 1.1 tron <ul> 657 1.1 tron 658 1.1 tron <li> <a href="#enable"> Turning on postscreen(8) without blocking 659 1.1 tron mail</a> 660 1.1 tron 661 1.1 tron <li> <a href="#starttls"> postscreen(8) TLS configuration </a> 662 1.1 tron 663 1.1 tron <li> <a href="#blocking"> Blocking mail with postscreen(8) </a> 664 1.1 tron 665 1.1 tron <li> <a href="#turnoff"> Turning off postscreen(8) </a> 666 1.1 tron 667 1.1 tron </ul> 668 1.1 tron 669 1.1 tron <h3> <a name="enable"> Turning on postscreen(8) without blocking mail</a> </h3> 670 1.1 tron 671 1.1 tron <p> To enable the <a href="postscreen.8.html">postscreen(8)</a> service and log client information 672 1.1 tron without blocking mail: </p> 673 1.1 tron 674 1.1 tron <ol> 675 1.1 tron 676 1.1 tron <li> <p> Make sure that local clients and systems with non-standard 677 1.1 tron SMTP implementations are excluded from any <a href="postscreen.8.html">postscreen(8)</a> tests. The 678 1.1 tron default is to exclude all clients in <a href="postconf.5.html#mynetworks">mynetworks</a>. To exclude additional 679 1.1 tron clients, for example, third-party performance monitoring tools (these 680 1.1 tron tend to have broken SMTP implementations): </p> 681 1.1 tron 682 1.1 tron <pre> 683 1.1 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 684 1.1 tron # Exclude broken clients by whitelisting. Clients in <a href="postconf.5.html#mynetworks">mynetworks</a> 685 1.1 tron # should always be whitelisted. 686 1.1 tron <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, 687 1.1 tron <a href="cidr_table.5.html">cidr</a>:/etc/postfix/postscreen_access.cidr 688 1.1 tron 689 1.1 tron /etc/postfix/postscreen_access.<a href="cidr_table.5.html">cidr</a>: 690 1.1 tron 192.168.254.0/24 permit 691 1.1 tron </pre> 692 1.1 tron 693 1.1 tron <li> <p> Comment out the "<tt>smtp inet ... smtpd</tt>" service 694 1.1 tron in <a href="master.5.html">master.cf</a>, including any "<tt>-o parameter=value</tt>" entries 695 1.1 tron that follow. </p> 696 1.1 tron 697 1.1 tron <pre> 698 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 699 1.1 tron #smtp inet n - n - - smtpd 700 1.1 tron # -o parameter=value ... 701 1.1 tron </pre> 702 1.1 tron 703 1.1 tron <li> <p> Uncomment the new "<tt>smtpd pass ... smtpd</tt>" service 704 1.1 tron in <a href="master.5.html">master.cf</a>, and duplicate any "<tt>-o parameter=value</tt>" entries 705 1.1 tron from the smtpd service that was commented out in the previous step. 706 1.1 tron </p> 707 1.1 tron 708 1.1 tron <pre> 709 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 710 1.1 tron smtpd pass - - n - - smtpd 711 1.1 tron -o parameter=value ... 712 1.1 tron </pre> 713 1.1 tron 714 1.1 tron <li> <p> Uncomment the new "<tt>smtp inet ... postscreen</tt>" 715 1.1 tron service in <a href="master.5.html">master.cf</a>. </p> 716 1.1 tron 717 1.1 tron <pre> 718 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 719 1.1 tron smtp inet n - n - 1 postscreen 720 1.1 tron </pre> 721 1.1 tron 722 1.1 tron <li> <p> Uncomment the new "<tt>tlsproxy unix ... tlsproxy</tt>" 723 1.1 tron service in <a href="master.5.html">master.cf</a>. This service implements STARTTLS support for 724 1.1 tron <a href="postscreen.8.html">postscreen(8)</a>. </p> 725 1.1 tron 726 1.1 tron <pre> 727 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 728 1.1 tron tlsproxy unix - - n - 0 tlsproxy 729 1.1 tron </pre> 730 1.1 tron 731 1.1 tron <li> <p> Uncomment the new "<tt>dnsblog unix ... dnsblog</tt>" 732 1.1 tron service in <a href="master.5.html">master.cf</a>. This service does DNSBL lookups for <a href="postscreen.8.html">postscreen(8)</a> 733 1.1 tron and logs results. </p> 734 1.1 tron 735 1.1 tron <pre> 736 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 737 1.1 tron dnsblog unix - - n - 0 dnsblog 738 1.1 tron </pre> 739 1.1 tron 740 1.1 tron <li> <p> To enable DNSBL lookups, list some DNS blocklist sites in 741 1.1 tron <a href="postconf.5.html">main.cf</a>, separated by whitespace. Different sites can have different 742 1.1 tron weights. For example: 743 1.1 tron 744 1.1 tron <pre> 745 1.1 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 746 1.1 tron <a href="postconf.5.html#postscreen_dnsbl_threshold">postscreen_dnsbl_threshold</a> = 2 747 1.1 tron <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> = zen.spamhaus.org*2 748 1.1 tron bl.spamcop.net*1 b.barracudacentral.org*1 749 1.1 tron </pre> 750 1.1 tron 751 1.1 tron <p> Note: if your DNSBL queries have a "secret" in the domain name, 752 1.1 tron you must censor this information from the <a href="postscreen.8.html">postscreen(8)</a> SMTP replies. 753 1.1 tron For example: </p> 754 1.1 tron 755 1.1 tron <pre> 756 1.1 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 757 1.1 tron <a href="postconf.5.html#postscreen_dnsbl_reply_map">postscreen_dnsbl_reply_map</a> = texthash:/etc/postfix/dnsbl_reply 758 1.1 tron </pre> 759 1.1 tron 760 1.1 tron <pre> 761 1.1 tron /etc/postfix/dnsbl_reply: 762 1.1 tron # Secret DNSBL name Name in <a href="postscreen.8.html">postscreen(8)</a> replies 763 1.1 tron secret.zen.spamhaus.org zen.spamhaus.org 764 1.1 tron </pre> 765 1.1 tron 766 1.1 tron <p> The texthash: format is similar to hash: except that there is 767 1.1 tron no need to run <a href="postmap.1.html">postmap(1)</a> before the file can be used, and that it 768 1.1 tron does not detect changes after the file is read. It is new with 769 1.1 tron Postfix version 2.8. </p> 770 1.1 tron 771 1.1 tron <li> <p> Read the new configuration with "<tt>postfix reload</tt>". 772 1.1 tron </p> 773 1.1 tron 774 1.1 tron </ol> 775 1.1 tron 776 1.1 tron <p> Notes: </p> 777 1.1 tron 778 1.1 tron <ul> 779 1.1 tron 780 1.1 tron <li> <p> Some <a href="postscreen.8.html">postscreen(8)</a> configuration parameters implement 781 1.1 tron stress-dependent behavior. This is supported only when the default 782 1.1 tron value is stress-dependent (that is, it looks like ${stress?X}${stress:Y}). 783 1.1 tron Other parameters always evaluate as if the stress value is the empty 784 1.1 tron string. </p> 785 1.1 tron 786 1.1 tron <li> <p> See "<a href="#before_220">Tests before the 220 SMTP server 787 1.1 tron greeting</a>" for details about the logging from these postscreen(8) 788 1.1 tron tests. </p> 789 1.1 tron 790 1.1 tron <li> <p> If you run Postfix 2.6 or earlier you must stop and start 791 1.1 tron the master daemon ("<tt>postfix stop; postfix start</tt>"). This 792 1.1 tron is needed because the Postfix "pass" master service type did not 793 1.1 tron work reliably on all systems. </p> 794 1.1 tron 795 1.1 tron </ul> 796 1.1 tron 797 1.1 tron <h3> <a name="starttls"> postscreen(8) TLS configuration </a> </h3> 798 1.1 tron 799 1.1 tron <p> <a href="postscreen.8.html">postscreen(8)</a> TLS support is available for remote SMTP clients 800 1.1 tron that aren't whitelisted, including clients that need to renew their 801 1.1 tron temporary whitelist status. When a remote SMTP client requests TLS 802 1.1 tron service, <a href="postscreen.8.html">postscreen(8)</a> invisibly hands off the connection to a 803 1.1 tron <a href="tlsproxy.8.html">tlsproxy(8)</a> process. Then, <a href="tlsproxy.8.html">tlsproxy(8)</a> encrypts and decrypts the 804 1.1 tron traffic between <a href="postscreen.8.html">postscreen(8)</a> and the remote SMTP client. One 805 1.1 tron <a href="tlsproxy.8.html">tlsproxy(8)</a> process can handle multiple SMTP sessions. The number 806 1.1 tron of <a href="tlsproxy.8.html">tlsproxy(8)</a> processes slowly increases with server load, but it 807 1.1 tron should always be much smaller than the number of <a href="postscreen.8.html">postscreen(8)</a> TLS 808 1.1 tron sessions. </p> 809 1.1 tron 810 1.1 tron <p> TLS support for <a href="postscreen.8.html">postscreen(8)</a> and <a href="tlsproxy.8.html">tlsproxy(8)</a> uses the same 811 1.1 tron parameters as with <a href="smtpd.8.html">smtpd(8)</a>. We recommend that you keep the relevant 812 1.1 tron configuration parameters in <a href="postconf.5.html">main.cf</a>. If you must specify "-o 813 1.1 tron smtpd_mumble=value" parameter overrides in <a href="master.5.html">master.cf</a> for a 814 1.1 tron postscreen-protected <a href="smtpd.8.html">smtpd(8)</a> service, then you should specify those 815 1.1 tron same parameter overrides for the <a href="postscreen.8.html">postscreen(8)</a> and <a href="tlsproxy.8.html">tlsproxy(8)</a> 816 1.1 tron services. </p> 817 1.1 tron 818 1.1 tron <h3> <a name="blocking"> Blocking mail with postscreen(8) </a> </h3> 819 1.1 tron 820 1.1 tron <p> For compatibility with <a href="smtpd.8.html">smtpd(8)</a>, <a href="postscreen.8.html">postscreen(8)</a> implements the 821 1.1 tron <a href="postconf.5.html#soft_bounce">soft_bounce</a> safety feature. This causes Postfix to reject mail with 822 1.1 tron a "try again" reply code. </p> 823 1.1 tron 824 1.1 tron <ul> 825 1.1 tron 826 1.1 tron <li> <p> To turn this on for all of Postfix, specify "<tt><a href="postconf.5.html#soft_bounce">soft_bounce</a> 827 1.1 tron = yes</tt>" in <a href="postconf.5.html">main.cf</a>. </p> 828 1.1 tron 829 1.1 tron <li> <p> To turn this on for <a href="postscreen.8.html">postscreen(8)</a> only, append "<tt>-o 830 1.1 tron <a href="postconf.5.html#soft_bounce">soft_bounce</a>=yes</tt>" (note: NO SPACES around '=') to the postscreen 831 1.1 tron entry in <a href="master.5.html">master.cf</a>. <p> 832 1.1 tron 833 1.1 tron </ul> 834 1.1 tron 835 1.1 tron <p> Execute "<tt>postfix reload</tt>" to make the change effective. </p> 836 1.1 tron 837 1.1 tron <p> After testing, do not forget to remove the <a href="postconf.5.html#soft_bounce">soft_bounce</a> feature, 838 1.1 tron otherwise senders won't receive their non-delivery notification 839 1.1 tron until many days later. </p> 840 1.1 tron 841 1.1 tron <p> To use the <a href="postscreen.8.html">postscreen(8)</a> service to block mail, edit <a href="postconf.5.html">main.cf</a> and 842 1.1 tron specify one or more of: </p> 843 1.1 tron 844 1.1 tron <ul> 845 1.1 tron 846 1.1 tron <li> <p> "<tt><a href="postconf.5.html#postscreen_dnsbl_action">postscreen_dnsbl_action</a> = enforce</tt>", to reject 847 1.1 tron clients that are on DNS blocklists, and to log the helo/sender/recipient 848 1.1 tron information. With good DNSBLs this reduces the amount of load on 849 1.1 tron Postfix SMTP servers dramatically. </p> 850 1.1 tron 851 1.1 tron <li> <p> "<tt><a href="postconf.5.html#postscreen_greet_action">postscreen_greet_action</a> = enforce</tt>", to reject 852 1.1 tron clients that talk before their turn, and to log the helo/sender/recipient 853 1.1 tron information. This stops over half of all known-to-be illegitimate 854 1.1 tron connections to Wietse's mail server. It is backup protection for 855 1.1 tron zombies that haven't yet been blacklisted. </p> 856 1.1 tron 857 1.1 tron <li> <p> You can also enable "<a href="#after_220">deep protocol 858 1.1 tron tests</a>", but these are more intrusive than the pregreet or DNSBL 859 1.1 tron tests. </p> 860 1.1 tron 861 1.1 tron <p> When a good client passes the "<a href="#after_220">deep 862 1.1 tron protocol tests</a>", postscreen(8) adds the client to the temporary 863 1.1 tron whitelist but it cannot hand off the "live" connection to a Postfix 864 1.1 tron SMTP server process in the middle of the session. Instead, <a href="postscreen.8.html">postscreen(8)</a> 865 1.1 tron defers mail delivery attempts with a 4XX status, logs the 866 1.1 tron helo/sender/recipient information, and waits for the client to 867 1.1 tron disconnect. </p> 868 1.1 tron 869 1.1 tron <p> When the good client comes back in a later session, it is allowed 870 1.1 tron to talk directly to a Postfix SMTP server. See "after_220 <a 871 1.1 tron href="#after_220">Tests after the 220 SMTP server greeting</a> above 872 1.1 tron for limitations with AUTH and other features that clients may need. 873 1.1 tron </p> 874 1.1 tron 875 1.1 tron <p> An unexpected benefit from "<a href="#after_220">deep protocol 876 1.1 tron tests</a>" is that some "good" clients don't return after the 4XX 877 1.1 tron reply; these clients were not so good after all. Wietse enables 878 1.1 tron "<a href="#after_220">deep protocol tests</a>" on his own internet-facing 879 1.1 tron mail server. </p> 880 1.1 tron 881 1.1 tron <li> <p> There is also support for permanent blacklisting and 882 1.1 tron whitelisting; see the description of the <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> 883 1.1 tron parameter for details. </p> 884 1.1 tron 885 1.1 tron </ul> 886 1.1 tron 887 1.1 tron <h3> <a name="turnoff"> Turning off postscreen(8) </a> </h3> 888 1.1 tron 889 1.1 tron <p> To turn off <a href="postscreen.8.html">postscreen(8)</a> and handle mail directly with Postfix 890 1.1 tron SMTP server processes: </p> 891 1.1 tron 892 1.1 tron <ol> 893 1.1 tron 894 1.1 tron <li> <p> Comment out the "<tt>smtp inet ... postscreen</tt>" service 895 1.1 tron in <a href="master.5.html">master.cf</a>, including any "<tt>-o parameter=value</tt>" entries 896 1.1 tron that follow. </p> 897 1.1 tron 898 1.1 tron <pre> 899 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 900 1.1 tron #smtp inet n - n - 1 postscreen 901 1.1 tron # -o parameter=value ... 902 1.1 tron </pre> 903 1.1 tron 904 1.1 tron <li> <p> Comment out the "<tt>dnsblog unix ... dnsblog</tt>" service 905 1.1 tron in <a href="master.5.html">master.cf</a>. </p> 906 1.1 tron 907 1.1 tron <pre> 908 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 909 1.1 tron #dnsblog unix - - n - 0 dnsblog 910 1.1 tron </pre> 911 1.1 tron 912 1.1 tron <li> <p> Comment out the "<tt>smtpd pass ... smtpd</tt>" service 913 1.1 tron in <a href="master.5.html">master.cf</a>, including any "<tt>-o parameter=value</tt>" entries 914 1.1 tron that follow. </p> 915 1.1 tron 916 1.1 tron <pre> 917 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 918 1.1 tron #smtpd pass - - n - - smtpd 919 1.1 tron # -o parameter=value ... 920 1.1 tron </pre> 921 1.1 tron 922 1.1 tron <li> <p> Comment out the "<tt>tlsproxy unix ... tlsproxy</tt>" 923 1.1 tron service in <a href="master.5.html">master.cf</a>, including any "<tt>-o parameter=value</tt>" 924 1.1 tron entries that follow. </p> 925 1.1 tron 926 1.1 tron <pre> 927 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 928 1.1 tron #tlsproxy unix - - n - 0 tlsproxy 929 1.1 tron # -o parameter=value ... 930 1.1 tron </pre> 931 1.1 tron 932 1.1 tron <li> <p> Uncomment the "<tt>smtp inet ... smtpd</tt>" service in 933 1.1 tron <a href="master.5.html">master.cf</a>, including any "<tt>-o parameter=value</tt>" entries that 934 1.1 tron may follow. </p> 935 1.1 tron 936 1.1 tron <pre> 937 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 938 1.1 tron smtp inet n - n - - smtpd 939 1.1 tron -o parameter=value ... 940 1.1 tron </pre> 941 1.1 tron 942 1.1 tron <li> <p> Read the new configuration with "<tt>postfix reload</tt>". 943 1.1 tron </p> 944 1.1 tron 945 1.1 tron </ol> 946 1.1 tron 947 1.1 tron <h2> <a name="historical"> Historical notes and credits </a> </h2> 948 1.1 tron 949 1.1 tron <p> Many ideas in <a href="postscreen.8.html">postscreen(8)</a> were explored in earlier work by 950 1.1 tron Michael Tokarev, in OpenBSD spamd, and in MailChannels Traffic 951 1.1 tron Control. </p> 952 1.1 tron 953 1.1 tron <p> Wietse threw together a crude prototype with pregreet and dnsbl 954 1.1 tron support in June 2009, because he needed something new for a Mailserver 955 1.1 tron conference presentation in July. Ralf Hildebrandt ran this code on 956 1.1 tron several servers to collect real-world statistics. This version used 957 1.1 tron the <a href="dnsblog.8.html">dnsblog(8)</a> ad-hoc DNS client program. </p> 958 1.1 tron 959 1.1 tron <p> Wietse needed new material for a LISA conference presentation 960 1.1 tron in November 2010, so he added support for DNSBL weights and filters 961 1.1 tron in August, followed by a major code rewrite, deep protocol tests, 962 1.1 tron helo/sender/recipient logging, and stress-adaptive behavior in 963 1.1 tron September. Ralf Hildebrandt ran this code on several servers to 964 1.1 tron collect real-world statistics. This version still used the embarrassing 965 1.1 tron <a href="dnsblog.8.html">dnsblog(8)</a> ad-hoc DNS client program. </p> 966 1.1 tron 967 1.1 tron <p> Wietse added STARTTLS support in December 2010. This makes 968 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> usable for sites that require TLS support. The 969 1.1 tron implementation introduces the <a href="tlsproxy.8.html">tlsproxy(8)</a> event-driven TLS proxy 970 1.1 tron that decrypts/encrypts the sessions for multiple SMTP clients. </p> 971 1.1 tron 972 1.1 tron </body> 973 1.1 tron 974 1.1 tron </html> 975 1.1 tron 976
Indexes created Sun Jun 07 00:24:08 UTC 2026