1 1.1 christos <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" 2 1.1.1.3 christos "https://www.w3.org/TR/html4/loose.dtd"> 3 1.1 christos 4 1.1 christos <head> 5 1.1 christos 6 1.1 christos <title>Postfix Postscreen Howto (Postfix 2.8 - 3.5)</title> 7 1.1 christos 8 1.1 christos <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> 9 1.1.1.2 christos <link rel='stylesheet' type='text/css' href='postfix-doc.css'> 10 1.1 christos 11 1.1 christos </head> 12 1.1 christos 13 1.1 christos <body> 14 1.1 christos 15 1.1 christos <h1><img src="postfix-logo.jpg" width="203" height="98" ALT="">Postfix Postscreen Howto (Postfix 2.8 - 3.5)</h1> 16 1.1 christos 17 1.1 christos <hr> 18 1.1 christos 19 1.1 christos <h2> <a name="intro">Introduction</a> </h2> 20 1.1 christos 21 1.1 christos <p> This document describes features that are available in Postfix 22 1.1 christos 2.8 - 3.5. </p> 23 1.1 christos 24 1.1 christos <p> The Postfix postscreen(8) daemon provides additional protection 25 1.1 christos against mail server overload. One postscreen(8) process handles 26 1.1 christos multiple inbound SMTP connections, and decides which clients may 27 1.1 christos talk to a Postfix SMTP server process. By keeping spambots away, 28 1.1 christos postscreen(8) leaves more SMTP server processes available for 29 1.1 christos legitimate clients, and delays the onset of <a 30 1.1 christos href="STRESS_README.html">server overload</a> conditions. </p> 31 1.1 christos 32 1.1 christos <p> postscreen(8) should not be used on SMTP ports that receive 33 1.1 christos mail from end-user clients (MUAs). In a typical deployment, 34 1.1 christos postscreen(8) handles the MX service on TCP port 25, while MUA 35 1.1 christos clients submit mail via the submission service on TCP port 587 which 36 1.1 christos requires client authentication. Alternatively, a site could set up 37 1.1 christos a dedicated, non-postscreen, "port 25" server that provides submission 38 1.1 christos service and client authentication, but no MX service. </p> 39 1.1 christos 40 1.1 christos <p> postscreen(8) maintains a temporary allowlist for clients that 41 1.1 christos pass its tests; by allowing allowlisted clients to skip tests, 42 1.1 christos postscreen(8) minimizes its impact on legitimate email traffic. 43 1.1 christos </p> 44 1.1 christos 45 1.1 christos <p> postscreen(8) is part of a multi-layer defense. <p> 46 1.1 christos 47 1.1 christos <ul> 48 1.1 christos 49 1.1 christos <li> <p> As the first layer, postscreen(8) blocks connections from 50 1.1 christos zombies and other spambots that are responsible for about 90% of 51 1.1 christos all spam. It is implemented as a single process to make this defense 52 1.1 christos as inexpensive as possible. </p> 53 1.1 christos 54 1.1 christos <li> <p> The second layer implements more complex SMTP-level access 55 1.1 christos checks with <a href="SMTPD_ACCESS_README.html">Postfix SMTP servers</a>, 56 1.1 christos <a href="SMTPD_POLICY_README.html">policy daemons</a>, and 57 1.1 christos <a href="MILTER_README.html">Milter applications</a>. </p> 58 1.1 christos 59 1.1 christos <li> <p> The third layer performs light-weight content inspection 60 1.1 christos with the Postfix built-in header_checks and body_checks. This can 61 1.1 christos block unacceptable attachments such as executable programs, and 62 1.1 christos worms or viruses with easy-to-recognize signatures. </p> 63 1.1 christos 64 1.1 christos <li> <p> The fourth layer provides heavy-weight content inspection 65 1.1 christos with external content filters. Typical examples are <a 66 1.1 christos href="http://www.ijs.si/software/amavisd/">Amavisd-new</a>, <a 67 1.1 christos href="http://spamassassin.apache.org/">SpamAssassin</a>, and <a 68 1.1 christos href="MILTER_README.html">Milter applications</a>. </p> 69 1.1 christos 70 1.1 christos </ul> 71 1.1 christos 72 1.1 christos <p> Each layer reduces the spam volume. The general strategy is to 73 1.1 christos use the less expensive defenses first, and to use the more expensive 74 1.1 christos defenses only for the spam that remains. </p> 75 1.1 christos 76 1.1 christos <p> Topics in this document: </p> 77 1.1 christos 78 1.1 christos <ul> 79 1.1 christos 80 1.1 christos <li> <a href="#intro">Introduction</a> 81 1.1 christos 82 1.1 christos <li> <a href="#basic">The basic idea behind postscreen(8)</a> 83 1.1 christos 84 1.1 christos <li> <a href="#general"> General operation </a> 85 1.1 christos 86 1.1 christos <li> <a href="#quick">Quick tests before everything else</a> 87 1.1 christos 88 1.1 christos <li> <a href="#before_220"> Tests before the 220 SMTP server greeting </a> 89 1.1 christos 90 1.1 christos <li> <a href="#after_220">Tests after the 220 SMTP server greeting</a> 91 1.1 christos 92 1.1 christos <li> <a href="#other_error">Other errors</a> 93 1.1 christos 94 1.1 christos <li> <a href="#victory">When all tests succeed</a> 95 1.1 christos 96 1.1 christos <li> <a href="#config"> Configuring the postscreen(8) service</a> 97 1.1 christos 98 1.1 christos <li> <a href="#historical"> Historical notes and credits </a> 99 1.1 christos 100 1.1 christos </ul> 101 1.1 christos 102 1.1 christos <h2> <a name="basic">The basic idea behind postscreen(8)</a> </h2> 103 1.1 christos 104 1.1 christos <p> Most email is spam, and most spam is sent out by zombies (malware 105 1.1 christos on compromised end-user computers). Wietse expects that the zombie 106 1.1 christos problem will get worse before things improve, if ever. Without a 107 1.1 christos tool like postscreen(8) that keeps the zombies away, Postfix would be 108 1.1 christos spending most of its resources not receiving email. </p> 109 1.1 christos 110 1.1 christos <p> The main challenge for postscreen(8) is to make an is-a-zombie 111 1.1 christos decision based on a single measurement. This is necessary because 112 1.1 christos many zombies try to fly under the radar and avoid spamming the same 113 1.1 christos site repeatedly. Once postscreen(8) decides that a client is 114 1.1 christos not-a-zombie, it allowlists the client temporarily to avoid further 115 1.1 christos delays for legitimate mail. </p> 116 1.1 christos 117 1.1 christos <p> Zombies have challenges too: they have only a limited amount 118 1.1 christos of time to deliver spam before their IP address becomes denylisted. 119 1.1 christos To speed up spam deliveries, zombies make compromises in their SMTP 120 1.1 christos protocol implementation. For example, they speak before their turn, 121 1.1 christos or they ignore responses from SMTP servers and continue sending 122 1.1 christos mail even when the server tells them to go away. </p> 123 1.1 christos 124 1.1 christos <p> postscreen(8) uses a variety of measurements to recognize 125 1.1 christos zombies. First, postscreen(8) determines if the remote SMTP client 126 1.1 christos IP address is denylisted. Second, postscreen(8) looks for protocol 127 1.1 christos compromises that are made to speed up delivery. These are good 128 1.1 christos indicators for making is-a-zombie decisions based on single 129 1.1 christos measurements. </p> 130 1.1 christos 131 1.1 christos <p> postscreen(8) does not inspect message content. Message content 132 1.1 christos can vary from one delivery to the next, especially with clients 133 1.1 christos that (also) send legitimate email. Content is not a good indicator 134 1.1 christos for making is-a-zombie decisions based on single measurements, 135 1.1 christos and that is the problem that postscreen(8) is focused on. </p> 136 1.1 christos 137 1.1 christos <h2> <a name="general"> General operation </a> </h2> 138 1.1 christos 139 1.1 christos <p> For each connection from an SMTP client, postscreen(8) performs 140 1.1 christos a number of tests 141 1.1 christos in the order as described below. Some tests introduce a delay of 142 1.1 christos a few seconds. postscreen(8) maintains a temporary allowlist for 143 1.1 christos clients that pass its tests; by allowing allowlisted clients to 144 1.1 christos skip tests, postscreen(8) minimizes its impact on legitimate email 145 1.1 christos traffic. </p> 146 1.1 christos 147 1.1 christos <p> By default, postscreen(8) hands off all connections to a Postfix 148 1.1 christos SMTP server process after logging its findings. This mode is useful 149 1.1 christos for non-destructive testing. </p> 150 1.1 christos 151 1.1 christos <p> In a typical production setting, postscreen(8) is configured 152 1.1 christos to reject mail from clients that fail one or more tests, after 153 1.1 christos logging the helo, sender and recipient information. </p> 154 1.1 christos 155 1.1 christos <p> Note: postscreen(8) is not an SMTP proxy; this is intentional. 156 1.1 christos The purpose is to keep zombies away from Postfix, with minimal 157 1.1 christos overhead for legitimate clients. </p> 158 1.1 christos 159 1.1 christos <h2> <a name="quick">Quick tests before everything else</a> </h2> 160 1.1 christos 161 1.1 christos <p> Before engaging in SMTP-level tests. postscreen(8) queries a 162 1.1 christos number of local deny and allowlists. These tests speed up the 163 1.1 christos handling of known clients. </p> 164 1.1 christos 165 1.1 christos <ul> 166 1.1 christos 167 1.1 christos <li> <a href="#perm_white_black"> Permanent allow/denylist test </a> 168 1.1 christos 169 1.1 christos <li> <a href="#temp_white"> Temporary allowlist test </a> 170 1.1 christos 171 1.1 christos <li> <a href="#white_veto"> MX Policy test </a> 172 1.1 christos 173 1.1 christos </ul> 174 1.1 christos 175 1.1 christos <h3> <a name="perm_white_black"> Permanent allow/denylist test </a> </h3> 176 1.1 christos 177 1.1 christos <p> The postscreen_access_list parameter (default: permit_mynetworks) 178 1.1 christos specifies a permanent access list for SMTP client IP addresses. Typically 179 1.1 christos one would specify something that allowlists local networks, followed 180 1.1 christos by a CIDR table for selective allow- and denylisting. </p> 181 1.1 christos 182 1.1 christos <p> Example: </p> 183 1.1 christos 184 1.1 christos <pre> 185 1.1 christos /etc/postfix/main.cf: 186 1.1 christos postscreen_access_list = permit_mynetworks, 187 1.1 christos cidr:/etc/postfix/postscreen_access.cidr 188 1.1 christos 189 1.1 christos /etc/postfix/postscreen_access.cidr: 190 1.1 christos # Rules are evaluated in the order as specified. 191 1.1 christos # Denylist 192.168.* except 192.168.0.1. 192 1.1 christos 192.168.0.1 permit 193 1.1 christos 192.168.0.0/16 reject 194 1.1 christos </pre> 195 1.1 christos 196 1.1 christos <p> See the postscreen_access_list manpage documentation for more 197 1.1 christos details. </p> 198 1.1 christos 199 1.1 christos <p> When the SMTP client address matches a "permit" action, 200 1.1 christos postscreen(8) logs this with the client address and port number as: 201 1.1 christos </p> 202 1.1 christos 203 1.1 christos <pre> 204 1.1 christos <b>WHITELISTED</b> <i>[address]:port</i> 205 1.1 christos </pre> 206 1.1 christos 207 1.1 christos <p> The allowlist action is not configurable: immediately hand off the 208 1.1 christos connection to a Postfix SMTP server process. </p> 209 1.1 christos 210 1.1 christos <p> When the SMTP client address matches a "reject" action, 211 1.1 christos postscreen(8) logs this with the client address and port number as: 212 1.1 christos </p> 213 1.1 christos 214 1.1 christos <pre> 215 1.1 christos <b>BLACKLISTED</b> <i>[address]:port</i> 216 1.1 christos </pre> 217 1.1 christos 218 1.1 christos <p> The postscreen_blacklist_action parameter specifies the action 219 1.1 christos that is taken next. See "<a href="#fail_before_220">When tests 220 1.1 christos fail before the 220 SMTP server greeting</a>" below. </p> 221 1.1 christos 222 1.1 christos <h3> <a name="temp_white"> Temporary allowlist test </a> </h3> 223 1.1 christos 224 1.1 christos <p> The postscreen(8) daemon maintains a <i>temporary</i> 225 1.1 christos allowlist for SMTP client IP addresses that have passed all 226 1.1 christos the tests described below. The postscreen_cache_map parameter 227 1.1 christos specifies the location of the temporary allowlist. The 228 1.1 christos temporary allowlist is not used for SMTP client addresses 229 1.1 christos that appear on the <i>permanent</i> access list. </p> 230 1.1 christos 231 1.1 christos <p> By default the temporary allowlist is not shared with other 232 1.1 christos postscreen(8) daemons. See 233 1.1 christos <a href="#temp_white_sharing"> Sharing 234 1.1 christos the temporary allowlist </a> below for alternatives. </p> 235 1.1 christos 236 1.1 christos <p> When the SMTP client address appears on the temporary 237 1.1 christos allowlist, postscreen(8) logs this with the client address and port 238 1.1 christos number as: </p> 239 1.1 christos 240 1.1 christos <pre> 241 1.1 christos <b>PASS OLD</b> <i>[address]:port</i> 242 1.1 christos </pre> 243 1.1 christos 244 1.1 christos <p> The action is not configurable: immediately hand off the 245 1.1 christos connection to a Postfix SMTP server process. The client is 246 1.1 christos excluded from further tests until its temporary allowlist 247 1.1 christos entry expires, as controlled with the postscreen_*_ttl 248 1.1 christos parameters. Expired entries are silently renewed if possible. </p> 249 1.1 christos 250 1.1 christos <h3> <a name="white_veto"> MX Policy test </a> </h3> 251 1.1 christos 252 1.1 christos <p> When the remote SMTP client is not on the static access list 253 1.1 christos or temporary allowlist, postscreen(8) can implement a number of 254 1.1 christos allowlist tests, before it grants the client a temporary allowlist 255 1.1 christos status that allows it to talk to a Postfix SMTP server process. </p> 256 1.1 christos 257 1.1 christos <p> When postscreen(8) is configured to monitor all primary and 258 1.1 christos backup MX addresses, it can refuse to allowlist clients that connect 259 1.1 christos to a backup MX address only (an old spammer trick to take advantage 260 1.1 christos of backup MX hosts with weaker anti-spam policies than primary MX 261 1.1 christos hosts). </p> 262 1.1 christos 263 1.1 christos <blockquote> <p> NOTE: The following solution is for small sites. 264 1.1 christos Larger sites would have to share the postscreen(8) cache between 265 1.1 christos primary and backup MTAs, which would introduce a common point of 266 1.1 christos failure. </p> </blockquote> 267 1.1 christos 268 1.1 christos <ul> 269 1.1 christos 270 1.1 christos <li> <p> First, configure the host to listen on both primary and 271 1.1 christos backup MX addresses. Use the appropriate <tt>ifconfig</tt> or <tt>ip</tt> 272 1.1 christos command for the local operating system, or update the appropriate 273 1.1 christos configuration files and "refresh" the network protocol stack. </p> 274 1.1 christos 275 1.1 christos <p> <p> Second, configure Postfix to listen on the new IP address 276 1.1 christos (this step is needed when you have specified inet_interfaces in 277 1.1 christos main.cf). </p> 278 1.1 christos 279 1.1 christos <li> <p> Then, configure postscreen(8) to deny the temporary allowlist 280 1.1 christos status on the backup MX address(es). An example for Wietse's 281 1.1 christos server is: </p> 282 1.1 christos 283 1.1 christos <pre> 284 1.1 christos /etc/postfix/main.cf: 285 1.1 christos postscreen_whitelist_interfaces = !168.100.189.8 static:all 286 1.1 christos </pre> 287 1.1 christos 288 1.1 christos <p> Translation: allow clients to obtain the temporary allowlist 289 1.1 christos status on all server IP addresses except 168.100.189.8, which is a 290 1.1 christos backup MX address. </p> 291 1.1 christos 292 1.1 christos </ul> 293 1.1 christos 294 1.1 christos <p> When a non-allowlisted client connects the backup MX address, 295 1.1 christos postscreen(8) logs this with the client address and port number as: 296 1.1 christos </p> 297 1.1 christos 298 1.1 christos <pre> 299 1.1 christos <b>CONNECT from</b> <i>[address]:port</i> <b>to [168.100.189.8]:25</b> 300 1.1 christos <b>WHITELIST VETO</b> <i>[address]:port</i> 301 1.1 christos </pre> 302 1.1 christos 303 1.1 christos <p> Translation: the client at <i>[address]:port</i> connected to 304 1.1 christos the backup MX address 168.100.189.8 while it was not allowlisted. 305 1.1 christos The client will not be granted the temporary allowlist status, even 306 1.1 christos if passes all the allowlist tests described below. </p> 307 1.1 christos 308 1.1 christos <h2> <a name="before_220"> Tests before the 220 SMTP server greeting </a> </h2> 309 1.1 christos 310 1.1 christos <p> The postscreen_greet_wait parameter specifies a short time 311 1.1 christos interval before the "220 <i>text</i>..." server greeting, where 312 1.1 christos postscreen(8) can run a number of tests in parallel. </p> 313 1.1 christos 314 1.1 christos <p> When a good client passes these tests, and no "<a 315 1.1 christos href="#after_220">deep protocol tests</a>" 316 1.1 christos are configured, postscreen(8) 317 1.1 christos adds the client to the temporary allowlist and hands off the "live" 318 1.1 christos connection to a Postfix SMTP server process. The client can then 319 1.1 christos continue as if postscreen(8) never even existed (except of course 320 1.1 christos for the short postscreen_greet_wait delay). </p> 321 1.1 christos 322 1.1 christos <ul> 323 1.1 christos 324 1.1 christos <li> <a href="#pregreet"> Pregreet test </a> 325 1.1 christos 326 1.1 christos <li> <a href="#dnsbl"> DNS Allow/denylist test </a> 327 1.1 christos 328 1.1 christos <li> <a href="#fail_before_220">When tests fail before the 220 SMTP server greeting</a> 329 1.1 christos 330 1.1 christos </ul> 331 1.1 christos 332 1.1 christos <h3> <a name="pregreet"> Pregreet test </a> </h3> 333 1.1 christos 334 1.1 christos <p> The SMTP protocol is a classic example of a protocol where the 335 1.1 christos server speaks before the client. postscreen(8) detects zombies 336 1.1 christos that are in a hurry and that speak before their turn. This test is 337 1.1 christos enabled by default. </p> 338 1.1 christos 339 1.1 christos <p> The postscreen_greet_banner parameter specifies the <i>text</i> 340 1.1 christos portion of a "220-<i>text</i>..." teaser banner (default: $smtpd_banner). 341 1.1 christos Note that this becomes the first part of a multi-line server greeting. 342 1.1 christos The postscreen(8) daemon sends this before the postscreen_greet_wait 343 1.1 christos timer is started. The purpose of the teaser banner is to confuse 344 1.1 christos zombies so that they speak before their turn. It has no effect on 345 1.1 christos SMTP clients that correctly implement the protocol. </p> 346 1.1 christos 347 1.1 christos <p> To avoid problems with poorly-implemented SMTP engines in network 348 1.1 christos appliances or network testing tools, either exclude them from all 349 1.1 christos tests with the postscreen_access_list feature or else specify 350 1.1 christos an empty teaser banner: </p> 351 1.1 christos 352 1.1 christos <pre> 353 1.1 christos /etc/postfix/main.cf: 354 1.1 christos # Exclude broken clients by allowlisting. Clients in mynetworks 355 1.1 christos # should always be allowlisted. 356 1.1 christos postscreen_access_list = permit_mynetworks, 357 1.1 christos cidr:/etc/postfix/postscreen_access.cidr 358 1.1 christos 359 1.1 christos /etc/postfix/postscreen_access.cidr: 360 1.1 christos 192.168.254.0/24 permit 361 1.1 christos </pre> 362 1.1 christos 363 1.1 christos <pre> 364 1.1 christos /etc/postfix/main.cf: 365 1.1 christos # Disable the teaser banner (try allowlisting first if you can). 366 1.1 christos postscreen_greet_banner = 367 1.1 christos </pre> 368 1.1 christos 369 1.1 christos <p> When an SMTP client sends a command before the 370 1.1 christos postscreen_greet_wait time has elapsed, postscreen(8) logs this as: 371 1.1 christos </p> 372 1.1 christos 373 1.1 christos <pre> 374 1.1 christos <b>PREGREET</b> <i>count</i> <b>after</b> <i>time</i> <b>from</b> <i>[address]:port text...</i> 375 1.1 christos </pre> 376 1.1 christos 377 1.1 christos <p> Translation: the client at <i>[address]:port</i> sent <i>count</i> 378 1.1 christos bytes before its turn to speak. This happened <i>time</i> seconds 379 1.1 christos after the postscreen_greet_wait timer was started. The <i>text</i> 380 1.1 christos is what the client sent (truncated to 100 bytes, and with non-printable 381 1.1 christos characters replaced with C-style escapes such as \r for carriage-return 382 1.1 christos and \n for newline). </p> 383 1.1 christos 384 1.1 christos <p> The postscreen_greet_action parameter specifies the action that 385 1.1 christos is taken next. See "<a href="#fail_before_220">When tests fail 386 1.1 christos before the 220 SMTP server greeting</a>" below. </p> 387 1.1 christos 388 1.1 christos <h3> <a name="dnsbl"> DNS Allow/denylist test </a> </h3> 389 1.1 christos 390 1.1 christos <p> The postscreen_dnsbl_sites parameter (default: empty) specifies 391 1.1 christos a list of DNS blocklist servers with optional filters and weight 392 1.1 christos factors (positive weights for denylisting, negative for allowlisting). 393 1.1 christos These servers will be queried in parallel with the reverse client 394 1.1 christos IP address. This test is disabled by default. </p> 395 1.1 christos 396 1.1 christos <blockquote> 397 1.1 christos <p> 398 1.1 christos CAUTION: when postscreen rejects mail, its SMTP reply contains the 399 1.1 christos DNSBL domain name. Use the postscreen_dnsbl_reply_map feature to 400 1.1 christos hide "password" information in DNSBL domain names. 401 1.1 christos </p> 402 1.1 christos </blockquote> 403 1.1 christos 404 1.1 christos <p> When the postscreen_greet_wait time has elapsed, and the combined 405 1.1 christos DNSBL score is equal to or greater than the postscreen_dnsbl_threshold 406 1.1 christos parameter value, postscreen(8) logs this as: </p> 407 1.1 christos 408 1.1 christos <pre> 409 1.1 christos <b>DNSBL rank</b> <i>count</i> <b>for</b> <i>[address]:port</i> 410 1.1 christos </pre> 411 1.1 christos 412 1.1 christos <p> Translation: the SMTP client at <i>[address]:port</i> has a combined 413 1.1 christos DNSBL score of <i>count</i>. </p> 414 1.1 christos 415 1.1 christos <p> The postscreen_dnsbl_action parameter specifies the action that 416 1.1 christos is taken when the combined DNSBL score is equal to or greater than 417 1.1 christos the threshold. See "<a href="#fail_before_220">When tests fail 418 1.1 christos before the 220 SMTP server greeting</a>" below. </p> 419 1.1 christos 420 1.1 christos <h3> <a name="fail_before_220">When tests fail before the 220 SMTP server greeting</a> </h3> 421 1.1 christos 422 1.1 christos <p> When the client address matches the permanent denylist, or 423 1.1 christos when the client fails the pregreet or DNSBL tests, the action is 424 1.1 christos specified with postscreen_blacklist_action, postscreen_greet_action, 425 1.1 christos or postscreen_dnsbl_action, respectively. </p> 426 1.1 christos 427 1.1 christos <dl> 428 1.1 christos 429 1.1 christos <dt> <b>ignore</b> (default) </dt> 430 1.1 christos 431 1.1 christos <dd> Ignore the failure of this test. Allow other tests to complete. 432 1.1 christos Repeat this test the next time the client connects. This option 433 1.1 christos is useful for testing and collecting statistics without blocking 434 1.1 christos mail. </dd> 435 1.1 christos 436 1.1 christos <dt> <b>enforce</b> </dt> 437 1.1 christos 438 1.1 christos <dd> Allow other tests to complete. Reject attempts to deliver mail 439 1.1 christos with a 550 SMTP reply, and log the helo/sender/recipient information. 440 1.1 christos Repeat this test the next time the client connects. </dd> 441 1.1 christos 442 1.1 christos <dt> <b>drop</b> </dt> 443 1.1 christos 444 1.1 christos <dd> Drop the connection immediately with a 521 SMTP reply. Repeat 445 1.1 christos this test the next time the client connects. </dd> 446 1.1 christos 447 1.1 christos </dl> 448 1.1 christos 449 1.1 christos <h2> <a name="after_220">Tests after the 220 SMTP server greeting</a> </h2> 450 1.1 christos 451 1.1 christos <p> In this phase of the protocol, postscreen(8) implements a 452 1.1 christos number of "deep protocol" tests. These tests use an SMTP protocol 453 1.1 christos engine that is built into the postscreen(8) server. </p> 454 1.1 christos 455 1.1 christos <p> Important note: these protocol tests are disabled by default. 456 1.1 christos They are more intrusive than the pregreet and DNSBL tests, and they 457 1.1 christos have limitations as discussed next. </p> 458 1.1 christos 459 1.1 christos <ul> 460 1.1 christos 461 1.1 christos <li> <p> The main limitation of "after 220 greeting" tests is that 462 1.1 christos a new client must disconnect after passing these tests (reason: 463 1.1 christos postscreen is not a proxy). Then the client must reconnect from 464 1.1 christos the same IP address before it can deliver mail. The following 465 1.1 christos measures may help to avoid email delays: </p> 466 1.1 christos 467 1.1 christos <ul> 468 1.1 christos 469 1.1 christos <li> <p> Allow "good" clients to skip tests with the 470 1.1 christos postscreen_dnsbl_whitelist_threshold feature (Postfix 2.11 and 471 1.1 christos later). This is especially effective for sites such as Google that 472 1.1 christos never retry immediately from the same IP address. </p> 473 1.1 christos 474 1.1 christos <li> <p> Small sites: Configure postscreen(8) to listen on multiple 475 1.1 christos IP addresses, published in DNS as different IP addresses for the 476 1.1 christos same MX hostname or for different MX hostnames. This avoids mail 477 1.1 christos delivery delays with clients that reconnect immediately from the 478 1.1 christos same IP address. </p> 479 1.1 christos 480 1.1 christos <li> <p> Large sites: Share the postscreen(8) cache between different 481 1.1 christos Postfix MTAs with a large-enough memcache_table(5). Again, this 482 1.1 christos avoids mail delivery delays with clients that reconnect immediately 483 1.1 christos from the same IP address. </p> 484 1.1 christos 485 1.1 christos </ul> 486 1.1 christos 487 1.1 christos <li> <p> postscreen(8)'s built-in SMTP engine does not implement the 488 1.1 christos AUTH, XCLIENT, and XFORWARD features. If you need to make these 489 1.1 christos services available on port 25, then do not enable the tests after 490 1.1 christos the 220 server greeting. </p> 491 1.1 christos 492 1.1 christos <li> <p> End-user clients should connect directly to the submission 493 1.1 christos service, so that they never have to deal with postscreen(8)'s tests. 494 1.1 christos </p> 495 1.1 christos 496 1.1 christos </ul> 497 1.1 christos 498 1.1 christos <p> The following "after 220 greeting" tests are available: </p> 499 1.1 christos 500 1.1 christos <ul> 501 1.1 christos 502 1.1 christos <li> <a href="#pipelining">Command pipelining test</a> 503 1.1 christos 504 1.1 christos <li> <a href="#non_smtp">Non-SMTP command test</a> 505 1.1 christos 506 1.1 christos <li> <a href="#barelf">Bare newline test</a> 507 1.1 christos 508 1.1 christos <li> <a href="#fail_after_220">When tests fail after the 220 SMTP server greeting</a> 509 1.1 christos 510 1.1 christos </ul> 511 1.1 christos 512 1.1 christos <h3> <a name="pipelining">Command pipelining test</a> </h3> 513 1.1 christos 514 1.1 christos <p> By default, SMTP is a half-duplex protocol: the sender and 515 1.1 christos receiver send one command and one response at a time. Unlike the 516 1.1 christos Postfix SMTP server, postscreen(8) does not announce support 517 1.1 christos for ESMTP command pipelining. Therefore, clients are not allowed 518 1.1 christos to send multiple commands. postscreen(8)'s 519 1.1 christos <a href="#after_220">deep 520 1.1 christos protocol test</a> for this is disabled by default. </p> 521 1.1 christos 522 1.1 christos <p> With "postscreen_pipelining_enable = yes", postscreen(8) detects 523 1.1 christos zombies that send multiple commands, instead of sending one command 524 1.1 christos and waiting for the server to reply. </p> 525 1.1 christos 526 1.1 christos <p> This test is opportunistically enabled when postscreen(8) has 527 1.1 christos to use the built-in SMTP engine anyway. This is to make postscreen(8) 528 1.1 christos logging more informative. </p> 529 1.1 christos 530 1.1 christos <p> When a client sends multiple commands, postscreen(8) logs this 531 1.1 christos as: </p> 532 1.1 christos 533 1.1 christos <pre> 534 1.1 christos <b>COMMAND PIPELINING from</b> <i>[address]:port</i> <b>after</b> <i>command</i>: <i>text</i> 535 1.1 christos </pre> 536 1.1 christos 537 1.1 christos <p> Translation: the SMTP client at <i>[address]:port</i> sent 538 1.1 christos multiple SMTP commands, instead of sending one command and then 539 1.1 christos waiting for the server to reply. This happened after the client 540 1.1 christos sent <i>command</i>. The <i>text</i> shows part of the input that 541 1.1 christos was sent too early; it is not logged with Postfix 2.8. </p> 542 1.1 christos 543 1.1 christos <p> The postscreen_pipelining_action parameter specifies the action 544 1.1 christos that is taken next. See "<a href="#fail_after_220">When tests fail 545 1.1 christos after the 220 SMTP server greeting</a>" below. </p> 546 1.1 christos 547 1.1 christos <h3> <a name="non_smtp">Non-SMTP command test</a> </h3> 548 1.1 christos 549 1.1 christos <p> Some spambots send their mail through open proxies. A symptom 550 1.1 christos of this is the usage of commands such as CONNECT and other non-SMTP 551 1.1 christos commands. Just like the Postfix SMTP server's smtpd_forbidden_commands 552 1.1 christos feature, postscreen(8) has an equivalent postscreen_forbidden_commands 553 1.1 christos feature to block these clients. postscreen(8)'s 554 1.1 christos <a href="#after_220">deep 555 1.1 christos protocol test</a> for this is disabled by default. </p> 556 1.1 christos 557 1.1 christos <p> With "postscreen_non_smtp_command_enable = yes", postscreen(8) 558 1.1 christos detects zombies that send commands specified with the 559 1.1 christos postscreen_forbidden_commands parameter. This also detects commands 560 1.1 christos with the syntax of a message header label. The latter is a symptom 561 1.1 christos that the client is sending message content after ignoring all the 562 1.1 christos responses from postscreen(8) that reject mail. </p> 563 1.1 christos 564 1.1 christos <p> This test is opportunistically enabled when postscreen(8) has 565 1.1 christos to use the built-in SMTP engine anyway. This is to make postscreen(8) 566 1.1 christos logging more informative. </p> 567 1.1 christos 568 1.1 christos <p> When a client sends non-SMTP commands, postscreen(8) logs this 569 1.1 christos as: </p> 570 1.1 christos 571 1.1 christos <pre> 572 1.1 christos <b>NON-SMTP COMMAND from</b> <i>[address]:port</i> <b>after</b> <i>command: text</i> 573 1.1 christos </pre> 574 1.1 christos 575 1.1 christos <p> Translation: the SMTP client at <i>[address]:port</i> sent a 576 1.1 christos command that matches the postscreen_forbidden_commands 577 1.1 christos parameter, or that has the syntax of a message header label (text 578 1.1 christos followed by optional space and ":"). 579 1.1 christos The "<tt><b>after</b> <i>command</i></tt>" portion is logged with 580 1.1 christos Postfix 2.10 and later. </p> 581 1.1 christos 582 1.1 christos <p> The postscreen_non_smtp_command_action parameter specifies 583 1.1 christos the action that is taken next. See "<a href="#fail_after_220">When 584 1.1 christos tests fail after the 220 SMTP server greeting</a>" below. </p> 585 1.1 christos 586 1.1 christos <h3> <a name="barelf">Bare newline test</a> </h3> 587 1.1 christos 588 1.1 christos <p> SMTP is a line-oriented protocol: lines have a limited length, 589 1.1 christos and are terminated with <CR><LF>. Lines ending in a 590 1.1 christos "bare" <LF>, that is newline not preceded by carriage return, 591 1.1 christos are not allowed in SMTP. postscreen(8)'s 592 1.1 christos <a href="#after_220">deep 593 1.1 christos protocol test</a> for this is disabled by default. </p> 594 1.1 christos 595 1.1 christos <p> With "postscreen_bare_newline_enable = yes", postscreen(8) 596 1.1 christos detects clients that send lines ending in bare newline characters. 597 1.1 christos </p> 598 1.1 christos 599 1.1 christos <p> This test is opportunistically enabled when postscreen(8) has 600 1.1 christos to use the built-in SMTP engine anyway. This is to make postscreen(8) 601 1.1 christos logging more informative. </p> 602 1.1 christos 603 1.1 christos <p> When a client sends bare newline characters, postscreen(8) logs 604 1.1 christos this as: 605 1.1 christos </p> 606 1.1 christos 607 1.1 christos <pre> 608 1.1 christos <b>BARE NEWLINE from</b> <i>[address]:port</i> <b>after</b> <i>command</i> 609 1.1 christos </pre> 610 1.1 christos 611 1.1 christos <p> Translation: the SMTP client at <i>[address]:port</i> sent a bare 612 1.1 christos newline character, that is newline not preceded by carriage 613 1.1 christos return. 614 1.1 christos The "<tt><b>after</b> <i>command</i></tt>" portion is logged with 615 1.1 christos Postfix 2.10 and later. </p> 616 1.1 christos 617 1.1 christos <p> The postscreen_bare_newline_action parameter specifies the 618 1.1 christos action that is taken next. See "<a href="#fail_after_220">When 619 1.1 christos tests fail after the 220 SMTP server greeting</a>" below. </p> 620 1.1 christos 621 1.1 christos <h3> <a name="fail_after_220">When tests fail after the 220 SMTP server greeting</a> </h3> 622 1.1 christos 623 1.1 christos <p> When the client fails the pipelining, non-SMTP command or bare 624 1.1 christos newline tests, the action is specified with postscreen_pipelining_action, 625 1.1 christos postscreen_non_smtp_command_action or postscreen_bare_newline_action, 626 1.1 christos respectively. </p> 627 1.1 christos 628 1.1 christos <dl> 629 1.1 christos 630 1.1 christos <dt> <b>ignore</b> (default for bare newline) </dt> 631 1.1 christos 632 1.1 christos <dd> Ignore the failure of this test. Allow other tests to complete. 633 1.1 christos Do NOT repeat this test before the result from some other test 634 1.1 christos expires. 635 1.1 christos 636 1.1 christos This option is useful for testing and collecting statistics without 637 1.1 christos blocking mail permanently. </dd> 638 1.1 christos 639 1.1 christos <dt> <b>enforce</b> (default for pipelining) </dt> 640 1.1 christos 641 1.1 christos <dd> Allow other tests to complete. Reject attempts to deliver 642 1.1 christos mail with a 550 SMTP reply, and log the helo/sender/recipient 643 1.1 christos information. Repeat this test the next time the client connects. 644 1.1 christos </dd> 645 1.1 christos 646 1.1 christos <dt> <b>drop</b> (default for non-SMTP commands) </dt> 647 1.1 christos 648 1.1 christos <dd> Drop the connection immediately with a 521 SMTP reply. Repeat 649 1.1 christos this test the next time the client connects. This action is 650 1.1 christos compatible with the Postfix SMTP server's smtpd_forbidden_commands 651 1.1 christos feature. </dd> 652 1.1 christos 653 1.1 christos </dl> 654 1.1 christos 655 1.1 christos <h2> <a name="other_error">Other errors</a> </h2> 656 1.1 christos 657 1.1 christos <p> When an SMTP client hangs up unexpectedly, postscreen(8) logs 658 1.1 christos this as: </p> 659 1.1 christos 660 1.1 christos <pre> 661 1.1 christos <b>HANGUP after</b> <i>time</i> <b>from</b> <i>[address]:port</i> <b>in</b> <i>test name</i> 662 1.1 christos </pre> 663 1.1 christos 664 1.1 christos <p> Translation: the SMTP client at <i>[address]:port</i> disconnected 665 1.1 christos unexpectedly, <i>time</i> seconds after the start of the 666 1.1 christos test named <i>test name</i>. </p> 667 1.1 christos 668 1.1 christos <p> There is no punishment for hanging up. A client that hangs up 669 1.1 christos without sending the QUIT command can still pass all postscreen(8) 670 1.1 christos tests. </p> 671 1.1 christos 672 1.1 christos <!-- 673 1.1 christos 674 1.1 christos <p> While an unexpired penalty is in effect, an SMTP client is not 675 1.1 christos allowed to pass any tests, and postscreen(8) logs each connection 676 1.1 christos with the remaining amount of penalty time as: </p> 677 1.1 christos 678 1.1 christos <pre> 679 1.1 christos <b>PENALTY</b> <i>time</i> <b>for</b> <i>[address]:port</i> 680 1.1 christos </pre> 681 1.1 christos 682 1.1 christos <p> During this time, all attempts by the client to deliver mail 683 1.1 christos will be deferred with a 450 SMTP status. </p> 684 1.1 christos 685 1.1 christos --> 686 1.1 christos 687 1.1 christos <p> The following errors are reported by the built-in SMTP engine. 688 1.1 christos This engine never accepts mail, therefore it has per-session limits 689 1.1 christos on the number of commands and on the session length. </p> 690 1.1 christos 691 1.1 christos <pre> 692 1.1 christos <b>COMMAND TIME LIMIT</b> <b>from</b> <i>[address]:port</i> <b>after</b> <i>command</i> 693 1.1 christos </pre> 694 1.1 christos 695 1.1 christos <p> Translation: the SMTP client at <i>[address]:port</i> reached the 696 1.1 christos per-command time limit as specified with the postscreen_command_time_limit 697 1.1 christos parameter. The session is terminated immediately. 698 1.1 christos The "<tt><b>after</b> <i>command</i></tt>" portion is logged with 699 1.1 christos Postfix 2.10 and later. </p> 700 1.1 christos 701 1.1 christos <pre> 702 1.1 christos <b>COMMAND COUNT LIMIT from</b> <i>[address]:port</i> <b>after</b> <i>command</i> 703 1.1 christos </pre> 704 1.1 christos 705 1.1 christos <p> Translation: the SMTP client at <i>[address]:port</i> reached the 706 1.1 christos per-session command count limit as specified with the 707 1.1 christos postscreen_command_count_limit parameter. The session is terminated 708 1.1 christos immediately. 709 1.1 christos The "<tt><b>after</b> <i>command</i></tt>" portion is logged with 710 1.1 christos Postfix 2.10 and later. </p> 711 1.1 christos 712 1.1 christos <pre> 713 1.1 christos <b>COMMAND LENGTH LIMIT from</b> <i>[address]:port</i> <b>after</b> <i>command</i> 714 1.1 christos </pre> 715 1.1 christos 716 1.1 christos <p> Translation: the SMTP client at <i>[address]:port</i> reached the 717 1.1 christos per-command length limit, as specified with the line_length_limit 718 1.1 christos parameter. The session is terminated immediately. 719 1.1 christos The "<tt><b>after</b> <i>command</i></tt>" portion is logged with 720 1.1 christos Postfix 2.10 and later. </p> 721 1.1 christos 722 1.1 christos <p> When an SMTP client makes too many connections at the same time, 723 1.1 christos postscreen(8) rejects the connection with a 421 status code and logs: </p> 724 1.1 christos 725 1.1 christos <pre> 726 1.1 christos <b>NOQUEUE: reject: CONNECT from</b> <i>[address]:port</i><b>: too many connections</b> 727 1.1 christos </pre> 728 1.1 christos 729 1.1 christos <p> The postscreen_client_connection_count_limit parameter controls this limit. </p> 730 1.1 christos 731 1.1 christos <p> When an SMTP client connects after postscreen(8) has reached a 732 1.1 christos connection count limit, postscreen(8) rejects the connection with 733 1.1 christos a 421 status code and logs: </p> 734 1.1 christos 735 1.1 christos <pre> 736 1.1 christos <b>NOQUEUE: reject: CONNECT from</b> <i>[address]:port</i><b>: all screening ports busy</b> 737 1.1 christos <b>NOQUEUE: reject: CONNECT from</b> <i>[address]:port</i><b>: all server ports busy</b> 738 1.1 christos </pre> 739 1.1 christos 740 1.1 christos <p> The postscreen_pre_queue_limit and postscreen_post_queue_limit 741 1.1 christos parameters control these limits. </p> 742 1.1 christos 743 1.1 christos <h2> <a name="victory">When all tests succeed</a> </h2> 744 1.1 christos 745 1.1 christos <p> When a new SMTP client passes all tests (i.e. it is not allowlisted 746 1.1 christos via some mechanism), postscreen(8) logs this as: </p> 747 1.1 christos 748 1.1 christos <pre> 749 1.1 christos <b>PASS NEW</b> <i>[address]:port</i> 750 1.1 christos </pre> 751 1.1 christos 752 1.1 christos <p> Where <i>[address]:port</i> are the client IP address and port. 753 1.1 christos Then, postscreen(8) 754 1.1 christos creates a temporary allowlist entry that excludes the client IP 755 1.1 christos address from further tests until the temporary allowlist entry 756 1.1 christos expires, as controlled with the postscreen_*_ttl parameters. </p> 757 1.1 christos 758 1.1 christos <p> When no "<a href="#after_220">deep protocol tests</a>" are 759 1.1 christos configured, postscreen(8) hands off the "live" connection to a Postfix 760 1.1 christos SMTP server process. The client can then continue as if postscreen(8) 761 1.1 christos never even existed (except for the short postscreen_greet_wait delay). 762 1.1 christos </p> 763 1.1 christos 764 1.1 christos <p> When any "<a href="#after_220">deep protocol tests</a>" are 765 1.1 christos configured, postscreen(8) cannot hand off the "live" connection to 766 1.1 christos a Postfix SMTP server process in the middle of the session. Instead, 767 1.1 christos postscreen(8) defers mail delivery attempts with a 4XX status, logs 768 1.1 christos the helo/sender/recipient information, and waits for the client to 769 1.1 christos disconnect. The next time the client connects it will be allowed 770 1.1 christos to talk to a Postfix SMTP server process to deliver its mail. 771 1.1 christos postscreen(8) mitigates the impact of this limitation by giving 772 1.1 christos <a href="#after_220">deep protocol tests</a> a long expiration 773 1.1 christos time. </p> 774 1.1 christos 775 1.1 christos <h2> <a name="config"> Configuring the postscreen(8) service</a> 776 1.1 christos </h2> 777 1.1 christos 778 1.1 christos <p> postscreen(8) has been tested on FreeBSD [4-8], Linux 2.[4-6] 779 1.1 christos and Solaris 9 systems. </p> 780 1.1 christos 781 1.1 christos <ul> 782 1.1 christos 783 1.1 christos <li> <a href="#enable"> Turning on postscreen(8) without blocking 784 1.1 christos mail</a> 785 1.1 christos 786 1.1 christos <li> <a href="#starttls"> postscreen(8) TLS configuration </a> 787 1.1 christos 788 1.1 christos <li> <a href="#blocking"> Blocking mail with postscreen(8) </a> 789 1.1 christos 790 1.1 christos <li> <a href="#turnoff"> Turning off postscreen(8) </a> 791 1.1 christos 792 1.1 christos <li> <a href="#temp_white_sharing"> Sharing the temporary allowlist 793 1.1 christos </a> 794 1.1 christos 795 1.1 christos </ul> 796 1.1 christos 797 1.1 christos <h3> <a name="enable"> Turning on postscreen(8) without blocking mail</a> </h3> 798 1.1 christos 799 1.1 christos <p> To enable the postscreen(8) service and log client information 800 1.1 christos without blocking mail: </p> 801 1.1 christos 802 1.1 christos <ol> 803 1.1 christos 804 1.1 christos <li> <p> Make sure that local clients and systems with non-standard 805 1.1 christos SMTP implementations are excluded from any postscreen(8) tests. The 806 1.1 christos default is to exclude all clients in mynetworks. To exclude additional 807 1.1 christos clients, for example, third-party performance monitoring tools (these 808 1.1 christos tend to have broken SMTP implementations): </p> 809 1.1 christos 810 1.1 christos <pre> 811 1.1 christos /etc/postfix/main.cf: 812 1.1 christos # Exclude broken clients by allowlisting. Clients in mynetworks 813 1.1 christos # should always be allowlisted. 814 1.1 christos postscreen_access_list = permit_mynetworks, 815 1.1 christos cidr:/etc/postfix/postscreen_access.cidr 816 1.1 christos 817 1.1 christos /etc/postfix/postscreen_access.cidr: 818 1.1 christos 192.168.254.0/24 permit 819 1.1 christos </pre> 820 1.1 christos 821 1.1 christos <li> <p> Comment out the "<tt>smtp inet ... smtpd</tt>" service 822 1.1 christos in master.cf, including any "<tt>-o parameter=value</tt>" entries 823 1.1 christos that follow. </p> 824 1.1 christos 825 1.1 christos <pre> 826 1.1 christos /etc/postfix/master.cf: 827 1.1 christos #smtp inet n - n - - smtpd 828 1.1 christos # -o parameter=value ... 829 1.1 christos </pre> 830 1.1 christos 831 1.1 christos <li> <p> Uncomment the new "<tt>smtpd pass ... smtpd</tt>" service 832 1.1 christos in master.cf, and duplicate any "<tt>-o parameter=value</tt>" entries 833 1.1 christos from the smtpd service that was commented out in the previous step. 834 1.1 christos </p> 835 1.1 christos 836 1.1 christos <pre> 837 1.1 christos /etc/postfix/master.cf: 838 1.1 christos smtpd pass - - n - - smtpd 839 1.1 christos -o parameter=value ... 840 1.1 christos </pre> 841 1.1 christos 842 1.1 christos <li> <p> Uncomment the new "<tt>smtp inet ... postscreen</tt>" 843 1.1 christos service in master.cf. </p> 844 1.1 christos 845 1.1 christos <pre> 846 1.1 christos /etc/postfix/master.cf: 847 1.1 christos smtp inet n - n - 1 postscreen 848 1.1 christos </pre> 849 1.1 christos 850 1.1 christos <li> <p> Uncomment the new "<tt>tlsproxy unix ... tlsproxy</tt>" 851 1.1 christos service in master.cf. This service implements STARTTLS support for 852 1.1 christos postscreen(8). </p> 853 1.1 christos 854 1.1 christos <pre> 855 1.1 christos /etc/postfix/master.cf: 856 1.1 christos tlsproxy unix - - n - 0 tlsproxy 857 1.1 christos </pre> 858 1.1 christos 859 1.1 christos <li> <p> Uncomment the new "<tt>dnsblog unix ... dnsblog</tt>" 860 1.1 christos service in master.cf. This service does DNSBL lookups for postscreen(8) 861 1.1 christos and logs results. </p> 862 1.1 christos 863 1.1 christos <pre> 864 1.1 christos /etc/postfix/master.cf: 865 1.1 christos dnsblog unix - - n - 0 dnsblog 866 1.1 christos </pre> 867 1.1 christos 868 1.1 christos <li> <p> To enable DNSBL lookups, list some DNS blocklist sites in 869 1.1 christos main.cf, separated by whitespace. Different sites can have different 870 1.1 christos weights. For example: 871 1.1 christos 872 1.1 christos <pre> 873 1.1 christos /etc/postfix/main.cf: 874 1.1 christos postscreen_dnsbl_threshold = 2 875 1.1 christos postscreen_dnsbl_sites = zen.spamhaus.org*2 876 1.1 christos bl.spamcop.net*1 b.barracudacentral.org*1 877 1.1 christos </pre> 878 1.1 christos 879 1.1 christos <p> Note: if your DNSBL queries have a "secret" in the domain name, 880 1.1 christos you must censor this information from the postscreen(8) SMTP replies. 881 1.1 christos For example: </p> 882 1.1 christos 883 1.1 christos <pre> 884 1.1 christos /etc/postfix/main.cf: 885 1.1 christos postscreen_dnsbl_reply_map = texthash:/etc/postfix/dnsbl_reply 886 1.1 christos </pre> 887 1.1 christos 888 1.1 christos <pre> 889 1.1 christos /etc/postfix/dnsbl_reply: 890 1.1 christos # Secret DNSBL name Name in postscreen(8) replies 891 1.1 christos secret.zen.dq.spamhaus.net zen.spamhaus.org 892 1.1 christos </pre> 893 1.1 christos 894 1.1 christos <p> The texthash: format is similar to hash: except that there is 895 1.1 christos no need to run postmap(1) before the file can be used, and that it 896 1.1 christos does not detect changes after the file is read. It is new with 897 1.1 christos Postfix version 2.8. </p> 898 1.1 christos 899 1.1 christos <li> <p> Read the new configuration with "<tt>postfix reload</tt>". 900 1.1 christos </p> 901 1.1 christos 902 1.1 christos </ol> 903 1.1 christos 904 1.1 christos <p> Notes: </p> 905 1.1 christos 906 1.1 christos <ul> 907 1.1 christos 908 1.1 christos <li> <p> Some postscreen(8) configuration parameters implement 909 1.1 christos stress-dependent behavior. This is supported only when the default 910 1.1 christos value is stress-dependent (that is, "postconf -d <i>parametername</i>" 911 1.1 christos output shows 912 1.1 christos "<i>parametername</i> = ${stress?<i>something</i>}${stress:<i>something</i>}" or 913 1.1 christos "<i>parametername</i> = ${stress?{<i>something</i>}:{<i>something</i>}}"). 914 1.1 christos Other parameters always evaluate as if the stress value is the empty 915 1.1 christos string. </p> 916 1.1 christos 917 1.1 christos <li> <p> See "<a href="#before_220">Tests before the 220 SMTP server 918 1.1 christos greeting</a>" for details about the logging from these 919 1.1 christos postscreen(8) tests. </p> 920 1.1 christos 921 1.1 christos <li> <p> If you run Postfix 2.6 or earlier you must stop and start 922 1.1 christos the master daemon ("<tt>postfix stop; postfix start</tt>"). This 923 1.1 christos is needed because the Postfix "pass" master service type did not 924 1.1 christos work reliably on all systems. </p> 925 1.1 christos 926 1.1 christos </ul> 927 1.1 christos 928 1.1 christos <h3> <a name="starttls"> postscreen(8) TLS configuration </a> </h3> 929 1.1 christos 930 1.1 christos <p> postscreen(8) TLS support is available for remote SMTP clients 931 1.1 christos that aren't allowlisted, including clients that need to renew their 932 1.1 christos temporary allowlist status. When a remote SMTP client requests TLS 933 1.1 christos service, postscreen(8) invisibly hands off the connection to a 934 1.1 christos tlsproxy(8) process. Then, tlsproxy(8) encrypts and decrypts the 935 1.1 christos traffic between postscreen(8) and the remote SMTP client. One 936 1.1 christos tlsproxy(8) process can handle multiple SMTP sessions. The number 937 1.1 christos of tlsproxy(8) processes slowly increases with server load, but it 938 1.1 christos should always be much smaller than the number of postscreen(8) TLS 939 1.1 christos sessions. </p> 940 1.1 christos 941 1.1 christos <p> TLS support for postscreen(8) and tlsproxy(8) uses the same 942 1.1 christos parameters as with smtpd(8). We recommend that you keep the relevant 943 1.1 christos configuration parameters in main.cf. If you must specify "-o 944 1.1 christos smtpd_mumble=value" parameter overrides in master.cf for a 945 1.1 christos postscreen-protected smtpd(8) service, then you should specify those 946 1.1 christos same parameter overrides for the postscreen(8) and tlsproxy(8) 947 1.1 christos services. </p> 948 1.1 christos 949 1.1 christos <h3> <a name="blocking"> Blocking mail with postscreen(8) </a> </h3> 950 1.1 christos 951 1.1 christos <p> For compatibility with smtpd(8), postscreen(8) implements the 952 1.1 christos soft_bounce safety feature. This causes Postfix to reject mail with 953 1.1 christos a "try again" reply code. </p> 954 1.1 christos 955 1.1 christos <ul> 956 1.1 christos 957 1.1 christos <li> <p> To turn this on for all of Postfix, specify "<tt>soft_bounce 958 1.1 christos = yes</tt>" in main.cf. </p> 959 1.1 christos 960 1.1 christos <li> <p> To turn this on for postscreen(8) only, append "<tt>-o 961 1.1 christos soft_bounce=yes</tt>" (note: NO SPACES around '=') to the postscreen 962 1.1 christos entry in master.cf. <p> 963 1.1 christos 964 1.1 christos </ul> 965 1.1 christos 966 1.1 christos <p> Execute "<tt>postfix reload</tt>" to make the change effective. </p> 967 1.1 christos 968 1.1 christos <p> After testing, do not forget to remove the soft_bounce feature, 969 1.1 christos otherwise senders won't receive their non-delivery notification 970 1.1 christos until many days later. </p> 971 1.1 christos 972 1.1 christos <p> To use the postscreen(8) service to block mail, edit main.cf and 973 1.1 christos specify one or more of: </p> 974 1.1 christos 975 1.1 christos <ul> 976 1.1 christos 977 1.1 christos <li> <p> "<tt>postscreen_dnsbl_action = enforce</tt>", to reject 978 1.1 christos clients that are on DNS blocklists, and to log the helo/sender/recipient 979 1.1 christos information. With good DNSBLs this reduces the amount of load on 980 1.1 christos Postfix SMTP servers dramatically. </p> 981 1.1 christos 982 1.1 christos <li> <p> "<tt>postscreen_greet_action = enforce</tt>", to reject 983 1.1 christos clients that talk before their turn, and to log the helo/sender/recipient 984 1.1 christos information. This stops over half of all known-to-be illegitimate 985 1.1 christos connections to Wietse's mail server. It is backup protection for 986 1.1 christos zombies that haven't yet been denylisted. </p> 987 1.1 christos 988 1.1 christos <li> <p> You can also enable "<a href="#after_220">deep protocol 989 1.1 christos tests</a>", but these are more intrusive than the pregreet or DNSBL 990 1.1 christos tests. </p> 991 1.1 christos 992 1.1 christos <p> When a good client passes the "<a href="#after_220">deep 993 1.1 christos protocol tests</a>", 994 1.1 christos postscreen(8) adds the client to the temporary 995 1.1 christos allowlist but it cannot hand off the "live" connection to a Postfix 996 1.1 christos SMTP server process in the middle of the session. Instead, postscreen(8) 997 1.1 christos defers mail delivery attempts with a 4XX status, logs the 998 1.1 christos helo/sender/recipient information, and waits for the client to 999 1.1 christos disconnect. </p> 1000 1.1 christos 1001 1.1 christos <p> When the good client comes back in a later session, it is allowed 1002 1.1 christos to talk directly to a Postfix SMTP server. See "<a href="#after_220">Tests 1003 1.1 christos after the 220 SMTP server greeting</a>" above for limitations with 1004 1.1 christos AUTH and other features that clients may need. </p> 1005 1.1 christos 1006 1.1 christos <p> An unexpected benefit from "<a href="#after_220">deep protocol 1007 1.1 christos tests</a>" is that some "good" clients don't return after the 4XX 1008 1.1 christos reply; these clients were not so good after all. </p> 1009 1.1 christos 1010 1.1 christos <p> Unfortunately, some senders will retry requests from different 1011 1.1 christos IP addresses, and may never get allowlisted. For this reason, 1012 1.1 christos Wietse stopped using "<a href="#after_220">deep protocol tests</a>" 1013 1.1 christos on his own internet-facing mail server. </p> 1014 1.1 christos 1015 1.1 christos <li> <p> There is also support for permanent denylisting and 1016 1.1 christos allowlisting; see the description of the postscreen_access_list 1017 1.1 christos parameter for details. </p> 1018 1.1 christos 1019 1.1 christos </ul> 1020 1.1 christos 1021 1.1 christos <h3> <a name="turnoff"> Turning off postscreen(8) </a> </h3> 1022 1.1 christos 1023 1.1 christos <p> To turn off postscreen(8) and handle mail directly with Postfix 1024 1.1 christos SMTP server processes: </p> 1025 1.1 christos 1026 1.1 christos <ol> 1027 1.1 christos 1028 1.1 christos <li> <p> Comment out the "<tt>smtp inet ... postscreen</tt>" service 1029 1.1 christos in master.cf, including any "<tt>-o parameter=value</tt>" entries 1030 1.1 christos that follow. </p> 1031 1.1 christos 1032 1.1 christos <pre> 1033 1.1 christos /etc/postfix/master.cf: 1034 1.1 christos #smtp inet n - n - 1 postscreen 1035 1.1 christos # -o parameter=value ... 1036 1.1 christos </pre> 1037 1.1 christos 1038 1.1 christos <li> <p> Comment out the "<tt>dnsblog unix ... dnsblog</tt>" service 1039 1.1 christos in master.cf. </p> 1040 1.1 christos 1041 1.1 christos <pre> 1042 1.1 christos /etc/postfix/master.cf: 1043 1.1 christos #dnsblog unix - - n - 0 dnsblog 1044 1.1 christos </pre> 1045 1.1 christos 1046 1.1 christos <li> <p> Comment out the "<tt>smtpd pass ... smtpd</tt>" service 1047 1.1 christos in master.cf, including any "<tt>-o parameter=value</tt>" entries 1048 1.1 christos that follow. </p> 1049 1.1 christos 1050 1.1 christos <pre> 1051 1.1 christos /etc/postfix/master.cf: 1052 1.1 christos #smtpd pass - - n - - smtpd 1053 1.1 christos # -o parameter=value ... 1054 1.1 christos </pre> 1055 1.1 christos 1056 1.1 christos <li> <p> Comment out the "<tt>tlsproxy unix ... tlsproxy</tt>" 1057 1.1 christos service in master.cf, including any "<tt>-o parameter=value</tt>" 1058 1.1 christos entries that follow. </p> 1059 1.1 christos 1060 1.1 christos <pre> 1061 1.1 christos /etc/postfix/master.cf: 1062 1.1 christos #tlsproxy unix - - n - 0 tlsproxy 1063 1.1 christos # -o parameter=value ... 1064 1.1 christos </pre> 1065 1.1 christos 1066 1.1 christos <li> <p> Uncomment the "<tt>smtp inet ... smtpd</tt>" service in 1067 1.1 christos master.cf, including any "<tt>-o parameter=value</tt>" entries that 1068 1.1 christos may follow. </p> 1069 1.1 christos 1070 1.1 christos <pre> 1071 1.1 christos /etc/postfix/master.cf: 1072 1.1 christos smtp inet n - n - - smtpd 1073 1.1 christos -o parameter=value ... 1074 1.1 christos </pre> 1075 1.1 christos 1076 1.1 christos <li> <p> Read the new configuration with "<tt>postfix reload</tt>". 1077 1.1 christos </p> 1078 1.1 christos 1079 1.1 christos </ol> 1080 1.1 christos 1081 1.1 christos <h3> <a name="temp_white_sharing"> Sharing the temporary allowlist </a> </h3> 1082 1.1 christos 1083 1.1 christos <p> By default, the temporary allowlist is not shared between 1084 1.1 christos multiple postscreen(8) daemons. To enable sharing, choose one 1085 1.1 christos of the following options: </p> 1086 1.1 christos 1087 1.1 christos <ul> 1088 1.1 christos 1089 1.1 christos <li> <p> A non-persistent memcache: temporary allowlist can be shared 1090 1.1 christos between postscreen(8) daemons on the same host or different 1091 1.1 christos hosts. Disable cache cleanup (postscreen_cache_cleanup_interval 1092 1.1 christos = 0) in all postscreen(8) daemons because memcache: has no 1093 1.1 christos first-next API (but see example 4 below for memcache: with 1094 1.1 christos persistent backup). This requires Postfix 2.9 or later. </p> 1095 1.1 christos 1096 1.1 christos <pre> 1097 1.1 christos # Example 1: non-persistent memcache: allowlist. 1098 1.1 christos /etc/postfix/main.cf: 1099 1.1 christos postscreen_cache_map = memcache:/etc/postfix/postscreen_cache 1100 1.1 christos postscreen_cache_cleanup_interval = 0 1101 1.1 christos 1102 1.1 christos /etc/postfix/postscreen_cache: 1103 1.1 christos memcache = inet:127.0.0.1:11211 1104 1.1 christos key_format = postscreen:%s 1105 1.1 christos </pre> 1106 1.1 christos 1107 1.1 christos <li> <p> 1108 1.1 christos A persistent lmdb: temporary allowlist can be shared between 1109 1.1 christos postscreen(8) daemons that run under the same master(8) daemon, 1110 1.1 christos or under different master(8) daemons on the same host. Disable 1111 1.1 christos cache cleanup (postscreen_cache_cleanup_interval = 0) in all 1112 1.1 christos postscreen(8) daemons except one that is responsible for cache 1113 1.1 christos cleanup. This requires Postfix 2.11 or later. </p> 1114 1.1 christos 1115 1.1 christos <pre> 1116 1.1 christos # Example 2: persistent lmdb: allowlist. 1117 1.1 christos /etc/postfix/main.cf: 1118 1.1 christos postscreen_cache_map = lmdb:$data_directory/postscreen_cache 1119 1.1 christos # See note 1 below. 1120 1.1 christos # postscreen_cache_cleanup_interval = 0 1121 1.1 christos </pre> 1122 1.1 christos 1123 1.1 christos <li> <p> Other kinds of persistent temporary allowlist can be shared 1124 1.1 christos only between postscreen(8) daemons that run under the same 1125 1.1 christos master(8) daemon. In this case, temporary allowlist access must 1126 1.1 christos be shared through the proxymap(8) daemon. This requires Postfix 1127 1.1 christos 2.9 or later. </p> 1128 1.1 christos 1129 1.1 christos <pre> 1130 1.1 christos # Example 3: proxied btree: allowlist. 1131 1.1 christos /etc/postfix/main.cf: 1132 1.1 christos postscreen_cache_map = 1133 1.1 christos proxy:btree:/var/lib/postfix/postscreen_cache 1134 1.1 christos # See note 1 below. 1135 1.1 christos # postscreen_cache_cleanup_interval = 0 1136 1.1 christos 1137 1.1 christos # Example 4: proxied btree: allowlist with memcache: accelerator. 1138 1.1 christos /etc/postfix/main.cf: 1139 1.1 christos postscreen_cache_map = memcache:/etc/postfix/postscreen_cache 1140 1.1 christos proxy_write_maps = 1141 1.1 christos proxy:btree:/var/lib/postfix/postscreen_cache 1142 1.1 christos ... other proxied tables ... 1143 1.1 christos # See note 1 below. 1144 1.1 christos # postscreen_cache_cleanup_interval = 0 1145 1.1 christos 1146 1.1 christos /etc/postfix/postscreen_cache: 1147 1.1 christos # Note: the $data_directory macro is not defined in this context. 1148 1.1 christos memcache = inet:127.0.0.1:11211 1149 1.1 christos backup = proxy:btree:/var/lib/postfix/postscreen_cache 1150 1.1 christos key_format = postscreen:%s 1151 1.1 christos </pre> 1152 1.1 christos 1153 1.1 christos <p> Note 1: disable cache cleanup (postscreen_cache_cleanup_interval 1154 1.1 christos = 0) in all postscreen(8) daemons except one that is responsible 1155 1.1 christos for cache cleanup. </p> 1156 1.1 christos 1157 1.1 christos <p> Note 2: postscreen(8) cache sharing via proxymap(8) requires Postfix 1158 1.1 christos 2.9 or later; earlier proxymap(8) implementations don't support 1159 1.1 christos cache cleanup. </p> 1160 1.1 christos 1161 1.1 christos </ul> 1162 1.1 christos 1163 1.1 christos <h2> <a name="historical"> Historical notes and credits </a> </h2> 1164 1.1 christos 1165 1.1 christos <p> Many ideas in postscreen(8) were explored in earlier work by 1166 1.1 christos Michael Tokarev, in OpenBSD spamd, and in MailChannels Traffic 1167 1.1 christos Control. </p> 1168 1.1 christos 1169 1.1 christos <p> Wietse threw together a crude prototype with pregreet and dnsbl 1170 1.1 christos support in June 2009, because he needed something new for a Mailserver 1171 1.1 christos conference presentation in July. Ralf Hildebrandt ran this code on 1172 1.1 christos several servers to collect real-world statistics. This version used 1173 1.1 christos the dnsblog(8) ad-hoc DNS client program. </p> 1174 1.1 christos 1175 1.1 christos <p> Wietse needed new material for a LISA conference presentation 1176 1.1 christos in November 2010, so he added support for DNSBL weights and filters 1177 1.1 christos in August, followed by a major code rewrite, deep protocol tests, 1178 1.1 christos helo/sender/recipient logging, and stress-adaptive behavior in 1179 1.1 christos September. Ralf Hildebrandt ran this code on several servers to 1180 1.1 christos collect real-world statistics. This version still used the embarrassing 1181 1.1 christos dnsblog(8) ad-hoc DNS client program. </p> 1182 1.1 christos 1183 1.1 christos <p> Wietse added STARTTLS support in December 2010. This makes 1184 1.1 christos postscreen(8) usable for sites that require TLS support. The 1185 1.1 christos implementation introduces the tlsproxy(8) event-driven TLS proxy 1186 1.1 christos that decrypts/encrypts the sessions for multiple SMTP clients. </p> 1187 1.1 christos 1188 1.1 christos <p> The tlsproxy(8) implementation led to the discovery of a "new" 1189 1.1 christos class of vulnerability (<a 1190 1.1 christos href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0411" 1191 1.1 christos >CVE-2011-0411</a>) that affected multiple implementations of SMTP, 1192 1.1 christos POP, IMAP, NNTP, and FTP over TLS. </p> 1193 1.1 christos 1194 1.1 christos <p> postscreen(8) was officially released as part of the Postfix 1195 1.1 christos 2.8 stable release in January 2011.</p> 1196 1.1 christos 1197 1.1 christos </body> 1198 1.1 christos 1199 1.1 christos </html> 1200
Indexes created Sat Jun 06 00:24:59 UTC 2026