5

I have a mail server (iRedMail) that uses Postfix. I've been getting a lot of spam, so I modified the /etc/postfix/main.cf file and have the smtpd_recipient_restrictions set to this:

smtpd_recipient_restrictions =
        reject_rbl_client zen.spamhaus.org,
        reject_rbl_client bl.spamcop.net,
        reject_rbl_client cbl.abuseat.org,
        reject_rbl_client b.barracudacentral.org,
        reject_invalid_hostname,
        reject_unknown_sender_domain,
        reject_unknown_recipient_domain,
        check_policy_service inet:127.0.0.1:7777,
        check_policy_service inet:127.0.0.1:10031,
        reject_non_fqdn_sender,
        reject_non_fqdn_hostname,
        reject_non_fqdn_recipient,
        reject_unlisted_recipient,
        permit_mynetworks,
        permit_sasl_authenticated,
        reject_unauth_destination,
        permit

Yet, spam messages are still coming through from IPs that are on these blacklists.

If I look at my /var/log/mail.log file, I see the messages coming through. Here's an example of one:

Jan 11 01:09:19 mailhost postfix/smtpd[935]: DA5736B578: client=localhost[127.0.0.1]
Jan 11 01:09:19 mailhost postfix/cleanup[922]: DA5736B578: message-id=<ObreptitiousSoundness_300b221f33a2b213a8dc0ee683baadacnick@mydomain.com>
Jan 11 01:09:19 mailhost postfix/qmgr[31818]: DA5736B578: from=<Trump.Business.Success@aslk.riflebuzz.review>, size=6081, nrcpt=1 (queue active)
Jan 11 01:09:19 mailhost postfix/smtpd[935]: disconnect from localhost[127.0.0.1]
Jan 11 01:09:19 mailhost amavis[737]: (00737-01) Passed CLEAN, LOCAL [89.185.243.3] [89.185.243.3] <Trump.Business.Success@aslk.riflebuzz.review> -> <nick@mydomain.com>, Message-ID: <ObreptitiousSoundness_300b221f33a2b213a8dc0ee683baadacnick@mydomain.com>, mail_id: NBO0lwDs11eq, Hits: -1.097, size: 5620, queued_as: DA5736B578, 647 ms
Jan 11 01:09:19 mailhost postfix/smtp[930]: D662C6B575: to=<nick@mydomain.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=2.1, delays=1.5/0.01/0.02/0.65, dsn=2.0.0, status=sent (250 2.0.0 from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as DA5736B578)

When I lookup 89.185.243.3 on MXToolBox, it's listed on Spamhaus Zen.

Is my configuration incorrect? I've noticed that apparently the order of the items makes a difference.

Thanks!

6
  • Can you restart postfix? Jan 11, 2016 at 2:32
  • Yes, @JoseCarlosRamosCarmenates, It restarts fine with no errors when I run "service postfix restart". I restarted immediately after updating the file.
    – Nick
    Jan 11, 2016 at 2:50
  • The above logs seems to be for a mail originated from localhost client=localhost[127.0.0.1]
    – clement
    Jan 11, 2016 at 6:12
  • @clement I thought it was coming from the IP on the 5th line (89.185.243.3). Do you think this spam is originating from my own server? If so, any clues on how I could discover where and eliminate that? What's this IP (89.185.243.3) if it's not the sending server's IP?
    – Nick
    Jan 11, 2016 at 16:55
  • 5th line is what amavis got from headers. You should rely on client=hostname[ip] logged by smtpd
    – clement
    Jan 11, 2016 at 17:11

1 Answer 1

2

Your configuration isn't optimal, better use RBLs in the client restrictions. Here's what I would suggest, though some is a bit restrictive and I don't know your complete setup of Postfix. This is an example, see Postfix manual and advices for more information about the params …


smtpd_helo_restrictions =
    permit_mynetworks,
    permit_sasl_authenticated,
    reject_unauth_pipelining,
    reject_non_fqdn_hostname

smtpd_client_restrictions =
    permit_mynetworks,
    permit_sasl_authenticated,
    reject_unauth_destination,
    reject_rbl_client zen.spamhaus.org,
    reject_rbl_client bl.spamcop.net,
    reject_rbl_client cbl.abuseat.org,
    reject_rbl_client b.barracudacentral.org

smtpd_sender_restrictions =
    reject_non_fqdn_sender,
    reject_unknown_sender_domain,
    permit_mynetworks,
    permit_sasl_authenticated,
    reject_authenticated_sender_login_mismatch,
    reject_sender_login_mismatch

smtpd_recipient_restrictions =
    reject_unknown_recipient_domain,
    check_policy_service inet:127.0.0.1:7777,
    check_policy_service inet:127.0.0.1:10031,
    reject_non_fqdn_recipient,
    reject_unlisted_recipient,
    permit
1
  • Postfix also does support mixed restriction lists that combine information about the client, helo, sender and recipient or etrn command. This is so that you can apply more less intensive restrictions (e.g. is the recipient even hosted here) before applying more taxing restrictions (a network trip to a blacklist).
    – jaydisc
    Jan 4, 2017 at 23:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.