Am 21.12.2012 13:23, schrieb /dev/rob0: > On Fri, Dec 21, 2012 at 06:52:21AM -0500, John Allen wrote: >> On 21/12/2012 6:25 AM, Reindl Harald wrote: >>> Am 21.12.2012 01:19, schrieb John Allen: >>>> I am doing the admin work for a small group, about 30 people. >>>> >>>> While this setup works I have the feeling that I am missing >>>> something in the Submission stanza of master.cf which might >>>> leave me vulnerable > >>> below a 100% woring one with no open relay >>> >>> submission inet n - n - 50 smtpd -o >>> -o smtpd_client_connection_count_limit=15 >>> -o smtpd_client_connection_rate_limit=80 >>> -o smtpd_sasl_auth_enable=yes -o smtpd_delay_reject=yes -o >>> smtpd_client_restrictions=permit_sasl_authenticated,reject > > Not directly a security issue, but it's a good idea to set -o > syslog_name so that you can know which connections were on which > port/smtpd. This is done in recent master.cf examples.
but you need to make sure that any log-analyze software handle this right pflogsum AFAIk can in recent versions, for logwatch i am unsure > The above assumes that smtpd_recipient_restrictions also has > permit_sasl_authenticated If maintaining strict separation of your > outbound/submission stream from your inbound/MX stream, this might > not be a safe assumption. but "permit_sasl_authenticated,reject" resulsts in anything without SASL auth is rejected, however my "smtpd_recipient_restrictions" are in "main.cf" smtpd_recipient_restrictions = permit_mynetworks reject_non_fqdn_recipient reject_non_fqdn_sender reject_unlisted_sender reject_authenticated_sender_login_mismatch permit_sasl_authenticated reject_unauth_destination reject_unknown_sender_domain reject_unknown_recipient_domain reject_invalid_hostname reject_unknown_reverse_client_hostname reject_unauth_pipelining reject_rbl_client dnsbl-1.uceprotect.net check_policy_service unix:/var/spool/postfix/postgrey/socket check_recipient_access proxy:mysql:/etc/postfix/mysql-spamfilter.cf > MX smtpd has different needs. The limits in this example would not > work on MX mail. Some MTAs (qmail comes to mind) which do one > connection per mail might easily exceed the above count and rate > limits. However, a user's MUA would be very unlikely to do so, > unless, of course, it is possessed by malware. correct, maybe i should mention that our postfix is not MX for anything and has a seperated service for deliver messages from the barracuda-appliance 91.118.73.15:10026 inet n - n - - smtpd -o mynetworks=91.118.73.20 -o smtpd_client_connection_count_limit=75 -o smtpd_recipient_restrictions=$barracuda_smtpd_recipient_restrictions -o receive_override_options=no_header_body_checks,no_milters -o local_header_rewrite_clients= -o sender_dependent_relayhost_maps= -o content_filter= -o smtpd_delay_reject=no -o smtpd_client_restrictions= -o smtpd_helo_restrictions= -o smtpd_helo_required=no -o smtpd_sender_restrictions= -o smtpd_sender_login_maps= -o smtpd_data_restrictions= -o smtpd_end_of_data_restrictions= -o smtpd_restriction_classes= -o smtpd_error_sleep_time=0 -o smtpd_soft_error_limit=1001 -o smtpd_hard_error_limit=1000 -o smtpd_client_connection_rate_limit=0 -o smtpd_peername_lookup=no -o smtpd_use_tls=no -o smtpd_tls_security_level=none -o smtpd_sasl_auth_enable=no -o smtpd_reject_footer= -o max_idle=1h -o max_use=1000 > Note that these limits would only slow down malware; they couldn't > stop it correct, the goal here is to reduce the damage between a hacked account starts to send spam and someone notice it and take actions was there short ago and from the logs there was a total amount of lower than 1000 spam messages sent through a compromised account which is bad enough but compared to the theoretical impact not too bad
signature.asc
Description: OpenPGP digital signature
