POSTSCREEN_README.html revision 1.1.1.5
1 1.1 tron <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" 2 1.1 tron "http://www.w3.org/TR/html4/loose.dtd"> 3 1.1 tron 4 1.1 tron <head> 5 1.1 tron 6 1.1 tron <title>Postfix Postscreen Howto</title> 7 1.1 tron 8 1.1 tron <meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> 9 1.1 tron 10 1.1 tron </head> 11 1.1 tron 12 1.1 tron <body> 13 1.1 tron 14 1.1 tron <h1><img src="postfix-logo.jpg" width="203" height="98" ALT="">Postfix Postscreen Howto</h1> 15 1.1 tron 16 1.1 tron <hr> 17 1.1 tron 18 1.1 tron <h2> <a name="intro">Introduction</a> </h2> 19 1.1 tron 20 1.1.1.3 tron <p> This document describes features that are available in Postfix 21 1.1.1.3 tron 2.8 and later. </p> 22 1.1.1.3 tron 23 1.1.1.3 tron <p> The Postfix <a href="postscreen.8.html">postscreen(8)</a> daemon provides additional protection 24 1.1.1.3 tron against mail server overload. One <a href="postscreen.8.html">postscreen(8)</a> process handles 25 1.1.1.3 tron multiple inbound SMTP connections, and decides which clients may 26 1.1.1.3 tron talk to a Postfix SMTP server process. By keeping spambots away, 27 1.1.1.3 tron <a href="postscreen.8.html">postscreen(8)</a> leaves more SMTP server processes available for 28 1.1.1.3 tron legitimate clients, and delays the onset of <a 29 1.1.1.3 tron href="STRESS_README.html">server overload</a> conditions. </p> 30 1.1.1.3 tron 31 1.1.1.3 tron <p> <a href="postscreen.8.html">postscreen(8)</a> should not be used on SMTP ports that receive 32 1.1.1.3 tron mail from end-user clients (MUAs). In a typical deployment, 33 1.1.1.3 tron <a href="postscreen.8.html">postscreen(8)</a> handles the MX service on TCP port 25, while MUA 34 1.1.1.3 tron clients submit mail via the submission service on TCP port 587 which 35 1.1.1.3 tron requires client authentication. Alternatively, a site could set up 36 1.1.1.3 tron a dedicated, non-postscreen, "port 25" server that provides submission 37 1.1.1.3 tron service and client authentication, but no MX service. </p> 38 1.1 tron 39 1.1.1.2 tron <p> <a href="postscreen.8.html">postscreen(8)</a> maintains a temporary whitelist for clients that 40 1.1.1.2 tron pass its tests; by allowing whitelisted clients to skip tests, 41 1.1.1.2 tron <a href="postscreen.8.html">postscreen(8)</a> minimizes its impact on legitimate email traffic. 42 1.1.1.2 tron </p> 43 1.1.1.2 tron 44 1.1 tron <p> <a href="postscreen.8.html">postscreen(8)</a> is part of a multi-layer defense. <p> 45 1.1 tron 46 1.1 tron <ul> 47 1.1 tron 48 1.1 tron <li> <p> As the first layer, <a href="postscreen.8.html">postscreen(8)</a> blocks connections from 49 1.1 tron zombies and other spambots that are responsible for about 90% of 50 1.1 tron all spam. It is implemented as a single process to make this defense 51 1.1.1.3 tron as inexpensive as possible. </p> 52 1.1 tron 53 1.1 tron <li> <p> The second layer implements more complex SMTP-level access 54 1.1.1.3 tron checks with <a href="SMTPD_ACCESS_README.html">Postfix SMTP servers</a>, 55 1.1.1.3 tron <a href="SMTPD_POLICY_README.html">policy daemons</a>, and 56 1.1.1.3 tron <a href="MILTER_README.html">Milter applications</a>. </p> 57 1.1 tron 58 1.1 tron <li> <p> The third layer performs light-weight content inspection 59 1.1 tron with the Postfix built-in <a href="postconf.5.html#header_checks">header_checks</a> and <a href="postconf.5.html#body_checks">body_checks</a>. This can 60 1.1 tron block unacceptable attachments such as executable programs, and 61 1.1 tron worms or viruses with easy-to-recognize signatures. </p> 62 1.1 tron 63 1.1 tron <li> <p> The fourth layer provides heavy-weight content inspection 64 1.1.1.3 tron with external content filters. Typical examples are <a 65 1.1.1.3 tron href="http://www.ijs.si/software/amavisd/">Amavisd-new</a>, <a 66 1.1.1.3 tron href="http://spamassassin.apache.org/">SpamAssassin</a>, and <a 67 1.1.1.3 tron href="MILTER_README.html">Milter applications</a>. </p> 68 1.1 tron 69 1.1 tron </ul> 70 1.1 tron 71 1.1 tron <p> Each layer reduces the spam volume. The general strategy is to 72 1.1 tron use the less expensive defenses first, and to use the more expensive 73 1.1.1.2 tron defenses only for the spam that remains. </p> 74 1.1 tron 75 1.1 tron <p> Topics in this document: </p> 76 1.1 tron 77 1.1 tron <ul> 78 1.1 tron 79 1.1 tron <li> <a href="#intro">Introduction</a> 80 1.1 tron 81 1.1 tron <li> <a href="#basic">The basic idea behind postscreen(8)</a> 82 1.1 tron 83 1.1 tron <li> <a href="#general"> General operation </a> 84 1.1 tron 85 1.1 tron <li> <a href="#quick">Quick tests before everything else</a> 86 1.1 tron 87 1.1 tron <li> <a href="#before_220"> Tests before the 220 SMTP server greeting </a> 88 1.1 tron 89 1.1 tron <li> <a href="#after_220">Tests after the 220 SMTP server greeting</a> 90 1.1 tron 91 1.1 tron <li> <a href="#other_error">Other errors</a> 92 1.1 tron 93 1.1 tron <li> <a href="#victory">When all tests succeed</a> 94 1.1 tron 95 1.1 tron <li> <a href="#config"> Configuring the postscreen(8) service</a> 96 1.1 tron 97 1.1 tron <li> <a href="#historical"> Historical notes and credits </a> 98 1.1 tron 99 1.1 tron </ul> 100 1.1 tron 101 1.1 tron <h2> <a name="basic">The basic idea behind postscreen(8)</a> </h2> 102 1.1 tron 103 1.1 tron <p> Most email is spam, and most spam is sent out by zombies (malware 104 1.1 tron on compromised end-user computers). Wietse expects that the zombie 105 1.1 tron problem will get worse before things improve, if ever. Without a 106 1.1 tron tool like <a href="postscreen.8.html">postscreen(8)</a> that keeps the zombies away, Postfix would be 107 1.1 tron spending most of its resources not receiving email. </p> 108 1.1 tron 109 1.1 tron <p> The main challenge for <a href="postscreen.8.html">postscreen(8)</a> is to make an is-it-a-zombie 110 1.1 tron decision based on a single measurement. This is necessary because 111 1.1.1.2 tron many zombies try to fly under the radar and avoid spamming the same 112 1.1.1.2 tron site repeatedly. Once <a href="postscreen.8.html">postscreen(8)</a> decides that a client is 113 1.1.1.2 tron not-a-zombie, it whitelists the client temporarily to avoid further 114 1.1.1.2 tron delays for legitimate mail. </p> 115 1.1 tron 116 1.1 tron <p> Zombies have challenges too: they have only a limited amount 117 1.1 tron of time to deliver spam before their IP address becomes blacklisted. 118 1.1 tron To speed up spam deliveries, zombies make compromises in their SMTP 119 1.1 tron protocol implementation. For example, they speak before their turn, 120 1.1 tron or they ignore responses from SMTP servers and continue sending 121 1.1 tron mail even when the server tells them to go away. </p> 122 1.1 tron 123 1.1 tron <p> <a href="postscreen.8.html">postscreen(8)</a> uses a variety of measurements to recognize 124 1.1 tron zombies. First, <a href="postscreen.8.html">postscreen(8)</a> determines if the remote SMTP client 125 1.1 tron IP address is blacklisted. Second, <a href="postscreen.8.html">postscreen(8)</a> looks for protocol 126 1.1 tron compromises that are made to speed up delivery. These are good 127 1.1 tron indicators for making is-it-a-zombie decisions based on single 128 1.1 tron measurements. </p> 129 1.1 tron 130 1.1 tron <p> <a href="postscreen.8.html">postscreen(8)</a> does not inspect message content. Message content 131 1.1 tron can vary from one delivery to the next, especially with clients 132 1.1 tron that (also) send legitimate email. Content is not a good indicator 133 1.1 tron for making is-it-a-zombie decisions based on single measurements, 134 1.1 tron and that is the problem that <a href="postscreen.8.html">postscreen(8)</a> is focused on. </p> 135 1.1 tron 136 1.1 tron <h2> <a name="general"> General operation </a> </h2> 137 1.1 tron 138 1.1.1.3 tron <p> For each connection from an SMTP client, <a href="postscreen.8.html">postscreen(8)</a> performs 139 1.1.1.3 tron a number of tests 140 1.1 tron in the order as described below. Some tests introduce a delay of 141 1.1.1.2 tron a few seconds. <a href="postscreen.8.html">postscreen(8)</a> maintains a temporary whitelist for 142 1.1.1.2 tron clients that pass its tests; by allowing whitelisted clients to 143 1.1.1.2 tron skip tests, <a href="postscreen.8.html">postscreen(8)</a> minimizes its impact on legitimate email 144 1.1.1.2 tron traffic. </p> 145 1.1.1.2 tron 146 1.1.1.2 tron <p> By default, <a href="postscreen.8.html">postscreen(8)</a> hands off all connections to a Postfix 147 1.1.1.2 tron SMTP server process after logging its findings. This mode is useful 148 1.1.1.2 tron for non-destructive testing. </p> 149 1.1 tron 150 1.1 tron <p> In a typical production setting, <a href="postscreen.8.html">postscreen(8)</a> is configured 151 1.1 tron to reject mail from clients that fail one or more tests, after 152 1.1 tron logging the helo, sender and recipient information. </p> 153 1.1 tron 154 1.1 tron <p> Note: <a href="postscreen.8.html">postscreen(8)</a> is not an SMTP proxy; this is intentional. 155 1.1 tron The purpose is to keep zombies away from Postfix, with minimal 156 1.1 tron overhead for legitimate clients. </p> 157 1.1 tron 158 1.1 tron <h2> <a name="quick">Quick tests before everything else</a> </h2> 159 1.1 tron 160 1.1 tron <p> Before engaging in SMTP-level tests. <a href="postscreen.8.html">postscreen(8)</a> queries a 161 1.1 tron number of local black and whitelists. These tests speed up the 162 1.1 tron handling of known clients. </p> 163 1.1 tron 164 1.1 tron <ul> 165 1.1 tron 166 1.1 tron <li> <a href="#perm_white_black"> Permanent white/blacklist test </a> 167 1.1 tron 168 1.1 tron <li> <a href="#temp_white"> Temporary whitelist test </a> 169 1.1 tron 170 1.1.1.2 tron <li> <a href="#white_veto"> MX Policy test </a> 171 1.1.1.2 tron 172 1.1 tron </ul> 173 1.1 tron 174 1.1 tron <h3> <a name="perm_white_black"> Permanent white/blacklist test </a> </h3> 175 1.1 tron 176 1.1 tron <p> The <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> parameter (default: <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>) 177 1.1 tron specifies a permanent access list for SMTP client IP addresses. Typically 178 1.1 tron one would specify something that whitelists local networks, followed 179 1.1 tron by a CIDR table for selective white- and blacklisting. </p> 180 1.1 tron 181 1.1 tron <p> Example: </p> 182 1.1 tron 183 1.1 tron <pre> 184 1.1 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 185 1.1 tron <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, 186 1.1 tron <a href="cidr_table.5.html">cidr</a>:/etc/postfix/postscreen_access.cidr 187 1.1 tron 188 1.1 tron /etc/postfix/postscreen_access.<a href="cidr_table.5.html">cidr</a>: 189 1.1 tron # Rules are evaluated in the order as specified. 190 1.1 tron # Blacklist 192.168.* except 192.168.0.1. 191 1.1 tron 192.168.0.1 permit 192 1.1 tron 192.168.0.0/16 reject 193 1.1 tron </pre> 194 1.1 tron 195 1.1 tron <p> See the <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> manpage documentation for more 196 1.1 tron details. </p> 197 1.1 tron 198 1.1 tron <p> When the SMTP client address matches a "permit" action, 199 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> logs this with the client address and port number as: 200 1.1 tron </p> 201 1.1 tron 202 1.1 tron <pre> 203 1.1 tron <b>WHITELISTED</b> <i>[address]:port</i> 204 1.1 tron </pre> 205 1.1 tron 206 1.1 tron <p> The whitelist action is not configurable: immediately hand off the 207 1.1 tron connection to a Postfix SMTP server process. </p> 208 1.1 tron 209 1.1 tron <p> When the SMTP client address matches a "reject" action, 210 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> logs this with the client address and port number as: 211 1.1 tron </p> 212 1.1 tron 213 1.1 tron <pre> 214 1.1 tron <b>BLACKLISTED</b> <i>[address]:port</i> 215 1.1 tron </pre> 216 1.1 tron 217 1.1 tron <p> The <a href="postconf.5.html#postscreen_blacklist_action">postscreen_blacklist_action</a> parameter specifies the action 218 1.1 tron that is taken next. See "<a href="#fail_before_220">When tests 219 1.1 tron fail before the 220 SMTP server greeting</a>" below. </p> 220 1.1 tron 221 1.1 tron <h3> <a name="temp_white"> Temporary whitelist test </a> </h3> 222 1.1 tron 223 1.1 tron <p> The <a href="postscreen.8.html">postscreen(8)</a> daemon maintains a <i>temporary</i> 224 1.1 tron whitelist for SMTP client IP addresses that have passed all 225 1.1 tron the tests described below. The <a href="postconf.5.html#postscreen_cache_map">postscreen_cache_map</a> parameter 226 1.1 tron specifies the location of the temporary whitelist. The 227 1.1 tron temporary whitelist is not used for SMTP client addresses 228 1.1.1.2 tron that appear on the <i>permanent</i> access list. </p> 229 1.1.1.2 tron 230 1.1.1.4 tron <p> By default the temporary whitelist is not shared with other 231 1.1.1.4 tron postscreen(8) daemons. See <a href="#temp_white_sharing"> Sharing 232 1.1.1.4 tron the temporary whitelist </a> below for alternatives. </p> 233 1.1 tron 234 1.1 tron <p> When the SMTP client address appears on the temporary 235 1.1 tron whitelist, <a href="postscreen.8.html">postscreen(8)</a> logs this with the client address and port 236 1.1 tron number as: </p> 237 1.1 tron 238 1.1 tron <pre> 239 1.1 tron <b>PASS OLD</b> <i>[address]:port</i> 240 1.1 tron </pre> 241 1.1 tron 242 1.1 tron <p> The action is not configurable: immediately hand off the 243 1.1 tron connection to a Postfix SMTP server process. The client is 244 1.1 tron excluded from further tests until its temporary whitelist 245 1.1 tron entry expires, as controlled with the postscreen_*_ttl 246 1.1 tron parameters. Expired entries are silently renewed if possible. </p> 247 1.1 tron 248 1.1.1.2 tron <h3> <a name="white_veto"> MX Policy test </a> </h3> 249 1.1.1.2 tron 250 1.1.1.2 tron <p> When the remote SMTP client is not on the static access list 251 1.1.1.2 tron or temporary whitelist, <a href="postscreen.8.html">postscreen(8)</a> can implement a number of 252 1.1.1.2 tron whitelist tests, before it grants the client a temporary whitelist 253 1.1.1.2 tron status that allows it to talk to a Postfix SMTP server process. </p> 254 1.1.1.2 tron 255 1.1.1.3 tron <p> When <a href="postscreen.8.html">postscreen(8)</a> is configured to monitor all primary and 256 1.1.1.3 tron backup MX addresses, it can refuse to whitelist clients that connect 257 1.1.1.3 tron to a backup MX address only (an old spammer trick to take advantage 258 1.1.1.3 tron of backup MX hosts with weaker anti-spam policies than primary MX 259 1.1.1.2 tron hosts). </p> 260 1.1.1.2 tron 261 1.1.1.3 tron <blockquote> <p> NOTE: The following solution is for small sites. 262 1.1.1.3 tron Larger sites would have to share the <a href="postscreen.8.html">postscreen(8)</a> cache between 263 1.1.1.3 tron primary and backup MTAs, which would introduce a common point of 264 1.1.1.3 tron failure. </p> </blockquote> 265 1.1.1.3 tron 266 1.1.1.2 tron <ul> 267 1.1.1.2 tron 268 1.1.1.2 tron <li> <p> First, configure the host to listen on both primary and 269 1.1.1.2 tron backup MX addresses. Use the appropriate <tt>ifconfig</tt> command 270 1.1.1.2 tron for the local operating system, or update the appropriate configuration 271 1.1.1.2 tron files and "refresh" the network protocol stack. </p> 272 1.1.1.2 tron 273 1.1.1.3 tron <p> <p> Second, configure Postfix to listen on the new IP address 274 1.1.1.3 tron (this step is needed when you have specified <a href="postconf.5.html#inet_interfaces">inet_interfaces</a> in 275 1.1.1.3 tron <a href="postconf.5.html">main.cf</a>). </p> 276 1.1.1.3 tron 277 1.1.1.2 tron <li> <p> Then, configure <a href="postscreen.8.html">postscreen(8)</a> to deny the temporary whitelist 278 1.1.1.2 tron status on the backup MX address(es). An example for Wietse's 279 1.1.1.2 tron server is: </p> 280 1.1.1.2 tron 281 1.1.1.2 tron <pre> 282 1.1.1.2 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 283 1.1.1.2 tron <a href="postconf.5.html#postscreen_whitelist_interfaces">postscreen_whitelist_interfaces</a> = !168.100.189.8 <a href="DATABASE_README.html#types">static</a>:all 284 1.1.1.2 tron </pre> 285 1.1.1.2 tron 286 1.1.1.2 tron <p> Translation: allow clients to obtain the temporary whitelist 287 1.1.1.2 tron status on all server IP addresses except 168.100.189.8, which is a 288 1.1.1.2 tron backup MX address. </p> 289 1.1.1.2 tron 290 1.1.1.2 tron </ul> 291 1.1.1.2 tron 292 1.1.1.2 tron <p> When a non-whitelisted client connects the backup MX address, 293 1.1.1.2 tron <a href="postscreen.8.html">postscreen(8)</a> logs this with the client address and port number as: 294 1.1.1.2 tron </p> 295 1.1.1.2 tron 296 1.1.1.2 tron <pre> 297 1.1.1.2 tron <b>CONNECT from</b> <i>[address]:port</i> <b>to [168.100.189.8]:25</b> 298 1.1.1.2 tron <b>WHITELIST VETO</b> <i>[address]:port</i> 299 1.1.1.2 tron </pre> 300 1.1.1.2 tron 301 1.1.1.2 tron <p> Translation: the client at <i>[address]:port</i> connected to 302 1.1.1.2 tron the backup MX address 168.100.189.8 while it was not whitelisted. 303 1.1.1.2 tron The client will not be granted the temporary whitelist status, even 304 1.1.1.2 tron if passes all the whitelist tests described below. </p> 305 1.1.1.2 tron 306 1.1 tron <h2> <a name="before_220"> Tests before the 220 SMTP server greeting </a> </h2> 307 1.1 tron 308 1.1 tron <p> The <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> parameter specifies a short time 309 1.1 tron interval before the "220 <i>text</i>..." server greeting, where 310 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> can run a number of tests in parallel. </p> 311 1.1 tron 312 1.1 tron <p> When a good client passes these tests, and no "<a 313 1.1 tron href="#after_220">deep protocol tests</a>" are configured, postscreen(8) 314 1.1 tron adds the client to the temporary whitelist and hands off the "live" 315 1.1 tron connection to a Postfix SMTP server process. The client can then 316 1.1 tron continue as if <a href="postscreen.8.html">postscreen(8)</a> never even existed (except of course 317 1.1 tron for the short <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> delay). </p> 318 1.1 tron 319 1.1 tron <ul> 320 1.1 tron 321 1.1 tron <li> <a href="#pregreet"> Pregreet test </a> 322 1.1 tron 323 1.1 tron <li> <a href="#dnsbl"> DNS White/blacklist test </a> 324 1.1 tron 325 1.1 tron <li> <a href="#fail_before_220">When tests fail before the 220 SMTP server greeting</a> 326 1.1 tron 327 1.1 tron </ul> 328 1.1 tron 329 1.1 tron <h3> <a name="pregreet"> Pregreet test </a> </h3> 330 1.1 tron 331 1.1 tron <p> The SMTP protocol is a classic example of a protocol where the 332 1.1 tron server speaks before the client. <a href="postscreen.8.html">postscreen(8)</a> detects zombies 333 1.1 tron that are in a hurry and that speak before their turn. This test is 334 1.1 tron enabled by default. </p> 335 1.1 tron 336 1.1 tron <p> The <a href="postconf.5.html#postscreen_greet_banner">postscreen_greet_banner</a> parameter specifies the <i>text</i> 337 1.1 tron portion of a "220-<i>text</i>..." teaser banner (default: $<a href="postconf.5.html#smtpd_banner">smtpd_banner</a>). 338 1.1 tron Note that this becomes the first part of a multi-line server greeting. 339 1.1 tron The <a href="postscreen.8.html">postscreen(8)</a> daemon sends this before the <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> 340 1.1 tron timer is started. The purpose of the teaser banner is to confuse 341 1.1 tron zombies so that they speak before their turn. It has no effect on 342 1.1 tron SMTP clients that correctly implement the protocol. </p> 343 1.1 tron 344 1.1 tron <p> To avoid problems with poorly-implemented SMTP engines in network 345 1.1 tron appliances or network testing tools, either exclude them from all 346 1.1 tron tests with the <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> feature or else specify 347 1.1 tron an empty teaser banner: </p> 348 1.1 tron 349 1.1 tron <pre> 350 1.1 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 351 1.1 tron # Exclude broken clients by whitelisting. Clients in <a href="postconf.5.html#mynetworks">mynetworks</a> 352 1.1 tron # should always be whitelisted. 353 1.1 tron <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, 354 1.1 tron <a href="cidr_table.5.html">cidr</a>:/etc/postfix/postscreen_access.cidr 355 1.1 tron 356 1.1 tron /etc/postfix/postscreen_access.<a href="cidr_table.5.html">cidr</a>: 357 1.1 tron 192.168.254.0/24 permit 358 1.1 tron </pre> 359 1.1 tron 360 1.1 tron <pre> 361 1.1 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 362 1.1 tron # Disable the teaser banner (try whitelisting first if you can). 363 1.1 tron <a href="postconf.5.html#postscreen_greet_banner">postscreen_greet_banner</a> = 364 1.1 tron </pre> 365 1.1 tron 366 1.1 tron <p> When an SMTP client sends a command before the 367 1.1 tron <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> time has elapsed, <a href="postscreen.8.html">postscreen(8)</a> logs this as: 368 1.1 tron </p> 369 1.1 tron 370 1.1 tron <pre> 371 1.1 tron <b>PREGREET</b> <i>count</i> <b>after</b> <i>time</i> <b>from</b> <i>[address]:port text...</i> 372 1.1 tron </pre> 373 1.1 tron 374 1.1 tron <p> Translation: the client at <i>[address]:port</i> sent <i>count</i> 375 1.1 tron bytes before its turn to speak. This happened <i>time</i> seconds 376 1.1 tron after the <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> timer was started. The <i>text</i> 377 1.1 tron is what the client sent (truncated to 100 bytes, and with non-printable 378 1.1 tron characters replaced with C-style escapes such as \r for carriage-return 379 1.1 tron and \n for newline). </p> 380 1.1 tron 381 1.1 tron <p> The <a href="postconf.5.html#postscreen_greet_action">postscreen_greet_action</a> parameter specifies the action that 382 1.1 tron is taken next. See "<a href="#fail_before_220">When tests fail 383 1.1 tron before the 220 SMTP server greeting</a>" below. </p> 384 1.1 tron 385 1.1 tron <h3> <a name="dnsbl"> DNS White/blacklist test </a> </h3> 386 1.1 tron 387 1.1 tron <p> The <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> parameter (default: empty) specifies 388 1.1 tron a list of DNS blocklist servers with optional filters and weight 389 1.1 tron factors (positive weights for blacklisting, negative for whitelisting). 390 1.1 tron These servers will be queried in parallel with the reverse client 391 1.1 tron IP address. This test is disabled by default. </p> 392 1.1 tron 393 1.1 tron <blockquote> 394 1.1 tron <p> 395 1.1 tron CAUTION: when postscreen rejects mail, its SMTP reply contains the 396 1.1 tron DNSBL domain name. Use the <a href="postconf.5.html#postscreen_dnsbl_reply_map">postscreen_dnsbl_reply_map</a> feature to 397 1.1 tron hide "password" information in DNSBL domain names. 398 1.1 tron </p> 399 1.1 tron </blockquote> 400 1.1 tron 401 1.1 tron <p> When the <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> time has elapsed, and the combined 402 1.1 tron DNSBL score is equal to or greater than the <a href="postconf.5.html#postscreen_dnsbl_threshold">postscreen_dnsbl_threshold</a> 403 1.1 tron parameter value, <a href="postscreen.8.html">postscreen(8)</a> logs this as: </p> 404 1.1 tron 405 1.1 tron <pre> 406 1.1 tron <b>DNSBL rank</b> <i>count</i> <b>for</b> <i>[address]:port</i> 407 1.1 tron </pre> 408 1.1 tron 409 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> has a combined 410 1.1 tron DNSBL score of <i>count</i>. </p> 411 1.1 tron 412 1.1 tron <p> The <a href="postconf.5.html#postscreen_dnsbl_action">postscreen_dnsbl_action</a> parameter specifies the action that 413 1.1 tron is taken when the combined DNSBL score is equal to or greater than 414 1.1 tron the threshold. See "<a href="#fail_before_220">When tests fail 415 1.1 tron before the 220 SMTP server greeting</a>" below. </p> 416 1.1 tron 417 1.1 tron <h3> <a name="fail_before_220">When tests fail before the 220 SMTP server greeting</a> </h3> 418 1.1 tron 419 1.1 tron <p> When the client address matches the permanent blacklist, or 420 1.1 tron when the client fails the pregreet or DNSBL tests, the action is 421 1.1 tron specified with <a href="postconf.5.html#postscreen_blacklist_action">postscreen_blacklist_action</a>, <a href="postconf.5.html#postscreen_greet_action">postscreen_greet_action</a>, 422 1.1 tron or <a href="postconf.5.html#postscreen_dnsbl_action">postscreen_dnsbl_action</a>, respectively. </p> 423 1.1 tron 424 1.1 tron <dl> 425 1.1 tron 426 1.1 tron <dt> <b>ignore</b> (default) </dt> 427 1.1 tron 428 1.1 tron <dd> Ignore the failure of this test. Allow other tests to complete. 429 1.1 tron Repeat this test the next time the client connects. This option 430 1.1 tron is useful for testing and collecting statistics without blocking 431 1.1 tron mail. </dd> 432 1.1 tron 433 1.1 tron <dt> <b>enforce</b> </dt> 434 1.1 tron 435 1.1 tron <dd> Allow other tests to complete. Reject attempts to deliver mail 436 1.1 tron with a 550 SMTP reply, and log the helo/sender/recipient information. 437 1.1 tron Repeat this test the next time the client connects. </dd> 438 1.1 tron 439 1.1 tron <dt> <b>drop</b> </dt> 440 1.1 tron 441 1.1 tron <dd> Drop the connection immediately with a 521 SMTP reply. Repeat 442 1.1 tron this test the next time the client connects. </dd> 443 1.1 tron 444 1.1 tron </dl> 445 1.1 tron 446 1.1 tron <h2> <a name="after_220">Tests after the 220 SMTP server greeting</a> </h2> 447 1.1 tron 448 1.1 tron <p> In this phase of the protocol, <a href="postscreen.8.html">postscreen(8)</a> implements a 449 1.1 tron number of "deep protocol" tests. These tests use an SMTP protocol 450 1.1 tron engine that is built into the <a href="postscreen.8.html">postscreen(8)</a> server. </p> 451 1.1 tron 452 1.1.1.4 tron <p> Important note: these protocol tests are disabled by default. 453 1.1 tron They are more intrusive than the pregreet and DNSBL tests, and they 454 1.1 tron have limitations as discussed next. </p> 455 1.1 tron 456 1.1 tron <ul> 457 1.1 tron 458 1.1.1.4 tron <li> <p> The main limitation of "after 220 greeting" tests is that 459 1.1.1.4 tron a new client must disconnect after passing these tests (reason: 460 1.1.1.4 tron postscreen is not a proxy). Then the client must reconnect from 461 1.1.1.4 tron the same IP address before it can deliver mail. The following 462 1.1.1.4 tron measures may help to avoid email delays: </p> 463 1.1 tron 464 1.1.1.4 tron <ul> 465 1.1.1.4 tron 466 1.1.1.4 tron <li> <p> Allow "good" clients to skip tests with the 467 1.1.1.4 tron <a href="postconf.5.html#postscreen_dnsbl_whitelist_threshold">postscreen_dnsbl_whitelist_threshold</a> feature (Postfix 2.11 and 468 1.1.1.4 tron later). This is especially effective for sites such as Google that 469 1.1.1.4 tron never retry immediately from the same IP address. </p> 470 1.1.1.4 tron 471 1.1.1.4 tron <li> <p> Small sites: Configure <a href="postscreen.8.html">postscreen(8)</a> to listen on multiple 472 1.1.1.4 tron IP addresses, published in DNS as different IP addresses for the 473 1.1.1.4 tron same MX hostname or for different MX hostnames. This avoids mail 474 1.1.1.4 tron delivery delays with clients that reconnect immediately from the 475 1.1.1.4 tron same IP address. </p> 476 1.1.1.4 tron 477 1.1.1.4 tron <li> <p> Large sites: Share the <a href="postscreen.8.html">postscreen(8)</a> cache between different 478 1.1.1.4 tron Postfix MTAs with a large-enough <a href="memcache_table.5.html">memcache_table(5)</a>. Again, this 479 1.1.1.4 tron avoids mail delivery delays with clients that reconnect immediately 480 1.1.1.4 tron from the same IP address. </p> 481 1.1 tron 482 1.1 tron </ul> 483 1.1 tron 484 1.1.1.4 tron <li> <p> <a href="postscreen.8.html">postscreen(8)</a>'s built-in SMTP engine does not implement the 485 1.1.1.4 tron AUTH, XCLIENT, and XFORWARD features. If you need to make these 486 1.1.1.4 tron services available on port 25, then do not enable the tests after 487 1.1.1.4 tron the 220 server greeting. </p> 488 1.1.1.4 tron 489 1.1.1.4 tron <li> <p> End-user clients should connect directly to the submission 490 1.1 tron service, so that they never have to deal with <a href="postscreen.8.html">postscreen(8)</a>'s tests. 491 1.1 tron </p> 492 1.1 tron 493 1.1.1.4 tron </ul> 494 1.1.1.4 tron 495 1.1.1.4 tron <p> The following "after 220 greeting" tests are available: </p> 496 1.1.1.4 tron 497 1.1 tron <ul> 498 1.1 tron 499 1.1 tron <li> <a href="#pipelining">Command pipelining test</a> 500 1.1 tron 501 1.1 tron <li> <a href="#non_smtp">Non-SMTP command test</a> 502 1.1 tron 503 1.1 tron <li> <a href="#barelf">Bare newline test</a> 504 1.1 tron 505 1.1 tron <li> <a href="#fail_after_220">When tests fail after the 220 SMTP server greeting</a> 506 1.1 tron 507 1.1 tron </ul> 508 1.1 tron 509 1.1 tron <h3> <a name="pipelining">Command pipelining test</a> </h3> 510 1.1 tron 511 1.1 tron <p> By default, SMTP is a half-duplex protocol: the sender and 512 1.1 tron receiver send one command and one response at a time. Unlike the 513 1.1 tron Postfix SMTP server, <a href="postscreen.8.html">postscreen(8)</a> does not announce support 514 1.1 tron for ESMTP command pipelining. Therefore, clients are not allowed 515 1.1 tron to send multiple commands. postscreen(8)'s <a href="#after_220">deep 516 1.1 tron protocol test</a> for this is disabled by default. </p> 517 1.1 tron 518 1.1 tron <p> With "<a href="postconf.5.html#postscreen_pipelining_enable">postscreen_pipelining_enable</a> = yes", <a href="postscreen.8.html">postscreen(8)</a> detects 519 1.1 tron zombies that send multiple commands, instead of sending one command 520 1.1 tron and waiting for the server to reply. </p> 521 1.1 tron 522 1.1 tron <p> This test is opportunistically enabled when <a href="postscreen.8.html">postscreen(8)</a> has 523 1.1 tron to use the built-in SMTP engine anyway. This is to make <a href="postscreen.8.html">postscreen(8)</a> 524 1.1 tron logging more informative. </p> 525 1.1 tron 526 1.1 tron <p> When a client sends multiple commands, <a href="postscreen.8.html">postscreen(8)</a> logs this 527 1.1 tron as: </p> 528 1.1 tron 529 1.1 tron <pre> 530 1.1.1.2 tron <b>COMMAND PIPELINING from</b> <i>[address]:port</i> <b>after</b> <i>command</i>: <i>text</i> 531 1.1 tron </pre> 532 1.1 tron 533 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> sent 534 1.1 tron multiple SMTP commands, instead of sending one command and then 535 1.1 tron waiting for the server to reply. This happened after the client 536 1.1.1.2 tron sent <i>command</i>. The <i>text</i> shows part of the input that 537 1.1.1.2 tron was sent too early; it is not logged with Postfix 2.8. </p> 538 1.1 tron 539 1.1 tron <p> The <a href="postconf.5.html#postscreen_pipelining_action">postscreen_pipelining_action</a> parameter specifies the action 540 1.1 tron that is taken next. See "<a href="#fail_after_220">When tests fail 541 1.1 tron after the 220 SMTP server greeting</a>" below. </p> 542 1.1 tron 543 1.1 tron <h3> <a name="non_smtp">Non-SMTP command test</a> </h3> 544 1.1 tron 545 1.1 tron <p> Some spambots send their mail through open proxies. A symptom 546 1.1 tron of this is the usage of commands such as CONNECT and other non-SMTP 547 1.1 tron commands. Just like the Postfix SMTP server's <a href="postconf.5.html#smtpd_forbidden_commands">smtpd_forbidden_commands</a> 548 1.1 tron feature, <a href="postscreen.8.html">postscreen(8)</a> has an equivalent <a href="postconf.5.html#postscreen_forbidden_commands">postscreen_forbidden_commands</a> 549 1.1 tron feature to block these clients. postscreen(8)'s <a href="#after_220">deep 550 1.1 tron protocol test</a> for this is disabled by default. </p> 551 1.1 tron 552 1.1 tron <p> With "<a href="postconf.5.html#postscreen_non_smtp_command_enable">postscreen_non_smtp_command_enable</a> = yes", <a href="postscreen.8.html">postscreen(8)</a> 553 1.1 tron detects zombies that send commands specified with the 554 1.1 tron <a href="postconf.5.html#postscreen_forbidden_commands">postscreen_forbidden_commands</a> parameter. This also detects commands 555 1.1 tron with the syntax of a message header label. The latter is a symptom 556 1.1 tron that the client is sending message content after ignoring all the 557 1.1 tron responses from <a href="postscreen.8.html">postscreen(8)</a> that reject mail. </p> 558 1.1 tron 559 1.1 tron <p> This test is opportunistically enabled when <a href="postscreen.8.html">postscreen(8)</a> has 560 1.1 tron to use the built-in SMTP engine anyway. This is to make <a href="postscreen.8.html">postscreen(8)</a> 561 1.1 tron logging more informative. </p> 562 1.1 tron 563 1.1 tron <p> When a client sends non-SMTP commands, <a href="postscreen.8.html">postscreen(8)</a> logs this 564 1.1 tron as: </p> 565 1.1 tron 566 1.1 tron <pre> 567 1.1.1.3 tron <b>NON-SMTP COMMAND from</b> <i>[address]:port</i> <b>after</b> <i>command: text</i> 568 1.1 tron </pre> 569 1.1 tron 570 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> sent a 571 1.1.1.3 tron command that matches the <a href="postconf.5.html#postscreen_forbidden_commands">postscreen_forbidden_commands</a> 572 1.1.1.3 tron parameter, or that has the syntax of a message header label (text 573 1.1.1.3 tron followed by optional space and ":"). 574 1.1.1.3 tron The "<tt><b>after</b> <i>command</i></tt>" portion is logged with 575 1.1.1.3 tron Postfix 2.10 and later. </p> 576 1.1 tron 577 1.1 tron <p> The <a href="postconf.5.html#postscreen_non_smtp_command_action">postscreen_non_smtp_command_action</a> parameter specifies 578 1.1 tron the action that is taken next. See "<a href="#fail_after_220">When 579 1.1 tron tests fail after the 220 SMTP server greeting</a>" below. </p> 580 1.1 tron 581 1.1 tron <h3> <a name="barelf">Bare newline test</a> </h3> 582 1.1 tron 583 1.1 tron <p> SMTP is a line-oriented protocol: lines have a limited length, 584 1.1 tron and are terminated with <CR><LF>. Lines ending in a 585 1.1 tron "bare" <LF>, that is newline not preceded by carriage return, 586 1.1 tron are not allowed in SMTP. postscreen(8)'s <a href="#after_220">deep 587 1.1 tron protocol test</a> for this is disabled by default. </p> 588 1.1 tron 589 1.1 tron <p> With "<a href="postconf.5.html#postscreen_bare_newline_enable">postscreen_bare_newline_enable</a> = yes", <a href="postscreen.8.html">postscreen(8)</a> 590 1.1 tron detects clients that send lines ending in bare newline characters. 591 1.1 tron </p> 592 1.1 tron 593 1.1 tron <p> This test is opportunistically enabled when <a href="postscreen.8.html">postscreen(8)</a> has 594 1.1 tron to use the built-in SMTP engine anyway. This is to make <a href="postscreen.8.html">postscreen(8)</a> 595 1.1 tron logging more informative. </p> 596 1.1 tron 597 1.1 tron <p> When a client sends bare newline characters, <a href="postscreen.8.html">postscreen(8)</a> logs 598 1.1 tron this as: 599 1.1 tron </p> 600 1.1 tron 601 1.1 tron <pre> 602 1.1.1.3 tron <b>BARE NEWLINE from</b> <i>[address]:port</i> <b>after</b> <i>command</i> 603 1.1 tron </pre> 604 1.1 tron 605 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> sent a bare 606 1.1 tron newline character, that is newline not preceded by carriage 607 1.1.1.3 tron return. 608 1.1.1.3 tron The "<tt><b>after</b> <i>command</i></tt>" portion is logged with 609 1.1.1.3 tron Postfix 2.10 and later. </p> 610 1.1 tron 611 1.1 tron <p> The <a href="postconf.5.html#postscreen_bare_newline_action">postscreen_bare_newline_action</a> parameter specifies the 612 1.1 tron action that is taken next. See "<a href="#fail_after_220">When 613 1.1 tron tests fail after the 220 SMTP server greeting</a>" below. </p> 614 1.1 tron 615 1.1 tron <h3> <a name="fail_after_220">When tests fail after the 220 SMTP server greeting</a> </h3> 616 1.1 tron 617 1.1 tron <p> When the client fails the pipelining, non-SMTP command or bare 618 1.1 tron newline tests, the action is specified with <a href="postconf.5.html#postscreen_pipelining_action">postscreen_pipelining_action</a>, 619 1.1 tron <a href="postconf.5.html#postscreen_non_smtp_command_action">postscreen_non_smtp_command_action</a> or <a href="postconf.5.html#postscreen_bare_newline_action">postscreen_bare_newline_action</a>, 620 1.1 tron respectively. </p> 621 1.1 tron 622 1.1 tron <dl> 623 1.1 tron 624 1.1 tron <dt> <b>ignore</b> (default for bare newline) </dt> 625 1.1 tron 626 1.1 tron <dd> Ignore the failure of this test. Allow other tests to complete. 627 1.1 tron Do NOT repeat this test before the result from some other test 628 1.1 tron expires. 629 1.1 tron 630 1.1 tron This option is useful for testing and collecting statistics without 631 1.1 tron blocking mail permanently. </dd> 632 1.1 tron 633 1.1 tron <dt> <b>enforce</b> (default for pipelining) </dt> 634 1.1 tron 635 1.1 tron <dd> Allow other tests to complete. Reject attempts to deliver 636 1.1 tron mail with a 550 SMTP reply, and log the helo/sender/recipient 637 1.1 tron information. Repeat this test the next time the client connects. 638 1.1 tron </dd> 639 1.1 tron 640 1.1 tron <dt> <b>drop</b> (default for non-SMTP commands) </dt> 641 1.1 tron 642 1.1 tron <dd> Drop the connection immediately with a 521 SMTP reply. Repeat 643 1.1 tron this test the next time the client connects. This action is 644 1.1 tron compatible with the Postfix SMTP server's <a href="postconf.5.html#smtpd_forbidden_commands">smtpd_forbidden_commands</a> 645 1.1 tron feature. </dd> 646 1.1 tron 647 1.1 tron </dl> 648 1.1 tron 649 1.1 tron <h2> <a name="other_error">Other errors</a> </h2> 650 1.1 tron 651 1.1.1.2 tron <p> When an SMTP client hangs up unexpectedly, <a href="postscreen.8.html">postscreen(8)</a> logs 652 1.1.1.2 tron this as: </p> 653 1.1 tron 654 1.1 tron <pre> 655 1.1 tron <b>HANGUP after</b> <i>time</i> <b>from</b> <i>[address]:port</i> <b>in</b> <i>test name</i> 656 1.1 tron </pre> 657 1.1 tron 658 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> disconnected 659 1.1 tron unexpectedly, <i>time</i> seconds after the start of the 660 1.1 tron test named <i>test name</i>. </p> 661 1.1 tron 662 1.1.1.2 tron <p> There is no punishment for hanging up. A client that hangs up 663 1.1.1.2 tron without sending the QUIT command can still pass all <a href="postscreen.8.html">postscreen(8)</a> 664 1.1.1.2 tron tests. </p> 665 1.1.1.2 tron 666 1.1 tron <!-- 667 1.1 tron 668 1.1 tron <p> While an unexpired penalty is in effect, an SMTP client is not 669 1.1 tron allowed to pass any tests, and <a href="postscreen.8.html">postscreen(8)</a> logs each connection 670 1.1 tron with the remaining amount of penalty time as: </p> 671 1.1 tron 672 1.1 tron <pre> 673 1.1 tron <b>PENALTY</b> <i>time</i> <b>for</b> <i>[address]:port</i> 674 1.1 tron </pre> 675 1.1 tron 676 1.1 tron <p> During this time, all attempts by the client to deliver mail 677 1.1 tron will be deferred with a 450 SMTP status. </p> 678 1.1 tron 679 1.1 tron --> 680 1.1 tron 681 1.1 tron <p> The following errors are reported by the built-in SMTP engine. 682 1.1 tron This engine never accepts mail, therefore it has per-session limits 683 1.1 tron on the number of commands and on the session length. </p> 684 1.1 tron 685 1.1 tron <pre> 686 1.1.1.3 tron <b>COMMAND TIME LIMIT</b> <b>from</b> <i>[address]:port</i> <b>after</b> <i>command</i> 687 1.1 tron </pre> 688 1.1 tron 689 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> reached the 690 1.1 tron per-command time limit as specified with the <a href="postconf.5.html#postscreen_command_time_limit">postscreen_command_time_limit</a> 691 1.1.1.3 tron parameter. The session is terminated immediately. 692 1.1.1.3 tron The "<tt><b>after</b> <i>command</i></tt>" portion is logged with 693 1.1.1.3 tron Postfix 2.10 and later. </p> 694 1.1 tron 695 1.1 tron <pre> 696 1.1.1.3 tron <b>COMMAND COUNT LIMIT from</b> <i>[address]:port</i> <b>after</b> <i>command</i> 697 1.1 tron </pre> 698 1.1 tron 699 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> reached the 700 1.1 tron per-session command count limit as specified with the 701 1.1 tron <a href="postconf.5.html#postscreen_command_count_limit">postscreen_command_count_limit</a> parameter. The session is terminated 702 1.1.1.3 tron immediately. 703 1.1.1.3 tron The "<tt><b>after</b> <i>command</i></tt>" portion is logged with 704 1.1.1.3 tron Postfix 2.10 and later. </p> 705 1.1 tron 706 1.1 tron <pre> 707 1.1.1.3 tron <b>COMMAND LENGTH LIMIT from</b> <i>[address]:port</i> <b>after</b> <i>command</i> 708 1.1 tron </pre> 709 1.1 tron 710 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> reached the 711 1.1 tron per-command length limit, as specified with the <a href="postconf.5.html#line_length_limit">line_length_limit</a> 712 1.1.1.3 tron parameter. The session is terminated immediately. 713 1.1.1.3 tron The "<tt><b>after</b> <i>command</i></tt>" portion is logged with 714 1.1.1.3 tron Postfix 2.10 and later. </p> 715 1.1 tron 716 1.1 tron <p> When an SMTP client makes too many connections at the same time, 717 1.1 tron or when all <a href="postscreen.8.html">postscreen(8)</a> ports are busy, <a href="postscreen.8.html">postscreen(8)</a> rejects the 718 1.1 tron connection with a 421 status code and logs: </p> 719 1.1 tron 720 1.1 tron <pre> 721 1.1 tron <b>NOQUEUE: reject: CONNECT from</b> <i>[address]:port</i><b>: too many connections</b> 722 1.1 tron <b>NOQUEUE: reject: CONNECT from</b> <i>[address]:port</i><b>: all server ports busy</b> 723 1.1 tron </pre> 724 1.1 tron 725 1.1 tron <p> The <a href="postconf.5.html#postscreen_client_connection_count_limit">postscreen_client_connection_count_limit</a> and 726 1.1 tron <a href="postconf.5.html#postscreen_pre_queue_limit">postscreen_pre_queue_limit</a> parameters control these limits. </p> 727 1.1 tron 728 1.1 tron <h2> <a name="victory">When all tests succeed</a> </h2> 729 1.1 tron 730 1.1 tron <p> When a new SMTP client passes all tests (i.e. it is not whitelisted 731 1.1 tron via some mechanism), <a href="postscreen.8.html">postscreen(8)</a> logs this as: </p> 732 1.1 tron 733 1.1 tron <pre> 734 1.1 tron <b>PASS NEW</b> <i>[address]:port</i> 735 1.1 tron </pre> 736 1.1 tron 737 1.1 tron <p> Where <i>[address]:port</i> are the client IP address and port. 738 1.1 tron Then, <a href="postscreen.8.html">postscreen(8)</a> 739 1.1 tron creates a temporary whitelist entry that excludes the client IP 740 1.1 tron address from further tests until the temporary whitelist entry 741 1.1 tron expires, as controlled with the postscreen_*_ttl parameters. </p> 742 1.1 tron 743 1.1 tron <p> When no "<a href="#after_220">deep protocol tests</a>" are 744 1.1 tron configured, <a href="postscreen.8.html">postscreen(8)</a> hands off the "live" connection to a Postfix 745 1.1 tron SMTP server process. The client can then continue as if <a href="postscreen.8.html">postscreen(8)</a> 746 1.1 tron never even existed (except for the short <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> delay). 747 1.1 tron </p> 748 1.1 tron 749 1.1 tron <p> When any "<a href="#after_220">deep protocol tests</a>" are 750 1.1 tron configured, <a href="postscreen.8.html">postscreen(8)</a> cannot hand off the "live" connection to 751 1.1 tron a Postfix SMTP server process in the middle of the session. Instead, 752 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> defers mail delivery attempts with a 4XX status, logs 753 1.1 tron the helo/sender/recipient information, and waits for the client to 754 1.1 tron disconnect. The next time the client connects it will be allowed 755 1.1 tron to talk to a Postfix SMTP server process to deliver its mail. 756 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> mitigates the impact of this limitation by giving 757 1.1 tron <a href="#after_220">deep protocol tests</a> a long expiration 758 1.1 tron time. </p> 759 1.1 tron 760 1.1 tron <h2> <a name="config"> Configuring the postscreen(8) service</a> 761 1.1 tron </h2> 762 1.1 tron 763 1.1 tron <p> <a href="postscreen.8.html">postscreen(8)</a> has been tested on FreeBSD [4-8], Linux 2.[4-6] 764 1.1 tron and Solaris 9 systems. </p> 765 1.1 tron 766 1.1 tron <ul> 767 1.1 tron 768 1.1 tron <li> <a href="#enable"> Turning on postscreen(8) without blocking 769 1.1 tron mail</a> 770 1.1 tron 771 1.1 tron <li> <a href="#starttls"> postscreen(8) TLS configuration </a> 772 1.1 tron 773 1.1 tron <li> <a href="#blocking"> Blocking mail with postscreen(8) </a> 774 1.1 tron 775 1.1 tron <li> <a href="#turnoff"> Turning off postscreen(8) </a> 776 1.1 tron 777 1.1.1.4 tron <li> <a href="#temp_white_sharing"> Sharing the temporary whitelist 778 1.1.1.4 tron </a> 779 1.1.1.4 tron 780 1.1 tron </ul> 781 1.1 tron 782 1.1 tron <h3> <a name="enable"> Turning on postscreen(8) without blocking mail</a> </h3> 783 1.1 tron 784 1.1 tron <p> To enable the <a href="postscreen.8.html">postscreen(8)</a> service and log client information 785 1.1 tron without blocking mail: </p> 786 1.1 tron 787 1.1 tron <ol> 788 1.1 tron 789 1.1 tron <li> <p> Make sure that local clients and systems with non-standard 790 1.1 tron SMTP implementations are excluded from any <a href="postscreen.8.html">postscreen(8)</a> tests. The 791 1.1 tron default is to exclude all clients in <a href="postconf.5.html#mynetworks">mynetworks</a>. To exclude additional 792 1.1 tron clients, for example, third-party performance monitoring tools (these 793 1.1 tron tend to have broken SMTP implementations): </p> 794 1.1 tron 795 1.1 tron <pre> 796 1.1 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 797 1.1 tron # Exclude broken clients by whitelisting. Clients in <a href="postconf.5.html#mynetworks">mynetworks</a> 798 1.1 tron # should always be whitelisted. 799 1.1 tron <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, 800 1.1 tron <a href="cidr_table.5.html">cidr</a>:/etc/postfix/postscreen_access.cidr 801 1.1 tron 802 1.1 tron /etc/postfix/postscreen_access.<a href="cidr_table.5.html">cidr</a>: 803 1.1 tron 192.168.254.0/24 permit 804 1.1 tron </pre> 805 1.1 tron 806 1.1 tron <li> <p> Comment out the "<tt>smtp inet ... smtpd</tt>" service 807 1.1 tron in <a href="master.5.html">master.cf</a>, including any "<tt>-o parameter=value</tt>" entries 808 1.1 tron that follow. </p> 809 1.1 tron 810 1.1 tron <pre> 811 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 812 1.1 tron #smtp inet n - n - - smtpd 813 1.1 tron # -o parameter=value ... 814 1.1 tron </pre> 815 1.1 tron 816 1.1 tron <li> <p> Uncomment the new "<tt>smtpd pass ... smtpd</tt>" service 817 1.1 tron in <a href="master.5.html">master.cf</a>, and duplicate any "<tt>-o parameter=value</tt>" entries 818 1.1 tron from the smtpd service that was commented out in the previous step. 819 1.1 tron </p> 820 1.1 tron 821 1.1 tron <pre> 822 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 823 1.1 tron smtpd pass - - n - - smtpd 824 1.1 tron -o parameter=value ... 825 1.1 tron </pre> 826 1.1 tron 827 1.1 tron <li> <p> Uncomment the new "<tt>smtp inet ... postscreen</tt>" 828 1.1 tron service in <a href="master.5.html">master.cf</a>. </p> 829 1.1 tron 830 1.1 tron <pre> 831 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 832 1.1 tron smtp inet n - n - 1 postscreen 833 1.1 tron </pre> 834 1.1 tron 835 1.1 tron <li> <p> Uncomment the new "<tt>tlsproxy unix ... tlsproxy</tt>" 836 1.1 tron service in <a href="master.5.html">master.cf</a>. This service implements STARTTLS support for 837 1.1 tron <a href="postscreen.8.html">postscreen(8)</a>. </p> 838 1.1 tron 839 1.1 tron <pre> 840 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 841 1.1 tron tlsproxy unix - - n - 0 tlsproxy 842 1.1 tron </pre> 843 1.1 tron 844 1.1 tron <li> <p> Uncomment the new "<tt>dnsblog unix ... dnsblog</tt>" 845 1.1 tron service in <a href="master.5.html">master.cf</a>. This service does DNSBL lookups for <a href="postscreen.8.html">postscreen(8)</a> 846 1.1 tron and logs results. </p> 847 1.1 tron 848 1.1 tron <pre> 849 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 850 1.1 tron dnsblog unix - - n - 0 dnsblog 851 1.1 tron </pre> 852 1.1 tron 853 1.1 tron <li> <p> To enable DNSBL lookups, list some DNS blocklist sites in 854 1.1 tron <a href="postconf.5.html">main.cf</a>, separated by whitespace. Different sites can have different 855 1.1 tron weights. For example: 856 1.1 tron 857 1.1 tron <pre> 858 1.1 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 859 1.1 tron <a href="postconf.5.html#postscreen_dnsbl_threshold">postscreen_dnsbl_threshold</a> = 2 860 1.1 tron <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> = zen.spamhaus.org*2 861 1.1 tron bl.spamcop.net*1 b.barracudacentral.org*1 862 1.1 tron </pre> 863 1.1 tron 864 1.1 tron <p> Note: if your DNSBL queries have a "secret" in the domain name, 865 1.1 tron you must censor this information from the <a href="postscreen.8.html">postscreen(8)</a> SMTP replies. 866 1.1 tron For example: </p> 867 1.1 tron 868 1.1 tron <pre> 869 1.1 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 870 1.1.1.2 tron <a href="postconf.5.html#postscreen_dnsbl_reply_map">postscreen_dnsbl_reply_map</a> = <a href="DATABASE_README.html#types">texthash</a>:/etc/postfix/dnsbl_reply 871 1.1 tron </pre> 872 1.1 tron 873 1.1 tron <pre> 874 1.1 tron /etc/postfix/dnsbl_reply: 875 1.1.1.5 christos # Secret DNSBL name Name in <a href="postscreen.8.html">postscreen(8)</a> replies 876 1.1.1.5 christos secret.zen.dq.spamhaus.net zen.spamhaus.org 877 1.1 tron </pre> 878 1.1 tron 879 1.1.1.4 tron <p> The <a href="DATABASE_README.html#types">texthash</a>: format is similar to <a href="DATABASE_README.html#types">hash</a>: except that there is 880 1.1 tron no need to run <a href="postmap.1.html">postmap(1)</a> before the file can be used, and that it 881 1.1 tron does not detect changes after the file is read. It is new with 882 1.1 tron Postfix version 2.8. </p> 883 1.1 tron 884 1.1 tron <li> <p> Read the new configuration with "<tt>postfix reload</tt>". 885 1.1 tron </p> 886 1.1 tron 887 1.1 tron </ol> 888 1.1 tron 889 1.1 tron <p> Notes: </p> 890 1.1 tron 891 1.1 tron <ul> 892 1.1 tron 893 1.1 tron <li> <p> Some <a href="postscreen.8.html">postscreen(8)</a> configuration parameters implement 894 1.1 tron stress-dependent behavior. This is supported only when the default 895 1.1.1.2 tron value is stress-dependent (that is, "postconf -d <i>parametername</i>" 896 1.1.1.2 tron output shows "<i>parametername</i> = 897 1.1.1.2 tron ${stress?<i>something</i>}${stress:<i>something</i>}"). 898 1.1 tron Other parameters always evaluate as if the stress value is the empty 899 1.1 tron string. </p> 900 1.1 tron 901 1.1 tron <li> <p> See "<a href="#before_220">Tests before the 220 SMTP server 902 1.1 tron greeting</a>" for details about the logging from these postscreen(8) 903 1.1 tron tests. </p> 904 1.1 tron 905 1.1 tron <li> <p> If you run Postfix 2.6 or earlier you must stop and start 906 1.1 tron the master daemon ("<tt>postfix stop; postfix start</tt>"). This 907 1.1 tron is needed because the Postfix "pass" master service type did not 908 1.1 tron work reliably on all systems. </p> 909 1.1 tron 910 1.1 tron </ul> 911 1.1 tron 912 1.1 tron <h3> <a name="starttls"> postscreen(8) TLS configuration </a> </h3> 913 1.1 tron 914 1.1 tron <p> <a href="postscreen.8.html">postscreen(8)</a> TLS support is available for remote SMTP clients 915 1.1 tron that aren't whitelisted, including clients that need to renew their 916 1.1 tron temporary whitelist status. When a remote SMTP client requests TLS 917 1.1 tron service, <a href="postscreen.8.html">postscreen(8)</a> invisibly hands off the connection to a 918 1.1 tron <a href="tlsproxy.8.html">tlsproxy(8)</a> process. Then, <a href="tlsproxy.8.html">tlsproxy(8)</a> encrypts and decrypts the 919 1.1 tron traffic between <a href="postscreen.8.html">postscreen(8)</a> and the remote SMTP client. One 920 1.1 tron <a href="tlsproxy.8.html">tlsproxy(8)</a> process can handle multiple SMTP sessions. The number 921 1.1 tron of <a href="tlsproxy.8.html">tlsproxy(8)</a> processes slowly increases with server load, but it 922 1.1 tron should always be much smaller than the number of <a href="postscreen.8.html">postscreen(8)</a> TLS 923 1.1 tron sessions. </p> 924 1.1 tron 925 1.1 tron <p> TLS support for <a href="postscreen.8.html">postscreen(8)</a> and <a href="tlsproxy.8.html">tlsproxy(8)</a> uses the same 926 1.1 tron parameters as with <a href="smtpd.8.html">smtpd(8)</a>. We recommend that you keep the relevant 927 1.1 tron configuration parameters in <a href="postconf.5.html">main.cf</a>. If you must specify "-o 928 1.1 tron smtpd_mumble=value" parameter overrides in <a href="master.5.html">master.cf</a> for a 929 1.1 tron postscreen-protected <a href="smtpd.8.html">smtpd(8)</a> service, then you should specify those 930 1.1 tron same parameter overrides for the <a href="postscreen.8.html">postscreen(8)</a> and <a href="tlsproxy.8.html">tlsproxy(8)</a> 931 1.1 tron services. </p> 932 1.1 tron 933 1.1 tron <h3> <a name="blocking"> Blocking mail with postscreen(8) </a> </h3> 934 1.1 tron 935 1.1 tron <p> For compatibility with <a href="smtpd.8.html">smtpd(8)</a>, <a href="postscreen.8.html">postscreen(8)</a> implements the 936 1.1 tron <a href="postconf.5.html#soft_bounce">soft_bounce</a> safety feature. This causes Postfix to reject mail with 937 1.1 tron a "try again" reply code. </p> 938 1.1 tron 939 1.1 tron <ul> 940 1.1 tron 941 1.1 tron <li> <p> To turn this on for all of Postfix, specify "<tt><a href="postconf.5.html#soft_bounce">soft_bounce</a> 942 1.1 tron = yes</tt>" in <a href="postconf.5.html">main.cf</a>. </p> 943 1.1 tron 944 1.1 tron <li> <p> To turn this on for <a href="postscreen.8.html">postscreen(8)</a> only, append "<tt>-o 945 1.1 tron <a href="postconf.5.html#soft_bounce">soft_bounce</a>=yes</tt>" (note: NO SPACES around '=') to the postscreen 946 1.1 tron entry in <a href="master.5.html">master.cf</a>. <p> 947 1.1 tron 948 1.1 tron </ul> 949 1.1 tron 950 1.1 tron <p> Execute "<tt>postfix reload</tt>" to make the change effective. </p> 951 1.1 tron 952 1.1 tron <p> After testing, do not forget to remove the <a href="postconf.5.html#soft_bounce">soft_bounce</a> feature, 953 1.1 tron otherwise senders won't receive their non-delivery notification 954 1.1 tron until many days later. </p> 955 1.1 tron 956 1.1 tron <p> To use the <a href="postscreen.8.html">postscreen(8)</a> service to block mail, edit <a href="postconf.5.html">main.cf</a> and 957 1.1 tron specify one or more of: </p> 958 1.1 tron 959 1.1 tron <ul> 960 1.1 tron 961 1.1 tron <li> <p> "<tt><a href="postconf.5.html#postscreen_dnsbl_action">postscreen_dnsbl_action</a> = enforce</tt>", to reject 962 1.1 tron clients that are on DNS blocklists, and to log the helo/sender/recipient 963 1.1 tron information. With good DNSBLs this reduces the amount of load on 964 1.1 tron Postfix SMTP servers dramatically. </p> 965 1.1 tron 966 1.1 tron <li> <p> "<tt><a href="postconf.5.html#postscreen_greet_action">postscreen_greet_action</a> = enforce</tt>", to reject 967 1.1 tron clients that talk before their turn, and to log the helo/sender/recipient 968 1.1 tron information. This stops over half of all known-to-be illegitimate 969 1.1 tron connections to Wietse's mail server. It is backup protection for 970 1.1 tron zombies that haven't yet been blacklisted. </p> 971 1.1 tron 972 1.1 tron <li> <p> You can also enable "<a href="#after_220">deep protocol 973 1.1 tron tests</a>", but these are more intrusive than the pregreet or DNSBL 974 1.1 tron tests. </p> 975 1.1 tron 976 1.1 tron <p> When a good client passes the "<a href="#after_220">deep 977 1.1 tron protocol tests</a>", postscreen(8) adds the client to the temporary 978 1.1 tron whitelist but it cannot hand off the "live" connection to a Postfix 979 1.1 tron SMTP server process in the middle of the session. Instead, <a href="postscreen.8.html">postscreen(8)</a> 980 1.1 tron defers mail delivery attempts with a 4XX status, logs the 981 1.1 tron helo/sender/recipient information, and waits for the client to 982 1.1 tron disconnect. </p> 983 1.1 tron 984 1.1 tron <p> When the good client comes back in a later session, it is allowed 985 1.1.1.5 christos to talk directly to a Postfix SMTP server. See "<a href="#after_220">Tests 986 1.1.1.5 christos after the 220 SMTP server greeting</a>" above for limitations with 987 1.1.1.5 christos AUTH and other features that clients may need. </p> 988 1.1 tron 989 1.1 tron <p> An unexpected benefit from "<a href="#after_220">deep protocol 990 1.1 tron tests</a>" is that some "good" clients don't return after the 4XX 991 1.1.1.5 christos reply; these clients were not so good after all. </p> 992 1.1.1.5 christos 993 1.1.1.5 christos <p> Unfortunately, some senders will retry requests from different 994 1.1.1.5 christos IP addresses, and may never get whitelisted. For this reason, 995 1.1.1.5 christos Wietse stopped using "<a href="#after_220">deep protocol tests</a>" 996 1.1.1.5 christos on his own internet-facing mail server. </p> 997 1.1 tron 998 1.1 tron <li> <p> There is also support for permanent blacklisting and 999 1.1 tron whitelisting; see the description of the <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> 1000 1.1 tron parameter for details. </p> 1001 1.1 tron 1002 1.1 tron </ul> 1003 1.1 tron 1004 1.1 tron <h3> <a name="turnoff"> Turning off postscreen(8) </a> </h3> 1005 1.1 tron 1006 1.1 tron <p> To turn off <a href="postscreen.8.html">postscreen(8)</a> and handle mail directly with Postfix 1007 1.1 tron SMTP server processes: </p> 1008 1.1 tron 1009 1.1 tron <ol> 1010 1.1 tron 1011 1.1 tron <li> <p> Comment out the "<tt>smtp inet ... postscreen</tt>" service 1012 1.1 tron in <a href="master.5.html">master.cf</a>, including any "<tt>-o parameter=value</tt>" entries 1013 1.1 tron that follow. </p> 1014 1.1 tron 1015 1.1 tron <pre> 1016 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 1017 1.1 tron #smtp inet n - n - 1 postscreen 1018 1.1 tron # -o parameter=value ... 1019 1.1 tron </pre> 1020 1.1 tron 1021 1.1 tron <li> <p> Comment out the "<tt>dnsblog unix ... dnsblog</tt>" service 1022 1.1 tron in <a href="master.5.html">master.cf</a>. </p> 1023 1.1 tron 1024 1.1 tron <pre> 1025 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 1026 1.1 tron #dnsblog unix - - n - 0 dnsblog 1027 1.1 tron </pre> 1028 1.1 tron 1029 1.1 tron <li> <p> Comment out the "<tt>smtpd pass ... smtpd</tt>" service 1030 1.1 tron in <a href="master.5.html">master.cf</a>, including any "<tt>-o parameter=value</tt>" entries 1031 1.1 tron that follow. </p> 1032 1.1 tron 1033 1.1 tron <pre> 1034 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 1035 1.1 tron #smtpd pass - - n - - smtpd 1036 1.1 tron # -o parameter=value ... 1037 1.1 tron </pre> 1038 1.1 tron 1039 1.1 tron <li> <p> Comment out the "<tt>tlsproxy unix ... tlsproxy</tt>" 1040 1.1 tron service in <a href="master.5.html">master.cf</a>, including any "<tt>-o parameter=value</tt>" 1041 1.1 tron entries that follow. </p> 1042 1.1 tron 1043 1.1 tron <pre> 1044 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 1045 1.1 tron #tlsproxy unix - - n - 0 tlsproxy 1046 1.1 tron # -o parameter=value ... 1047 1.1 tron </pre> 1048 1.1 tron 1049 1.1 tron <li> <p> Uncomment the "<tt>smtp inet ... smtpd</tt>" service in 1050 1.1 tron <a href="master.5.html">master.cf</a>, including any "<tt>-o parameter=value</tt>" entries that 1051 1.1 tron may follow. </p> 1052 1.1 tron 1053 1.1 tron <pre> 1054 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 1055 1.1 tron smtp inet n - n - - smtpd 1056 1.1 tron -o parameter=value ... 1057 1.1 tron </pre> 1058 1.1 tron 1059 1.1 tron <li> <p> Read the new configuration with "<tt>postfix reload</tt>". 1060 1.1 tron </p> 1061 1.1 tron 1062 1.1 tron </ol> 1063 1.1 tron 1064 1.1.1.4 tron <h3> <a name="temp_white_sharing"> Sharing the temporary whitelist </a> </h3> 1065 1.1.1.4 tron 1066 1.1.1.4 tron <p> By default, the temporary whitelist is not shared between 1067 1.1.1.4 tron multiple <a href="postscreen.8.html">postscreen(8)</a> daemons. To enable sharing, choose one 1068 1.1.1.4 tron of the following options: </p> 1069 1.1.1.4 tron 1070 1.1.1.4 tron <ul> 1071 1.1.1.4 tron 1072 1.1.1.4 tron <li> <p> A non-persistent <a href="memcache_table.5.html">memcache</a>: temporary whitelist can be shared 1073 1.1.1.4 tron between <a href="postscreen.8.html">postscreen(8)</a> daemons on the same host or different 1074 1.1.1.4 tron hosts. Disable cache cleanup (<a href="postconf.5.html#postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a> 1075 1.1.1.4 tron = 0) in all <a href="postscreen.8.html">postscreen(8)</a> daemons because <a href="memcache_table.5.html">memcache</a>: does not 1076 1.1.1.4 tron implement this (but see example 4 below for <a href="memcache_table.5.html">memcache</a>: with 1077 1.1.1.4 tron persistent backup). This requires Postfix 2.9 or later. </p> 1078 1.1.1.4 tron 1079 1.1.1.4 tron <pre> 1080 1.1.1.4 tron # Example 1: non-persistent <a href="memcache_table.5.html">memcache</a>: whitelist. 1081 1.1.1.4 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 1082 1.1.1.4 tron <a href="postconf.5.html#postscreen_cache_map">postscreen_cache_map</a> = <a href="memcache_table.5.html">memcache</a>:/etc/postfix/postscreen_cache 1083 1.1.1.4 tron <a href="postconf.5.html#postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a> = 0 1084 1.1.1.4 tron 1085 1.1.1.4 tron /etc/postfix/postscreen_cache: 1086 1.1.1.4 tron memcache = inet:127.0.0.1:11211 1087 1.1.1.4 tron key_format = postscreen:%s 1088 1.1.1.4 tron </pre> 1089 1.1.1.4 tron 1090 1.1.1.4 tron <li> <p> 1091 1.1.1.4 tron A persistent <a href="lmdb_table.5.html">lmdb</a>: temporary whitelist can be shared between 1092 1.1.1.4 tron <a href="postscreen.8.html">postscreen(8)</a> daemons that run under the same <a href="master.8.html">master(8)</a> daemon, 1093 1.1.1.4 tron or under different <a href="master.8.html">master(8)</a> daemons on the same host. Disable 1094 1.1.1.4 tron cache cleanup (<a href="postconf.5.html#postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a> = 0) in all 1095 1.1.1.4 tron <a href="postscreen.8.html">postscreen(8)</a> daemons except one that is responsible for cache 1096 1.1.1.4 tron cleanup. This requires Postfix 2.11 or later. </p> 1097 1.1.1.4 tron 1098 1.1.1.4 tron <pre> 1099 1.1.1.4 tron # Example 2: persistent <a href="lmdb_table.5.html">lmdb</a>: whitelist. 1100 1.1.1.4 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 1101 1.1.1.4 tron <a href="postconf.5.html#postscreen_cache_map">postscreen_cache_map</a> = <a href="lmdb_table.5.html">lmdb</a>:$<a href="postconf.5.html#data_directory">data_directory</a>/postscreen_cache 1102 1.1.1.4 tron # See note 1 below. 1103 1.1.1.4 tron # <a href="postconf.5.html#postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a> = 0 1104 1.1.1.4 tron </pre> 1105 1.1.1.4 tron 1106 1.1.1.4 tron <li> <p> Other kinds of persistent temporary whitelist can be shared 1107 1.1.1.4 tron only between <a href="postscreen.8.html">postscreen(8)</a> daemons that run under the same 1108 1.1.1.4 tron <a href="master.8.html">master(8)</a> daemon. In this case, temporary whitelist access must 1109 1.1.1.4 tron be shared through the <a href="proxymap.8.html">proxymap(8)</a> daemon. This requires Postfix 1110 1.1.1.4 tron 2.9 or later. </p> 1111 1.1.1.4 tron 1112 1.1.1.4 tron <pre> 1113 1.1.1.4 tron # Example 3: proxied <a href="DATABASE_README.html#types">btree</a>: whitelist. 1114 1.1.1.4 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 1115 1.1.1.4 tron <a href="postconf.5.html#postscreen_cache_map">postscreen_cache_map</a> = 1116 1.1.1.4 tron <a href="proxymap.8.html">proxy</a>:<a href="DATABASE_README.html#types">btree</a>:/var/lib/postfix/postscreen_cache 1117 1.1.1.4 tron # See note 1 below. 1118 1.1.1.4 tron # <a href="postconf.5.html#postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a> = 0 1119 1.1.1.4 tron 1120 1.1.1.4 tron # Example 4: proxied <a href="DATABASE_README.html#types">btree</a>: whitelist with <a href="memcache_table.5.html">memcache</a>: accelerator. 1121 1.1.1.4 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 1122 1.1.1.4 tron <a href="postconf.5.html#postscreen_cache_map">postscreen_cache_map</a> = <a href="memcache_table.5.html">memcache</a>:/etc/postfix/postscreen_cache 1123 1.1.1.4 tron <a href="postconf.5.html#proxy_write_maps">proxy_write_maps</a> = 1124 1.1.1.4 tron <a href="proxymap.8.html">proxy</a>:<a href="DATABASE_README.html#types">btree</a>:/var/lib/postfix/postscreen_cache 1125 1.1.1.4 tron ... other proxied tables ... 1126 1.1.1.4 tron # See note 1 below. 1127 1.1.1.4 tron # <a href="postconf.5.html#postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a> = 0 1128 1.1.1.4 tron 1129 1.1.1.4 tron /etc/postfix/postscreen_cache: 1130 1.1.1.4 tron # Note: the $<a href="postconf.5.html#data_directory">data_directory</a> macro is not defined in this context. 1131 1.1.1.4 tron memcache = inet:127.0.0.1:11211 1132 1.1.1.4 tron backup = <a href="proxymap.8.html">proxy</a>:<a href="DATABASE_README.html#types">btree</a>:/var/lib/postfix/postscreen_cache 1133 1.1.1.4 tron key_format = postscreen:%s 1134 1.1.1.4 tron </pre> 1135 1.1.1.4 tron 1136 1.1.1.4 tron <p> Note 1: disable cache cleanup (<a href="postconf.5.html#postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a> 1137 1.1.1.4 tron = 0) in all <a href="postscreen.8.html">postscreen(8)</a> daemons except one that is responsible 1138 1.1.1.4 tron for cache cleanup. </p> 1139 1.1.1.4 tron 1140 1.1.1.4 tron <p> Note 2: <a href="postscreen.8.html">postscreen(8)</a> cache sharing via <a href="proxymap.8.html">proxymap(8)</a> requires Postfix 1141 1.1.1.4 tron 2.9 or later; earlier <a href="proxymap.8.html">proxymap(8)</a> implementations don't support 1142 1.1.1.4 tron cache cleanup. </p> 1143 1.1.1.4 tron 1144 1.1.1.4 tron </ul> 1145 1.1.1.4 tron 1146 1.1 tron <h2> <a name="historical"> Historical notes and credits </a> </h2> 1147 1.1 tron 1148 1.1 tron <p> Many ideas in <a href="postscreen.8.html">postscreen(8)</a> were explored in earlier work by 1149 1.1 tron Michael Tokarev, in OpenBSD spamd, and in MailChannels Traffic 1150 1.1 tron Control. </p> 1151 1.1 tron 1152 1.1 tron <p> Wietse threw together a crude prototype with pregreet and dnsbl 1153 1.1 tron support in June 2009, because he needed something new for a Mailserver 1154 1.1 tron conference presentation in July. Ralf Hildebrandt ran this code on 1155 1.1 tron several servers to collect real-world statistics. This version used 1156 1.1 tron the <a href="dnsblog.8.html">dnsblog(8)</a> ad-hoc DNS client program. </p> 1157 1.1 tron 1158 1.1 tron <p> Wietse needed new material for a LISA conference presentation 1159 1.1 tron in November 2010, so he added support for DNSBL weights and filters 1160 1.1 tron in August, followed by a major code rewrite, deep protocol tests, 1161 1.1 tron helo/sender/recipient logging, and stress-adaptive behavior in 1162 1.1 tron September. Ralf Hildebrandt ran this code on several servers to 1163 1.1 tron collect real-world statistics. This version still used the embarrassing 1164 1.1 tron <a href="dnsblog.8.html">dnsblog(8)</a> ad-hoc DNS client program. </p> 1165 1.1 tron 1166 1.1 tron <p> Wietse added STARTTLS support in December 2010. This makes 1167 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> usable for sites that require TLS support. The 1168 1.1 tron implementation introduces the <a href="tlsproxy.8.html">tlsproxy(8)</a> event-driven TLS proxy 1169 1.1 tron that decrypts/encrypts the sessions for multiple SMTP clients. </p> 1170 1.1 tron 1171 1.1.1.3 tron <p> The <a href="tlsproxy.8.html">tlsproxy(8)</a> implementation led to the discovery of a "new" 1172 1.1.1.3 tron class of vulnerability (<a 1173 1.1.1.3 tron href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0411" 1174 1.1.1.3 tron >CVE-2011-0411</a>) that affected multiple implementations of SMTP, 1175 1.1.1.3 tron POP, IMAP, NNTP, and FTP over TLS. </p> 1176 1.1.1.3 tron 1177 1.1.1.3 tron <p> <a href="postscreen.8.html">postscreen(8)</a> was officially released as part of the Postfix 1178 1.1.1.3 tron 2.8 stable release in January 2011.</p> 1179 1.1.1.3 tron 1180 1.1 tron </body> 1181 1.1 tron 1182 1.1 tron </html> 1183 1.1 tron 1184
Indexes created Sun Jun 07 00:24:08 UTC 2026