POSTSCREEN_README.html revision 1.1.1.2
1 1.1 tron <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" 2 1.1 tron "http://www.w3.org/TR/html4/loose.dtd"> 3 1.1 tron 4 1.1 tron <head> 5 1.1 tron 6 1.1 tron <title>Postfix Postscreen Howto</title> 7 1.1 tron 8 1.1 tron <meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> 9 1.1 tron 10 1.1 tron </head> 11 1.1 tron 12 1.1 tron <body> 13 1.1 tron 14 1.1 tron <h1><img src="postfix-logo.jpg" width="203" height="98" ALT="">Postfix Postscreen Howto</h1> 15 1.1 tron 16 1.1 tron <hr> 17 1.1 tron 18 1.1 tron <h2> <a name="intro">Introduction</a> </h2> 19 1.1 tron 20 1.1 tron <p> The Postfix <a href="postscreen.8.html">postscreen(8)</a> server performs triage on multiple 21 1.1 tron inbound SMTP connections at the same time. While a single <a href="postscreen.8.html">postscreen(8)</a> 22 1.1 tron process keeps zombies away from Postfix SMTP server processes, more 23 1.1 tron Postfix SMTP server processes remain available for legitimate 24 1.1 tron clients. </p> 25 1.1 tron 26 1.1.1.2 tron <p> <a href="postscreen.8.html">postscreen(8)</a> maintains a temporary whitelist for clients that 27 1.1.1.2 tron pass its tests; by allowing whitelisted clients to skip tests, 28 1.1.1.2 tron <a href="postscreen.8.html">postscreen(8)</a> minimizes its impact on legitimate email traffic. 29 1.1.1.2 tron </p> 30 1.1.1.2 tron 31 1.1 tron <p> <a href="postscreen.8.html">postscreen(8)</a> should not be used on SMTP ports that receive 32 1.1 tron mail from end-user clients (MUAs). In a typical deployment, 33 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> is used on the "port 25" service, while MUA clients 34 1.1.1.2 tron submit mail via the submission service (port 587) which normally 35 1.1.1.2 tron requires client authentication, or via a "port 25" server that 36 1.1.1.2 tron provides no MX service (i.e. a dedicated server that provides 37 1.1.1.2 tron submission service on port 25). </p> 38 1.1 tron 39 1.1 tron <p> <a href="postscreen.8.html">postscreen(8)</a> is part of a multi-layer defense. <p> 40 1.1 tron 41 1.1 tron <ul> 42 1.1 tron 43 1.1 tron <li> <p> As the first layer, <a href="postscreen.8.html">postscreen(8)</a> blocks connections from 44 1.1 tron zombies and other spambots that are responsible for about 90% of 45 1.1 tron all spam. It is implemented as a single process to make this defense 46 1.1 tron as cheap as possible. </p> 47 1.1 tron 48 1.1 tron <li> <p> The second layer implements more complex SMTP-level access 49 1.1 tron checks with Postfix SMTP servers, policy daemons, and Milter 50 1.1 tron applications. </p> 51 1.1 tron 52 1.1 tron <li> <p> The third layer performs light-weight content inspection 53 1.1 tron with the Postfix built-in <a href="postconf.5.html#header_checks">header_checks</a> and <a href="postconf.5.html#body_checks">body_checks</a>. This can 54 1.1 tron block unacceptable attachments such as executable programs, and 55 1.1 tron worms or viruses with easy-to-recognize signatures. </p> 56 1.1 tron 57 1.1 tron <li> <p> The fourth layer provides heavy-weight content inspection 58 1.1 tron with external content filters. Typical examples are Amavisd-new, 59 1.1 tron SpamAssassin, and Milter applications. </p> 60 1.1 tron 61 1.1 tron </ul> 62 1.1 tron 63 1.1 tron <p> Each layer reduces the spam volume. The general strategy is to 64 1.1 tron use the less expensive defenses first, and to use the more expensive 65 1.1.1.2 tron defenses only for the spam that remains. </p> 66 1.1 tron 67 1.1 tron <p> Topics in this document: </p> 68 1.1 tron 69 1.1 tron <ul> 70 1.1 tron 71 1.1 tron <li> <a href="#intro">Introduction</a> 72 1.1 tron 73 1.1 tron <li> <a href="#basic">The basic idea behind postscreen(8)</a> 74 1.1 tron 75 1.1 tron <li> <a href="#general"> General operation </a> 76 1.1 tron 77 1.1 tron <li> <a href="#quick">Quick tests before everything else</a> 78 1.1 tron 79 1.1 tron <li> <a href="#before_220"> Tests before the 220 SMTP server greeting </a> 80 1.1 tron 81 1.1 tron <li> <a href="#after_220">Tests after the 220 SMTP server greeting</a> 82 1.1 tron 83 1.1 tron <li> <a href="#other_error">Other errors</a> 84 1.1 tron 85 1.1 tron <li> <a href="#victory">When all tests succeed</a> 86 1.1 tron 87 1.1 tron <li> <a href="#config"> Configuring the postscreen(8) service</a> 88 1.1 tron 89 1.1 tron <li> <a href="#historical"> Historical notes and credits </a> 90 1.1 tron 91 1.1 tron </ul> 92 1.1 tron 93 1.1 tron <h2> <a name="basic">The basic idea behind postscreen(8)</a> </h2> 94 1.1 tron 95 1.1 tron <p> Most email is spam, and most spam is sent out by zombies (malware 96 1.1 tron on compromised end-user computers). Wietse expects that the zombie 97 1.1 tron problem will get worse before things improve, if ever. Without a 98 1.1 tron tool like <a href="postscreen.8.html">postscreen(8)</a> that keeps the zombies away, Postfix would be 99 1.1 tron spending most of its resources not receiving email. </p> 100 1.1 tron 101 1.1 tron <p> The main challenge for <a href="postscreen.8.html">postscreen(8)</a> is to make an is-it-a-zombie 102 1.1 tron decision based on a single measurement. This is necessary because 103 1.1.1.2 tron many zombies try to fly under the radar and avoid spamming the same 104 1.1.1.2 tron site repeatedly. Once <a href="postscreen.8.html">postscreen(8)</a> decides that a client is 105 1.1.1.2 tron not-a-zombie, it whitelists the client temporarily to avoid further 106 1.1.1.2 tron delays for legitimate mail. </p> 107 1.1 tron 108 1.1 tron <p> Zombies have challenges too: they have only a limited amount 109 1.1 tron of time to deliver spam before their IP address becomes blacklisted. 110 1.1 tron To speed up spam deliveries, zombies make compromises in their SMTP 111 1.1 tron protocol implementation. For example, they speak before their turn, 112 1.1 tron or they ignore responses from SMTP servers and continue sending 113 1.1 tron mail even when the server tells them to go away. </p> 114 1.1 tron 115 1.1 tron <p> <a href="postscreen.8.html">postscreen(8)</a> uses a variety of measurements to recognize 116 1.1 tron zombies. First, <a href="postscreen.8.html">postscreen(8)</a> determines if the remote SMTP client 117 1.1 tron IP address is blacklisted. Second, <a href="postscreen.8.html">postscreen(8)</a> looks for protocol 118 1.1 tron compromises that are made to speed up delivery. These are good 119 1.1 tron indicators for making is-it-a-zombie decisions based on single 120 1.1 tron measurements. </p> 121 1.1 tron 122 1.1 tron <p> <a href="postscreen.8.html">postscreen(8)</a> does not inspect message content. Message content 123 1.1 tron can vary from one delivery to the next, especially with clients 124 1.1 tron that (also) send legitimate email. Content is not a good indicator 125 1.1 tron for making is-it-a-zombie decisions based on single measurements, 126 1.1 tron and that is the problem that <a href="postscreen.8.html">postscreen(8)</a> is focused on. </p> 127 1.1 tron 128 1.1 tron <h2> <a name="general"> General operation </a> </h2> 129 1.1 tron 130 1.1 tron <p> The <a href="postscreen.8.html">postscreen(8)</a> triage process involves a number of tests, 131 1.1 tron in the order as described below. Some tests introduce a delay of 132 1.1.1.2 tron a few seconds. <a href="postscreen.8.html">postscreen(8)</a> maintains a temporary whitelist for 133 1.1.1.2 tron clients that pass its tests; by allowing whitelisted clients to 134 1.1.1.2 tron skip tests, <a href="postscreen.8.html">postscreen(8)</a> minimizes its impact on legitimate email 135 1.1.1.2 tron traffic. </p> 136 1.1.1.2 tron 137 1.1.1.2 tron <p> By default, <a href="postscreen.8.html">postscreen(8)</a> hands off all connections to a Postfix 138 1.1.1.2 tron SMTP server process after logging its findings. This mode is useful 139 1.1.1.2 tron for non-destructive testing. </p> 140 1.1 tron 141 1.1 tron <p> In a typical production setting, <a href="postscreen.8.html">postscreen(8)</a> is configured 142 1.1 tron to reject mail from clients that fail one or more tests, after 143 1.1 tron logging the helo, sender and recipient information. </p> 144 1.1 tron 145 1.1 tron <p> Note: <a href="postscreen.8.html">postscreen(8)</a> is not an SMTP proxy; this is intentional. 146 1.1 tron The purpose is to keep zombies away from Postfix, with minimal 147 1.1 tron overhead for legitimate clients. </p> 148 1.1 tron 149 1.1 tron <h2> <a name="quick">Quick tests before everything else</a> </h2> 150 1.1 tron 151 1.1 tron <p> Before engaging in SMTP-level tests. <a href="postscreen.8.html">postscreen(8)</a> queries a 152 1.1 tron number of local black and whitelists. These tests speed up the 153 1.1 tron handling of known clients. </p> 154 1.1 tron 155 1.1 tron <ul> 156 1.1 tron 157 1.1 tron <li> <a href="#perm_white_black"> Permanent white/blacklist test </a> 158 1.1 tron 159 1.1 tron <li> <a href="#temp_white"> Temporary whitelist test </a> 160 1.1 tron 161 1.1.1.2 tron <li> <a href="#white_veto"> MX Policy test </a> 162 1.1.1.2 tron 163 1.1 tron </ul> 164 1.1 tron 165 1.1 tron <h3> <a name="perm_white_black"> Permanent white/blacklist test </a> </h3> 166 1.1 tron 167 1.1 tron <p> The <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> parameter (default: <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>) 168 1.1 tron specifies a permanent access list for SMTP client IP addresses. Typically 169 1.1 tron one would specify something that whitelists local networks, followed 170 1.1 tron by a CIDR table for selective white- and blacklisting. </p> 171 1.1 tron 172 1.1 tron <p> Example: </p> 173 1.1 tron 174 1.1 tron <pre> 175 1.1 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 176 1.1 tron <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, 177 1.1 tron <a href="cidr_table.5.html">cidr</a>:/etc/postfix/postscreen_access.cidr 178 1.1 tron 179 1.1 tron /etc/postfix/postscreen_access.<a href="cidr_table.5.html">cidr</a>: 180 1.1 tron # Rules are evaluated in the order as specified. 181 1.1 tron # Blacklist 192.168.* except 192.168.0.1. 182 1.1 tron 192.168.0.1 permit 183 1.1 tron 192.168.0.0/16 reject 184 1.1 tron </pre> 185 1.1 tron 186 1.1 tron <p> See the <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> manpage documentation for more 187 1.1 tron details. </p> 188 1.1 tron 189 1.1 tron <p> When the SMTP client address matches a "permit" action, 190 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> logs this with the client address and port number as: 191 1.1 tron </p> 192 1.1 tron 193 1.1 tron <pre> 194 1.1 tron <b>WHITELISTED</b> <i>[address]:port</i> 195 1.1 tron </pre> 196 1.1 tron 197 1.1 tron <p> The whitelist action is not configurable: immediately hand off the 198 1.1 tron connection to a Postfix SMTP server process. </p> 199 1.1 tron 200 1.1 tron <p> When the SMTP client address matches a "reject" action, 201 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> logs this with the client address and port number as: 202 1.1 tron </p> 203 1.1 tron 204 1.1 tron <pre> 205 1.1 tron <b>BLACKLISTED</b> <i>[address]:port</i> 206 1.1 tron </pre> 207 1.1 tron 208 1.1 tron <p> The <a href="postconf.5.html#postscreen_blacklist_action">postscreen_blacklist_action</a> parameter specifies the action 209 1.1 tron that is taken next. See "<a href="#fail_before_220">When tests 210 1.1 tron fail before the 220 SMTP server greeting</a>" below. </p> 211 1.1 tron 212 1.1 tron <h3> <a name="temp_white"> Temporary whitelist test </a> </h3> 213 1.1 tron 214 1.1 tron <p> The <a href="postscreen.8.html">postscreen(8)</a> daemon maintains a <i>temporary</i> 215 1.1 tron whitelist for SMTP client IP addresses that have passed all 216 1.1 tron the tests described below. The <a href="postconf.5.html#postscreen_cache_map">postscreen_cache_map</a> parameter 217 1.1 tron specifies the location of the temporary whitelist. The 218 1.1 tron temporary whitelist is not used for SMTP client addresses 219 1.1.1.2 tron that appear on the <i>permanent</i> access list. </p> 220 1.1.1.2 tron 221 1.1.1.2 tron <blockquote> <p> NOTE: To share a <a href="postscreen.8.html">postscreen(8)</a> cache between 222 1.1.1.2 tron multiple <a href="postscreen.8.html">postscreen(8)</a> instances, use "<tt><a href="postconf.5.html#postscreen_cache_map">postscreen_cache_map</a> = 223 1.1.1.2 tron <a href="proxymap.8.html">proxy</a>:btree:$<a href="postconf.5.html#data_directory">data_directory</a>/postscreen_cache</tt>", and disable 224 1.1.1.2 tron cache cleanup (<a href="postconf.5.html#postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a> = 0) in all 225 1.1.1.2 tron <a href="postscreen.8.html">postscreen(8)</a> instances except one that is responsible for cache 226 1.1.1.2 tron cleanup. </p> <p> <a href="postscreen.8.html">postscreen(8)</a> cache sharing requires Postfix 2.9 227 1.1.1.2 tron or later; earlier <a href="proxymap.8.html">proxymap(8)</a> implementations don't support cache 228 1.1.1.2 tron cleanup. </p> <p> For an alternative <a href="postscreen.8.html">postscreen(8)</a> cache sharing 229 1.1.1.2 tron approach see the <a href="memcache_table.5.html">memcache_table(5)</a> manpage. </p> </blockquote> 230 1.1 tron 231 1.1 tron <p> When the SMTP client address appears on the temporary 232 1.1 tron whitelist, <a href="postscreen.8.html">postscreen(8)</a> logs this with the client address and port 233 1.1 tron number as: </p> 234 1.1 tron 235 1.1 tron <pre> 236 1.1 tron <b>PASS OLD</b> <i>[address]:port</i> 237 1.1 tron </pre> 238 1.1 tron 239 1.1 tron <p> The action is not configurable: immediately hand off the 240 1.1 tron connection to a Postfix SMTP server process. The client is 241 1.1 tron excluded from further tests until its temporary whitelist 242 1.1 tron entry expires, as controlled with the postscreen_*_ttl 243 1.1 tron parameters. Expired entries are silently renewed if possible. </p> 244 1.1 tron 245 1.1.1.2 tron <h3> <a name="white_veto"> MX Policy test </a> </h3> 246 1.1.1.2 tron 247 1.1.1.2 tron <p> When the remote SMTP client is not on the static access list 248 1.1.1.2 tron or temporary whitelist, <a href="postscreen.8.html">postscreen(8)</a> can implement a number of 249 1.1.1.2 tron whitelist tests, before it grants the client a temporary whitelist 250 1.1.1.2 tron status that allows it to talk to a Postfix SMTP server process. </p> 251 1.1.1.2 tron 252 1.1.1.2 tron <p> By listening on both primary and backup MX addresses, <a href="postscreen.8.html">postscreen(8)</a> 253 1.1.1.2 tron can deny the temporary whitelist status to clients that connect 254 1.1.1.2 tron only to backup MX hosts (an old spammer trick to take advantage of 255 1.1.1.2 tron backup MX hosts with weaker anti-spam policies than primary MX 256 1.1.1.2 tron hosts). </p> 257 1.1.1.2 tron 258 1.1.1.2 tron <ul> 259 1.1.1.2 tron 260 1.1.1.2 tron <li> <p> First, configure the host to listen on both primary and 261 1.1.1.2 tron backup MX addresses. Use the appropriate <tt>ifconfig</tt> command 262 1.1.1.2 tron for the local operating system, or update the appropriate configuration 263 1.1.1.2 tron files and "refresh" the network protocol stack. </p> 264 1.1.1.2 tron 265 1.1.1.2 tron <li> <p> Then, configure <a href="postscreen.8.html">postscreen(8)</a> to deny the temporary whitelist 266 1.1.1.2 tron status on the backup MX address(es). An example for Wietse's 267 1.1.1.2 tron server is: </p> 268 1.1.1.2 tron 269 1.1.1.2 tron <pre> 270 1.1.1.2 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 271 1.1.1.2 tron <a href="postconf.5.html#postscreen_whitelist_interfaces">postscreen_whitelist_interfaces</a> = !168.100.189.8 <a href="DATABASE_README.html#types">static</a>:all 272 1.1.1.2 tron </pre> 273 1.1.1.2 tron 274 1.1.1.2 tron <p> Translation: allow clients to obtain the temporary whitelist 275 1.1.1.2 tron status on all server IP addresses except 168.100.189.8, which is a 276 1.1.1.2 tron backup MX address. </p> 277 1.1.1.2 tron 278 1.1.1.2 tron </ul> 279 1.1.1.2 tron 280 1.1.1.2 tron <p> When a non-whitelisted client connects the backup MX address, 281 1.1.1.2 tron <a href="postscreen.8.html">postscreen(8)</a> logs this with the client address and port number as: 282 1.1.1.2 tron </p> 283 1.1.1.2 tron 284 1.1.1.2 tron <pre> 285 1.1.1.2 tron <b>CONNECT from</b> <i>[address]:port</i> <b>to [168.100.189.8]:25</b> 286 1.1.1.2 tron <b>WHITELIST VETO</b> <i>[address]:port</i> 287 1.1.1.2 tron </pre> 288 1.1.1.2 tron 289 1.1.1.2 tron <p> Translation: the client at <i>[address]:port</i> connected to 290 1.1.1.2 tron the backup MX address 168.100.189.8 while it was not whitelisted. 291 1.1.1.2 tron The client will not be granted the temporary whitelist status, even 292 1.1.1.2 tron if passes all the whitelist tests described below. </p> 293 1.1.1.2 tron 294 1.1 tron <h2> <a name="before_220"> Tests before the 220 SMTP server greeting </a> </h2> 295 1.1 tron 296 1.1 tron <p> The <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> parameter specifies a short time 297 1.1 tron interval before the "220 <i>text</i>..." server greeting, where 298 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> can run a number of tests in parallel. </p> 299 1.1 tron 300 1.1 tron <p> When a good client passes these tests, and no "<a 301 1.1 tron href="#after_220">deep protocol tests</a>" are configured, postscreen(8) 302 1.1 tron adds the client to the temporary whitelist and hands off the "live" 303 1.1 tron connection to a Postfix SMTP server process. The client can then 304 1.1 tron continue as if <a href="postscreen.8.html">postscreen(8)</a> never even existed (except of course 305 1.1 tron for the short <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> delay). </p> 306 1.1 tron 307 1.1 tron <ul> 308 1.1 tron 309 1.1 tron <li> <a href="#pregreet"> Pregreet test </a> 310 1.1 tron 311 1.1 tron <li> <a href="#dnsbl"> DNS White/blacklist test </a> 312 1.1 tron 313 1.1 tron <li> <a href="#fail_before_220">When tests fail before the 220 SMTP server greeting</a> 314 1.1 tron 315 1.1 tron </ul> 316 1.1 tron 317 1.1 tron <h3> <a name="pregreet"> Pregreet test </a> </h3> 318 1.1 tron 319 1.1 tron <p> The SMTP protocol is a classic example of a protocol where the 320 1.1 tron server speaks before the client. <a href="postscreen.8.html">postscreen(8)</a> detects zombies 321 1.1 tron that are in a hurry and that speak before their turn. This test is 322 1.1 tron enabled by default. </p> 323 1.1 tron 324 1.1 tron <p> The <a href="postconf.5.html#postscreen_greet_banner">postscreen_greet_banner</a> parameter specifies the <i>text</i> 325 1.1 tron portion of a "220-<i>text</i>..." teaser banner (default: $<a href="postconf.5.html#smtpd_banner">smtpd_banner</a>). 326 1.1 tron Note that this becomes the first part of a multi-line server greeting. 327 1.1 tron The <a href="postscreen.8.html">postscreen(8)</a> daemon sends this before the <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> 328 1.1 tron timer is started. The purpose of the teaser banner is to confuse 329 1.1 tron zombies so that they speak before their turn. It has no effect on 330 1.1 tron SMTP clients that correctly implement the protocol. </p> 331 1.1 tron 332 1.1 tron <p> To avoid problems with poorly-implemented SMTP engines in network 333 1.1 tron appliances or network testing tools, either exclude them from all 334 1.1 tron tests with the <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> feature or else specify 335 1.1 tron an empty teaser banner: </p> 336 1.1 tron 337 1.1 tron <pre> 338 1.1 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 339 1.1 tron # Exclude broken clients by whitelisting. Clients in <a href="postconf.5.html#mynetworks">mynetworks</a> 340 1.1 tron # should always be whitelisted. 341 1.1 tron <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, 342 1.1 tron <a href="cidr_table.5.html">cidr</a>:/etc/postfix/postscreen_access.cidr 343 1.1 tron 344 1.1 tron /etc/postfix/postscreen_access.<a href="cidr_table.5.html">cidr</a>: 345 1.1 tron 192.168.254.0/24 permit 346 1.1 tron </pre> 347 1.1 tron 348 1.1 tron <pre> 349 1.1 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 350 1.1 tron # Disable the teaser banner (try whitelisting first if you can). 351 1.1 tron <a href="postconf.5.html#postscreen_greet_banner">postscreen_greet_banner</a> = 352 1.1 tron </pre> 353 1.1 tron 354 1.1 tron <p> When an SMTP client sends a command before the 355 1.1 tron <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> time has elapsed, <a href="postscreen.8.html">postscreen(8)</a> logs this as: 356 1.1 tron </p> 357 1.1 tron 358 1.1 tron <pre> 359 1.1 tron <b>PREGREET</b> <i>count</i> <b>after</b> <i>time</i> <b>from</b> <i>[address]:port text...</i> 360 1.1 tron </pre> 361 1.1 tron 362 1.1 tron <p> Translation: the client at <i>[address]:port</i> sent <i>count</i> 363 1.1 tron bytes before its turn to speak. This happened <i>time</i> seconds 364 1.1 tron after the <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> timer was started. The <i>text</i> 365 1.1 tron is what the client sent (truncated to 100 bytes, and with non-printable 366 1.1 tron characters replaced with C-style escapes such as \r for carriage-return 367 1.1 tron and \n for newline). </p> 368 1.1 tron 369 1.1 tron <p> The <a href="postconf.5.html#postscreen_greet_action">postscreen_greet_action</a> parameter specifies the action that 370 1.1 tron is taken next. See "<a href="#fail_before_220">When tests fail 371 1.1 tron before the 220 SMTP server greeting</a>" below. </p> 372 1.1 tron 373 1.1 tron <h3> <a name="dnsbl"> DNS White/blacklist test </a> </h3> 374 1.1 tron 375 1.1 tron <p> The <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> parameter (default: empty) specifies 376 1.1 tron a list of DNS blocklist servers with optional filters and weight 377 1.1 tron factors (positive weights for blacklisting, negative for whitelisting). 378 1.1 tron These servers will be queried in parallel with the reverse client 379 1.1 tron IP address. This test is disabled by default. </p> 380 1.1 tron 381 1.1 tron <blockquote> 382 1.1 tron <p> 383 1.1 tron CAUTION: when postscreen rejects mail, its SMTP reply contains the 384 1.1 tron DNSBL domain name. Use the <a href="postconf.5.html#postscreen_dnsbl_reply_map">postscreen_dnsbl_reply_map</a> feature to 385 1.1 tron hide "password" information in DNSBL domain names. 386 1.1 tron </p> 387 1.1 tron </blockquote> 388 1.1 tron 389 1.1 tron <p> When the <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> time has elapsed, and the combined 390 1.1 tron DNSBL score is equal to or greater than the <a href="postconf.5.html#postscreen_dnsbl_threshold">postscreen_dnsbl_threshold</a> 391 1.1 tron parameter value, <a href="postscreen.8.html">postscreen(8)</a> logs this as: </p> 392 1.1 tron 393 1.1 tron <pre> 394 1.1 tron <b>DNSBL rank</b> <i>count</i> <b>for</b> <i>[address]:port</i> 395 1.1 tron </pre> 396 1.1 tron 397 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> has a combined 398 1.1 tron DNSBL score of <i>count</i>. </p> 399 1.1 tron 400 1.1 tron <p> The <a href="postconf.5.html#postscreen_dnsbl_action">postscreen_dnsbl_action</a> parameter specifies the action that 401 1.1 tron is taken when the combined DNSBL score is equal to or greater than 402 1.1 tron the threshold. See "<a href="#fail_before_220">When tests fail 403 1.1 tron before the 220 SMTP server greeting</a>" below. </p> 404 1.1 tron 405 1.1 tron <h3> <a name="fail_before_220">When tests fail before the 220 SMTP server greeting</a> </h3> 406 1.1 tron 407 1.1 tron <p> When the client address matches the permanent blacklist, or 408 1.1 tron when the client fails the pregreet or DNSBL tests, the action is 409 1.1 tron specified with <a href="postconf.5.html#postscreen_blacklist_action">postscreen_blacklist_action</a>, <a href="postconf.5.html#postscreen_greet_action">postscreen_greet_action</a>, 410 1.1 tron or <a href="postconf.5.html#postscreen_dnsbl_action">postscreen_dnsbl_action</a>, respectively. </p> 411 1.1 tron 412 1.1 tron <dl> 413 1.1 tron 414 1.1 tron <dt> <b>ignore</b> (default) </dt> 415 1.1 tron 416 1.1 tron <dd> Ignore the failure of this test. Allow other tests to complete. 417 1.1 tron Repeat this test the next time the client connects. This option 418 1.1 tron is useful for testing and collecting statistics without blocking 419 1.1 tron mail. </dd> 420 1.1 tron 421 1.1 tron <dt> <b>enforce</b> </dt> 422 1.1 tron 423 1.1 tron <dd> Allow other tests to complete. Reject attempts to deliver mail 424 1.1 tron with a 550 SMTP reply, and log the helo/sender/recipient information. 425 1.1 tron Repeat this test the next time the client connects. </dd> 426 1.1 tron 427 1.1 tron <dt> <b>drop</b> </dt> 428 1.1 tron 429 1.1 tron <dd> Drop the connection immediately with a 521 SMTP reply. Repeat 430 1.1 tron this test the next time the client connects. </dd> 431 1.1 tron 432 1.1 tron </dl> 433 1.1 tron 434 1.1 tron <h2> <a name="after_220">Tests after the 220 SMTP server greeting</a> </h2> 435 1.1 tron 436 1.1 tron <p> In this phase of the protocol, <a href="postscreen.8.html">postscreen(8)</a> implements a 437 1.1 tron number of "deep protocol" tests. These tests use an SMTP protocol 438 1.1 tron engine that is built into the <a href="postscreen.8.html">postscreen(8)</a> server. </p> 439 1.1 tron 440 1.1 tron <p> Important note: deep protocol tests are disabled by default. 441 1.1 tron They are more intrusive than the pregreet and DNSBL tests, and they 442 1.1 tron have limitations as discussed next. </p> 443 1.1 tron 444 1.1 tron <ul> 445 1.1 tron 446 1.1 tron <li> <p> When a good client passes the <a href="#after_220">deep 447 1.1 tron protocol tests</a>, postscreen(8) adds the client to the temporary 448 1.1 tron whitelist but it cannot hand off the "live" connection to a Postfix 449 1.1 tron SMTP server process in the middle of the session. Instead, <a href="postscreen.8.html">postscreen(8)</a> 450 1.1 tron defers mail delivery attempts with a 4XX status, logs the 451 1.1 tron helo/sender/recipient information, and waits for the client to 452 1.1 tron disconnect. </p> 453 1.1 tron 454 1.1 tron <p> The next time the client connects it will be allowed to talk 455 1.1 tron to a Postfix SMTP server process to deliver its mail. To minimize the 456 1.1 tron impact of this limitation, <a href="postscreen.8.html">postscreen(8)</a> gives deep protocol tests 457 1.1 tron a relatively long expiration time. </p> 458 1.1 tron 459 1.1 tron <li> <p> <a href="postscreen.8.html">postscreen(8)</a>'s built-in SMTP engine does not implement 460 1.1 tron the AUTH, XCLIENT, and XFORWARD features. AUTH support may be added 461 1.1 tron in a future version. In the mean time, if you need to make these 462 1.1 tron services available on port 25, then do not enable the tests after 463 1.1 tron the 220 server greeting. </p> 464 1.1 tron 465 1.1 tron </ul> 466 1.1 tron 467 1.1 tron <p> End-user clients should connect directly to the submission 468 1.1 tron service, so that they never have to deal with <a href="postscreen.8.html">postscreen(8)</a>'s tests. 469 1.1 tron </p> 470 1.1 tron 471 1.1 tron <ul> 472 1.1 tron 473 1.1 tron <li> <a href="#pipelining">Command pipelining test</a> 474 1.1 tron 475 1.1 tron <li> <a href="#non_smtp">Non-SMTP command test</a> 476 1.1 tron 477 1.1 tron <li> <a href="#barelf">Bare newline test</a> 478 1.1 tron 479 1.1 tron <li> <a href="#fail_after_220">When tests fail after the 220 SMTP server greeting</a> 480 1.1 tron 481 1.1 tron </ul> 482 1.1 tron 483 1.1 tron <h3> <a name="pipelining">Command pipelining test</a> </h3> 484 1.1 tron 485 1.1 tron <p> By default, SMTP is a half-duplex protocol: the sender and 486 1.1 tron receiver send one command and one response at a time. Unlike the 487 1.1 tron Postfix SMTP server, <a href="postscreen.8.html">postscreen(8)</a> does not announce support 488 1.1 tron for ESMTP command pipelining. Therefore, clients are not allowed 489 1.1 tron to send multiple commands. postscreen(8)'s <a href="#after_220">deep 490 1.1 tron protocol test</a> for this is disabled by default. </p> 491 1.1 tron 492 1.1 tron <p> With "<a href="postconf.5.html#postscreen_pipelining_enable">postscreen_pipelining_enable</a> = yes", <a href="postscreen.8.html">postscreen(8)</a> detects 493 1.1 tron zombies that send multiple commands, instead of sending one command 494 1.1 tron and waiting for the server to reply. </p> 495 1.1 tron 496 1.1 tron <p> This test is opportunistically enabled when <a href="postscreen.8.html">postscreen(8)</a> has 497 1.1 tron to use the built-in SMTP engine anyway. This is to make <a href="postscreen.8.html">postscreen(8)</a> 498 1.1 tron logging more informative. </p> 499 1.1 tron 500 1.1 tron <p> When a client sends multiple commands, <a href="postscreen.8.html">postscreen(8)</a> logs this 501 1.1 tron as: </p> 502 1.1 tron 503 1.1 tron <pre> 504 1.1.1.2 tron <b>COMMAND PIPELINING from</b> <i>[address]:port</i> <b>after</b> <i>command</i>: <i>text</i> 505 1.1 tron </pre> 506 1.1 tron 507 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> sent 508 1.1 tron multiple SMTP commands, instead of sending one command and then 509 1.1 tron waiting for the server to reply. This happened after the client 510 1.1.1.2 tron sent <i>command</i>. The <i>text</i> shows part of the input that 511 1.1.1.2 tron was sent too early; it is not logged with Postfix 2.8. </p> 512 1.1 tron 513 1.1 tron <p> The <a href="postconf.5.html#postscreen_pipelining_action">postscreen_pipelining_action</a> parameter specifies the action 514 1.1 tron that is taken next. See "<a href="#fail_after_220">When tests fail 515 1.1 tron after the 220 SMTP server greeting</a>" below. </p> 516 1.1 tron 517 1.1 tron <h3> <a name="non_smtp">Non-SMTP command test</a> </h3> 518 1.1 tron 519 1.1 tron <p> Some spambots send their mail through open proxies. A symptom 520 1.1 tron of this is the usage of commands such as CONNECT and other non-SMTP 521 1.1 tron commands. Just like the Postfix SMTP server's <a href="postconf.5.html#smtpd_forbidden_commands">smtpd_forbidden_commands</a> 522 1.1 tron feature, <a href="postscreen.8.html">postscreen(8)</a> has an equivalent <a href="postconf.5.html#postscreen_forbidden_commands">postscreen_forbidden_commands</a> 523 1.1 tron feature to block these clients. postscreen(8)'s <a href="#after_220">deep 524 1.1 tron protocol test</a> for this is disabled by default. </p> 525 1.1 tron 526 1.1 tron <p> With "<a href="postconf.5.html#postscreen_non_smtp_command_enable">postscreen_non_smtp_command_enable</a> = yes", <a href="postscreen.8.html">postscreen(8)</a> 527 1.1 tron detects zombies that send commands specified with the 528 1.1 tron <a href="postconf.5.html#postscreen_forbidden_commands">postscreen_forbidden_commands</a> parameter. This also detects commands 529 1.1 tron with the syntax of a message header label. The latter is a symptom 530 1.1 tron that the client is sending message content after ignoring all the 531 1.1 tron responses from <a href="postscreen.8.html">postscreen(8)</a> that reject mail. </p> 532 1.1 tron 533 1.1 tron <p> This test is opportunistically enabled when <a href="postscreen.8.html">postscreen(8)</a> has 534 1.1 tron to use the built-in SMTP engine anyway. This is to make <a href="postscreen.8.html">postscreen(8)</a> 535 1.1 tron logging more informative. </p> 536 1.1 tron 537 1.1 tron <p> When a client sends non-SMTP commands, <a href="postscreen.8.html">postscreen(8)</a> logs this 538 1.1 tron as: </p> 539 1.1 tron 540 1.1 tron <pre> 541 1.1 tron <b>NON-SMTP COMMAND from</b> <i>[address]:port command</i> 542 1.1 tron </pre> 543 1.1 tron 544 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> sent a 545 1.1 tron <i>command</i> that matches the <a href="postconf.5.html#postscreen_forbidden_commands">postscreen_forbidden_commands</a> 546 1.1 tron parameter, or that has the syntax of a message header label. </p> 547 1.1 tron 548 1.1 tron <p> The <a href="postconf.5.html#postscreen_non_smtp_command_action">postscreen_non_smtp_command_action</a> parameter specifies 549 1.1 tron the action that is taken next. See "<a href="#fail_after_220">When 550 1.1 tron tests fail after the 220 SMTP server greeting</a>" below. </p> 551 1.1 tron 552 1.1 tron <h3> <a name="barelf">Bare newline test</a> </h3> 553 1.1 tron 554 1.1 tron <p> SMTP is a line-oriented protocol: lines have a limited length, 555 1.1 tron and are terminated with <CR><LF>. Lines ending in a 556 1.1 tron "bare" <LF>, that is newline not preceded by carriage return, 557 1.1 tron are not allowed in SMTP. postscreen(8)'s <a href="#after_220">deep 558 1.1 tron protocol test</a> for this is disabled by default. </p> 559 1.1 tron 560 1.1 tron <p> With "<a href="postconf.5.html#postscreen_bare_newline_enable">postscreen_bare_newline_enable</a> = yes", <a href="postscreen.8.html">postscreen(8)</a> 561 1.1 tron detects clients that send lines ending in bare newline characters. 562 1.1 tron </p> 563 1.1 tron 564 1.1 tron <p> This test is opportunistically enabled when <a href="postscreen.8.html">postscreen(8)</a> has 565 1.1 tron to use the built-in SMTP engine anyway. This is to make <a href="postscreen.8.html">postscreen(8)</a> 566 1.1 tron logging more informative. </p> 567 1.1 tron 568 1.1 tron <p> When a client sends bare newline characters, <a href="postscreen.8.html">postscreen(8)</a> logs 569 1.1 tron this as: 570 1.1 tron </p> 571 1.1 tron 572 1.1 tron <pre> 573 1.1 tron <b>BARE NEWLINE from</b> <i>[address]:port</i> 574 1.1 tron </pre> 575 1.1 tron 576 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> sent a bare 577 1.1 tron newline character, that is newline not preceded by carriage 578 1.1 tron return. </p> 579 1.1 tron 580 1.1 tron <p> The <a href="postconf.5.html#postscreen_bare_newline_action">postscreen_bare_newline_action</a> parameter specifies the 581 1.1 tron action that is taken next. See "<a href="#fail_after_220">When 582 1.1 tron tests fail after the 220 SMTP server greeting</a>" below. </p> 583 1.1 tron 584 1.1 tron <h3> <a name="fail_after_220">When tests fail after the 220 SMTP server greeting</a> </h3> 585 1.1 tron 586 1.1 tron <p> When the client fails the pipelining, non-SMTP command or bare 587 1.1 tron newline tests, the action is specified with <a href="postconf.5.html#postscreen_pipelining_action">postscreen_pipelining_action</a>, 588 1.1 tron <a href="postconf.5.html#postscreen_non_smtp_command_action">postscreen_non_smtp_command_action</a> or <a href="postconf.5.html#postscreen_bare_newline_action">postscreen_bare_newline_action</a>, 589 1.1 tron respectively. </p> 590 1.1 tron 591 1.1 tron <dl> 592 1.1 tron 593 1.1 tron <dt> <b>ignore</b> (default for bare newline) </dt> 594 1.1 tron 595 1.1 tron <dd> Ignore the failure of this test. Allow other tests to complete. 596 1.1 tron Do NOT repeat this test before the result from some other test 597 1.1 tron expires. 598 1.1 tron 599 1.1 tron This option is useful for testing and collecting statistics without 600 1.1 tron blocking mail permanently. </dd> 601 1.1 tron 602 1.1 tron <dt> <b>enforce</b> (default for pipelining) </dt> 603 1.1 tron 604 1.1 tron <dd> Allow other tests to complete. Reject attempts to deliver 605 1.1 tron mail with a 550 SMTP reply, and log the helo/sender/recipient 606 1.1 tron information. Repeat this test the next time the client connects. 607 1.1 tron </dd> 608 1.1 tron 609 1.1 tron <dt> <b>drop</b> (default for non-SMTP commands) </dt> 610 1.1 tron 611 1.1 tron <dd> Drop the connection immediately with a 521 SMTP reply. Repeat 612 1.1 tron this test the next time the client connects. This action is 613 1.1 tron compatible with the Postfix SMTP server's <a href="postconf.5.html#smtpd_forbidden_commands">smtpd_forbidden_commands</a> 614 1.1 tron feature. </dd> 615 1.1 tron 616 1.1 tron </dl> 617 1.1 tron 618 1.1 tron <h2> <a name="other_error">Other errors</a> </h2> 619 1.1 tron 620 1.1.1.2 tron <p> When an SMTP client hangs up unexpectedly, <a href="postscreen.8.html">postscreen(8)</a> logs 621 1.1.1.2 tron this as: </p> 622 1.1 tron 623 1.1 tron <pre> 624 1.1 tron <b>HANGUP after</b> <i>time</i> <b>from</b> <i>[address]:port</i> <b>in</b> <i>test name</i> 625 1.1 tron </pre> 626 1.1 tron 627 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> disconnected 628 1.1 tron unexpectedly, <i>time</i> seconds after the start of the 629 1.1 tron test named <i>test name</i>. </p> 630 1.1 tron 631 1.1.1.2 tron <p> There is no punishment for hanging up. A client that hangs up 632 1.1.1.2 tron without sending the QUIT command can still pass all <a href="postscreen.8.html">postscreen(8)</a> 633 1.1.1.2 tron tests. </p> 634 1.1.1.2 tron 635 1.1 tron <!-- 636 1.1 tron 637 1.1 tron <p> While an unexpired penalty is in effect, an SMTP client is not 638 1.1 tron allowed to pass any tests, and <a href="postscreen.8.html">postscreen(8)</a> logs each connection 639 1.1 tron with the remaining amount of penalty time as: </p> 640 1.1 tron 641 1.1 tron <pre> 642 1.1 tron <b>PENALTY</b> <i>time</i> <b>for</b> <i>[address]:port</i> 643 1.1 tron </pre> 644 1.1 tron 645 1.1 tron <p> During this time, all attempts by the client to deliver mail 646 1.1 tron will be deferred with a 450 SMTP status. </p> 647 1.1 tron 648 1.1 tron --> 649 1.1 tron 650 1.1 tron <p> The following errors are reported by the built-in SMTP engine. 651 1.1 tron This engine never accepts mail, therefore it has per-session limits 652 1.1 tron on the number of commands and on the session length. </p> 653 1.1 tron 654 1.1 tron <pre> 655 1.1 tron <b>COMMAND TIME LIMIT</b> <b>from</b> <i>[address]:port</i> 656 1.1 tron </pre> 657 1.1 tron 658 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> reached the 659 1.1 tron per-command time limit as specified with the <a href="postconf.5.html#postscreen_command_time_limit">postscreen_command_time_limit</a> 660 1.1 tron parameter. The session is terminated immediately. </p> 661 1.1 tron 662 1.1 tron <pre> 663 1.1 tron <b>COMMAND COUNT LIMIT from</b> <i>[address]:port</i> 664 1.1 tron </pre> 665 1.1 tron 666 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> reached the 667 1.1 tron per-session command count limit as specified with the 668 1.1 tron <a href="postconf.5.html#postscreen_command_count_limit">postscreen_command_count_limit</a> parameter. The session is terminated 669 1.1 tron immediately. </p> 670 1.1 tron 671 1.1 tron <pre> 672 1.1 tron <b>COMMAND LENGTH LIMIT from</b> <i>[address]:port</i> 673 1.1 tron </pre> 674 1.1 tron 675 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> reached the 676 1.1 tron per-command length limit, as specified with the <a href="postconf.5.html#line_length_limit">line_length_limit</a> 677 1.1 tron parameter. The session is terminated immediately. </p> 678 1.1 tron 679 1.1 tron <p> When an SMTP client makes too many connections at the same time, 680 1.1 tron or when all <a href="postscreen.8.html">postscreen(8)</a> ports are busy, <a href="postscreen.8.html">postscreen(8)</a> rejects the 681 1.1 tron connection with a 421 status code and logs: </p> 682 1.1 tron 683 1.1 tron <pre> 684 1.1 tron <b>NOQUEUE: reject: CONNECT from</b> <i>[address]:port</i><b>: too many connections</b> 685 1.1 tron <b>NOQUEUE: reject: CONNECT from</b> <i>[address]:port</i><b>: all server ports busy</b> 686 1.1 tron </pre> 687 1.1 tron 688 1.1 tron <p> The <a href="postconf.5.html#postscreen_client_connection_count_limit">postscreen_client_connection_count_limit</a> and 689 1.1 tron <a href="postconf.5.html#postscreen_pre_queue_limit">postscreen_pre_queue_limit</a> parameters control these limits. </p> 690 1.1 tron 691 1.1 tron <h2> <a name="victory">When all tests succeed</a> </h2> 692 1.1 tron 693 1.1 tron <p> When a new SMTP client passes all tests (i.e. it is not whitelisted 694 1.1 tron via some mechanism), <a href="postscreen.8.html">postscreen(8)</a> logs this as: </p> 695 1.1 tron 696 1.1 tron <pre> 697 1.1 tron <b>PASS NEW</b> <i>[address]:port</i> 698 1.1 tron </pre> 699 1.1 tron 700 1.1 tron <p> Where <i>[address]:port</i> are the client IP address and port. 701 1.1 tron Then, <a href="postscreen.8.html">postscreen(8)</a> 702 1.1 tron creates a temporary whitelist entry that excludes the client IP 703 1.1 tron address from further tests until the temporary whitelist entry 704 1.1 tron expires, as controlled with the postscreen_*_ttl parameters. </p> 705 1.1 tron 706 1.1 tron <p> When no "<a href="#after_220">deep protocol tests</a>" are 707 1.1 tron configured, <a href="postscreen.8.html">postscreen(8)</a> hands off the "live" connection to a Postfix 708 1.1 tron SMTP server process. The client can then continue as if <a href="postscreen.8.html">postscreen(8)</a> 709 1.1 tron never even existed (except for the short <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> delay). 710 1.1 tron </p> 711 1.1 tron 712 1.1 tron <p> When any "<a href="#after_220">deep protocol tests</a>" are 713 1.1 tron configured, <a href="postscreen.8.html">postscreen(8)</a> cannot hand off the "live" connection to 714 1.1 tron a Postfix SMTP server process in the middle of the session. Instead, 715 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> defers mail delivery attempts with a 4XX status, logs 716 1.1 tron the helo/sender/recipient information, and waits for the client to 717 1.1 tron disconnect. The next time the client connects it will be allowed 718 1.1 tron to talk to a Postfix SMTP server process to deliver its mail. 719 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> mitigates the impact of this limitation by giving 720 1.1 tron <a href="#after_220">deep protocol tests</a> a long expiration 721 1.1 tron time. </p> 722 1.1 tron 723 1.1 tron <h2> <a name="config"> Configuring the postscreen(8) service</a> 724 1.1 tron </h2> 725 1.1 tron 726 1.1 tron <p> <a href="postscreen.8.html">postscreen(8)</a> has been tested on FreeBSD [4-8], Linux 2.[4-6] 727 1.1 tron and Solaris 9 systems. </p> 728 1.1 tron 729 1.1 tron <ul> 730 1.1 tron 731 1.1 tron <li> <a href="#enable"> Turning on postscreen(8) without blocking 732 1.1 tron mail</a> 733 1.1 tron 734 1.1 tron <li> <a href="#starttls"> postscreen(8) TLS configuration </a> 735 1.1 tron 736 1.1 tron <li> <a href="#blocking"> Blocking mail with postscreen(8) </a> 737 1.1 tron 738 1.1 tron <li> <a href="#turnoff"> Turning off postscreen(8) </a> 739 1.1 tron 740 1.1 tron </ul> 741 1.1 tron 742 1.1 tron <h3> <a name="enable"> Turning on postscreen(8) without blocking mail</a> </h3> 743 1.1 tron 744 1.1 tron <p> To enable the <a href="postscreen.8.html">postscreen(8)</a> service and log client information 745 1.1 tron without blocking mail: </p> 746 1.1 tron 747 1.1 tron <ol> 748 1.1 tron 749 1.1 tron <li> <p> Make sure that local clients and systems with non-standard 750 1.1 tron SMTP implementations are excluded from any <a href="postscreen.8.html">postscreen(8)</a> tests. The 751 1.1 tron default is to exclude all clients in <a href="postconf.5.html#mynetworks">mynetworks</a>. To exclude additional 752 1.1 tron clients, for example, third-party performance monitoring tools (these 753 1.1 tron tend to have broken SMTP implementations): </p> 754 1.1 tron 755 1.1 tron <pre> 756 1.1 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 757 1.1 tron # Exclude broken clients by whitelisting. Clients in <a href="postconf.5.html#mynetworks">mynetworks</a> 758 1.1 tron # should always be whitelisted. 759 1.1 tron <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, 760 1.1 tron <a href="cidr_table.5.html">cidr</a>:/etc/postfix/postscreen_access.cidr 761 1.1 tron 762 1.1 tron /etc/postfix/postscreen_access.<a href="cidr_table.5.html">cidr</a>: 763 1.1 tron 192.168.254.0/24 permit 764 1.1 tron </pre> 765 1.1 tron 766 1.1 tron <li> <p> Comment out the "<tt>smtp inet ... smtpd</tt>" service 767 1.1 tron in <a href="master.5.html">master.cf</a>, including any "<tt>-o parameter=value</tt>" entries 768 1.1 tron that follow. </p> 769 1.1 tron 770 1.1 tron <pre> 771 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 772 1.1 tron #smtp inet n - n - - smtpd 773 1.1 tron # -o parameter=value ... 774 1.1 tron </pre> 775 1.1 tron 776 1.1 tron <li> <p> Uncomment the new "<tt>smtpd pass ... smtpd</tt>" service 777 1.1 tron in <a href="master.5.html">master.cf</a>, and duplicate any "<tt>-o parameter=value</tt>" entries 778 1.1 tron from the smtpd service that was commented out in the previous step. 779 1.1 tron </p> 780 1.1 tron 781 1.1 tron <pre> 782 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 783 1.1 tron smtpd pass - - n - - smtpd 784 1.1 tron -o parameter=value ... 785 1.1 tron </pre> 786 1.1 tron 787 1.1 tron <li> <p> Uncomment the new "<tt>smtp inet ... postscreen</tt>" 788 1.1 tron service in <a href="master.5.html">master.cf</a>. </p> 789 1.1 tron 790 1.1 tron <pre> 791 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 792 1.1 tron smtp inet n - n - 1 postscreen 793 1.1 tron </pre> 794 1.1 tron 795 1.1 tron <li> <p> Uncomment the new "<tt>tlsproxy unix ... tlsproxy</tt>" 796 1.1 tron service in <a href="master.5.html">master.cf</a>. This service implements STARTTLS support for 797 1.1 tron <a href="postscreen.8.html">postscreen(8)</a>. </p> 798 1.1 tron 799 1.1 tron <pre> 800 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 801 1.1 tron tlsproxy unix - - n - 0 tlsproxy 802 1.1 tron </pre> 803 1.1 tron 804 1.1 tron <li> <p> Uncomment the new "<tt>dnsblog unix ... dnsblog</tt>" 805 1.1 tron service in <a href="master.5.html">master.cf</a>. This service does DNSBL lookups for <a href="postscreen.8.html">postscreen(8)</a> 806 1.1 tron and logs results. </p> 807 1.1 tron 808 1.1 tron <pre> 809 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 810 1.1 tron dnsblog unix - - n - 0 dnsblog 811 1.1 tron </pre> 812 1.1 tron 813 1.1 tron <li> <p> To enable DNSBL lookups, list some DNS blocklist sites in 814 1.1 tron <a href="postconf.5.html">main.cf</a>, separated by whitespace. Different sites can have different 815 1.1 tron weights. For example: 816 1.1 tron 817 1.1 tron <pre> 818 1.1 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 819 1.1 tron <a href="postconf.5.html#postscreen_dnsbl_threshold">postscreen_dnsbl_threshold</a> = 2 820 1.1 tron <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> = zen.spamhaus.org*2 821 1.1 tron bl.spamcop.net*1 b.barracudacentral.org*1 822 1.1 tron </pre> 823 1.1 tron 824 1.1 tron <p> Note: if your DNSBL queries have a "secret" in the domain name, 825 1.1 tron you must censor this information from the <a href="postscreen.8.html">postscreen(8)</a> SMTP replies. 826 1.1 tron For example: </p> 827 1.1 tron 828 1.1 tron <pre> 829 1.1 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 830 1.1.1.2 tron <a href="postconf.5.html#postscreen_dnsbl_reply_map">postscreen_dnsbl_reply_map</a> = <a href="DATABASE_README.html#types">texthash</a>:/etc/postfix/dnsbl_reply 831 1.1 tron </pre> 832 1.1 tron 833 1.1 tron <pre> 834 1.1 tron /etc/postfix/dnsbl_reply: 835 1.1 tron # Secret DNSBL name Name in <a href="postscreen.8.html">postscreen(8)</a> replies 836 1.1 tron secret.zen.spamhaus.org zen.spamhaus.org 837 1.1 tron </pre> 838 1.1 tron 839 1.1.1.2 tron <p> The <a href="DATABASE_README.html#types">texthash</a>: format is similar to hash: except that there is 840 1.1 tron no need to run <a href="postmap.1.html">postmap(1)</a> before the file can be used, and that it 841 1.1 tron does not detect changes after the file is read. It is new with 842 1.1 tron Postfix version 2.8. </p> 843 1.1 tron 844 1.1 tron <li> <p> Read the new configuration with "<tt>postfix reload</tt>". 845 1.1 tron </p> 846 1.1 tron 847 1.1 tron </ol> 848 1.1 tron 849 1.1 tron <p> Notes: </p> 850 1.1 tron 851 1.1 tron <ul> 852 1.1 tron 853 1.1 tron <li> <p> Some <a href="postscreen.8.html">postscreen(8)</a> configuration parameters implement 854 1.1 tron stress-dependent behavior. This is supported only when the default 855 1.1.1.2 tron value is stress-dependent (that is, "postconf -d <i>parametername</i>" 856 1.1.1.2 tron output shows "<i>parametername</i> = 857 1.1.1.2 tron ${stress?<i>something</i>}${stress:<i>something</i>}"). 858 1.1 tron Other parameters always evaluate as if the stress value is the empty 859 1.1 tron string. </p> 860 1.1 tron 861 1.1 tron <li> <p> See "<a href="#before_220">Tests before the 220 SMTP server 862 1.1 tron greeting</a>" for details about the logging from these postscreen(8) 863 1.1 tron tests. </p> 864 1.1 tron 865 1.1 tron <li> <p> If you run Postfix 2.6 or earlier you must stop and start 866 1.1 tron the master daemon ("<tt>postfix stop; postfix start</tt>"). This 867 1.1 tron is needed because the Postfix "pass" master service type did not 868 1.1 tron work reliably on all systems. </p> 869 1.1 tron 870 1.1 tron </ul> 871 1.1 tron 872 1.1 tron <h3> <a name="starttls"> postscreen(8) TLS configuration </a> </h3> 873 1.1 tron 874 1.1 tron <p> <a href="postscreen.8.html">postscreen(8)</a> TLS support is available for remote SMTP clients 875 1.1 tron that aren't whitelisted, including clients that need to renew their 876 1.1 tron temporary whitelist status. When a remote SMTP client requests TLS 877 1.1 tron service, <a href="postscreen.8.html">postscreen(8)</a> invisibly hands off the connection to a 878 1.1 tron <a href="tlsproxy.8.html">tlsproxy(8)</a> process. Then, <a href="tlsproxy.8.html">tlsproxy(8)</a> encrypts and decrypts the 879 1.1 tron traffic between <a href="postscreen.8.html">postscreen(8)</a> and the remote SMTP client. One 880 1.1 tron <a href="tlsproxy.8.html">tlsproxy(8)</a> process can handle multiple SMTP sessions. The number 881 1.1 tron of <a href="tlsproxy.8.html">tlsproxy(8)</a> processes slowly increases with server load, but it 882 1.1 tron should always be much smaller than the number of <a href="postscreen.8.html">postscreen(8)</a> TLS 883 1.1 tron sessions. </p> 884 1.1 tron 885 1.1 tron <p> TLS support for <a href="postscreen.8.html">postscreen(8)</a> and <a href="tlsproxy.8.html">tlsproxy(8)</a> uses the same 886 1.1 tron parameters as with <a href="smtpd.8.html">smtpd(8)</a>. We recommend that you keep the relevant 887 1.1 tron configuration parameters in <a href="postconf.5.html">main.cf</a>. If you must specify "-o 888 1.1 tron smtpd_mumble=value" parameter overrides in <a href="master.5.html">master.cf</a> for a 889 1.1 tron postscreen-protected <a href="smtpd.8.html">smtpd(8)</a> service, then you should specify those 890 1.1 tron same parameter overrides for the <a href="postscreen.8.html">postscreen(8)</a> and <a href="tlsproxy.8.html">tlsproxy(8)</a> 891 1.1 tron services. </p> 892 1.1 tron 893 1.1 tron <h3> <a name="blocking"> Blocking mail with postscreen(8) </a> </h3> 894 1.1 tron 895 1.1 tron <p> For compatibility with <a href="smtpd.8.html">smtpd(8)</a>, <a href="postscreen.8.html">postscreen(8)</a> implements the 896 1.1 tron <a href="postconf.5.html#soft_bounce">soft_bounce</a> safety feature. This causes Postfix to reject mail with 897 1.1 tron a "try again" reply code. </p> 898 1.1 tron 899 1.1 tron <ul> 900 1.1 tron 901 1.1 tron <li> <p> To turn this on for all of Postfix, specify "<tt><a href="postconf.5.html#soft_bounce">soft_bounce</a> 902 1.1 tron = yes</tt>" in <a href="postconf.5.html">main.cf</a>. </p> 903 1.1 tron 904 1.1 tron <li> <p> To turn this on for <a href="postscreen.8.html">postscreen(8)</a> only, append "<tt>-o 905 1.1 tron <a href="postconf.5.html#soft_bounce">soft_bounce</a>=yes</tt>" (note: NO SPACES around '=') to the postscreen 906 1.1 tron entry in <a href="master.5.html">master.cf</a>. <p> 907 1.1 tron 908 1.1 tron </ul> 909 1.1 tron 910 1.1 tron <p> Execute "<tt>postfix reload</tt>" to make the change effective. </p> 911 1.1 tron 912 1.1 tron <p> After testing, do not forget to remove the <a href="postconf.5.html#soft_bounce">soft_bounce</a> feature, 913 1.1 tron otherwise senders won't receive their non-delivery notification 914 1.1 tron until many days later. </p> 915 1.1 tron 916 1.1 tron <p> To use the <a href="postscreen.8.html">postscreen(8)</a> service to block mail, edit <a href="postconf.5.html">main.cf</a> and 917 1.1 tron specify one or more of: </p> 918 1.1 tron 919 1.1 tron <ul> 920 1.1 tron 921 1.1 tron <li> <p> "<tt><a href="postconf.5.html#postscreen_dnsbl_action">postscreen_dnsbl_action</a> = enforce</tt>", to reject 922 1.1 tron clients that are on DNS blocklists, and to log the helo/sender/recipient 923 1.1 tron information. With good DNSBLs this reduces the amount of load on 924 1.1 tron Postfix SMTP servers dramatically. </p> 925 1.1 tron 926 1.1 tron <li> <p> "<tt><a href="postconf.5.html#postscreen_greet_action">postscreen_greet_action</a> = enforce</tt>", to reject 927 1.1 tron clients that talk before their turn, and to log the helo/sender/recipient 928 1.1 tron information. This stops over half of all known-to-be illegitimate 929 1.1 tron connections to Wietse's mail server. It is backup protection for 930 1.1 tron zombies that haven't yet been blacklisted. </p> 931 1.1 tron 932 1.1 tron <li> <p> You can also enable "<a href="#after_220">deep protocol 933 1.1 tron tests</a>", but these are more intrusive than the pregreet or DNSBL 934 1.1 tron tests. </p> 935 1.1 tron 936 1.1 tron <p> When a good client passes the "<a href="#after_220">deep 937 1.1 tron protocol tests</a>", postscreen(8) adds the client to the temporary 938 1.1 tron whitelist but it cannot hand off the "live" connection to a Postfix 939 1.1 tron SMTP server process in the middle of the session. Instead, <a href="postscreen.8.html">postscreen(8)</a> 940 1.1 tron defers mail delivery attempts with a 4XX status, logs the 941 1.1 tron helo/sender/recipient information, and waits for the client to 942 1.1 tron disconnect. </p> 943 1.1 tron 944 1.1 tron <p> When the good client comes back in a later session, it is allowed 945 1.1 tron to talk directly to a Postfix SMTP server. See "after_220 <a 946 1.1 tron href="#after_220">Tests after the 220 SMTP server greeting</a> above 947 1.1 tron for limitations with AUTH and other features that clients may need. 948 1.1 tron </p> 949 1.1 tron 950 1.1 tron <p> An unexpected benefit from "<a href="#after_220">deep protocol 951 1.1 tron tests</a>" is that some "good" clients don't return after the 4XX 952 1.1 tron reply; these clients were not so good after all. Wietse enables 953 1.1 tron "<a href="#after_220">deep protocol tests</a>" on his own internet-facing 954 1.1 tron mail server. </p> 955 1.1 tron 956 1.1 tron <li> <p> There is also support for permanent blacklisting and 957 1.1 tron whitelisting; see the description of the <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> 958 1.1 tron parameter for details. </p> 959 1.1 tron 960 1.1 tron </ul> 961 1.1 tron 962 1.1 tron <h3> <a name="turnoff"> Turning off postscreen(8) </a> </h3> 963 1.1 tron 964 1.1 tron <p> To turn off <a href="postscreen.8.html">postscreen(8)</a> and handle mail directly with Postfix 965 1.1 tron SMTP server processes: </p> 966 1.1 tron 967 1.1 tron <ol> 968 1.1 tron 969 1.1 tron <li> <p> Comment out the "<tt>smtp inet ... postscreen</tt>" service 970 1.1 tron in <a href="master.5.html">master.cf</a>, including any "<tt>-o parameter=value</tt>" entries 971 1.1 tron that follow. </p> 972 1.1 tron 973 1.1 tron <pre> 974 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 975 1.1 tron #smtp inet n - n - 1 postscreen 976 1.1 tron # -o parameter=value ... 977 1.1 tron </pre> 978 1.1 tron 979 1.1 tron <li> <p> Comment out the "<tt>dnsblog unix ... dnsblog</tt>" service 980 1.1 tron in <a href="master.5.html">master.cf</a>. </p> 981 1.1 tron 982 1.1 tron <pre> 983 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 984 1.1 tron #dnsblog unix - - n - 0 dnsblog 985 1.1 tron </pre> 986 1.1 tron 987 1.1 tron <li> <p> Comment out the "<tt>smtpd pass ... smtpd</tt>" service 988 1.1 tron in <a href="master.5.html">master.cf</a>, including any "<tt>-o parameter=value</tt>" entries 989 1.1 tron that follow. </p> 990 1.1 tron 991 1.1 tron <pre> 992 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 993 1.1 tron #smtpd pass - - n - - smtpd 994 1.1 tron # -o parameter=value ... 995 1.1 tron </pre> 996 1.1 tron 997 1.1 tron <li> <p> Comment out the "<tt>tlsproxy unix ... tlsproxy</tt>" 998 1.1 tron service in <a href="master.5.html">master.cf</a>, including any "<tt>-o parameter=value</tt>" 999 1.1 tron entries that follow. </p> 1000 1.1 tron 1001 1.1 tron <pre> 1002 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 1003 1.1 tron #tlsproxy unix - - n - 0 tlsproxy 1004 1.1 tron # -o parameter=value ... 1005 1.1 tron </pre> 1006 1.1 tron 1007 1.1 tron <li> <p> Uncomment the "<tt>smtp inet ... smtpd</tt>" service in 1008 1.1 tron <a href="master.5.html">master.cf</a>, including any "<tt>-o parameter=value</tt>" entries that 1009 1.1 tron may follow. </p> 1010 1.1 tron 1011 1.1 tron <pre> 1012 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 1013 1.1 tron smtp inet n - n - - smtpd 1014 1.1 tron -o parameter=value ... 1015 1.1 tron </pre> 1016 1.1 tron 1017 1.1 tron <li> <p> Read the new configuration with "<tt>postfix reload</tt>". 1018 1.1 tron </p> 1019 1.1 tron 1020 1.1 tron </ol> 1021 1.1 tron 1022 1.1 tron <h2> <a name="historical"> Historical notes and credits </a> </h2> 1023 1.1 tron 1024 1.1 tron <p> Many ideas in <a href="postscreen.8.html">postscreen(8)</a> were explored in earlier work by 1025 1.1 tron Michael Tokarev, in OpenBSD spamd, and in MailChannels Traffic 1026 1.1 tron Control. </p> 1027 1.1 tron 1028 1.1 tron <p> Wietse threw together a crude prototype with pregreet and dnsbl 1029 1.1 tron support in June 2009, because he needed something new for a Mailserver 1030 1.1 tron conference presentation in July. Ralf Hildebrandt ran this code on 1031 1.1 tron several servers to collect real-world statistics. This version used 1032 1.1 tron the <a href="dnsblog.8.html">dnsblog(8)</a> ad-hoc DNS client program. </p> 1033 1.1 tron 1034 1.1 tron <p> Wietse needed new material for a LISA conference presentation 1035 1.1 tron in November 2010, so he added support for DNSBL weights and filters 1036 1.1 tron in August, followed by a major code rewrite, deep protocol tests, 1037 1.1 tron helo/sender/recipient logging, and stress-adaptive behavior in 1038 1.1 tron September. Ralf Hildebrandt ran this code on several servers to 1039 1.1 tron collect real-world statistics. This version still used the embarrassing 1040 1.1 tron <a href="dnsblog.8.html">dnsblog(8)</a> ad-hoc DNS client program. </p> 1041 1.1 tron 1042 1.1 tron <p> Wietse added STARTTLS support in December 2010. This makes 1043 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> usable for sites that require TLS support. The 1044 1.1 tron implementation introduces the <a href="tlsproxy.8.html">tlsproxy(8)</a> event-driven TLS proxy 1045 1.1 tron that decrypts/encrypts the sessions for multiple SMTP clients. </p> 1046 1.1 tron 1047 1.1 tron </body> 1048 1.1 tron 1049 1.1 tron </html> 1050 1.1 tron 1051
Indexes created Sun Jun 07 00:24:08 UTC 2026