POSTSCREEN_README.html revision 1.1.1.3
1 1.1 tron <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" 2 1.1 tron "http://www.w3.org/TR/html4/loose.dtd"> 3 1.1 tron 4 1.1 tron <head> 5 1.1 tron 6 1.1 tron <title>Postfix Postscreen Howto</title> 7 1.1 tron 8 1.1 tron <meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> 9 1.1 tron 10 1.1 tron </head> 11 1.1 tron 12 1.1 tron <body> 13 1.1 tron 14 1.1 tron <h1><img src="postfix-logo.jpg" width="203" height="98" ALT="">Postfix Postscreen Howto</h1> 15 1.1 tron 16 1.1 tron <hr> 17 1.1 tron 18 1.1 tron <h2> <a name="intro">Introduction</a> </h2> 19 1.1 tron 20 1.1.1.3 tron <p> This document describes features that are available in Postfix 21 1.1.1.3 tron 2.8 and later. </p> 22 1.1.1.3 tron 23 1.1.1.3 tron <p> The Postfix <a href="postscreen.8.html">postscreen(8)</a> daemon provides additional protection 24 1.1.1.3 tron against mail server overload. One <a href="postscreen.8.html">postscreen(8)</a> process handles 25 1.1.1.3 tron multiple inbound SMTP connections, and decides which clients may 26 1.1.1.3 tron talk to a Postfix SMTP server process. By keeping spambots away, 27 1.1.1.3 tron <a href="postscreen.8.html">postscreen(8)</a> leaves more SMTP server processes available for 28 1.1.1.3 tron legitimate clients, and delays the onset of <a 29 1.1.1.3 tron href="STRESS_README.html">server overload</a> conditions. </p> 30 1.1.1.3 tron 31 1.1.1.3 tron <p> <a href="postscreen.8.html">postscreen(8)</a> should not be used on SMTP ports that receive 32 1.1.1.3 tron mail from end-user clients (MUAs). In a typical deployment, 33 1.1.1.3 tron <a href="postscreen.8.html">postscreen(8)</a> handles the MX service on TCP port 25, while MUA 34 1.1.1.3 tron clients submit mail via the submission service on TCP port 587 which 35 1.1.1.3 tron requires client authentication. Alternatively, a site could set up 36 1.1.1.3 tron a dedicated, non-postscreen, "port 25" server that provides submission 37 1.1.1.3 tron service and client authentication, but no MX service. </p> 38 1.1 tron 39 1.1.1.2 tron <p> <a href="postscreen.8.html">postscreen(8)</a> maintains a temporary whitelist for clients that 40 1.1.1.2 tron pass its tests; by allowing whitelisted clients to skip tests, 41 1.1.1.2 tron <a href="postscreen.8.html">postscreen(8)</a> minimizes its impact on legitimate email traffic. 42 1.1.1.2 tron </p> 43 1.1.1.2 tron 44 1.1 tron <p> <a href="postscreen.8.html">postscreen(8)</a> is part of a multi-layer defense. <p> 45 1.1 tron 46 1.1 tron <ul> 47 1.1 tron 48 1.1 tron <li> <p> As the first layer, <a href="postscreen.8.html">postscreen(8)</a> blocks connections from 49 1.1 tron zombies and other spambots that are responsible for about 90% of 50 1.1 tron all spam. It is implemented as a single process to make this defense 51 1.1.1.3 tron as inexpensive as possible. </p> 52 1.1 tron 53 1.1 tron <li> <p> The second layer implements more complex SMTP-level access 54 1.1.1.3 tron checks with <a href="SMTPD_ACCESS_README.html">Postfix SMTP servers</a>, 55 1.1.1.3 tron <a href="SMTPD_POLICY_README.html">policy daemons</a>, and 56 1.1.1.3 tron <a href="MILTER_README.html">Milter applications</a>. </p> 57 1.1 tron 58 1.1 tron <li> <p> The third layer performs light-weight content inspection 59 1.1 tron with the Postfix built-in <a href="postconf.5.html#header_checks">header_checks</a> and <a href="postconf.5.html#body_checks">body_checks</a>. This can 60 1.1 tron block unacceptable attachments such as executable programs, and 61 1.1 tron worms or viruses with easy-to-recognize signatures. </p> 62 1.1 tron 63 1.1 tron <li> <p> The fourth layer provides heavy-weight content inspection 64 1.1.1.3 tron with external content filters. Typical examples are <a 65 1.1.1.3 tron href="http://www.ijs.si/software/amavisd/">Amavisd-new</a>, <a 66 1.1.1.3 tron href="http://spamassassin.apache.org/">SpamAssassin</a>, and <a 67 1.1.1.3 tron href="MILTER_README.html">Milter applications</a>. </p> 68 1.1 tron 69 1.1 tron </ul> 70 1.1 tron 71 1.1 tron <p> Each layer reduces the spam volume. The general strategy is to 72 1.1 tron use the less expensive defenses first, and to use the more expensive 73 1.1.1.2 tron defenses only for the spam that remains. </p> 74 1.1 tron 75 1.1 tron <p> Topics in this document: </p> 76 1.1 tron 77 1.1 tron <ul> 78 1.1 tron 79 1.1 tron <li> <a href="#intro">Introduction</a> 80 1.1 tron 81 1.1 tron <li> <a href="#basic">The basic idea behind postscreen(8)</a> 82 1.1 tron 83 1.1 tron <li> <a href="#general"> General operation </a> 84 1.1 tron 85 1.1 tron <li> <a href="#quick">Quick tests before everything else</a> 86 1.1 tron 87 1.1 tron <li> <a href="#before_220"> Tests before the 220 SMTP server greeting </a> 88 1.1 tron 89 1.1 tron <li> <a href="#after_220">Tests after the 220 SMTP server greeting</a> 90 1.1 tron 91 1.1 tron <li> <a href="#other_error">Other errors</a> 92 1.1 tron 93 1.1 tron <li> <a href="#victory">When all tests succeed</a> 94 1.1 tron 95 1.1 tron <li> <a href="#config"> Configuring the postscreen(8) service</a> 96 1.1 tron 97 1.1 tron <li> <a href="#historical"> Historical notes and credits </a> 98 1.1 tron 99 1.1 tron </ul> 100 1.1 tron 101 1.1 tron <h2> <a name="basic">The basic idea behind postscreen(8)</a> </h2> 102 1.1 tron 103 1.1 tron <p> Most email is spam, and most spam is sent out by zombies (malware 104 1.1 tron on compromised end-user computers). Wietse expects that the zombie 105 1.1 tron problem will get worse before things improve, if ever. Without a 106 1.1 tron tool like <a href="postscreen.8.html">postscreen(8)</a> that keeps the zombies away, Postfix would be 107 1.1 tron spending most of its resources not receiving email. </p> 108 1.1 tron 109 1.1 tron <p> The main challenge for <a href="postscreen.8.html">postscreen(8)</a> is to make an is-it-a-zombie 110 1.1 tron decision based on a single measurement. This is necessary because 111 1.1.1.2 tron many zombies try to fly under the radar and avoid spamming the same 112 1.1.1.2 tron site repeatedly. Once <a href="postscreen.8.html">postscreen(8)</a> decides that a client is 113 1.1.1.2 tron not-a-zombie, it whitelists the client temporarily to avoid further 114 1.1.1.2 tron delays for legitimate mail. </p> 115 1.1 tron 116 1.1 tron <p> Zombies have challenges too: they have only a limited amount 117 1.1 tron of time to deliver spam before their IP address becomes blacklisted. 118 1.1 tron To speed up spam deliveries, zombies make compromises in their SMTP 119 1.1 tron protocol implementation. For example, they speak before their turn, 120 1.1 tron or they ignore responses from SMTP servers and continue sending 121 1.1 tron mail even when the server tells them to go away. </p> 122 1.1 tron 123 1.1 tron <p> <a href="postscreen.8.html">postscreen(8)</a> uses a variety of measurements to recognize 124 1.1 tron zombies. First, <a href="postscreen.8.html">postscreen(8)</a> determines if the remote SMTP client 125 1.1 tron IP address is blacklisted. Second, <a href="postscreen.8.html">postscreen(8)</a> looks for protocol 126 1.1 tron compromises that are made to speed up delivery. These are good 127 1.1 tron indicators for making is-it-a-zombie decisions based on single 128 1.1 tron measurements. </p> 129 1.1 tron 130 1.1 tron <p> <a href="postscreen.8.html">postscreen(8)</a> does not inspect message content. Message content 131 1.1 tron can vary from one delivery to the next, especially with clients 132 1.1 tron that (also) send legitimate email. Content is not a good indicator 133 1.1 tron for making is-it-a-zombie decisions based on single measurements, 134 1.1 tron and that is the problem that <a href="postscreen.8.html">postscreen(8)</a> is focused on. </p> 135 1.1 tron 136 1.1 tron <h2> <a name="general"> General operation </a> </h2> 137 1.1 tron 138 1.1.1.3 tron <p> For each connection from an SMTP client, <a href="postscreen.8.html">postscreen(8)</a> performs 139 1.1.1.3 tron a number of tests 140 1.1 tron in the order as described below. Some tests introduce a delay of 141 1.1.1.2 tron a few seconds. <a href="postscreen.8.html">postscreen(8)</a> maintains a temporary whitelist for 142 1.1.1.2 tron clients that pass its tests; by allowing whitelisted clients to 143 1.1.1.2 tron skip tests, <a href="postscreen.8.html">postscreen(8)</a> minimizes its impact on legitimate email 144 1.1.1.2 tron traffic. </p> 145 1.1.1.2 tron 146 1.1.1.2 tron <p> By default, <a href="postscreen.8.html">postscreen(8)</a> hands off all connections to a Postfix 147 1.1.1.2 tron SMTP server process after logging its findings. This mode is useful 148 1.1.1.2 tron for non-destructive testing. </p> 149 1.1 tron 150 1.1 tron <p> In a typical production setting, <a href="postscreen.8.html">postscreen(8)</a> is configured 151 1.1 tron to reject mail from clients that fail one or more tests, after 152 1.1 tron logging the helo, sender and recipient information. </p> 153 1.1 tron 154 1.1 tron <p> Note: <a href="postscreen.8.html">postscreen(8)</a> is not an SMTP proxy; this is intentional. 155 1.1 tron The purpose is to keep zombies away from Postfix, with minimal 156 1.1 tron overhead for legitimate clients. </p> 157 1.1 tron 158 1.1 tron <h2> <a name="quick">Quick tests before everything else</a> </h2> 159 1.1 tron 160 1.1 tron <p> Before engaging in SMTP-level tests. <a href="postscreen.8.html">postscreen(8)</a> queries a 161 1.1 tron number of local black and whitelists. These tests speed up the 162 1.1 tron handling of known clients. </p> 163 1.1 tron 164 1.1 tron <ul> 165 1.1 tron 166 1.1 tron <li> <a href="#perm_white_black"> Permanent white/blacklist test </a> 167 1.1 tron 168 1.1 tron <li> <a href="#temp_white"> Temporary whitelist test </a> 169 1.1 tron 170 1.1.1.2 tron <li> <a href="#white_veto"> MX Policy test </a> 171 1.1.1.2 tron 172 1.1 tron </ul> 173 1.1 tron 174 1.1 tron <h3> <a name="perm_white_black"> Permanent white/blacklist test </a> </h3> 175 1.1 tron 176 1.1 tron <p> The <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> parameter (default: <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>) 177 1.1 tron specifies a permanent access list for SMTP client IP addresses. Typically 178 1.1 tron one would specify something that whitelists local networks, followed 179 1.1 tron by a CIDR table for selective white- and blacklisting. </p> 180 1.1 tron 181 1.1 tron <p> Example: </p> 182 1.1 tron 183 1.1 tron <pre> 184 1.1 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 185 1.1 tron <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, 186 1.1 tron <a href="cidr_table.5.html">cidr</a>:/etc/postfix/postscreen_access.cidr 187 1.1 tron 188 1.1 tron /etc/postfix/postscreen_access.<a href="cidr_table.5.html">cidr</a>: 189 1.1 tron # Rules are evaluated in the order as specified. 190 1.1 tron # Blacklist 192.168.* except 192.168.0.1. 191 1.1 tron 192.168.0.1 permit 192 1.1 tron 192.168.0.0/16 reject 193 1.1 tron </pre> 194 1.1 tron 195 1.1 tron <p> See the <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> manpage documentation for more 196 1.1 tron details. </p> 197 1.1 tron 198 1.1 tron <p> When the SMTP client address matches a "permit" action, 199 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> logs this with the client address and port number as: 200 1.1 tron </p> 201 1.1 tron 202 1.1 tron <pre> 203 1.1 tron <b>WHITELISTED</b> <i>[address]:port</i> 204 1.1 tron </pre> 205 1.1 tron 206 1.1 tron <p> The whitelist action is not configurable: immediately hand off the 207 1.1 tron connection to a Postfix SMTP server process. </p> 208 1.1 tron 209 1.1 tron <p> When the SMTP client address matches a "reject" action, 210 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> logs this with the client address and port number as: 211 1.1 tron </p> 212 1.1 tron 213 1.1 tron <pre> 214 1.1 tron <b>BLACKLISTED</b> <i>[address]:port</i> 215 1.1 tron </pre> 216 1.1 tron 217 1.1 tron <p> The <a href="postconf.5.html#postscreen_blacklist_action">postscreen_blacklist_action</a> parameter specifies the action 218 1.1 tron that is taken next. See "<a href="#fail_before_220">When tests 219 1.1 tron fail before the 220 SMTP server greeting</a>" below. </p> 220 1.1 tron 221 1.1 tron <h3> <a name="temp_white"> Temporary whitelist test </a> </h3> 222 1.1 tron 223 1.1 tron <p> The <a href="postscreen.8.html">postscreen(8)</a> daemon maintains a <i>temporary</i> 224 1.1 tron whitelist for SMTP client IP addresses that have passed all 225 1.1 tron the tests described below. The <a href="postconf.5.html#postscreen_cache_map">postscreen_cache_map</a> parameter 226 1.1 tron specifies the location of the temporary whitelist. The 227 1.1 tron temporary whitelist is not used for SMTP client addresses 228 1.1.1.2 tron that appear on the <i>permanent</i> access list. </p> 229 1.1.1.2 tron 230 1.1.1.3 tron <blockquote> 231 1.1.1.3 tron 232 1.1.1.3 tron <p> NOTE: To share a <a href="postscreen.8.html">postscreen(8)</a> cache between multiple 233 1.1.1.3 tron <a href="postscreen.8.html">postscreen(8)</a> instances under the same <a href="master.8.html">master(8)</a> daemon, use 234 1.1.1.3 tron "<tt><a href="postconf.5.html#postscreen_cache_map">postscreen_cache_map</a> = 235 1.1.1.3 tron <a href="proxymap.8.html">proxy</a>:btree:$<a href="postconf.5.html#data_directory">data_directory</a>/postscreen_cache</tt>", and disable 236 1.1.1.3 tron cache cleanup (<a href="postconf.5.html#postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a> = 0) in all 237 1.1.1.3 tron <a href="postscreen.8.html">postscreen(8)</a> instances except one that is responsible for cache 238 1.1.1.3 tron cleanup. </p> 239 1.1.1.3 tron 240 1.1.1.3 tron <p> <a href="postscreen.8.html">postscreen(8)</a> cache sharing requires Postfix 2.9 or later; 241 1.1.1.3 tron earlier <a href="proxymap.8.html">proxymap(8)</a> implementations don't support cache cleanup. 242 1.1.1.3 tron </p> 243 1.1.1.3 tron 244 1.1.1.3 tron <p> For an alternative <a href="postscreen.8.html">postscreen(8)</a> cache sharing approach, 245 1.1.1.3 tron see the <a href="memcache_table.5.html">memcache_table(5)</a> manpage. </p> 246 1.1.1.3 tron 247 1.1.1.3 tron </blockquote> 248 1.1 tron 249 1.1 tron <p> When the SMTP client address appears on the temporary 250 1.1 tron whitelist, <a href="postscreen.8.html">postscreen(8)</a> logs this with the client address and port 251 1.1 tron number as: </p> 252 1.1 tron 253 1.1 tron <pre> 254 1.1 tron <b>PASS OLD</b> <i>[address]:port</i> 255 1.1 tron </pre> 256 1.1 tron 257 1.1 tron <p> The action is not configurable: immediately hand off the 258 1.1 tron connection to a Postfix SMTP server process. The client is 259 1.1 tron excluded from further tests until its temporary whitelist 260 1.1 tron entry expires, as controlled with the postscreen_*_ttl 261 1.1 tron parameters. Expired entries are silently renewed if possible. </p> 262 1.1 tron 263 1.1.1.2 tron <h3> <a name="white_veto"> MX Policy test </a> </h3> 264 1.1.1.2 tron 265 1.1.1.2 tron <p> When the remote SMTP client is not on the static access list 266 1.1.1.2 tron or temporary whitelist, <a href="postscreen.8.html">postscreen(8)</a> can implement a number of 267 1.1.1.2 tron whitelist tests, before it grants the client a temporary whitelist 268 1.1.1.2 tron status that allows it to talk to a Postfix SMTP server process. </p> 269 1.1.1.2 tron 270 1.1.1.3 tron <p> When <a href="postscreen.8.html">postscreen(8)</a> is configured to monitor all primary and 271 1.1.1.3 tron backup MX addresses, it can refuse to whitelist clients that connect 272 1.1.1.3 tron to a backup MX address only (an old spammer trick to take advantage 273 1.1.1.3 tron of backup MX hosts with weaker anti-spam policies than primary MX 274 1.1.1.2 tron hosts). </p> 275 1.1.1.2 tron 276 1.1.1.3 tron <blockquote> <p> NOTE: The following solution is for small sites. 277 1.1.1.3 tron Larger sites would have to share the <a href="postscreen.8.html">postscreen(8)</a> cache between 278 1.1.1.3 tron primary and backup MTAs, which would introduce a common point of 279 1.1.1.3 tron failure. </p> </blockquote> 280 1.1.1.3 tron 281 1.1.1.2 tron <ul> 282 1.1.1.2 tron 283 1.1.1.2 tron <li> <p> First, configure the host to listen on both primary and 284 1.1.1.2 tron backup MX addresses. Use the appropriate <tt>ifconfig</tt> command 285 1.1.1.2 tron for the local operating system, or update the appropriate configuration 286 1.1.1.2 tron files and "refresh" the network protocol stack. </p> 287 1.1.1.2 tron 288 1.1.1.3 tron <p> <p> Second, configure Postfix to listen on the new IP address 289 1.1.1.3 tron (this step is needed when you have specified <a href="postconf.5.html#inet_interfaces">inet_interfaces</a> in 290 1.1.1.3 tron <a href="postconf.5.html">main.cf</a>). </p> 291 1.1.1.3 tron 292 1.1.1.2 tron <li> <p> Then, configure <a href="postscreen.8.html">postscreen(8)</a> to deny the temporary whitelist 293 1.1.1.2 tron status on the backup MX address(es). An example for Wietse's 294 1.1.1.2 tron server is: </p> 295 1.1.1.2 tron 296 1.1.1.2 tron <pre> 297 1.1.1.2 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 298 1.1.1.2 tron <a href="postconf.5.html#postscreen_whitelist_interfaces">postscreen_whitelist_interfaces</a> = !168.100.189.8 <a href="DATABASE_README.html#types">static</a>:all 299 1.1.1.2 tron </pre> 300 1.1.1.2 tron 301 1.1.1.2 tron <p> Translation: allow clients to obtain the temporary whitelist 302 1.1.1.2 tron status on all server IP addresses except 168.100.189.8, which is a 303 1.1.1.2 tron backup MX address. </p> 304 1.1.1.2 tron 305 1.1.1.2 tron </ul> 306 1.1.1.2 tron 307 1.1.1.2 tron <p> When a non-whitelisted client connects the backup MX address, 308 1.1.1.2 tron <a href="postscreen.8.html">postscreen(8)</a> logs this with the client address and port number as: 309 1.1.1.2 tron </p> 310 1.1.1.2 tron 311 1.1.1.2 tron <pre> 312 1.1.1.2 tron <b>CONNECT from</b> <i>[address]:port</i> <b>to [168.100.189.8]:25</b> 313 1.1.1.2 tron <b>WHITELIST VETO</b> <i>[address]:port</i> 314 1.1.1.2 tron </pre> 315 1.1.1.2 tron 316 1.1.1.2 tron <p> Translation: the client at <i>[address]:port</i> connected to 317 1.1.1.2 tron the backup MX address 168.100.189.8 while it was not whitelisted. 318 1.1.1.2 tron The client will not be granted the temporary whitelist status, even 319 1.1.1.2 tron if passes all the whitelist tests described below. </p> 320 1.1.1.2 tron 321 1.1 tron <h2> <a name="before_220"> Tests before the 220 SMTP server greeting </a> </h2> 322 1.1 tron 323 1.1 tron <p> The <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> parameter specifies a short time 324 1.1 tron interval before the "220 <i>text</i>..." server greeting, where 325 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> can run a number of tests in parallel. </p> 326 1.1 tron 327 1.1 tron <p> When a good client passes these tests, and no "<a 328 1.1 tron href="#after_220">deep protocol tests</a>" are configured, postscreen(8) 329 1.1 tron adds the client to the temporary whitelist and hands off the "live" 330 1.1 tron connection to a Postfix SMTP server process. The client can then 331 1.1 tron continue as if <a href="postscreen.8.html">postscreen(8)</a> never even existed (except of course 332 1.1 tron for the short <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> delay). </p> 333 1.1 tron 334 1.1 tron <ul> 335 1.1 tron 336 1.1 tron <li> <a href="#pregreet"> Pregreet test </a> 337 1.1 tron 338 1.1 tron <li> <a href="#dnsbl"> DNS White/blacklist test </a> 339 1.1 tron 340 1.1 tron <li> <a href="#fail_before_220">When tests fail before the 220 SMTP server greeting</a> 341 1.1 tron 342 1.1 tron </ul> 343 1.1 tron 344 1.1 tron <h3> <a name="pregreet"> Pregreet test </a> </h3> 345 1.1 tron 346 1.1 tron <p> The SMTP protocol is a classic example of a protocol where the 347 1.1 tron server speaks before the client. <a href="postscreen.8.html">postscreen(8)</a> detects zombies 348 1.1 tron that are in a hurry and that speak before their turn. This test is 349 1.1 tron enabled by default. </p> 350 1.1 tron 351 1.1 tron <p> The <a href="postconf.5.html#postscreen_greet_banner">postscreen_greet_banner</a> parameter specifies the <i>text</i> 352 1.1 tron portion of a "220-<i>text</i>..." teaser banner (default: $<a href="postconf.5.html#smtpd_banner">smtpd_banner</a>). 353 1.1 tron Note that this becomes the first part of a multi-line server greeting. 354 1.1 tron The <a href="postscreen.8.html">postscreen(8)</a> daemon sends this before the <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> 355 1.1 tron timer is started. The purpose of the teaser banner is to confuse 356 1.1 tron zombies so that they speak before their turn. It has no effect on 357 1.1 tron SMTP clients that correctly implement the protocol. </p> 358 1.1 tron 359 1.1 tron <p> To avoid problems with poorly-implemented SMTP engines in network 360 1.1 tron appliances or network testing tools, either exclude them from all 361 1.1 tron tests with the <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> feature or else specify 362 1.1 tron an empty teaser banner: </p> 363 1.1 tron 364 1.1 tron <pre> 365 1.1 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 366 1.1 tron # Exclude broken clients by whitelisting. Clients in <a href="postconf.5.html#mynetworks">mynetworks</a> 367 1.1 tron # should always be whitelisted. 368 1.1 tron <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, 369 1.1 tron <a href="cidr_table.5.html">cidr</a>:/etc/postfix/postscreen_access.cidr 370 1.1 tron 371 1.1 tron /etc/postfix/postscreen_access.<a href="cidr_table.5.html">cidr</a>: 372 1.1 tron 192.168.254.0/24 permit 373 1.1 tron </pre> 374 1.1 tron 375 1.1 tron <pre> 376 1.1 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 377 1.1 tron # Disable the teaser banner (try whitelisting first if you can). 378 1.1 tron <a href="postconf.5.html#postscreen_greet_banner">postscreen_greet_banner</a> = 379 1.1 tron </pre> 380 1.1 tron 381 1.1 tron <p> When an SMTP client sends a command before the 382 1.1 tron <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> time has elapsed, <a href="postscreen.8.html">postscreen(8)</a> logs this as: 383 1.1 tron </p> 384 1.1 tron 385 1.1 tron <pre> 386 1.1 tron <b>PREGREET</b> <i>count</i> <b>after</b> <i>time</i> <b>from</b> <i>[address]:port text...</i> 387 1.1 tron </pre> 388 1.1 tron 389 1.1 tron <p> Translation: the client at <i>[address]:port</i> sent <i>count</i> 390 1.1 tron bytes before its turn to speak. This happened <i>time</i> seconds 391 1.1 tron after the <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> timer was started. The <i>text</i> 392 1.1 tron is what the client sent (truncated to 100 bytes, and with non-printable 393 1.1 tron characters replaced with C-style escapes such as \r for carriage-return 394 1.1 tron and \n for newline). </p> 395 1.1 tron 396 1.1 tron <p> The <a href="postconf.5.html#postscreen_greet_action">postscreen_greet_action</a> parameter specifies the action that 397 1.1 tron is taken next. See "<a href="#fail_before_220">When tests fail 398 1.1 tron before the 220 SMTP server greeting</a>" below. </p> 399 1.1 tron 400 1.1 tron <h3> <a name="dnsbl"> DNS White/blacklist test </a> </h3> 401 1.1 tron 402 1.1 tron <p> The <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> parameter (default: empty) specifies 403 1.1 tron a list of DNS blocklist servers with optional filters and weight 404 1.1 tron factors (positive weights for blacklisting, negative for whitelisting). 405 1.1 tron These servers will be queried in parallel with the reverse client 406 1.1 tron IP address. This test is disabled by default. </p> 407 1.1 tron 408 1.1 tron <blockquote> 409 1.1 tron <p> 410 1.1 tron CAUTION: when postscreen rejects mail, its SMTP reply contains the 411 1.1 tron DNSBL domain name. Use the <a href="postconf.5.html#postscreen_dnsbl_reply_map">postscreen_dnsbl_reply_map</a> feature to 412 1.1 tron hide "password" information in DNSBL domain names. 413 1.1 tron </p> 414 1.1 tron </blockquote> 415 1.1 tron 416 1.1 tron <p> When the <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> time has elapsed, and the combined 417 1.1 tron DNSBL score is equal to or greater than the <a href="postconf.5.html#postscreen_dnsbl_threshold">postscreen_dnsbl_threshold</a> 418 1.1 tron parameter value, <a href="postscreen.8.html">postscreen(8)</a> logs this as: </p> 419 1.1 tron 420 1.1 tron <pre> 421 1.1 tron <b>DNSBL rank</b> <i>count</i> <b>for</b> <i>[address]:port</i> 422 1.1 tron </pre> 423 1.1 tron 424 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> has a combined 425 1.1 tron DNSBL score of <i>count</i>. </p> 426 1.1 tron 427 1.1 tron <p> The <a href="postconf.5.html#postscreen_dnsbl_action">postscreen_dnsbl_action</a> parameter specifies the action that 428 1.1 tron is taken when the combined DNSBL score is equal to or greater than 429 1.1 tron the threshold. See "<a href="#fail_before_220">When tests fail 430 1.1 tron before the 220 SMTP server greeting</a>" below. </p> 431 1.1 tron 432 1.1 tron <h3> <a name="fail_before_220">When tests fail before the 220 SMTP server greeting</a> </h3> 433 1.1 tron 434 1.1 tron <p> When the client address matches the permanent blacklist, or 435 1.1 tron when the client fails the pregreet or DNSBL tests, the action is 436 1.1 tron specified with <a href="postconf.5.html#postscreen_blacklist_action">postscreen_blacklist_action</a>, <a href="postconf.5.html#postscreen_greet_action">postscreen_greet_action</a>, 437 1.1 tron or <a href="postconf.5.html#postscreen_dnsbl_action">postscreen_dnsbl_action</a>, respectively. </p> 438 1.1 tron 439 1.1 tron <dl> 440 1.1 tron 441 1.1 tron <dt> <b>ignore</b> (default) </dt> 442 1.1 tron 443 1.1 tron <dd> Ignore the failure of this test. Allow other tests to complete. 444 1.1 tron Repeat this test the next time the client connects. This option 445 1.1 tron is useful for testing and collecting statistics without blocking 446 1.1 tron mail. </dd> 447 1.1 tron 448 1.1 tron <dt> <b>enforce</b> </dt> 449 1.1 tron 450 1.1 tron <dd> Allow other tests to complete. Reject attempts to deliver mail 451 1.1 tron with a 550 SMTP reply, and log the helo/sender/recipient information. 452 1.1 tron Repeat this test the next time the client connects. </dd> 453 1.1 tron 454 1.1 tron <dt> <b>drop</b> </dt> 455 1.1 tron 456 1.1 tron <dd> Drop the connection immediately with a 521 SMTP reply. Repeat 457 1.1 tron this test the next time the client connects. </dd> 458 1.1 tron 459 1.1 tron </dl> 460 1.1 tron 461 1.1 tron <h2> <a name="after_220">Tests after the 220 SMTP server greeting</a> </h2> 462 1.1 tron 463 1.1 tron <p> In this phase of the protocol, <a href="postscreen.8.html">postscreen(8)</a> implements a 464 1.1 tron number of "deep protocol" tests. These tests use an SMTP protocol 465 1.1 tron engine that is built into the <a href="postscreen.8.html">postscreen(8)</a> server. </p> 466 1.1 tron 467 1.1 tron <p> Important note: deep protocol tests are disabled by default. 468 1.1 tron They are more intrusive than the pregreet and DNSBL tests, and they 469 1.1 tron have limitations as discussed next. </p> 470 1.1 tron 471 1.1 tron <ul> 472 1.1 tron 473 1.1 tron <li> <p> When a good client passes the <a href="#after_220">deep 474 1.1 tron protocol tests</a>, postscreen(8) adds the client to the temporary 475 1.1 tron whitelist but it cannot hand off the "live" connection to a Postfix 476 1.1 tron SMTP server process in the middle of the session. Instead, <a href="postscreen.8.html">postscreen(8)</a> 477 1.1 tron defers mail delivery attempts with a 4XX status, logs the 478 1.1 tron helo/sender/recipient information, and waits for the client to 479 1.1 tron disconnect. </p> 480 1.1 tron 481 1.1 tron <p> The next time the client connects it will be allowed to talk 482 1.1 tron to a Postfix SMTP server process to deliver its mail. To minimize the 483 1.1 tron impact of this limitation, <a href="postscreen.8.html">postscreen(8)</a> gives deep protocol tests 484 1.1 tron a relatively long expiration time. </p> 485 1.1 tron 486 1.1 tron <li> <p> <a href="postscreen.8.html">postscreen(8)</a>'s built-in SMTP engine does not implement 487 1.1 tron the AUTH, XCLIENT, and XFORWARD features. AUTH support may be added 488 1.1 tron in a future version. In the mean time, if you need to make these 489 1.1 tron services available on port 25, then do not enable the tests after 490 1.1 tron the 220 server greeting. </p> 491 1.1 tron 492 1.1 tron </ul> 493 1.1 tron 494 1.1 tron <p> End-user clients should connect directly to the submission 495 1.1 tron service, so that they never have to deal with <a href="postscreen.8.html">postscreen(8)</a>'s tests. 496 1.1 tron </p> 497 1.1 tron 498 1.1 tron <ul> 499 1.1 tron 500 1.1 tron <li> <a href="#pipelining">Command pipelining test</a> 501 1.1 tron 502 1.1 tron <li> <a href="#non_smtp">Non-SMTP command test</a> 503 1.1 tron 504 1.1 tron <li> <a href="#barelf">Bare newline test</a> 505 1.1 tron 506 1.1 tron <li> <a href="#fail_after_220">When tests fail after the 220 SMTP server greeting</a> 507 1.1 tron 508 1.1 tron </ul> 509 1.1 tron 510 1.1 tron <h3> <a name="pipelining">Command pipelining test</a> </h3> 511 1.1 tron 512 1.1 tron <p> By default, SMTP is a half-duplex protocol: the sender and 513 1.1 tron receiver send one command and one response at a time. Unlike the 514 1.1 tron Postfix SMTP server, <a href="postscreen.8.html">postscreen(8)</a> does not announce support 515 1.1 tron for ESMTP command pipelining. Therefore, clients are not allowed 516 1.1 tron to send multiple commands. postscreen(8)'s <a href="#after_220">deep 517 1.1 tron protocol test</a> for this is disabled by default. </p> 518 1.1 tron 519 1.1 tron <p> With "<a href="postconf.5.html#postscreen_pipelining_enable">postscreen_pipelining_enable</a> = yes", <a href="postscreen.8.html">postscreen(8)</a> detects 520 1.1 tron zombies that send multiple commands, instead of sending one command 521 1.1 tron and waiting for the server to reply. </p> 522 1.1 tron 523 1.1 tron <p> This test is opportunistically enabled when <a href="postscreen.8.html">postscreen(8)</a> has 524 1.1 tron to use the built-in SMTP engine anyway. This is to make <a href="postscreen.8.html">postscreen(8)</a> 525 1.1 tron logging more informative. </p> 526 1.1 tron 527 1.1 tron <p> When a client sends multiple commands, <a href="postscreen.8.html">postscreen(8)</a> logs this 528 1.1 tron as: </p> 529 1.1 tron 530 1.1 tron <pre> 531 1.1.1.2 tron <b>COMMAND PIPELINING from</b> <i>[address]:port</i> <b>after</b> <i>command</i>: <i>text</i> 532 1.1 tron </pre> 533 1.1 tron 534 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> sent 535 1.1 tron multiple SMTP commands, instead of sending one command and then 536 1.1 tron waiting for the server to reply. This happened after the client 537 1.1.1.2 tron sent <i>command</i>. The <i>text</i> shows part of the input that 538 1.1.1.2 tron was sent too early; it is not logged with Postfix 2.8. </p> 539 1.1 tron 540 1.1 tron <p> The <a href="postconf.5.html#postscreen_pipelining_action">postscreen_pipelining_action</a> parameter specifies the action 541 1.1 tron that is taken next. See "<a href="#fail_after_220">When tests fail 542 1.1 tron after the 220 SMTP server greeting</a>" below. </p> 543 1.1 tron 544 1.1 tron <h3> <a name="non_smtp">Non-SMTP command test</a> </h3> 545 1.1 tron 546 1.1 tron <p> Some spambots send their mail through open proxies. A symptom 547 1.1 tron of this is the usage of commands such as CONNECT and other non-SMTP 548 1.1 tron commands. Just like the Postfix SMTP server's <a href="postconf.5.html#smtpd_forbidden_commands">smtpd_forbidden_commands</a> 549 1.1 tron feature, <a href="postscreen.8.html">postscreen(8)</a> has an equivalent <a href="postconf.5.html#postscreen_forbidden_commands">postscreen_forbidden_commands</a> 550 1.1 tron feature to block these clients. postscreen(8)'s <a href="#after_220">deep 551 1.1 tron protocol test</a> for this is disabled by default. </p> 552 1.1 tron 553 1.1 tron <p> With "<a href="postconf.5.html#postscreen_non_smtp_command_enable">postscreen_non_smtp_command_enable</a> = yes", <a href="postscreen.8.html">postscreen(8)</a> 554 1.1 tron detects zombies that send commands specified with the 555 1.1 tron <a href="postconf.5.html#postscreen_forbidden_commands">postscreen_forbidden_commands</a> parameter. This also detects commands 556 1.1 tron with the syntax of a message header label. The latter is a symptom 557 1.1 tron that the client is sending message content after ignoring all the 558 1.1 tron responses from <a href="postscreen.8.html">postscreen(8)</a> that reject mail. </p> 559 1.1 tron 560 1.1 tron <p> This test is opportunistically enabled when <a href="postscreen.8.html">postscreen(8)</a> has 561 1.1 tron to use the built-in SMTP engine anyway. This is to make <a href="postscreen.8.html">postscreen(8)</a> 562 1.1 tron logging more informative. </p> 563 1.1 tron 564 1.1 tron <p> When a client sends non-SMTP commands, <a href="postscreen.8.html">postscreen(8)</a> logs this 565 1.1 tron as: </p> 566 1.1 tron 567 1.1 tron <pre> 568 1.1.1.3 tron <b>NON-SMTP COMMAND from</b> <i>[address]:port</i> <b>after</b> <i>command: text</i> 569 1.1 tron </pre> 570 1.1 tron 571 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> sent a 572 1.1.1.3 tron command that matches the <a href="postconf.5.html#postscreen_forbidden_commands">postscreen_forbidden_commands</a> 573 1.1.1.3 tron parameter, or that has the syntax of a message header label (text 574 1.1.1.3 tron followed by optional space and ":"). 575 1.1.1.3 tron The "<tt><b>after</b> <i>command</i></tt>" portion is logged with 576 1.1.1.3 tron Postfix 2.10 and later. </p> 577 1.1 tron 578 1.1 tron <p> The <a href="postconf.5.html#postscreen_non_smtp_command_action">postscreen_non_smtp_command_action</a> parameter specifies 579 1.1 tron the action that is taken next. See "<a href="#fail_after_220">When 580 1.1 tron tests fail after the 220 SMTP server greeting</a>" below. </p> 581 1.1 tron 582 1.1 tron <h3> <a name="barelf">Bare newline test</a> </h3> 583 1.1 tron 584 1.1 tron <p> SMTP is a line-oriented protocol: lines have a limited length, 585 1.1 tron and are terminated with <CR><LF>. Lines ending in a 586 1.1 tron "bare" <LF>, that is newline not preceded by carriage return, 587 1.1 tron are not allowed in SMTP. postscreen(8)'s <a href="#after_220">deep 588 1.1 tron protocol test</a> for this is disabled by default. </p> 589 1.1 tron 590 1.1 tron <p> With "<a href="postconf.5.html#postscreen_bare_newline_enable">postscreen_bare_newline_enable</a> = yes", <a href="postscreen.8.html">postscreen(8)</a> 591 1.1 tron detects clients that send lines ending in bare newline characters. 592 1.1 tron </p> 593 1.1 tron 594 1.1 tron <p> This test is opportunistically enabled when <a href="postscreen.8.html">postscreen(8)</a> has 595 1.1 tron to use the built-in SMTP engine anyway. This is to make <a href="postscreen.8.html">postscreen(8)</a> 596 1.1 tron logging more informative. </p> 597 1.1 tron 598 1.1 tron <p> When a client sends bare newline characters, <a href="postscreen.8.html">postscreen(8)</a> logs 599 1.1 tron this as: 600 1.1 tron </p> 601 1.1 tron 602 1.1 tron <pre> 603 1.1.1.3 tron <b>BARE NEWLINE from</b> <i>[address]:port</i> <b>after</b> <i>command</i> 604 1.1 tron </pre> 605 1.1 tron 606 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> sent a bare 607 1.1 tron newline character, that is newline not preceded by carriage 608 1.1.1.3 tron return. 609 1.1.1.3 tron The "<tt><b>after</b> <i>command</i></tt>" portion is logged with 610 1.1.1.3 tron Postfix 2.10 and later. </p> 611 1.1 tron 612 1.1 tron <p> The <a href="postconf.5.html#postscreen_bare_newline_action">postscreen_bare_newline_action</a> parameter specifies the 613 1.1 tron action that is taken next. See "<a href="#fail_after_220">When 614 1.1 tron tests fail after the 220 SMTP server greeting</a>" below. </p> 615 1.1 tron 616 1.1 tron <h3> <a name="fail_after_220">When tests fail after the 220 SMTP server greeting</a> </h3> 617 1.1 tron 618 1.1 tron <p> When the client fails the pipelining, non-SMTP command or bare 619 1.1 tron newline tests, the action is specified with <a href="postconf.5.html#postscreen_pipelining_action">postscreen_pipelining_action</a>, 620 1.1 tron <a href="postconf.5.html#postscreen_non_smtp_command_action">postscreen_non_smtp_command_action</a> or <a href="postconf.5.html#postscreen_bare_newline_action">postscreen_bare_newline_action</a>, 621 1.1 tron respectively. </p> 622 1.1 tron 623 1.1 tron <dl> 624 1.1 tron 625 1.1 tron <dt> <b>ignore</b> (default for bare newline) </dt> 626 1.1 tron 627 1.1 tron <dd> Ignore the failure of this test. Allow other tests to complete. 628 1.1 tron Do NOT repeat this test before the result from some other test 629 1.1 tron expires. 630 1.1 tron 631 1.1 tron This option is useful for testing and collecting statistics without 632 1.1 tron blocking mail permanently. </dd> 633 1.1 tron 634 1.1 tron <dt> <b>enforce</b> (default for pipelining) </dt> 635 1.1 tron 636 1.1 tron <dd> Allow other tests to complete. Reject attempts to deliver 637 1.1 tron mail with a 550 SMTP reply, and log the helo/sender/recipient 638 1.1 tron information. Repeat this test the next time the client connects. 639 1.1 tron </dd> 640 1.1 tron 641 1.1 tron <dt> <b>drop</b> (default for non-SMTP commands) </dt> 642 1.1 tron 643 1.1 tron <dd> Drop the connection immediately with a 521 SMTP reply. Repeat 644 1.1 tron this test the next time the client connects. This action is 645 1.1 tron compatible with the Postfix SMTP server's <a href="postconf.5.html#smtpd_forbidden_commands">smtpd_forbidden_commands</a> 646 1.1 tron feature. </dd> 647 1.1 tron 648 1.1 tron </dl> 649 1.1 tron 650 1.1 tron <h2> <a name="other_error">Other errors</a> </h2> 651 1.1 tron 652 1.1.1.2 tron <p> When an SMTP client hangs up unexpectedly, <a href="postscreen.8.html">postscreen(8)</a> logs 653 1.1.1.2 tron this as: </p> 654 1.1 tron 655 1.1 tron <pre> 656 1.1 tron <b>HANGUP after</b> <i>time</i> <b>from</b> <i>[address]:port</i> <b>in</b> <i>test name</i> 657 1.1 tron </pre> 658 1.1 tron 659 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> disconnected 660 1.1 tron unexpectedly, <i>time</i> seconds after the start of the 661 1.1 tron test named <i>test name</i>. </p> 662 1.1 tron 663 1.1.1.2 tron <p> There is no punishment for hanging up. A client that hangs up 664 1.1.1.2 tron without sending the QUIT command can still pass all <a href="postscreen.8.html">postscreen(8)</a> 665 1.1.1.2 tron tests. </p> 666 1.1.1.2 tron 667 1.1 tron <!-- 668 1.1 tron 669 1.1 tron <p> While an unexpired penalty is in effect, an SMTP client is not 670 1.1 tron allowed to pass any tests, and <a href="postscreen.8.html">postscreen(8)</a> logs each connection 671 1.1 tron with the remaining amount of penalty time as: </p> 672 1.1 tron 673 1.1 tron <pre> 674 1.1 tron <b>PENALTY</b> <i>time</i> <b>for</b> <i>[address]:port</i> 675 1.1 tron </pre> 676 1.1 tron 677 1.1 tron <p> During this time, all attempts by the client to deliver mail 678 1.1 tron will be deferred with a 450 SMTP status. </p> 679 1.1 tron 680 1.1 tron --> 681 1.1 tron 682 1.1 tron <p> The following errors are reported by the built-in SMTP engine. 683 1.1 tron This engine never accepts mail, therefore it has per-session limits 684 1.1 tron on the number of commands and on the session length. </p> 685 1.1 tron 686 1.1 tron <pre> 687 1.1.1.3 tron <b>COMMAND TIME LIMIT</b> <b>from</b> <i>[address]:port</i> <b>after</b> <i>command</i> 688 1.1 tron </pre> 689 1.1 tron 690 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> reached the 691 1.1 tron per-command time limit as specified with the <a href="postconf.5.html#postscreen_command_time_limit">postscreen_command_time_limit</a> 692 1.1.1.3 tron parameter. The session is terminated immediately. 693 1.1.1.3 tron The "<tt><b>after</b> <i>command</i></tt>" portion is logged with 694 1.1.1.3 tron Postfix 2.10 and later. </p> 695 1.1 tron 696 1.1 tron <pre> 697 1.1.1.3 tron <b>COMMAND COUNT LIMIT from</b> <i>[address]:port</i> <b>after</b> <i>command</i> 698 1.1 tron </pre> 699 1.1 tron 700 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> reached the 701 1.1 tron per-session command count limit as specified with the 702 1.1 tron <a href="postconf.5.html#postscreen_command_count_limit">postscreen_command_count_limit</a> parameter. The session is terminated 703 1.1.1.3 tron immediately. 704 1.1.1.3 tron The "<tt><b>after</b> <i>command</i></tt>" portion is logged with 705 1.1.1.3 tron Postfix 2.10 and later. </p> 706 1.1 tron 707 1.1 tron <pre> 708 1.1.1.3 tron <b>COMMAND LENGTH LIMIT from</b> <i>[address]:port</i> <b>after</b> <i>command</i> 709 1.1 tron </pre> 710 1.1 tron 711 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> reached the 712 1.1 tron per-command length limit, as specified with the <a href="postconf.5.html#line_length_limit">line_length_limit</a> 713 1.1.1.3 tron parameter. The session is terminated immediately. 714 1.1.1.3 tron The "<tt><b>after</b> <i>command</i></tt>" portion is logged with 715 1.1.1.3 tron Postfix 2.10 and later. </p> 716 1.1 tron 717 1.1 tron <p> When an SMTP client makes too many connections at the same time, 718 1.1 tron or when all <a href="postscreen.8.html">postscreen(8)</a> ports are busy, <a href="postscreen.8.html">postscreen(8)</a> rejects the 719 1.1 tron connection with a 421 status code and logs: </p> 720 1.1 tron 721 1.1 tron <pre> 722 1.1 tron <b>NOQUEUE: reject: CONNECT from</b> <i>[address]:port</i><b>: too many connections</b> 723 1.1 tron <b>NOQUEUE: reject: CONNECT from</b> <i>[address]:port</i><b>: all server ports busy</b> 724 1.1 tron </pre> 725 1.1 tron 726 1.1 tron <p> The <a href="postconf.5.html#postscreen_client_connection_count_limit">postscreen_client_connection_count_limit</a> and 727 1.1 tron <a href="postconf.5.html#postscreen_pre_queue_limit">postscreen_pre_queue_limit</a> parameters control these limits. </p> 728 1.1 tron 729 1.1 tron <h2> <a name="victory">When all tests succeed</a> </h2> 730 1.1 tron 731 1.1 tron <p> When a new SMTP client passes all tests (i.e. it is not whitelisted 732 1.1 tron via some mechanism), <a href="postscreen.8.html">postscreen(8)</a> logs this as: </p> 733 1.1 tron 734 1.1 tron <pre> 735 1.1 tron <b>PASS NEW</b> <i>[address]:port</i> 736 1.1 tron </pre> 737 1.1 tron 738 1.1 tron <p> Where <i>[address]:port</i> are the client IP address and port. 739 1.1 tron Then, <a href="postscreen.8.html">postscreen(8)</a> 740 1.1 tron creates a temporary whitelist entry that excludes the client IP 741 1.1 tron address from further tests until the temporary whitelist entry 742 1.1 tron expires, as controlled with the postscreen_*_ttl parameters. </p> 743 1.1 tron 744 1.1 tron <p> When no "<a href="#after_220">deep protocol tests</a>" are 745 1.1 tron configured, <a href="postscreen.8.html">postscreen(8)</a> hands off the "live" connection to a Postfix 746 1.1 tron SMTP server process. The client can then continue as if <a href="postscreen.8.html">postscreen(8)</a> 747 1.1 tron never even existed (except for the short <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> delay). 748 1.1 tron </p> 749 1.1 tron 750 1.1 tron <p> When any "<a href="#after_220">deep protocol tests</a>" are 751 1.1 tron configured, <a href="postscreen.8.html">postscreen(8)</a> cannot hand off the "live" connection to 752 1.1 tron a Postfix SMTP server process in the middle of the session. Instead, 753 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> defers mail delivery attempts with a 4XX status, logs 754 1.1 tron the helo/sender/recipient information, and waits for the client to 755 1.1 tron disconnect. The next time the client connects it will be allowed 756 1.1 tron to talk to a Postfix SMTP server process to deliver its mail. 757 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> mitigates the impact of this limitation by giving 758 1.1 tron <a href="#after_220">deep protocol tests</a> a long expiration 759 1.1 tron time. </p> 760 1.1 tron 761 1.1 tron <h2> <a name="config"> Configuring the postscreen(8) service</a> 762 1.1 tron </h2> 763 1.1 tron 764 1.1 tron <p> <a href="postscreen.8.html">postscreen(8)</a> has been tested on FreeBSD [4-8], Linux 2.[4-6] 765 1.1 tron and Solaris 9 systems. </p> 766 1.1 tron 767 1.1 tron <ul> 768 1.1 tron 769 1.1 tron <li> <a href="#enable"> Turning on postscreen(8) without blocking 770 1.1 tron mail</a> 771 1.1 tron 772 1.1 tron <li> <a href="#starttls"> postscreen(8) TLS configuration </a> 773 1.1 tron 774 1.1 tron <li> <a href="#blocking"> Blocking mail with postscreen(8) </a> 775 1.1 tron 776 1.1 tron <li> <a href="#turnoff"> Turning off postscreen(8) </a> 777 1.1 tron 778 1.1 tron </ul> 779 1.1 tron 780 1.1 tron <h3> <a name="enable"> Turning on postscreen(8) without blocking mail</a> </h3> 781 1.1 tron 782 1.1 tron <p> To enable the <a href="postscreen.8.html">postscreen(8)</a> service and log client information 783 1.1 tron without blocking mail: </p> 784 1.1 tron 785 1.1 tron <ol> 786 1.1 tron 787 1.1 tron <li> <p> Make sure that local clients and systems with non-standard 788 1.1 tron SMTP implementations are excluded from any <a href="postscreen.8.html">postscreen(8)</a> tests. The 789 1.1 tron default is to exclude all clients in <a href="postconf.5.html#mynetworks">mynetworks</a>. To exclude additional 790 1.1 tron clients, for example, third-party performance monitoring tools (these 791 1.1 tron tend to have broken SMTP implementations): </p> 792 1.1 tron 793 1.1 tron <pre> 794 1.1 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 795 1.1 tron # Exclude broken clients by whitelisting. Clients in <a href="postconf.5.html#mynetworks">mynetworks</a> 796 1.1 tron # should always be whitelisted. 797 1.1 tron <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, 798 1.1 tron <a href="cidr_table.5.html">cidr</a>:/etc/postfix/postscreen_access.cidr 799 1.1 tron 800 1.1 tron /etc/postfix/postscreen_access.<a href="cidr_table.5.html">cidr</a>: 801 1.1 tron 192.168.254.0/24 permit 802 1.1 tron </pre> 803 1.1 tron 804 1.1 tron <li> <p> Comment out the "<tt>smtp inet ... smtpd</tt>" service 805 1.1 tron in <a href="master.5.html">master.cf</a>, including any "<tt>-o parameter=value</tt>" entries 806 1.1 tron that follow. </p> 807 1.1 tron 808 1.1 tron <pre> 809 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 810 1.1 tron #smtp inet n - n - - smtpd 811 1.1 tron # -o parameter=value ... 812 1.1 tron </pre> 813 1.1 tron 814 1.1 tron <li> <p> Uncomment the new "<tt>smtpd pass ... smtpd</tt>" service 815 1.1 tron in <a href="master.5.html">master.cf</a>, and duplicate any "<tt>-o parameter=value</tt>" entries 816 1.1 tron from the smtpd service that was commented out in the previous step. 817 1.1 tron </p> 818 1.1 tron 819 1.1 tron <pre> 820 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 821 1.1 tron smtpd pass - - n - - smtpd 822 1.1 tron -o parameter=value ... 823 1.1 tron </pre> 824 1.1 tron 825 1.1 tron <li> <p> Uncomment the new "<tt>smtp inet ... postscreen</tt>" 826 1.1 tron service in <a href="master.5.html">master.cf</a>. </p> 827 1.1 tron 828 1.1 tron <pre> 829 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 830 1.1 tron smtp inet n - n - 1 postscreen 831 1.1 tron </pre> 832 1.1 tron 833 1.1 tron <li> <p> Uncomment the new "<tt>tlsproxy unix ... tlsproxy</tt>" 834 1.1 tron service in <a href="master.5.html">master.cf</a>. This service implements STARTTLS support for 835 1.1 tron <a href="postscreen.8.html">postscreen(8)</a>. </p> 836 1.1 tron 837 1.1 tron <pre> 838 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 839 1.1 tron tlsproxy unix - - n - 0 tlsproxy 840 1.1 tron </pre> 841 1.1 tron 842 1.1 tron <li> <p> Uncomment the new "<tt>dnsblog unix ... dnsblog</tt>" 843 1.1 tron service in <a href="master.5.html">master.cf</a>. This service does DNSBL lookups for <a href="postscreen.8.html">postscreen(8)</a> 844 1.1 tron and logs results. </p> 845 1.1 tron 846 1.1 tron <pre> 847 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 848 1.1 tron dnsblog unix - - n - 0 dnsblog 849 1.1 tron </pre> 850 1.1 tron 851 1.1 tron <li> <p> To enable DNSBL lookups, list some DNS blocklist sites in 852 1.1 tron <a href="postconf.5.html">main.cf</a>, separated by whitespace. Different sites can have different 853 1.1 tron weights. For example: 854 1.1 tron 855 1.1 tron <pre> 856 1.1 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 857 1.1 tron <a href="postconf.5.html#postscreen_dnsbl_threshold">postscreen_dnsbl_threshold</a> = 2 858 1.1 tron <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> = zen.spamhaus.org*2 859 1.1 tron bl.spamcop.net*1 b.barracudacentral.org*1 860 1.1 tron </pre> 861 1.1 tron 862 1.1 tron <p> Note: if your DNSBL queries have a "secret" in the domain name, 863 1.1 tron you must censor this information from the <a href="postscreen.8.html">postscreen(8)</a> SMTP replies. 864 1.1 tron For example: </p> 865 1.1 tron 866 1.1 tron <pre> 867 1.1 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 868 1.1.1.2 tron <a href="postconf.5.html#postscreen_dnsbl_reply_map">postscreen_dnsbl_reply_map</a> = <a href="DATABASE_README.html#types">texthash</a>:/etc/postfix/dnsbl_reply 869 1.1 tron </pre> 870 1.1 tron 871 1.1 tron <pre> 872 1.1 tron /etc/postfix/dnsbl_reply: 873 1.1 tron # Secret DNSBL name Name in <a href="postscreen.8.html">postscreen(8)</a> replies 874 1.1 tron secret.zen.spamhaus.org zen.spamhaus.org 875 1.1 tron </pre> 876 1.1 tron 877 1.1.1.2 tron <p> The <a href="DATABASE_README.html#types">texthash</a>: format is similar to hash: except that there is 878 1.1 tron no need to run <a href="postmap.1.html">postmap(1)</a> before the file can be used, and that it 879 1.1 tron does not detect changes after the file is read. It is new with 880 1.1 tron Postfix version 2.8. </p> 881 1.1 tron 882 1.1 tron <li> <p> Read the new configuration with "<tt>postfix reload</tt>". 883 1.1 tron </p> 884 1.1 tron 885 1.1 tron </ol> 886 1.1 tron 887 1.1 tron <p> Notes: </p> 888 1.1 tron 889 1.1 tron <ul> 890 1.1 tron 891 1.1 tron <li> <p> Some <a href="postscreen.8.html">postscreen(8)</a> configuration parameters implement 892 1.1 tron stress-dependent behavior. This is supported only when the default 893 1.1.1.2 tron value is stress-dependent (that is, "postconf -d <i>parametername</i>" 894 1.1.1.2 tron output shows "<i>parametername</i> = 895 1.1.1.2 tron ${stress?<i>something</i>}${stress:<i>something</i>}"). 896 1.1 tron Other parameters always evaluate as if the stress value is the empty 897 1.1 tron string. </p> 898 1.1 tron 899 1.1 tron <li> <p> See "<a href="#before_220">Tests before the 220 SMTP server 900 1.1 tron greeting</a>" for details about the logging from these postscreen(8) 901 1.1 tron tests. </p> 902 1.1 tron 903 1.1 tron <li> <p> If you run Postfix 2.6 or earlier you must stop and start 904 1.1 tron the master daemon ("<tt>postfix stop; postfix start</tt>"). This 905 1.1 tron is needed because the Postfix "pass" master service type did not 906 1.1 tron work reliably on all systems. </p> 907 1.1 tron 908 1.1 tron </ul> 909 1.1 tron 910 1.1 tron <h3> <a name="starttls"> postscreen(8) TLS configuration </a> </h3> 911 1.1 tron 912 1.1 tron <p> <a href="postscreen.8.html">postscreen(8)</a> TLS support is available for remote SMTP clients 913 1.1 tron that aren't whitelisted, including clients that need to renew their 914 1.1 tron temporary whitelist status. When a remote SMTP client requests TLS 915 1.1 tron service, <a href="postscreen.8.html">postscreen(8)</a> invisibly hands off the connection to a 916 1.1 tron <a href="tlsproxy.8.html">tlsproxy(8)</a> process. Then, <a href="tlsproxy.8.html">tlsproxy(8)</a> encrypts and decrypts the 917 1.1 tron traffic between <a href="postscreen.8.html">postscreen(8)</a> and the remote SMTP client. One 918 1.1 tron <a href="tlsproxy.8.html">tlsproxy(8)</a> process can handle multiple SMTP sessions. The number 919 1.1 tron of <a href="tlsproxy.8.html">tlsproxy(8)</a> processes slowly increases with server load, but it 920 1.1 tron should always be much smaller than the number of <a href="postscreen.8.html">postscreen(8)</a> TLS 921 1.1 tron sessions. </p> 922 1.1 tron 923 1.1 tron <p> TLS support for <a href="postscreen.8.html">postscreen(8)</a> and <a href="tlsproxy.8.html">tlsproxy(8)</a> uses the same 924 1.1 tron parameters as with <a href="smtpd.8.html">smtpd(8)</a>. We recommend that you keep the relevant 925 1.1 tron configuration parameters in <a href="postconf.5.html">main.cf</a>. If you must specify "-o 926 1.1 tron smtpd_mumble=value" parameter overrides in <a href="master.5.html">master.cf</a> for a 927 1.1 tron postscreen-protected <a href="smtpd.8.html">smtpd(8)</a> service, then you should specify those 928 1.1 tron same parameter overrides for the <a href="postscreen.8.html">postscreen(8)</a> and <a href="tlsproxy.8.html">tlsproxy(8)</a> 929 1.1 tron services. </p> 930 1.1 tron 931 1.1 tron <h3> <a name="blocking"> Blocking mail with postscreen(8) </a> </h3> 932 1.1 tron 933 1.1 tron <p> For compatibility with <a href="smtpd.8.html">smtpd(8)</a>, <a href="postscreen.8.html">postscreen(8)</a> implements the 934 1.1 tron <a href="postconf.5.html#soft_bounce">soft_bounce</a> safety feature. This causes Postfix to reject mail with 935 1.1 tron a "try again" reply code. </p> 936 1.1 tron 937 1.1 tron <ul> 938 1.1 tron 939 1.1 tron <li> <p> To turn this on for all of Postfix, specify "<tt><a href="postconf.5.html#soft_bounce">soft_bounce</a> 940 1.1 tron = yes</tt>" in <a href="postconf.5.html">main.cf</a>. </p> 941 1.1 tron 942 1.1 tron <li> <p> To turn this on for <a href="postscreen.8.html">postscreen(8)</a> only, append "<tt>-o 943 1.1 tron <a href="postconf.5.html#soft_bounce">soft_bounce</a>=yes</tt>" (note: NO SPACES around '=') to the postscreen 944 1.1 tron entry in <a href="master.5.html">master.cf</a>. <p> 945 1.1 tron 946 1.1 tron </ul> 947 1.1 tron 948 1.1 tron <p> Execute "<tt>postfix reload</tt>" to make the change effective. </p> 949 1.1 tron 950 1.1 tron <p> After testing, do not forget to remove the <a href="postconf.5.html#soft_bounce">soft_bounce</a> feature, 951 1.1 tron otherwise senders won't receive their non-delivery notification 952 1.1 tron until many days later. </p> 953 1.1 tron 954 1.1 tron <p> To use the <a href="postscreen.8.html">postscreen(8)</a> service to block mail, edit <a href="postconf.5.html">main.cf</a> and 955 1.1 tron specify one or more of: </p> 956 1.1 tron 957 1.1 tron <ul> 958 1.1 tron 959 1.1 tron <li> <p> "<tt><a href="postconf.5.html#postscreen_dnsbl_action">postscreen_dnsbl_action</a> = enforce</tt>", to reject 960 1.1 tron clients that are on DNS blocklists, and to log the helo/sender/recipient 961 1.1 tron information. With good DNSBLs this reduces the amount of load on 962 1.1 tron Postfix SMTP servers dramatically. </p> 963 1.1 tron 964 1.1 tron <li> <p> "<tt><a href="postconf.5.html#postscreen_greet_action">postscreen_greet_action</a> = enforce</tt>", to reject 965 1.1 tron clients that talk before their turn, and to log the helo/sender/recipient 966 1.1 tron information. This stops over half of all known-to-be illegitimate 967 1.1 tron connections to Wietse's mail server. It is backup protection for 968 1.1 tron zombies that haven't yet been blacklisted. </p> 969 1.1 tron 970 1.1 tron <li> <p> You can also enable "<a href="#after_220">deep protocol 971 1.1 tron tests</a>", but these are more intrusive than the pregreet or DNSBL 972 1.1 tron tests. </p> 973 1.1 tron 974 1.1 tron <p> When a good client passes the "<a href="#after_220">deep 975 1.1 tron protocol tests</a>", postscreen(8) adds the client to the temporary 976 1.1 tron whitelist but it cannot hand off the "live" connection to a Postfix 977 1.1 tron SMTP server process in the middle of the session. Instead, <a href="postscreen.8.html">postscreen(8)</a> 978 1.1 tron defers mail delivery attempts with a 4XX status, logs the 979 1.1 tron helo/sender/recipient information, and waits for the client to 980 1.1 tron disconnect. </p> 981 1.1 tron 982 1.1 tron <p> When the good client comes back in a later session, it is allowed 983 1.1 tron to talk directly to a Postfix SMTP server. See "after_220 <a 984 1.1 tron href="#after_220">Tests after the 220 SMTP server greeting</a> above 985 1.1 tron for limitations with AUTH and other features that clients may need. 986 1.1 tron </p> 987 1.1 tron 988 1.1 tron <p> An unexpected benefit from "<a href="#after_220">deep protocol 989 1.1 tron tests</a>" is that some "good" clients don't return after the 4XX 990 1.1 tron reply; these clients were not so good after all. Wietse enables 991 1.1 tron "<a href="#after_220">deep protocol tests</a>" on his own internet-facing 992 1.1 tron mail server. </p> 993 1.1 tron 994 1.1 tron <li> <p> There is also support for permanent blacklisting and 995 1.1 tron whitelisting; see the description of the <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> 996 1.1 tron parameter for details. </p> 997 1.1 tron 998 1.1 tron </ul> 999 1.1 tron 1000 1.1 tron <h3> <a name="turnoff"> Turning off postscreen(8) </a> </h3> 1001 1.1 tron 1002 1.1 tron <p> To turn off <a href="postscreen.8.html">postscreen(8)</a> and handle mail directly with Postfix 1003 1.1 tron SMTP server processes: </p> 1004 1.1 tron 1005 1.1 tron <ol> 1006 1.1 tron 1007 1.1 tron <li> <p> Comment out the "<tt>smtp inet ... postscreen</tt>" service 1008 1.1 tron in <a href="master.5.html">master.cf</a>, including any "<tt>-o parameter=value</tt>" entries 1009 1.1 tron that follow. </p> 1010 1.1 tron 1011 1.1 tron <pre> 1012 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 1013 1.1 tron #smtp inet n - n - 1 postscreen 1014 1.1 tron # -o parameter=value ... 1015 1.1 tron </pre> 1016 1.1 tron 1017 1.1 tron <li> <p> Comment out the "<tt>dnsblog unix ... dnsblog</tt>" service 1018 1.1 tron in <a href="master.5.html">master.cf</a>. </p> 1019 1.1 tron 1020 1.1 tron <pre> 1021 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 1022 1.1 tron #dnsblog unix - - n - 0 dnsblog 1023 1.1 tron </pre> 1024 1.1 tron 1025 1.1 tron <li> <p> Comment out the "<tt>smtpd pass ... smtpd</tt>" service 1026 1.1 tron in <a href="master.5.html">master.cf</a>, including any "<tt>-o parameter=value</tt>" entries 1027 1.1 tron that follow. </p> 1028 1.1 tron 1029 1.1 tron <pre> 1030 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 1031 1.1 tron #smtpd pass - - n - - smtpd 1032 1.1 tron # -o parameter=value ... 1033 1.1 tron </pre> 1034 1.1 tron 1035 1.1 tron <li> <p> Comment out the "<tt>tlsproxy unix ... tlsproxy</tt>" 1036 1.1 tron service in <a href="master.5.html">master.cf</a>, including any "<tt>-o parameter=value</tt>" 1037 1.1 tron entries that follow. </p> 1038 1.1 tron 1039 1.1 tron <pre> 1040 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 1041 1.1 tron #tlsproxy unix - - n - 0 tlsproxy 1042 1.1 tron # -o parameter=value ... 1043 1.1 tron </pre> 1044 1.1 tron 1045 1.1 tron <li> <p> Uncomment the "<tt>smtp inet ... smtpd</tt>" service in 1046 1.1 tron <a href="master.5.html">master.cf</a>, including any "<tt>-o parameter=value</tt>" entries that 1047 1.1 tron may follow. </p> 1048 1.1 tron 1049 1.1 tron <pre> 1050 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 1051 1.1 tron smtp inet n - n - - smtpd 1052 1.1 tron -o parameter=value ... 1053 1.1 tron </pre> 1054 1.1 tron 1055 1.1 tron <li> <p> Read the new configuration with "<tt>postfix reload</tt>". 1056 1.1 tron </p> 1057 1.1 tron 1058 1.1 tron </ol> 1059 1.1 tron 1060 1.1 tron <h2> <a name="historical"> Historical notes and credits </a> </h2> 1061 1.1 tron 1062 1.1 tron <p> Many ideas in <a href="postscreen.8.html">postscreen(8)</a> were explored in earlier work by 1063 1.1 tron Michael Tokarev, in OpenBSD spamd, and in MailChannels Traffic 1064 1.1 tron Control. </p> 1065 1.1 tron 1066 1.1 tron <p> Wietse threw together a crude prototype with pregreet and dnsbl 1067 1.1 tron support in June 2009, because he needed something new for a Mailserver 1068 1.1 tron conference presentation in July. Ralf Hildebrandt ran this code on 1069 1.1 tron several servers to collect real-world statistics. This version used 1070 1.1 tron the <a href="dnsblog.8.html">dnsblog(8)</a> ad-hoc DNS client program. </p> 1071 1.1 tron 1072 1.1 tron <p> Wietse needed new material for a LISA conference presentation 1073 1.1 tron in November 2010, so he added support for DNSBL weights and filters 1074 1.1 tron in August, followed by a major code rewrite, deep protocol tests, 1075 1.1 tron helo/sender/recipient logging, and stress-adaptive behavior in 1076 1.1 tron September. Ralf Hildebrandt ran this code on several servers to 1077 1.1 tron collect real-world statistics. This version still used the embarrassing 1078 1.1 tron <a href="dnsblog.8.html">dnsblog(8)</a> ad-hoc DNS client program. </p> 1079 1.1 tron 1080 1.1 tron <p> Wietse added STARTTLS support in December 2010. This makes 1081 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> usable for sites that require TLS support. The 1082 1.1 tron implementation introduces the <a href="tlsproxy.8.html">tlsproxy(8)</a> event-driven TLS proxy 1083 1.1 tron that decrypts/encrypts the sessions for multiple SMTP clients. </p> 1084 1.1 tron 1085 1.1.1.3 tron <p> The <a href="tlsproxy.8.html">tlsproxy(8)</a> implementation led to the discovery of a "new" 1086 1.1.1.3 tron class of vulnerability (<a 1087 1.1.1.3 tron href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0411" 1088 1.1.1.3 tron >CVE-2011-0411</a>) that affected multiple implementations of SMTP, 1089 1.1.1.3 tron POP, IMAP, NNTP, and FTP over TLS. </p> 1090 1.1.1.3 tron 1091 1.1.1.3 tron <p> <a href="postscreen.8.html">postscreen(8)</a> was officially released as part of the Postfix 1092 1.1.1.3 tron 2.8 stable release in January 2011.</p> 1093 1.1.1.3 tron 1094 1.1 tron </body> 1095 1.1 tron 1096 1.1 tron </html> 1097 1.1 tron 1098
Indexes created Sun Jun 07 00:24:08 UTC 2026