POSTSCREEN_README.html revision 1.1.1.7
1 1.1 tron <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" 2 1.1 tron "http://www.w3.org/TR/html4/loose.dtd"> 3 1.1 tron 4 1.1 tron <head> 5 1.1 tron 6 1.1 tron <title>Postfix Postscreen Howto</title> 7 1.1 tron 8 1.1.1.7 christos <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> 9 1.1 tron 10 1.1 tron </head> 11 1.1 tron 12 1.1 tron <body> 13 1.1 tron 14 1.1 tron <h1><img src="postfix-logo.jpg" width="203" height="98" ALT="">Postfix Postscreen Howto</h1> 15 1.1 tron 16 1.1 tron <hr> 17 1.1 tron 18 1.1 tron <h2> <a name="intro">Introduction</a> </h2> 19 1.1 tron 20 1.1.1.3 tron <p> This document describes features that are available in Postfix 21 1.1.1.7 christos 3.6 and later. See <a href="POSTSCREEN_3_5_README.html"> 22 1.1.1.7 christos POSTSCREEN_3_5_README.html</a> for Postfix versions 2.8 - 3.5. </p> 23 1.1.1.3 tron 24 1.1.1.3 tron <p> The Postfix <a href="postscreen.8.html">postscreen(8)</a> daemon provides additional protection 25 1.1.1.3 tron against mail server overload. One <a href="postscreen.8.html">postscreen(8)</a> process handles 26 1.1.1.3 tron multiple inbound SMTP connections, and decides which clients may 27 1.1.1.3 tron talk to a Postfix SMTP server process. By keeping spambots away, 28 1.1.1.3 tron <a href="postscreen.8.html">postscreen(8)</a> leaves more SMTP server processes available for 29 1.1.1.3 tron legitimate clients, and delays the onset of <a 30 1.1.1.3 tron href="STRESS_README.html">server overload</a> conditions. </p> 31 1.1.1.3 tron 32 1.1.1.3 tron <p> <a href="postscreen.8.html">postscreen(8)</a> should not be used on SMTP ports that receive 33 1.1.1.3 tron mail from end-user clients (MUAs). In a typical deployment, 34 1.1.1.3 tron <a href="postscreen.8.html">postscreen(8)</a> handles the MX service on TCP port 25, while MUA 35 1.1.1.3 tron clients submit mail via the submission service on TCP port 587 which 36 1.1.1.3 tron requires client authentication. Alternatively, a site could set up 37 1.1.1.3 tron a dedicated, non-postscreen, "port 25" server that provides submission 38 1.1.1.3 tron service and client authentication, but no MX service. </p> 39 1.1 tron 40 1.1.1.7 christos <p> <a href="postscreen.8.html">postscreen(8)</a> maintains a temporary allowlist for clients that 41 1.1.1.7 christos pass its tests; by allowing allowlisted clients to skip tests, 42 1.1.1.2 tron <a href="postscreen.8.html">postscreen(8)</a> minimizes its impact on legitimate email traffic. 43 1.1.1.2 tron </p> 44 1.1.1.2 tron 45 1.1 tron <p> <a href="postscreen.8.html">postscreen(8)</a> is part of a multi-layer defense. <p> 46 1.1 tron 47 1.1 tron <ul> 48 1.1 tron 49 1.1 tron <li> <p> As the first layer, <a href="postscreen.8.html">postscreen(8)</a> blocks connections from 50 1.1 tron zombies and other spambots that are responsible for about 90% of 51 1.1 tron all spam. It is implemented as a single process to make this defense 52 1.1.1.3 tron as inexpensive as possible. </p> 53 1.1 tron 54 1.1 tron <li> <p> The second layer implements more complex SMTP-level access 55 1.1.1.3 tron checks with <a href="SMTPD_ACCESS_README.html">Postfix SMTP servers</a>, 56 1.1.1.3 tron <a href="SMTPD_POLICY_README.html">policy daemons</a>, and 57 1.1.1.3 tron <a href="MILTER_README.html">Milter applications</a>. </p> 58 1.1 tron 59 1.1 tron <li> <p> The third layer performs light-weight content inspection 60 1.1 tron with the Postfix built-in <a href="postconf.5.html#header_checks">header_checks</a> and <a href="postconf.5.html#body_checks">body_checks</a>. This can 61 1.1 tron block unacceptable attachments such as executable programs, and 62 1.1 tron worms or viruses with easy-to-recognize signatures. </p> 63 1.1 tron 64 1.1 tron <li> <p> The fourth layer provides heavy-weight content inspection 65 1.1.1.3 tron with external content filters. Typical examples are <a 66 1.1.1.3 tron href="http://www.ijs.si/software/amavisd/">Amavisd-new</a>, <a 67 1.1.1.3 tron href="http://spamassassin.apache.org/">SpamAssassin</a>, and <a 68 1.1.1.3 tron href="MILTER_README.html">Milter applications</a>. </p> 69 1.1 tron 70 1.1 tron </ul> 71 1.1 tron 72 1.1 tron <p> Each layer reduces the spam volume. The general strategy is to 73 1.1 tron use the less expensive defenses first, and to use the more expensive 74 1.1.1.2 tron defenses only for the spam that remains. </p> 75 1.1 tron 76 1.1 tron <p> Topics in this document: </p> 77 1.1 tron 78 1.1 tron <ul> 79 1.1 tron 80 1.1 tron <li> <a href="#intro">Introduction</a> 81 1.1 tron 82 1.1 tron <li> <a href="#basic">The basic idea behind postscreen(8)</a> 83 1.1 tron 84 1.1 tron <li> <a href="#general"> General operation </a> 85 1.1 tron 86 1.1 tron <li> <a href="#quick">Quick tests before everything else</a> 87 1.1 tron 88 1.1 tron <li> <a href="#before_220"> Tests before the 220 SMTP server greeting </a> 89 1.1 tron 90 1.1 tron <li> <a href="#after_220">Tests after the 220 SMTP server greeting</a> 91 1.1 tron 92 1.1 tron <li> <a href="#other_error">Other errors</a> 93 1.1 tron 94 1.1 tron <li> <a href="#victory">When all tests succeed</a> 95 1.1 tron 96 1.1 tron <li> <a href="#config"> Configuring the postscreen(8) service</a> 97 1.1 tron 98 1.1 tron <li> <a href="#historical"> Historical notes and credits </a> 99 1.1 tron 100 1.1 tron </ul> 101 1.1 tron 102 1.1 tron <h2> <a name="basic">The basic idea behind postscreen(8)</a> </h2> 103 1.1 tron 104 1.1 tron <p> Most email is spam, and most spam is sent out by zombies (malware 105 1.1 tron on compromised end-user computers). Wietse expects that the zombie 106 1.1 tron problem will get worse before things improve, if ever. Without a 107 1.1 tron tool like <a href="postscreen.8.html">postscreen(8)</a> that keeps the zombies away, Postfix would be 108 1.1 tron spending most of its resources not receiving email. </p> 109 1.1 tron 110 1.1.1.6 christos <p> The main challenge for <a href="postscreen.8.html">postscreen(8)</a> is to make an is-a-zombie 111 1.1 tron decision based on a single measurement. This is necessary because 112 1.1.1.2 tron many zombies try to fly under the radar and avoid spamming the same 113 1.1.1.2 tron site repeatedly. Once <a href="postscreen.8.html">postscreen(8)</a> decides that a client is 114 1.1.1.7 christos not-a-zombie, it allowlists the client temporarily to avoid further 115 1.1.1.2 tron delays for legitimate mail. </p> 116 1.1 tron 117 1.1 tron <p> Zombies have challenges too: they have only a limited amount 118 1.1.1.7 christos of time to deliver spam before their IP address becomes denylisted. 119 1.1 tron To speed up spam deliveries, zombies make compromises in their SMTP 120 1.1 tron protocol implementation. For example, they speak before their turn, 121 1.1 tron or they ignore responses from SMTP servers and continue sending 122 1.1 tron mail even when the server tells them to go away. </p> 123 1.1 tron 124 1.1 tron <p> <a href="postscreen.8.html">postscreen(8)</a> uses a variety of measurements to recognize 125 1.1 tron zombies. First, <a href="postscreen.8.html">postscreen(8)</a> determines if the remote SMTP client 126 1.1.1.7 christos IP address is denylisted. Second, <a href="postscreen.8.html">postscreen(8)</a> looks for protocol 127 1.1 tron compromises that are made to speed up delivery. These are good 128 1.1.1.6 christos indicators for making is-a-zombie decisions based on single 129 1.1 tron measurements. </p> 130 1.1 tron 131 1.1 tron <p> <a href="postscreen.8.html">postscreen(8)</a> does not inspect message content. Message content 132 1.1 tron can vary from one delivery to the next, especially with clients 133 1.1 tron that (also) send legitimate email. Content is not a good indicator 134 1.1.1.6 christos for making is-a-zombie decisions based on single measurements, 135 1.1 tron and that is the problem that <a href="postscreen.8.html">postscreen(8)</a> is focused on. </p> 136 1.1 tron 137 1.1 tron <h2> <a name="general"> General operation </a> </h2> 138 1.1 tron 139 1.1.1.3 tron <p> For each connection from an SMTP client, <a href="postscreen.8.html">postscreen(8)</a> performs 140 1.1.1.3 tron a number of tests 141 1.1 tron in the order as described below. Some tests introduce a delay of 142 1.1.1.7 christos a few seconds. <a href="postscreen.8.html">postscreen(8)</a> maintains a temporary allowlist for 143 1.1.1.7 christos clients that pass its tests; by allowing allowlisted clients to 144 1.1.1.2 tron skip tests, <a href="postscreen.8.html">postscreen(8)</a> minimizes its impact on legitimate email 145 1.1.1.2 tron traffic. </p> 146 1.1.1.2 tron 147 1.1.1.2 tron <p> By default, <a href="postscreen.8.html">postscreen(8)</a> hands off all connections to a Postfix 148 1.1.1.2 tron SMTP server process after logging its findings. This mode is useful 149 1.1.1.2 tron for non-destructive testing. </p> 150 1.1 tron 151 1.1 tron <p> In a typical production setting, <a href="postscreen.8.html">postscreen(8)</a> is configured 152 1.1 tron to reject mail from clients that fail one or more tests, after 153 1.1 tron logging the helo, sender and recipient information. </p> 154 1.1 tron 155 1.1 tron <p> Note: <a href="postscreen.8.html">postscreen(8)</a> is not an SMTP proxy; this is intentional. 156 1.1 tron The purpose is to keep zombies away from Postfix, with minimal 157 1.1 tron overhead for legitimate clients. </p> 158 1.1 tron 159 1.1 tron <h2> <a name="quick">Quick tests before everything else</a> </h2> 160 1.1 tron 161 1.1 tron <p> Before engaging in SMTP-level tests. <a href="postscreen.8.html">postscreen(8)</a> queries a 162 1.1.1.7 christos number of local deny and allowlists. These tests speed up the 163 1.1 tron handling of known clients. </p> 164 1.1 tron 165 1.1 tron <ul> 166 1.1 tron 167 1.1.1.7 christos <li> <a href="#perm_allow_deny"> Permanent allow/denylist test </a> 168 1.1 tron 169 1.1.1.7 christos <li> <a href="#temp_allow"> Temporary allowlist test </a> 170 1.1 tron 171 1.1.1.7 christos <li> <a href="#allow_veto"> MX Policy test </a> 172 1.1.1.2 tron 173 1.1 tron </ul> 174 1.1 tron 175 1.1.1.7 christos <h3> <a name="perm_allow_deny"> Permanent allow/denylist test </a> </h3> 176 1.1 tron 177 1.1 tron <p> The <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> parameter (default: <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>) 178 1.1 tron specifies a permanent access list for SMTP client IP addresses. Typically 179 1.1.1.7 christos one would specify something that allowlists local networks, followed 180 1.1.1.7 christos by a CIDR table for selective allow- and denylisting. </p> 181 1.1 tron 182 1.1 tron <p> Example: </p> 183 1.1 tron 184 1.1 tron <pre> 185 1.1 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 186 1.1 tron <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, 187 1.1 tron <a href="cidr_table.5.html">cidr</a>:/etc/postfix/postscreen_access.cidr 188 1.1 tron 189 1.1 tron /etc/postfix/postscreen_access.<a href="cidr_table.5.html">cidr</a>: 190 1.1 tron # Rules are evaluated in the order as specified. 191 1.1.1.7 christos # Denylist 192.168.* except 192.168.0.1. 192 1.1 tron 192.168.0.1 permit 193 1.1 tron 192.168.0.0/16 reject 194 1.1 tron </pre> 195 1.1 tron 196 1.1 tron <p> See the <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> manpage documentation for more 197 1.1 tron details. </p> 198 1.1 tron 199 1.1 tron <p> When the SMTP client address matches a "permit" action, 200 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> logs this with the client address and port number as: 201 1.1 tron </p> 202 1.1 tron 203 1.1.1.7 christos <blockquote> 204 1.1 tron <pre> 205 1.1.1.7 christos <b>ALLOWLISTED</b> <i>[address]:port</i> 206 1.1 tron </pre> 207 1.1.1.7 christos </blockquote> 208 1.1.1.7 christos 209 1.1.1.7 christos <blockquote> <p> Use the <a href="postconf.5.html#respectful_logging">respectful_logging</a> configuration parameter to 210 1.1.1.7 christos select a deprecated form of this logging. </p> </blockquote> 211 1.1 tron 212 1.1.1.7 christos <p> The allowlist action is not configurable: immediately hand off the 213 1.1 tron connection to a Postfix SMTP server process. </p> 214 1.1 tron 215 1.1 tron <p> When the SMTP client address matches a "reject" action, 216 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> logs this with the client address and port number as: 217 1.1 tron </p> 218 1.1 tron 219 1.1.1.7 christos <blockquote> 220 1.1 tron <pre> 221 1.1.1.7 christos <b>DENYLISTED</b> <i>[address]:port</i> 222 1.1 tron </pre> 223 1.1.1.7 christos </blockquote> 224 1.1 tron 225 1.1.1.7 christos <blockquote> <p> Use the <a href="postconf.5.html#respectful_logging">respectful_logging</a> configuration parameter to 226 1.1.1.7 christos select a deprecated form of this logging. </p> </blockquote> 227 1.1.1.7 christos 228 1.1.1.7 christos <p> The <a href="postconf.5.html#postscreen_denylist_action">postscreen_denylist_action</a> parameter specifies the action 229 1.1 tron that is taken next. See "<a href="#fail_before_220">When tests 230 1.1 tron fail before the 220 SMTP server greeting</a>" below. </p> 231 1.1 tron 232 1.1.1.7 christos <h3> <a name="temp_allow"> Temporary allowlist test </a> </h3> 233 1.1 tron 234 1.1 tron <p> The <a href="postscreen.8.html">postscreen(8)</a> daemon maintains a <i>temporary</i> 235 1.1.1.7 christos allowlist for SMTP client IP addresses that have passed all 236 1.1 tron the tests described below. The <a href="postconf.5.html#postscreen_cache_map">postscreen_cache_map</a> parameter 237 1.1.1.7 christos specifies the location of the temporary allowlist. The 238 1.1.1.7 christos temporary allowlist is not used for SMTP client addresses 239 1.1.1.2 tron that appear on the <i>permanent</i> access list. </p> 240 1.1.1.2 tron 241 1.1.1.7 christos <p> By default the temporary allowlist is not shared with other 242 1.1.1.7 christos <a href="postscreen.8.html">postscreen(8)</a> daemons. See 243 1.1.1.7 christos <a href="#temp_allow_sharing"> Sharing 244 1.1.1.7 christos the temporary allowlist </a> below for alternatives. </p> 245 1.1 tron 246 1.1 tron <p> When the SMTP client address appears on the temporary 247 1.1.1.7 christos allowlist, <a href="postscreen.8.html">postscreen(8)</a> logs this with the client address and port 248 1.1 tron number as: </p> 249 1.1 tron 250 1.1 tron <pre> 251 1.1 tron <b>PASS OLD</b> <i>[address]:port</i> 252 1.1 tron </pre> 253 1.1 tron 254 1.1 tron <p> The action is not configurable: immediately hand off the 255 1.1 tron connection to a Postfix SMTP server process. The client is 256 1.1.1.7 christos excluded from further tests until its temporary allowlist 257 1.1 tron entry expires, as controlled with the postscreen_*_ttl 258 1.1 tron parameters. Expired entries are silently renewed if possible. </p> 259 1.1 tron 260 1.1.1.7 christos <h3> <a name="allow_veto"> MX Policy test </a> </h3> 261 1.1.1.2 tron 262 1.1.1.2 tron <p> When the remote SMTP client is not on the static access list 263 1.1.1.7 christos or temporary allowlist, <a href="postscreen.8.html">postscreen(8)</a> can implement a number of 264 1.1.1.7 christos allowlist tests, before it grants the client a temporary allowlist 265 1.1.1.2 tron status that allows it to talk to a Postfix SMTP server process. </p> 266 1.1.1.2 tron 267 1.1.1.3 tron <p> When <a href="postscreen.8.html">postscreen(8)</a> is configured to monitor all primary and 268 1.1.1.7 christos backup MX addresses, it can refuse to allowlist clients that connect 269 1.1.1.3 tron to a backup MX address only (an old spammer trick to take advantage 270 1.1.1.3 tron of backup MX hosts with weaker anti-spam policies than primary MX 271 1.1.1.2 tron hosts). </p> 272 1.1.1.2 tron 273 1.1.1.3 tron <blockquote> <p> NOTE: The following solution is for small sites. 274 1.1.1.3 tron Larger sites would have to share the <a href="postscreen.8.html">postscreen(8)</a> cache between 275 1.1.1.3 tron primary and backup MTAs, which would introduce a common point of 276 1.1.1.3 tron failure. </p> </blockquote> 277 1.1.1.3 tron 278 1.1.1.2 tron <ul> 279 1.1.1.2 tron 280 1.1.1.2 tron <li> <p> First, configure the host to listen on both primary and 281 1.1.1.7 christos backup MX addresses. Use the appropriate <tt>ifconfig</tt> or <tt>ip</tt> 282 1.1.1.7 christos command for the local operating system, or update the appropriate 283 1.1.1.7 christos configuration files and "refresh" the network protocol stack. </p> 284 1.1.1.2 tron 285 1.1.1.3 tron <p> <p> Second, configure Postfix to listen on the new IP address 286 1.1.1.3 tron (this step is needed when you have specified <a href="postconf.5.html#inet_interfaces">inet_interfaces</a> in 287 1.1.1.3 tron <a href="postconf.5.html">main.cf</a>). </p> 288 1.1.1.3 tron 289 1.1.1.7 christos <li> <p> Then, configure <a href="postscreen.8.html">postscreen(8)</a> to deny the temporary allowlist 290 1.1.1.2 tron status on the backup MX address(es). An example for Wietse's 291 1.1.1.2 tron server is: </p> 292 1.1.1.2 tron 293 1.1.1.2 tron <pre> 294 1.1.1.2 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 295 1.1.1.7 christos <a href="postconf.5.html#postscreen_allowlist_interfaces">postscreen_allowlist_interfaces</a> = !168.100.189.8 <a href="DATABASE_README.html#types">static</a>:all 296 1.1.1.2 tron </pre> 297 1.1.1.2 tron 298 1.1.1.7 christos <p> Translation: allow clients to obtain the temporary allowlist 299 1.1.1.2 tron status on all server IP addresses except 168.100.189.8, which is a 300 1.1.1.2 tron backup MX address. </p> 301 1.1.1.2 tron 302 1.1.1.2 tron </ul> 303 1.1.1.2 tron 304 1.1.1.7 christos <p> When a non-allowlisted client connects the backup MX address, 305 1.1.1.2 tron <a href="postscreen.8.html">postscreen(8)</a> logs this with the client address and port number as: 306 1.1.1.2 tron </p> 307 1.1.1.2 tron 308 1.1.1.7 christos <blockquote> <pre> 309 1.1.1.7 christos <b>CONNECT from</b> <i>[address]:port</i> <b>to [168.100.189.8]:25</b> 310 1.1.1.7 christos <b>ALLOWLIST VETO</b> <i>[address]:port</i> 311 1.1.1.7 christos </pre> </blockquote> 312 1.1.1.7 christos 313 1.1.1.7 christos <blockquote> <p> Use the <a href="postconf.5.html#respectful_logging">respectful_logging</a> configuration parameter to 314 1.1.1.7 christos select a deprecated form of this logging. </p> </blockquote> 315 1.1.1.2 tron 316 1.1.1.2 tron <p> Translation: the client at <i>[address]:port</i> connected to 317 1.1.1.7 christos the backup MX address 168.100.189.8 while it was not allowlisted. 318 1.1.1.7 christos The client will not be granted the temporary allowlist status, even 319 1.1.1.7 christos if passes all the allowlist tests described below. </p> 320 1.1.1.2 tron 321 1.1 tron <h2> <a name="before_220"> Tests before the 220 SMTP server greeting </a> </h2> 322 1.1 tron 323 1.1 tron <p> The <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> parameter specifies a short time 324 1.1 tron interval before the "220 <i>text</i>..." server greeting, where 325 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> can run a number of tests in parallel. </p> 326 1.1 tron 327 1.1 tron <p> When a good client passes these tests, and no "<a 328 1.1.1.7 christos href="#after_220">deep protocol tests</a>" 329 1.1.1.7 christos are configured, <a href="postscreen.8.html">postscreen(8)</a> 330 1.1.1.7 christos adds the client to the temporary allowlist and hands off the "live" 331 1.1 tron connection to a Postfix SMTP server process. The client can then 332 1.1 tron continue as if <a href="postscreen.8.html">postscreen(8)</a> never even existed (except of course 333 1.1 tron for the short <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> delay). </p> 334 1.1 tron 335 1.1 tron <ul> 336 1.1 tron 337 1.1 tron <li> <a href="#pregreet"> Pregreet test </a> 338 1.1 tron 339 1.1.1.7 christos <li> <a href="#dnsbl"> DNS Allow/denylist test </a> 340 1.1 tron 341 1.1 tron <li> <a href="#fail_before_220">When tests fail before the 220 SMTP server greeting</a> 342 1.1 tron 343 1.1 tron </ul> 344 1.1 tron 345 1.1 tron <h3> <a name="pregreet"> Pregreet test </a> </h3> 346 1.1 tron 347 1.1 tron <p> The SMTP protocol is a classic example of a protocol where the 348 1.1 tron server speaks before the client. <a href="postscreen.8.html">postscreen(8)</a> detects zombies 349 1.1 tron that are in a hurry and that speak before their turn. This test is 350 1.1 tron enabled by default. </p> 351 1.1 tron 352 1.1 tron <p> The <a href="postconf.5.html#postscreen_greet_banner">postscreen_greet_banner</a> parameter specifies the <i>text</i> 353 1.1 tron portion of a "220-<i>text</i>..." teaser banner (default: $<a href="postconf.5.html#smtpd_banner">smtpd_banner</a>). 354 1.1 tron Note that this becomes the first part of a multi-line server greeting. 355 1.1 tron The <a href="postscreen.8.html">postscreen(8)</a> daemon sends this before the <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> 356 1.1 tron timer is started. The purpose of the teaser banner is to confuse 357 1.1 tron zombies so that they speak before their turn. It has no effect on 358 1.1 tron SMTP clients that correctly implement the protocol. </p> 359 1.1 tron 360 1.1 tron <p> To avoid problems with poorly-implemented SMTP engines in network 361 1.1 tron appliances or network testing tools, either exclude them from all 362 1.1 tron tests with the <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> feature or else specify 363 1.1 tron an empty teaser banner: </p> 364 1.1 tron 365 1.1 tron <pre> 366 1.1 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 367 1.1.1.7 christos # Exclude broken clients by allowlisting. Clients in <a href="postconf.5.html#mynetworks">mynetworks</a> 368 1.1.1.7 christos # should always be allowlisted. 369 1.1 tron <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, 370 1.1 tron <a href="cidr_table.5.html">cidr</a>:/etc/postfix/postscreen_access.cidr 371 1.1 tron 372 1.1 tron /etc/postfix/postscreen_access.<a href="cidr_table.5.html">cidr</a>: 373 1.1 tron 192.168.254.0/24 permit 374 1.1 tron </pre> 375 1.1 tron 376 1.1 tron <pre> 377 1.1 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 378 1.1.1.7 christos # Disable the teaser banner (try allowlisting first if you can). 379 1.1 tron <a href="postconf.5.html#postscreen_greet_banner">postscreen_greet_banner</a> = 380 1.1 tron </pre> 381 1.1 tron 382 1.1 tron <p> When an SMTP client sends a command before the 383 1.1 tron <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> time has elapsed, <a href="postscreen.8.html">postscreen(8)</a> logs this as: 384 1.1 tron </p> 385 1.1 tron 386 1.1 tron <pre> 387 1.1 tron <b>PREGREET</b> <i>count</i> <b>after</b> <i>time</i> <b>from</b> <i>[address]:port text...</i> 388 1.1 tron </pre> 389 1.1 tron 390 1.1 tron <p> Translation: the client at <i>[address]:port</i> sent <i>count</i> 391 1.1 tron bytes before its turn to speak. This happened <i>time</i> seconds 392 1.1 tron after the <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> timer was started. The <i>text</i> 393 1.1 tron is what the client sent (truncated to 100 bytes, and with non-printable 394 1.1 tron characters replaced with C-style escapes such as \r for carriage-return 395 1.1 tron and \n for newline). </p> 396 1.1 tron 397 1.1 tron <p> The <a href="postconf.5.html#postscreen_greet_action">postscreen_greet_action</a> parameter specifies the action that 398 1.1 tron is taken next. See "<a href="#fail_before_220">When tests fail 399 1.1 tron before the 220 SMTP server greeting</a>" below. </p> 400 1.1 tron 401 1.1.1.7 christos <h3> <a name="dnsbl"> DNS Allow/denylist test </a> </h3> 402 1.1 tron 403 1.1 tron <p> The <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> parameter (default: empty) specifies 404 1.1 tron a list of DNS blocklist servers with optional filters and weight 405 1.1.1.7 christos factors (positive weights for denylisting, negative for allowlisting). 406 1.1 tron These servers will be queried in parallel with the reverse client 407 1.1 tron IP address. This test is disabled by default. </p> 408 1.1 tron 409 1.1 tron <blockquote> 410 1.1 tron <p> 411 1.1 tron CAUTION: when postscreen rejects mail, its SMTP reply contains the 412 1.1 tron DNSBL domain name. Use the <a href="postconf.5.html#postscreen_dnsbl_reply_map">postscreen_dnsbl_reply_map</a> feature to 413 1.1 tron hide "password" information in DNSBL domain names. 414 1.1 tron </p> 415 1.1 tron </blockquote> 416 1.1 tron 417 1.1 tron <p> When the <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> time has elapsed, and the combined 418 1.1 tron DNSBL score is equal to or greater than the <a href="postconf.5.html#postscreen_dnsbl_threshold">postscreen_dnsbl_threshold</a> 419 1.1 tron parameter value, <a href="postscreen.8.html">postscreen(8)</a> logs this as: </p> 420 1.1 tron 421 1.1 tron <pre> 422 1.1 tron <b>DNSBL rank</b> <i>count</i> <b>for</b> <i>[address]:port</i> 423 1.1 tron </pre> 424 1.1 tron 425 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> has a combined 426 1.1 tron DNSBL score of <i>count</i>. </p> 427 1.1 tron 428 1.1 tron <p> The <a href="postconf.5.html#postscreen_dnsbl_action">postscreen_dnsbl_action</a> parameter specifies the action that 429 1.1 tron is taken when the combined DNSBL score is equal to or greater than 430 1.1 tron the threshold. See "<a href="#fail_before_220">When tests fail 431 1.1 tron before the 220 SMTP server greeting</a>" below. </p> 432 1.1 tron 433 1.1 tron <h3> <a name="fail_before_220">When tests fail before the 220 SMTP server greeting</a> </h3> 434 1.1 tron 435 1.1.1.7 christos <p> When the client address matches the permanent denylist, or 436 1.1 tron when the client fails the pregreet or DNSBL tests, the action is 437 1.1.1.7 christos specified with <a href="postconf.5.html#postscreen_denylist_action">postscreen_denylist_action</a>, <a href="postconf.5.html#postscreen_greet_action">postscreen_greet_action</a>, 438 1.1 tron or <a href="postconf.5.html#postscreen_dnsbl_action">postscreen_dnsbl_action</a>, respectively. </p> 439 1.1 tron 440 1.1 tron <dl> 441 1.1 tron 442 1.1 tron <dt> <b>ignore</b> (default) </dt> 443 1.1 tron 444 1.1 tron <dd> Ignore the failure of this test. Allow other tests to complete. 445 1.1 tron Repeat this test the next time the client connects. This option 446 1.1 tron is useful for testing and collecting statistics without blocking 447 1.1 tron mail. </dd> 448 1.1 tron 449 1.1 tron <dt> <b>enforce</b> </dt> 450 1.1 tron 451 1.1 tron <dd> Allow other tests to complete. Reject attempts to deliver mail 452 1.1 tron with a 550 SMTP reply, and log the helo/sender/recipient information. 453 1.1 tron Repeat this test the next time the client connects. </dd> 454 1.1 tron 455 1.1 tron <dt> <b>drop</b> </dt> 456 1.1 tron 457 1.1 tron <dd> Drop the connection immediately with a 521 SMTP reply. Repeat 458 1.1 tron this test the next time the client connects. </dd> 459 1.1 tron 460 1.1 tron </dl> 461 1.1 tron 462 1.1 tron <h2> <a name="after_220">Tests after the 220 SMTP server greeting</a> </h2> 463 1.1 tron 464 1.1 tron <p> In this phase of the protocol, <a href="postscreen.8.html">postscreen(8)</a> implements a 465 1.1 tron number of "deep protocol" tests. These tests use an SMTP protocol 466 1.1 tron engine that is built into the <a href="postscreen.8.html">postscreen(8)</a> server. </p> 467 1.1 tron 468 1.1.1.4 tron <p> Important note: these protocol tests are disabled by default. 469 1.1 tron They are more intrusive than the pregreet and DNSBL tests, and they 470 1.1 tron have limitations as discussed next. </p> 471 1.1 tron 472 1.1 tron <ul> 473 1.1 tron 474 1.1.1.4 tron <li> <p> The main limitation of "after 220 greeting" tests is that 475 1.1.1.4 tron a new client must disconnect after passing these tests (reason: 476 1.1.1.4 tron postscreen is not a proxy). Then the client must reconnect from 477 1.1.1.4 tron the same IP address before it can deliver mail. The following 478 1.1.1.4 tron measures may help to avoid email delays: </p> 479 1.1 tron 480 1.1.1.4 tron <ul> 481 1.1.1.4 tron 482 1.1.1.4 tron <li> <p> Allow "good" clients to skip tests with the 483 1.1.1.7 christos <a href="postconf.5.html#postscreen_dnsbl_allowlist_threshold">postscreen_dnsbl_allowlist_threshold</a> feature. This is especially effective 484 1.1.1.7 christos for large providers that usually don't retry from the same IP 485 1.1.1.7 christos address. </p> 486 1.1.1.4 tron 487 1.1.1.4 tron <li> <p> Small sites: Configure <a href="postscreen.8.html">postscreen(8)</a> to listen on multiple 488 1.1.1.4 tron IP addresses, published in DNS as different IP addresses for the 489 1.1.1.4 tron same MX hostname or for different MX hostnames. This avoids mail 490 1.1.1.4 tron delivery delays with clients that reconnect immediately from the 491 1.1.1.4 tron same IP address. </p> 492 1.1.1.4 tron 493 1.1.1.4 tron <li> <p> Large sites: Share the <a href="postscreen.8.html">postscreen(8)</a> cache between different 494 1.1.1.4 tron Postfix MTAs with a large-enough <a href="memcache_table.5.html">memcache_table(5)</a>. Again, this 495 1.1.1.4 tron avoids mail delivery delays with clients that reconnect immediately 496 1.1.1.4 tron from the same IP address. </p> 497 1.1 tron 498 1.1 tron </ul> 499 1.1 tron 500 1.1.1.4 tron <li> <p> <a href="postscreen.8.html">postscreen(8)</a>'s built-in SMTP engine does not implement the 501 1.1.1.4 tron AUTH, XCLIENT, and XFORWARD features. If you need to make these 502 1.1.1.4 tron services available on port 25, then do not enable the tests after 503 1.1.1.4 tron the 220 server greeting. </p> 504 1.1.1.4 tron 505 1.1.1.4 tron <li> <p> End-user clients should connect directly to the submission 506 1.1 tron service, so that they never have to deal with <a href="postscreen.8.html">postscreen(8)</a>'s tests. 507 1.1 tron </p> 508 1.1 tron 509 1.1.1.4 tron </ul> 510 1.1.1.4 tron 511 1.1.1.4 tron <p> The following "after 220 greeting" tests are available: </p> 512 1.1.1.4 tron 513 1.1 tron <ul> 514 1.1 tron 515 1.1 tron <li> <a href="#pipelining">Command pipelining test</a> 516 1.1 tron 517 1.1 tron <li> <a href="#non_smtp">Non-SMTP command test</a> 518 1.1 tron 519 1.1 tron <li> <a href="#barelf">Bare newline test</a> 520 1.1 tron 521 1.1 tron <li> <a href="#fail_after_220">When tests fail after the 220 SMTP server greeting</a> 522 1.1 tron 523 1.1 tron </ul> 524 1.1 tron 525 1.1 tron <h3> <a name="pipelining">Command pipelining test</a> </h3> 526 1.1 tron 527 1.1 tron <p> By default, SMTP is a half-duplex protocol: the sender and 528 1.1 tron receiver send one command and one response at a time. Unlike the 529 1.1 tron Postfix SMTP server, <a href="postscreen.8.html">postscreen(8)</a> does not announce support 530 1.1 tron for ESMTP command pipelining. Therefore, clients are not allowed 531 1.1.1.7 christos to send multiple commands. <a href="postscreen.8.html">postscreen(8)</a>'s 532 1.1.1.7 christos <a href="#after_220">deep 533 1.1 tron protocol test</a> for this is disabled by default. </p> 534 1.1 tron 535 1.1 tron <p> With "<a href="postconf.5.html#postscreen_pipelining_enable">postscreen_pipelining_enable</a> = yes", <a href="postscreen.8.html">postscreen(8)</a> detects 536 1.1 tron zombies that send multiple commands, instead of sending one command 537 1.1 tron and waiting for the server to reply. </p> 538 1.1 tron 539 1.1 tron <p> This test is opportunistically enabled when <a href="postscreen.8.html">postscreen(8)</a> has 540 1.1 tron to use the built-in SMTP engine anyway. This is to make <a href="postscreen.8.html">postscreen(8)</a> 541 1.1 tron logging more informative. </p> 542 1.1 tron 543 1.1 tron <p> When a client sends multiple commands, <a href="postscreen.8.html">postscreen(8)</a> logs this 544 1.1 tron as: </p> 545 1.1 tron 546 1.1 tron <pre> 547 1.1.1.2 tron <b>COMMAND PIPELINING from</b> <i>[address]:port</i> <b>after</b> <i>command</i>: <i>text</i> 548 1.1 tron </pre> 549 1.1 tron 550 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> sent 551 1.1 tron multiple SMTP commands, instead of sending one command and then 552 1.1 tron waiting for the server to reply. This happened after the client 553 1.1.1.2 tron sent <i>command</i>. The <i>text</i> shows part of the input that 554 1.1.1.2 tron was sent too early; it is not logged with Postfix 2.8. </p> 555 1.1 tron 556 1.1 tron <p> The <a href="postconf.5.html#postscreen_pipelining_action">postscreen_pipelining_action</a> parameter specifies the action 557 1.1 tron that is taken next. See "<a href="#fail_after_220">When tests fail 558 1.1 tron after the 220 SMTP server greeting</a>" below. </p> 559 1.1 tron 560 1.1 tron <h3> <a name="non_smtp">Non-SMTP command test</a> </h3> 561 1.1 tron 562 1.1 tron <p> Some spambots send their mail through open proxies. A symptom 563 1.1 tron of this is the usage of commands such as CONNECT and other non-SMTP 564 1.1 tron commands. Just like the Postfix SMTP server's <a href="postconf.5.html#smtpd_forbidden_commands">smtpd_forbidden_commands</a> 565 1.1 tron feature, <a href="postscreen.8.html">postscreen(8)</a> has an equivalent <a href="postconf.5.html#postscreen_forbidden_commands">postscreen_forbidden_commands</a> 566 1.1.1.7 christos feature to block these clients. <a href="postscreen.8.html">postscreen(8)</a>'s 567 1.1.1.7 christos <a href="#after_220">deep 568 1.1 tron protocol test</a> for this is disabled by default. </p> 569 1.1 tron 570 1.1 tron <p> With "<a href="postconf.5.html#postscreen_non_smtp_command_enable">postscreen_non_smtp_command_enable</a> = yes", <a href="postscreen.8.html">postscreen(8)</a> 571 1.1 tron detects zombies that send commands specified with the 572 1.1 tron <a href="postconf.5.html#postscreen_forbidden_commands">postscreen_forbidden_commands</a> parameter. This also detects commands 573 1.1 tron with the syntax of a message header label. The latter is a symptom 574 1.1 tron that the client is sending message content after ignoring all the 575 1.1 tron responses from <a href="postscreen.8.html">postscreen(8)</a> that reject mail. </p> 576 1.1 tron 577 1.1 tron <p> This test is opportunistically enabled when <a href="postscreen.8.html">postscreen(8)</a> has 578 1.1 tron to use the built-in SMTP engine anyway. This is to make <a href="postscreen.8.html">postscreen(8)</a> 579 1.1 tron logging more informative. </p> 580 1.1 tron 581 1.1 tron <p> When a client sends non-SMTP commands, <a href="postscreen.8.html">postscreen(8)</a> logs this 582 1.1 tron as: </p> 583 1.1 tron 584 1.1 tron <pre> 585 1.1.1.3 tron <b>NON-SMTP COMMAND from</b> <i>[address]:port</i> <b>after</b> <i>command: text</i> 586 1.1 tron </pre> 587 1.1 tron 588 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> sent a 589 1.1.1.3 tron command that matches the <a href="postconf.5.html#postscreen_forbidden_commands">postscreen_forbidden_commands</a> 590 1.1.1.3 tron parameter, or that has the syntax of a message header label (text 591 1.1.1.3 tron followed by optional space and ":"). 592 1.1.1.3 tron The "<tt><b>after</b> <i>command</i></tt>" portion is logged with 593 1.1.1.3 tron Postfix 2.10 and later. </p> 594 1.1 tron 595 1.1 tron <p> The <a href="postconf.5.html#postscreen_non_smtp_command_action">postscreen_non_smtp_command_action</a> parameter specifies 596 1.1 tron the action that is taken next. See "<a href="#fail_after_220">When 597 1.1 tron tests fail after the 220 SMTP server greeting</a>" below. </p> 598 1.1 tron 599 1.1 tron <h3> <a name="barelf">Bare newline test</a> </h3> 600 1.1 tron 601 1.1 tron <p> SMTP is a line-oriented protocol: lines have a limited length, 602 1.1 tron and are terminated with <CR><LF>. Lines ending in a 603 1.1 tron "bare" <LF>, that is newline not preceded by carriage return, 604 1.1.1.7 christos are not allowed in SMTP. <a href="postscreen.8.html">postscreen(8)</a>'s 605 1.1.1.7 christos <a href="#after_220">deep 606 1.1 tron protocol test</a> for this is disabled by default. </p> 607 1.1 tron 608 1.1 tron <p> With "<a href="postconf.5.html#postscreen_bare_newline_enable">postscreen_bare_newline_enable</a> = yes", <a href="postscreen.8.html">postscreen(8)</a> 609 1.1 tron detects clients that send lines ending in bare newline characters. 610 1.1 tron </p> 611 1.1 tron 612 1.1 tron <p> This test is opportunistically enabled when <a href="postscreen.8.html">postscreen(8)</a> has 613 1.1 tron to use the built-in SMTP engine anyway. This is to make <a href="postscreen.8.html">postscreen(8)</a> 614 1.1 tron logging more informative. </p> 615 1.1 tron 616 1.1 tron <p> When a client sends bare newline characters, <a href="postscreen.8.html">postscreen(8)</a> logs 617 1.1 tron this as: 618 1.1 tron </p> 619 1.1 tron 620 1.1 tron <pre> 621 1.1.1.3 tron <b>BARE NEWLINE from</b> <i>[address]:port</i> <b>after</b> <i>command</i> 622 1.1 tron </pre> 623 1.1 tron 624 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> sent a bare 625 1.1 tron newline character, that is newline not preceded by carriage 626 1.1.1.3 tron return. 627 1.1.1.3 tron The "<tt><b>after</b> <i>command</i></tt>" portion is logged with 628 1.1.1.3 tron Postfix 2.10 and later. </p> 629 1.1 tron 630 1.1 tron <p> The <a href="postconf.5.html#postscreen_bare_newline_action">postscreen_bare_newline_action</a> parameter specifies the 631 1.1 tron action that is taken next. See "<a href="#fail_after_220">When 632 1.1 tron tests fail after the 220 SMTP server greeting</a>" below. </p> 633 1.1 tron 634 1.1 tron <h3> <a name="fail_after_220">When tests fail after the 220 SMTP server greeting</a> </h3> 635 1.1 tron 636 1.1 tron <p> When the client fails the pipelining, non-SMTP command or bare 637 1.1 tron newline tests, the action is specified with <a href="postconf.5.html#postscreen_pipelining_action">postscreen_pipelining_action</a>, 638 1.1 tron <a href="postconf.5.html#postscreen_non_smtp_command_action">postscreen_non_smtp_command_action</a> or <a href="postconf.5.html#postscreen_bare_newline_action">postscreen_bare_newline_action</a>, 639 1.1 tron respectively. </p> 640 1.1 tron 641 1.1 tron <dl> 642 1.1 tron 643 1.1 tron <dt> <b>ignore</b> (default for bare newline) </dt> 644 1.1 tron 645 1.1 tron <dd> Ignore the failure of this test. Allow other tests to complete. 646 1.1 tron Do NOT repeat this test before the result from some other test 647 1.1 tron expires. 648 1.1 tron 649 1.1 tron This option is useful for testing and collecting statistics without 650 1.1 tron blocking mail permanently. </dd> 651 1.1 tron 652 1.1 tron <dt> <b>enforce</b> (default for pipelining) </dt> 653 1.1 tron 654 1.1 tron <dd> Allow other tests to complete. Reject attempts to deliver 655 1.1 tron mail with a 550 SMTP reply, and log the helo/sender/recipient 656 1.1 tron information. Repeat this test the next time the client connects. 657 1.1 tron </dd> 658 1.1 tron 659 1.1 tron <dt> <b>drop</b> (default for non-SMTP commands) </dt> 660 1.1 tron 661 1.1 tron <dd> Drop the connection immediately with a 521 SMTP reply. Repeat 662 1.1 tron this test the next time the client connects. This action is 663 1.1 tron compatible with the Postfix SMTP server's <a href="postconf.5.html#smtpd_forbidden_commands">smtpd_forbidden_commands</a> 664 1.1 tron feature. </dd> 665 1.1 tron 666 1.1 tron </dl> 667 1.1 tron 668 1.1 tron <h2> <a name="other_error">Other errors</a> </h2> 669 1.1 tron 670 1.1.1.2 tron <p> When an SMTP client hangs up unexpectedly, <a href="postscreen.8.html">postscreen(8)</a> logs 671 1.1.1.2 tron this as: </p> 672 1.1 tron 673 1.1 tron <pre> 674 1.1 tron <b>HANGUP after</b> <i>time</i> <b>from</b> <i>[address]:port</i> <b>in</b> <i>test name</i> 675 1.1 tron </pre> 676 1.1 tron 677 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> disconnected 678 1.1 tron unexpectedly, <i>time</i> seconds after the start of the 679 1.1 tron test named <i>test name</i>. </p> 680 1.1 tron 681 1.1.1.2 tron <p> There is no punishment for hanging up. A client that hangs up 682 1.1.1.2 tron without sending the QUIT command can still pass all <a href="postscreen.8.html">postscreen(8)</a> 683 1.1.1.2 tron tests. </p> 684 1.1.1.2 tron 685 1.1 tron <!-- 686 1.1 tron 687 1.1 tron <p> While an unexpired penalty is in effect, an SMTP client is not 688 1.1 tron allowed to pass any tests, and <a href="postscreen.8.html">postscreen(8)</a> logs each connection 689 1.1 tron with the remaining amount of penalty time as: </p> 690 1.1 tron 691 1.1 tron <pre> 692 1.1 tron <b>PENALTY</b> <i>time</i> <b>for</b> <i>[address]:port</i> 693 1.1 tron </pre> 694 1.1 tron 695 1.1 tron <p> During this time, all attempts by the client to deliver mail 696 1.1 tron will be deferred with a 450 SMTP status. </p> 697 1.1 tron 698 1.1 tron --> 699 1.1 tron 700 1.1 tron <p> The following errors are reported by the built-in SMTP engine. 701 1.1 tron This engine never accepts mail, therefore it has per-session limits 702 1.1 tron on the number of commands and on the session length. </p> 703 1.1 tron 704 1.1 tron <pre> 705 1.1.1.3 tron <b>COMMAND TIME LIMIT</b> <b>from</b> <i>[address]:port</i> <b>after</b> <i>command</i> 706 1.1 tron </pre> 707 1.1 tron 708 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> reached the 709 1.1 tron per-command time limit as specified with the <a href="postconf.5.html#postscreen_command_time_limit">postscreen_command_time_limit</a> 710 1.1.1.3 tron parameter. The session is terminated immediately. 711 1.1.1.3 tron The "<tt><b>after</b> <i>command</i></tt>" portion is logged with 712 1.1.1.3 tron Postfix 2.10 and later. </p> 713 1.1 tron 714 1.1 tron <pre> 715 1.1.1.3 tron <b>COMMAND COUNT LIMIT from</b> <i>[address]:port</i> <b>after</b> <i>command</i> 716 1.1 tron </pre> 717 1.1 tron 718 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> reached the 719 1.1 tron per-session command count limit as specified with the 720 1.1 tron <a href="postconf.5.html#postscreen_command_count_limit">postscreen_command_count_limit</a> parameter. The session is terminated 721 1.1.1.3 tron immediately. 722 1.1.1.3 tron The "<tt><b>after</b> <i>command</i></tt>" portion is logged with 723 1.1.1.3 tron Postfix 2.10 and later. </p> 724 1.1 tron 725 1.1 tron <pre> 726 1.1.1.3 tron <b>COMMAND LENGTH LIMIT from</b> <i>[address]:port</i> <b>after</b> <i>command</i> 727 1.1 tron </pre> 728 1.1 tron 729 1.1 tron <p> Translation: the SMTP client at <i>[address]:port</i> reached the 730 1.1 tron per-command length limit, as specified with the <a href="postconf.5.html#line_length_limit">line_length_limit</a> 731 1.1.1.3 tron parameter. The session is terminated immediately. 732 1.1.1.3 tron The "<tt><b>after</b> <i>command</i></tt>" portion is logged with 733 1.1.1.3 tron Postfix 2.10 and later. </p> 734 1.1 tron 735 1.1 tron <p> When an SMTP client makes too many connections at the same time, 736 1.1.1.6 christos <a href="postscreen.8.html">postscreen(8)</a> rejects the connection with a 421 status code and logs: </p> 737 1.1 tron 738 1.1 tron <pre> 739 1.1 tron <b>NOQUEUE: reject: CONNECT from</b> <i>[address]:port</i><b>: too many connections</b> 740 1.1.1.6 christos </pre> 741 1.1.1.6 christos 742 1.1.1.6 christos <p> The <a href="postconf.5.html#postscreen_client_connection_count_limit">postscreen_client_connection_count_limit</a> parameter controls this limit. </p> 743 1.1.1.6 christos 744 1.1.1.6 christos <p> When an SMTP client connects after <a href="postscreen.8.html">postscreen(8)</a> has reached a 745 1.1.1.6 christos connection count limit, <a href="postscreen.8.html">postscreen(8)</a> rejects the connection with 746 1.1.1.6 christos a 421 status code and logs: </p> 747 1.1.1.6 christos 748 1.1.1.6 christos <pre> 749 1.1.1.6 christos <b>NOQUEUE: reject: CONNECT from</b> <i>[address]:port</i><b>: all screening ports busy</b> 750 1.1 tron <b>NOQUEUE: reject: CONNECT from</b> <i>[address]:port</i><b>: all server ports busy</b> 751 1.1 tron </pre> 752 1.1 tron 753 1.1.1.6 christos <p> The <a href="postconf.5.html#postscreen_pre_queue_limit">postscreen_pre_queue_limit</a> and <a href="postconf.5.html#postscreen_post_queue_limit">postscreen_post_queue_limit</a> 754 1.1.1.6 christos parameters control these limits. </p> 755 1.1 tron 756 1.1 tron <h2> <a name="victory">When all tests succeed</a> </h2> 757 1.1 tron 758 1.1.1.7 christos <p> When a new SMTP client passes all tests (i.e. it is not allowlisted 759 1.1 tron via some mechanism), <a href="postscreen.8.html">postscreen(8)</a> logs this as: </p> 760 1.1 tron 761 1.1 tron <pre> 762 1.1 tron <b>PASS NEW</b> <i>[address]:port</i> 763 1.1 tron </pre> 764 1.1 tron 765 1.1 tron <p> Where <i>[address]:port</i> are the client IP address and port. 766 1.1 tron Then, <a href="postscreen.8.html">postscreen(8)</a> 767 1.1.1.7 christos creates a temporary allowlist entry that excludes the client IP 768 1.1.1.7 christos address from further tests until the temporary allowlist entry 769 1.1 tron expires, as controlled with the postscreen_*_ttl parameters. </p> 770 1.1 tron 771 1.1 tron <p> When no "<a href="#after_220">deep protocol tests</a>" are 772 1.1 tron configured, <a href="postscreen.8.html">postscreen(8)</a> hands off the "live" connection to a Postfix 773 1.1 tron SMTP server process. The client can then continue as if <a href="postscreen.8.html">postscreen(8)</a> 774 1.1 tron never even existed (except for the short <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> delay). 775 1.1 tron </p> 776 1.1 tron 777 1.1 tron <p> When any "<a href="#after_220">deep protocol tests</a>" are 778 1.1 tron configured, <a href="postscreen.8.html">postscreen(8)</a> cannot hand off the "live" connection to 779 1.1 tron a Postfix SMTP server process in the middle of the session. Instead, 780 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> defers mail delivery attempts with a 4XX status, logs 781 1.1 tron the helo/sender/recipient information, and waits for the client to 782 1.1 tron disconnect. The next time the client connects it will be allowed 783 1.1 tron to talk to a Postfix SMTP server process to deliver its mail. 784 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> mitigates the impact of this limitation by giving 785 1.1 tron <a href="#after_220">deep protocol tests</a> a long expiration 786 1.1 tron time. </p> 787 1.1 tron 788 1.1 tron <h2> <a name="config"> Configuring the postscreen(8) service</a> 789 1.1 tron </h2> 790 1.1 tron 791 1.1 tron <p> <a href="postscreen.8.html">postscreen(8)</a> has been tested on FreeBSD [4-8], Linux 2.[4-6] 792 1.1 tron and Solaris 9 systems. </p> 793 1.1 tron 794 1.1 tron <ul> 795 1.1 tron 796 1.1 tron <li> <a href="#enable"> Turning on postscreen(8) without blocking 797 1.1 tron mail</a> 798 1.1 tron 799 1.1 tron <li> <a href="#starttls"> postscreen(8) TLS configuration </a> 800 1.1 tron 801 1.1 tron <li> <a href="#blocking"> Blocking mail with postscreen(8) </a> 802 1.1 tron 803 1.1 tron <li> <a href="#turnoff"> Turning off postscreen(8) </a> 804 1.1 tron 805 1.1.1.7 christos <li> <a href="#temp_allow_sharing"> Sharing the temporary allowlist 806 1.1.1.4 tron </a> 807 1.1.1.4 tron 808 1.1 tron </ul> 809 1.1 tron 810 1.1 tron <h3> <a name="enable"> Turning on postscreen(8) without blocking mail</a> </h3> 811 1.1 tron 812 1.1 tron <p> To enable the <a href="postscreen.8.html">postscreen(8)</a> service and log client information 813 1.1 tron without blocking mail: </p> 814 1.1 tron 815 1.1 tron <ol> 816 1.1 tron 817 1.1 tron <li> <p> Make sure that local clients and systems with non-standard 818 1.1 tron SMTP implementations are excluded from any <a href="postscreen.8.html">postscreen(8)</a> tests. The 819 1.1 tron default is to exclude all clients in <a href="postconf.5.html#mynetworks">mynetworks</a>. To exclude additional 820 1.1 tron clients, for example, third-party performance monitoring tools (these 821 1.1 tron tend to have broken SMTP implementations): </p> 822 1.1 tron 823 1.1 tron <pre> 824 1.1 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 825 1.1.1.7 christos # Exclude broken clients by allowlisting. Clients in <a href="postconf.5.html#mynetworks">mynetworks</a> 826 1.1.1.7 christos # should always be allowlisted. 827 1.1 tron <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, 828 1.1 tron <a href="cidr_table.5.html">cidr</a>:/etc/postfix/postscreen_access.cidr 829 1.1 tron 830 1.1 tron /etc/postfix/postscreen_access.<a href="cidr_table.5.html">cidr</a>: 831 1.1 tron 192.168.254.0/24 permit 832 1.1 tron </pre> 833 1.1 tron 834 1.1 tron <li> <p> Comment out the "<tt>smtp inet ... smtpd</tt>" service 835 1.1 tron in <a href="master.5.html">master.cf</a>, including any "<tt>-o parameter=value</tt>" entries 836 1.1 tron that follow. </p> 837 1.1 tron 838 1.1 tron <pre> 839 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 840 1.1 tron #smtp inet n - n - - smtpd 841 1.1 tron # -o parameter=value ... 842 1.1 tron </pre> 843 1.1 tron 844 1.1 tron <li> <p> Uncomment the new "<tt>smtpd pass ... smtpd</tt>" service 845 1.1 tron in <a href="master.5.html">master.cf</a>, and duplicate any "<tt>-o parameter=value</tt>" entries 846 1.1 tron from the smtpd service that was commented out in the previous step. 847 1.1 tron </p> 848 1.1 tron 849 1.1 tron <pre> 850 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 851 1.1 tron smtpd pass - - n - - smtpd 852 1.1 tron -o parameter=value ... 853 1.1 tron </pre> 854 1.1 tron 855 1.1 tron <li> <p> Uncomment the new "<tt>smtp inet ... postscreen</tt>" 856 1.1 tron service in <a href="master.5.html">master.cf</a>. </p> 857 1.1 tron 858 1.1 tron <pre> 859 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 860 1.1 tron smtp inet n - n - 1 postscreen 861 1.1 tron </pre> 862 1.1 tron 863 1.1 tron <li> <p> Uncomment the new "<tt>tlsproxy unix ... tlsproxy</tt>" 864 1.1 tron service in <a href="master.5.html">master.cf</a>. This service implements STARTTLS support for 865 1.1 tron <a href="postscreen.8.html">postscreen(8)</a>. </p> 866 1.1 tron 867 1.1 tron <pre> 868 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 869 1.1 tron tlsproxy unix - - n - 0 tlsproxy 870 1.1 tron </pre> 871 1.1 tron 872 1.1 tron <li> <p> Uncomment the new "<tt>dnsblog unix ... dnsblog</tt>" 873 1.1 tron service in <a href="master.5.html">master.cf</a>. This service does DNSBL lookups for <a href="postscreen.8.html">postscreen(8)</a> 874 1.1 tron and logs results. </p> 875 1.1 tron 876 1.1 tron <pre> 877 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 878 1.1 tron dnsblog unix - - n - 0 dnsblog 879 1.1 tron </pre> 880 1.1 tron 881 1.1 tron <li> <p> To enable DNSBL lookups, list some DNS blocklist sites in 882 1.1 tron <a href="postconf.5.html">main.cf</a>, separated by whitespace. Different sites can have different 883 1.1 tron weights. For example: 884 1.1 tron 885 1.1 tron <pre> 886 1.1 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 887 1.1 tron <a href="postconf.5.html#postscreen_dnsbl_threshold">postscreen_dnsbl_threshold</a> = 2 888 1.1 tron <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> = zen.spamhaus.org*2 889 1.1 tron bl.spamcop.net*1 b.barracudacentral.org*1 890 1.1 tron </pre> 891 1.1 tron 892 1.1 tron <p> Note: if your DNSBL queries have a "secret" in the domain name, 893 1.1 tron you must censor this information from the <a href="postscreen.8.html">postscreen(8)</a> SMTP replies. 894 1.1 tron For example: </p> 895 1.1 tron 896 1.1 tron <pre> 897 1.1 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 898 1.1.1.2 tron <a href="postconf.5.html#postscreen_dnsbl_reply_map">postscreen_dnsbl_reply_map</a> = <a href="DATABASE_README.html#types">texthash</a>:/etc/postfix/dnsbl_reply 899 1.1 tron </pre> 900 1.1 tron 901 1.1 tron <pre> 902 1.1 tron /etc/postfix/dnsbl_reply: 903 1.1.1.5 christos # Secret DNSBL name Name in <a href="postscreen.8.html">postscreen(8)</a> replies 904 1.1.1.5 christos secret.zen.dq.spamhaus.net zen.spamhaus.org 905 1.1 tron </pre> 906 1.1 tron 907 1.1.1.4 tron <p> The <a href="DATABASE_README.html#types">texthash</a>: format is similar to <a href="DATABASE_README.html#types">hash</a>: except that there is 908 1.1 tron no need to run <a href="postmap.1.html">postmap(1)</a> before the file can be used, and that it 909 1.1 tron does not detect changes after the file is read. It is new with 910 1.1 tron Postfix version 2.8. </p> 911 1.1 tron 912 1.1 tron <li> <p> Read the new configuration with "<tt>postfix reload</tt>". 913 1.1 tron </p> 914 1.1 tron 915 1.1 tron </ol> 916 1.1 tron 917 1.1 tron <p> Notes: </p> 918 1.1 tron 919 1.1 tron <ul> 920 1.1 tron 921 1.1 tron <li> <p> Some <a href="postscreen.8.html">postscreen(8)</a> configuration parameters implement 922 1.1 tron stress-dependent behavior. This is supported only when the default 923 1.1.1.2 tron value is stress-dependent (that is, "postconf -d <i>parametername</i>" 924 1.1.1.7 christos output shows 925 1.1.1.7 christos "<i>parametername</i> = ${stress?<i>something</i>}${stress:<i>something</i>}" or 926 1.1.1.7 christos "<i>parametername</i> = ${stress?{<i>something</i>}:{<i>something</i>}}"). 927 1.1 tron Other parameters always evaluate as if the stress value is the empty 928 1.1 tron string. </p> 929 1.1 tron 930 1.1 tron <li> <p> See "<a href="#before_220">Tests before the 220 SMTP server 931 1.1.1.7 christos greeting</a>" for details about the logging from these 932 1.1.1.7 christos <a href="postscreen.8.html">postscreen(8)</a> tests. </p> 933 1.1 tron 934 1.1 tron <li> <p> If you run Postfix 2.6 or earlier you must stop and start 935 1.1 tron the master daemon ("<tt>postfix stop; postfix start</tt>"). This 936 1.1 tron is needed because the Postfix "pass" master service type did not 937 1.1 tron work reliably on all systems. </p> 938 1.1 tron 939 1.1 tron </ul> 940 1.1 tron 941 1.1 tron <h3> <a name="starttls"> postscreen(8) TLS configuration </a> </h3> 942 1.1 tron 943 1.1 tron <p> <a href="postscreen.8.html">postscreen(8)</a> TLS support is available for remote SMTP clients 944 1.1.1.7 christos that aren't allowlisted, including clients that need to renew their 945 1.1.1.7 christos temporary allowlist status. When a remote SMTP client requests TLS 946 1.1 tron service, <a href="postscreen.8.html">postscreen(8)</a> invisibly hands off the connection to a 947 1.1 tron <a href="tlsproxy.8.html">tlsproxy(8)</a> process. Then, <a href="tlsproxy.8.html">tlsproxy(8)</a> encrypts and decrypts the 948 1.1 tron traffic between <a href="postscreen.8.html">postscreen(8)</a> and the remote SMTP client. One 949 1.1 tron <a href="tlsproxy.8.html">tlsproxy(8)</a> process can handle multiple SMTP sessions. The number 950 1.1 tron of <a href="tlsproxy.8.html">tlsproxy(8)</a> processes slowly increases with server load, but it 951 1.1 tron should always be much smaller than the number of <a href="postscreen.8.html">postscreen(8)</a> TLS 952 1.1 tron sessions. </p> 953 1.1 tron 954 1.1 tron <p> TLS support for <a href="postscreen.8.html">postscreen(8)</a> and <a href="tlsproxy.8.html">tlsproxy(8)</a> uses the same 955 1.1 tron parameters as with <a href="smtpd.8.html">smtpd(8)</a>. We recommend that you keep the relevant 956 1.1 tron configuration parameters in <a href="postconf.5.html">main.cf</a>. If you must specify "-o 957 1.1 tron smtpd_mumble=value" parameter overrides in <a href="master.5.html">master.cf</a> for a 958 1.1 tron postscreen-protected <a href="smtpd.8.html">smtpd(8)</a> service, then you should specify those 959 1.1 tron same parameter overrides for the <a href="postscreen.8.html">postscreen(8)</a> and <a href="tlsproxy.8.html">tlsproxy(8)</a> 960 1.1 tron services. </p> 961 1.1 tron 962 1.1 tron <h3> <a name="blocking"> Blocking mail with postscreen(8) </a> </h3> 963 1.1 tron 964 1.1 tron <p> For compatibility with <a href="smtpd.8.html">smtpd(8)</a>, <a href="postscreen.8.html">postscreen(8)</a> implements the 965 1.1 tron <a href="postconf.5.html#soft_bounce">soft_bounce</a> safety feature. This causes Postfix to reject mail with 966 1.1 tron a "try again" reply code. </p> 967 1.1 tron 968 1.1 tron <ul> 969 1.1 tron 970 1.1 tron <li> <p> To turn this on for all of Postfix, specify "<tt><a href="postconf.5.html#soft_bounce">soft_bounce</a> 971 1.1 tron = yes</tt>" in <a href="postconf.5.html">main.cf</a>. </p> 972 1.1 tron 973 1.1 tron <li> <p> To turn this on for <a href="postscreen.8.html">postscreen(8)</a> only, append "<tt>-o 974 1.1 tron <a href="postconf.5.html#soft_bounce">soft_bounce</a>=yes</tt>" (note: NO SPACES around '=') to the postscreen 975 1.1 tron entry in <a href="master.5.html">master.cf</a>. <p> 976 1.1 tron 977 1.1 tron </ul> 978 1.1 tron 979 1.1 tron <p> Execute "<tt>postfix reload</tt>" to make the change effective. </p> 980 1.1 tron 981 1.1 tron <p> After testing, do not forget to remove the <a href="postconf.5.html#soft_bounce">soft_bounce</a> feature, 982 1.1 tron otherwise senders won't receive their non-delivery notification 983 1.1 tron until many days later. </p> 984 1.1 tron 985 1.1 tron <p> To use the <a href="postscreen.8.html">postscreen(8)</a> service to block mail, edit <a href="postconf.5.html">main.cf</a> and 986 1.1 tron specify one or more of: </p> 987 1.1 tron 988 1.1 tron <ul> 989 1.1 tron 990 1.1 tron <li> <p> "<tt><a href="postconf.5.html#postscreen_dnsbl_action">postscreen_dnsbl_action</a> = enforce</tt>", to reject 991 1.1 tron clients that are on DNS blocklists, and to log the helo/sender/recipient 992 1.1 tron information. With good DNSBLs this reduces the amount of load on 993 1.1 tron Postfix SMTP servers dramatically. </p> 994 1.1 tron 995 1.1 tron <li> <p> "<tt><a href="postconf.5.html#postscreen_greet_action">postscreen_greet_action</a> = enforce</tt>", to reject 996 1.1 tron clients that talk before their turn, and to log the helo/sender/recipient 997 1.1 tron information. This stops over half of all known-to-be illegitimate 998 1.1 tron connections to Wietse's mail server. It is backup protection for 999 1.1.1.7 christos zombies that haven't yet been denylisted. </p> 1000 1.1 tron 1001 1.1 tron <li> <p> You can also enable "<a href="#after_220">deep protocol 1002 1.1 tron tests</a>", but these are more intrusive than the pregreet or DNSBL 1003 1.1 tron tests. </p> 1004 1.1 tron 1005 1.1 tron <p> When a good client passes the "<a href="#after_220">deep 1006 1.1.1.7 christos protocol tests</a>", 1007 1.1.1.7 christos <a href="postscreen.8.html">postscreen(8)</a> adds the client to the temporary 1008 1.1.1.7 christos allowlist but it cannot hand off the "live" connection to a Postfix 1009 1.1 tron SMTP server process in the middle of the session. Instead, <a href="postscreen.8.html">postscreen(8)</a> 1010 1.1 tron defers mail delivery attempts with a 4XX status, logs the 1011 1.1 tron helo/sender/recipient information, and waits for the client to 1012 1.1 tron disconnect. </p> 1013 1.1 tron 1014 1.1 tron <p> When the good client comes back in a later session, it is allowed 1015 1.1.1.5 christos to talk directly to a Postfix SMTP server. See "<a href="#after_220">Tests 1016 1.1.1.5 christos after the 220 SMTP server greeting</a>" above for limitations with 1017 1.1.1.5 christos AUTH and other features that clients may need. </p> 1018 1.1 tron 1019 1.1 tron <p> An unexpected benefit from "<a href="#after_220">deep protocol 1020 1.1 tron tests</a>" is that some "good" clients don't return after the 4XX 1021 1.1.1.5 christos reply; these clients were not so good after all. </p> 1022 1.1.1.5 christos 1023 1.1.1.5 christos <p> Unfortunately, some senders will retry requests from different 1024 1.1.1.7 christos IP addresses, and may never get allowlisted. For this reason, 1025 1.1.1.5 christos Wietse stopped using "<a href="#after_220">deep protocol tests</a>" 1026 1.1.1.5 christos on his own internet-facing mail server. </p> 1027 1.1 tron 1028 1.1.1.7 christos <li> <p> There is also support for permanent denylisting and 1029 1.1.1.7 christos allowlisting; see the description of the <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> 1030 1.1 tron parameter for details. </p> 1031 1.1 tron 1032 1.1 tron </ul> 1033 1.1 tron 1034 1.1 tron <h3> <a name="turnoff"> Turning off postscreen(8) </a> </h3> 1035 1.1 tron 1036 1.1 tron <p> To turn off <a href="postscreen.8.html">postscreen(8)</a> and handle mail directly with Postfix 1037 1.1 tron SMTP server processes: </p> 1038 1.1 tron 1039 1.1 tron <ol> 1040 1.1 tron 1041 1.1 tron <li> <p> Comment out the "<tt>smtp inet ... postscreen</tt>" service 1042 1.1 tron in <a href="master.5.html">master.cf</a>, including any "<tt>-o parameter=value</tt>" entries 1043 1.1 tron that follow. </p> 1044 1.1 tron 1045 1.1 tron <pre> 1046 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 1047 1.1 tron #smtp inet n - n - 1 postscreen 1048 1.1 tron # -o parameter=value ... 1049 1.1 tron </pre> 1050 1.1 tron 1051 1.1 tron <li> <p> Comment out the "<tt>dnsblog unix ... dnsblog</tt>" service 1052 1.1 tron in <a href="master.5.html">master.cf</a>. </p> 1053 1.1 tron 1054 1.1 tron <pre> 1055 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 1056 1.1 tron #dnsblog unix - - n - 0 dnsblog 1057 1.1 tron </pre> 1058 1.1 tron 1059 1.1 tron <li> <p> Comment out the "<tt>smtpd pass ... smtpd</tt>" service 1060 1.1 tron in <a href="master.5.html">master.cf</a>, including any "<tt>-o parameter=value</tt>" entries 1061 1.1 tron that follow. </p> 1062 1.1 tron 1063 1.1 tron <pre> 1064 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 1065 1.1 tron #smtpd pass - - n - - smtpd 1066 1.1 tron # -o parameter=value ... 1067 1.1 tron </pre> 1068 1.1 tron 1069 1.1 tron <li> <p> Comment out the "<tt>tlsproxy unix ... tlsproxy</tt>" 1070 1.1 tron service in <a href="master.5.html">master.cf</a>, including any "<tt>-o parameter=value</tt>" 1071 1.1 tron entries that follow. </p> 1072 1.1 tron 1073 1.1 tron <pre> 1074 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 1075 1.1 tron #tlsproxy unix - - n - 0 tlsproxy 1076 1.1 tron # -o parameter=value ... 1077 1.1 tron </pre> 1078 1.1 tron 1079 1.1 tron <li> <p> Uncomment the "<tt>smtp inet ... smtpd</tt>" service in 1080 1.1 tron <a href="master.5.html">master.cf</a>, including any "<tt>-o parameter=value</tt>" entries that 1081 1.1 tron may follow. </p> 1082 1.1 tron 1083 1.1 tron <pre> 1084 1.1 tron /etc/postfix/<a href="master.5.html">master.cf</a>: 1085 1.1 tron smtp inet n - n - - smtpd 1086 1.1 tron -o parameter=value ... 1087 1.1 tron </pre> 1088 1.1 tron 1089 1.1 tron <li> <p> Read the new configuration with "<tt>postfix reload</tt>". 1090 1.1 tron </p> 1091 1.1 tron 1092 1.1 tron </ol> 1093 1.1 tron 1094 1.1.1.7 christos <h3> <a name="temp_allow_sharing"> Sharing the temporary allowlist </a> </h3> 1095 1.1.1.4 tron 1096 1.1.1.7 christos <p> By default, the temporary allowlist is not shared between 1097 1.1.1.4 tron multiple <a href="postscreen.8.html">postscreen(8)</a> daemons. To enable sharing, choose one 1098 1.1.1.4 tron of the following options: </p> 1099 1.1.1.4 tron 1100 1.1.1.4 tron <ul> 1101 1.1.1.4 tron 1102 1.1.1.7 christos <li> <p> A non-persistent <a href="memcache_table.5.html">memcache</a>: temporary allowlist can be shared 1103 1.1.1.4 tron between <a href="postscreen.8.html">postscreen(8)</a> daemons on the same host or different 1104 1.1.1.4 tron hosts. Disable cache cleanup (<a href="postconf.5.html#postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a> 1105 1.1.1.6 christos = 0) in all <a href="postscreen.8.html">postscreen(8)</a> daemons because <a href="memcache_table.5.html">memcache</a>: has no 1106 1.1.1.6 christos first-next API (but see example 4 below for <a href="memcache_table.5.html">memcache</a>: with 1107 1.1.1.4 tron persistent backup). This requires Postfix 2.9 or later. </p> 1108 1.1.1.4 tron 1109 1.1.1.4 tron <pre> 1110 1.1.1.7 christos # Example 1: non-persistent <a href="memcache_table.5.html">memcache</a>: allowlist. 1111 1.1.1.4 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 1112 1.1.1.4 tron <a href="postconf.5.html#postscreen_cache_map">postscreen_cache_map</a> = <a href="memcache_table.5.html">memcache</a>:/etc/postfix/postscreen_cache 1113 1.1.1.4 tron <a href="postconf.5.html#postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a> = 0 1114 1.1.1.4 tron 1115 1.1.1.4 tron /etc/postfix/postscreen_cache: 1116 1.1.1.4 tron memcache = inet:127.0.0.1:11211 1117 1.1.1.4 tron key_format = postscreen:%s 1118 1.1.1.4 tron </pre> 1119 1.1.1.4 tron 1120 1.1.1.4 tron <li> <p> 1121 1.1.1.7 christos A persistent <a href="lmdb_table.5.html">lmdb</a>: temporary allowlist can be shared between 1122 1.1.1.4 tron <a href="postscreen.8.html">postscreen(8)</a> daemons that run under the same <a href="master.8.html">master(8)</a> daemon, 1123 1.1.1.4 tron or under different <a href="master.8.html">master(8)</a> daemons on the same host. Disable 1124 1.1.1.4 tron cache cleanup (<a href="postconf.5.html#postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a> = 0) in all 1125 1.1.1.4 tron <a href="postscreen.8.html">postscreen(8)</a> daemons except one that is responsible for cache 1126 1.1.1.4 tron cleanup. This requires Postfix 2.11 or later. </p> 1127 1.1.1.4 tron 1128 1.1.1.4 tron <pre> 1129 1.1.1.7 christos # Example 2: persistent <a href="lmdb_table.5.html">lmdb</a>: allowlist. 1130 1.1.1.4 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 1131 1.1.1.4 tron <a href="postconf.5.html#postscreen_cache_map">postscreen_cache_map</a> = <a href="lmdb_table.5.html">lmdb</a>:$<a href="postconf.5.html#data_directory">data_directory</a>/postscreen_cache 1132 1.1.1.4 tron # See note 1 below. 1133 1.1.1.4 tron # <a href="postconf.5.html#postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a> = 0 1134 1.1.1.4 tron </pre> 1135 1.1.1.4 tron 1136 1.1.1.7 christos <li> <p> Other kinds of persistent temporary allowlist can be shared 1137 1.1.1.4 tron only between <a href="postscreen.8.html">postscreen(8)</a> daemons that run under the same 1138 1.1.1.7 christos <a href="master.8.html">master(8)</a> daemon. In this case, temporary allowlist access must 1139 1.1.1.4 tron be shared through the <a href="proxymap.8.html">proxymap(8)</a> daemon. This requires Postfix 1140 1.1.1.4 tron 2.9 or later. </p> 1141 1.1.1.4 tron 1142 1.1.1.4 tron <pre> 1143 1.1.1.7 christos # Example 3: proxied <a href="DATABASE_README.html#types">btree</a>: allowlist. 1144 1.1.1.4 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 1145 1.1.1.4 tron <a href="postconf.5.html#postscreen_cache_map">postscreen_cache_map</a> = 1146 1.1.1.4 tron <a href="proxymap.8.html">proxy</a>:<a href="DATABASE_README.html#types">btree</a>:/var/lib/postfix/postscreen_cache 1147 1.1.1.4 tron # See note 1 below. 1148 1.1.1.4 tron # <a href="postconf.5.html#postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a> = 0 1149 1.1.1.4 tron 1150 1.1.1.7 christos # Example 4: proxied <a href="DATABASE_README.html#types">btree</a>: allowlist with <a href="memcache_table.5.html">memcache</a>: accelerator. 1151 1.1.1.4 tron /etc/postfix/<a href="postconf.5.html">main.cf</a>: 1152 1.1.1.4 tron <a href="postconf.5.html#postscreen_cache_map">postscreen_cache_map</a> = <a href="memcache_table.5.html">memcache</a>:/etc/postfix/postscreen_cache 1153 1.1.1.4 tron <a href="postconf.5.html#proxy_write_maps">proxy_write_maps</a> = 1154 1.1.1.4 tron <a href="proxymap.8.html">proxy</a>:<a href="DATABASE_README.html#types">btree</a>:/var/lib/postfix/postscreen_cache 1155 1.1.1.4 tron ... other proxied tables ... 1156 1.1.1.4 tron # See note 1 below. 1157 1.1.1.4 tron # <a href="postconf.5.html#postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a> = 0 1158 1.1.1.4 tron 1159 1.1.1.4 tron /etc/postfix/postscreen_cache: 1160 1.1.1.4 tron # Note: the $<a href="postconf.5.html#data_directory">data_directory</a> macro is not defined in this context. 1161 1.1.1.4 tron memcache = inet:127.0.0.1:11211 1162 1.1.1.4 tron backup = <a href="proxymap.8.html">proxy</a>:<a href="DATABASE_README.html#types">btree</a>:/var/lib/postfix/postscreen_cache 1163 1.1.1.4 tron key_format = postscreen:%s 1164 1.1.1.4 tron </pre> 1165 1.1.1.4 tron 1166 1.1.1.4 tron <p> Note 1: disable cache cleanup (<a href="postconf.5.html#postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a> 1167 1.1.1.4 tron = 0) in all <a href="postscreen.8.html">postscreen(8)</a> daemons except one that is responsible 1168 1.1.1.4 tron for cache cleanup. </p> 1169 1.1.1.4 tron 1170 1.1.1.4 tron <p> Note 2: <a href="postscreen.8.html">postscreen(8)</a> cache sharing via <a href="proxymap.8.html">proxymap(8)</a> requires Postfix 1171 1.1.1.4 tron 2.9 or later; earlier <a href="proxymap.8.html">proxymap(8)</a> implementations don't support 1172 1.1.1.4 tron cache cleanup. </p> 1173 1.1.1.4 tron 1174 1.1.1.4 tron </ul> 1175 1.1.1.4 tron 1176 1.1 tron <h2> <a name="historical"> Historical notes and credits </a> </h2> 1177 1.1 tron 1178 1.1 tron <p> Many ideas in <a href="postscreen.8.html">postscreen(8)</a> were explored in earlier work by 1179 1.1 tron Michael Tokarev, in OpenBSD spamd, and in MailChannels Traffic 1180 1.1 tron Control. </p> 1181 1.1 tron 1182 1.1 tron <p> Wietse threw together a crude prototype with pregreet and dnsbl 1183 1.1 tron support in June 2009, because he needed something new for a Mailserver 1184 1.1 tron conference presentation in July. Ralf Hildebrandt ran this code on 1185 1.1 tron several servers to collect real-world statistics. This version used 1186 1.1 tron the <a href="dnsblog.8.html">dnsblog(8)</a> ad-hoc DNS client program. </p> 1187 1.1 tron 1188 1.1 tron <p> Wietse needed new material for a LISA conference presentation 1189 1.1 tron in November 2010, so he added support for DNSBL weights and filters 1190 1.1 tron in August, followed by a major code rewrite, deep protocol tests, 1191 1.1 tron helo/sender/recipient logging, and stress-adaptive behavior in 1192 1.1 tron September. Ralf Hildebrandt ran this code on several servers to 1193 1.1 tron collect real-world statistics. This version still used the embarrassing 1194 1.1 tron <a href="dnsblog.8.html">dnsblog(8)</a> ad-hoc DNS client program. </p> 1195 1.1 tron 1196 1.1 tron <p> Wietse added STARTTLS support in December 2010. This makes 1197 1.1 tron <a href="postscreen.8.html">postscreen(8)</a> usable for sites that require TLS support. The 1198 1.1 tron implementation introduces the <a href="tlsproxy.8.html">tlsproxy(8)</a> event-driven TLS proxy 1199 1.1 tron that decrypts/encrypts the sessions for multiple SMTP clients. </p> 1200 1.1 tron 1201 1.1.1.3 tron <p> The <a href="tlsproxy.8.html">tlsproxy(8)</a> implementation led to the discovery of a "new" 1202 1.1.1.3 tron class of vulnerability (<a 1203 1.1.1.3 tron href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0411" 1204 1.1.1.3 tron >CVE-2011-0411</a>) that affected multiple implementations of SMTP, 1205 1.1.1.3 tron POP, IMAP, NNTP, and FTP over TLS. </p> 1206 1.1.1.3 tron 1207 1.1.1.3 tron <p> <a href="postscreen.8.html">postscreen(8)</a> was officially released as part of the Postfix 1208 1.1.1.3 tron 2.8 stable release in January 2011.</p> 1209 1.1.1.3 tron 1210 1.1.1.7 christos <p> Noel Jones helped with the Postfix 3.6 transition towards respectful 1211 1.1.1.7 christos documentation. </p> 1212 1.1 tron 1213 1.1.1.7 christos </body> 1214 1.1 tron </html> 1215
Indexes created Sun Jun 07 00:24:08 UTC 2026