On Wednesday 26 October 2011 16:28:43 IT geek 31 wrote: > I'm trying to achieve the following: > > Stop spammers (obviously) > Permit relaying when I'm outside the network (using SASL) > > After reading through postconf, to prevent duplicate checks I > removed a number of checks from smtpd_sender_restrictions, so that > it now looks like this: > > smtpd_sender_restrictions = reject_unknown_sender_domain, > reject_non_fqdn_sender, permit > > smtpd_recipient_restrictions = permit_sasl_authenticated, > reject_unauth_destination,
For simplicity, you could insert the reject_* sender restrictions here, and eliminate smtpd_sender_restrictions. > check_recipient_access hash:/usr/pkg/etc/postfix/access, "access" is a bad name for this. Since you're checking recipient addresses, I would suggest a name of "rcpt_access", or similar. > reject_unauth_pipelining, > reject_non_fqdn_recipient, reject_unknown_recipient_domain, These two will do nothing useful. They don't hurt, but it might be useful for you to consider what they are. Spammers are going to be hitting you with [email protected]. They are probably not trying to hit "addresses@localhost" and the like. > reject_rbl_client zen.spamhaus.org, check_policy_service > inet:127.0.0.1:10023, permit > > I have also set smtpd_delay_reject = yes There is no need to set that, as "yes" is the default value. > However my access file does not appear to be being used (specifies > an address to be rejected, but it isn't). I don't suppose we can help with that without the relevant logs and portions of /usr/pkg/etc/postfix/access that you think should have matched. But before you post again, note again that it is called as a *recipient* address lookup. It will not be searched for client, helo, nor sender addresses. > Please can someone sanity check the smtpd_recipient_restrictions > line for me and verify the order is correct. I'm looking to move > to 2.8, but I want to make sure my config is correct before I do. > > postconf -n attached. > smtpd_helo_restrictions = check_helo_access > hash:/usr/pkg/etc/postfix/helo_access, reject_non_fqdn_hostname, > reject_invalid_hostname, reject_unknown_hostname, permit This check_helo_access file, /usr/pkg/etc/postfix/helo_access, has a better name. You are using the old syntax for reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, and reject_unknown_helo_hostname, but that is not a problem. Do, however, consider that the latter will block a great deal of non- spam. There are many MTAs behind NAT which will use a HELO name which does not resolve in the global DNS. (The non-FQDN and invalid checks are safe and effective.) Finally, you likewise might consider it easier to consolidate these into the recipient restriction stage, but do not do that if you're using helo_access as a whitelist. This is covered in the SMTPD_ACCESS_README, "dangerous use of smtpd_recipient_restrictions" section. -- Offlist mail to this address is discarded unless "/dev/rob0" or "not-spam" is in Subject: header
