cbl.abuseat.org*2 der hat mir gestern gmail ausgefiltert. Nach dem ich die Liste auskommentiert habe ist die Mail angekommen.
Habe eigentlich so konfiguriert wie du geschrieben hast.
postscreen_dnsbl_sites =
list.dnswl.org=127.0.[0..255].0*-2
list.dnswl.org=127.0.[0..255].1*-4
list.dnswl.org=127.0.[0..255].2*-6
list.dnswl.org=127.0.[0..255].3*-8
zen.spamhaus.org=127.0.0.9*25
zen.spamhaus.org=127.0.0.3*10
zen.spamhaus.org=127.0.0.2*5
zen.spamhaus.org=127.0.0.[4..7]*3
zen.spamhaus.org=127.0.0.[10..11]*3
swl.spamhaus.org*-10
bl.mailspike.net=127.0.0.2*10
bl.mailspike.net=127.0.0.10*5
bl.mailspike.net=127.0.0.11*4
bl.mailspike.net=127.0.0.12*3
bl.mailspike.net=127.0.0.13*2
bl.mailspike.net=127.0.0.14*1
wl.mailspike.net=127.0.0.16*-2
wl.mailspike.net=127.0.0.17*-4
wl.mailspike.net=127.0.0.18*-6
wl.mailspike.net=127.0.0.19*-8
wl.mailspike.net=127.0.0.20*-10
backscatter.spameatingmonkey.net*2
bl.ipv6.spameatingmonkey.net*2
bl.spameatingmonkey.net*2
ix.dnsbl.manitu.net*2
bl.spamcop.net*2
db.wpbl.info*2
psbl.surriel.com*2
torexit.dan.me.uk*2
tor.dan.me.uk*1
safe.dnsbl.sorbs.net*1
Also es ist ja schon relativ ruhig... Ich glaube vormittags, nach dem Aufstehen (wenn die PCs aus sind und Thunderbird nicht prüft) sind es vielleicht zwei oder drei SPAM Mails die auf dem Handy aufschlagen.Wenn Dir bei obiger Konfiguration wirklich noch störend zuviel Spam durchkommt, dann kannst Du selbstverständlich noch einen Spamfilter ala Spamassassin (ohne Amavis) einbinden.
Aug 26 10:52:17 srv01 postfix/postscreen[11898]: NOQUEUE: reject: RCPT from [xxx.xxx.xxx.xxx]:55696: 450 4.3.2 Service currently unavailable; from=<webmaster@domain1.tld>, to=<admin@domain2.tld>, proto=ESMTP, helo=<srv1.domain3.tld>
postscreen_access_list =
permit_mynetworks,
cidr:/etc/postfix/postscreen_access.cidr
Wenn ich nun hinter (oder vor) den 'permit_mynetworks' ein 'permit_sasl_authenticated' setze, müssten doch eigentlich alle User die eine E-Mail über den Server versenden wollen, die Möglichkeit haben zu senden ohne das es Probleme gibt, oder?
postscreen(8)'s built-in SMTP engine does not implement the AUTH, XCLIENT, and XFORWARD features. If you need to make these services available on port 25...
Hallöchen, seit längerer Zeit (weiß gar nicht mehr wie lange schon), kann zen.spamhaus.org nicht mehr erreicht werden.Ich habe postscreen so konfiguriert und fahre damit ganz gut
Nov 22 11:59:37 server postfix/smtpd[16110]: warning: 120.187.39.193.zen.spamhaus.org: RBL lookup error: Host or domain name not found. Name service error for name=120.187.39.193.zen.spamhaus.org type=A: Host not found, try again
nameserver 213.133.99.99
nameserver 213.133.98.98
nameserver 213.133.100.100
nameserver 2a01:4f8:0:1::add:9898
nameserver 2a01:4f8:0:1::add:1010
nameserver 2a01:4f8:0:1::add:9999
Wenn ich diese Config übernehme in mein Postfix dann kann ich nicht mehr raus und reinschicken könnte mir bitte jemand bei der Konfiguration behilflich sein ?Alle smtpd_*_restrictions versuchen unter smtpd_recipient_restrictions zusammenzufassen hat man vielleicht noch vor zehn Jahren gemacht, das ist allerdings falsch und sehr fehleranfällig. Die verschiedenen smtpd_*_restrictions sollte man strikt trennen, das trägt nicht nur zur Reduzierung der potentiellen Konfigurationsfehler bei, sondern erhöht auch die Flexibilität und Lesbarkeit.
Ich verwende folgende Konfiguration für Postfix 3.1.4 (Milter: opendkim, opendmarc):
main.cf
Code:allow_percent_hack = no always_add_missing_headers = yes biff = no compatibility_level = 2 data_directory = /var/lib/postfix disable_vrfy_command = yes dovecot_destination_recipient_limit = 1 enable_long_queue_ids = yes fast_flush_domains = home_mailbox = .maildir/ inet_interfaces = all inet_protocols = all lmtp_tls_fingerprint_digest = sha1 local_header_rewrite_clients = permit_mynetworks permit_sasl_authenticated mail_spool_directory = /var/vmail mailbox_size_limit = 0 masquerade_domains = $mydomain masquerade_exceptions = root mailer-daemon message_size_limit = 0 mydestination = $myhostname localhost.$mydomain localhost mydomain = example.com myhostname = mail.$mydomain mynetworks_style = host notify_classes = data protocol resource software openssl_path = /usr/bin/openssl postscreen_bare_newline_action = enforce postscreen_bare_newline_enable = yes postscreen_dnsbl_action = enforce postscreen_dnsbl_sites = list.dnswl.org=127.0.[0..255].0*-2 list.dnswl.org=127.0.[0..255].1*-4 list.dnswl.org=127.0.[0..255].2*-6 list.dnswl.org=127.0.[0..255].3*-8 zen.spamhaus.org=127.0.0.9*25 zen.spamhaus.org=127.0.0.3*10 zen.spamhaus.org=127.0.0.2*5 zen.spamhaus.org=127.0.0.[4..7]*3 zen.spamhaus.org=127.0.0.[10..11]*3 swl.spamhaus.org*-10 bl.mailspike.net=127.0.0.2*10 bl.mailspike.net=127.0.0.10*5 bl.mailspike.net=127.0.0.11*4 bl.mailspike.net=127.0.0.12*3 bl.mailspike.net=127.0.0.13*2 bl.mailspike.net=127.0.0.14*1 wl.mailspike.net=127.0.0.16*-2 wl.mailspike.net=127.0.0.17*-4 wl.mailspike.net=127.0.0.18*-6 wl.mailspike.net=127.0.0.19*-8 wl.mailspike.net=127.0.0.20*-10 backscatter.spameatingmonkey.net*2 bl.ipv6.spameatingmonkey.net*2 bl.spameatingmonkey.net*2 ix.dnsbl.manitu.net*2 bl.spamcop.net*2 db.wpbl.info*2 psbl.surriel.com*2 torexit.dan.me.uk*2 tor.dan.me.uk*1 safe.dnsbl.sorbs.net*1 postscreen_dnsbl_threshold = 5 postscreen_dnsbl_whitelist_threshold = 0 postscreen_greet_action = enforce postscreen_non_smtp_command_enable = yes postscreen_pipelining_enable = yes queue_directory = /var/spool/postfix recipient_delimiter = + remote_header_rewrite_domain = domain.invalid show_user_unknown_table_name = no smtp_dns_support_level = enabled smtp_tls_CAfile = /usr/local/share/certs/ca-root-nss.crt smtp_tls_ciphers = medium smtp_tls_exclude_ciphers = CAMELLIA SEED IDEA RC2 RC4 aDSS kECDHe kECDHr kDHd kDHr eNULL aNULL MEDIUM LOW EXPORT smtp_tls_fingerprint_digest = sha1 smtp_tls_loglevel = 1 smtp_tls_mandatory_ciphers = medium smtp_tls_mandatory_exclude_ciphers = CAMELLIA SEED IDEA RC2 RC4 aDSS kECDHe kECDHr kDHd kDHr eNULL aNULL MEDIUM LOW EXPORT smtp_tls_note_starttls_offer = yes smtp_tls_security_level = may smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache smtpd_client_port_logging = yes smtpd_client_restrictions = sleep 1 permit smtpd_data_restrictions = reject_unauth_pipelining reject_multi_recipient_bounce permit smtpd_end_of_data_restrictions = permit smtpd_etrn_restrictions = reject smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks permit_sasl_authenticated reject_invalid_helo_hostname reject_non_fqdn_helo_hostname permit smtpd_milters = inet:127.0.0.1:8891 inet:127.0.0.1:8893 smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated reject_non_fqdn_recipient reject_unknown_recipient_domain check_recipient_access pcre:${config_directory}/recipient_checks.pcre permit smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination permit smtpd_sasl_auth_enable = yes smtpd_sasl_authenticated_header = yes smtpd_sasl_path = private/auth smtpd_sasl_type = dovecot smtpd_sender_restrictions = reject_non_fqdn_sender reject_unknown_sender_domain permit smtpd_tls_auth_only = yes smtpd_tls_cert_file = /etc/ssl/certs/mail.example.com.crt smtpd_tls_ciphers = medium smtpd_tls_exclude_ciphers = CAMELLIA SEED IDEA RC2 RC4 aDSS kECDHe kECDHr kDHd kDHr eNULL aNULL MEDIUM LOW EXPORT smtpd_tls_fingerprint_digest = sha1 smtpd_tls_key_file = /etc/ssl/private/mail.example.com.key smtpd_tls_loglevel = 1 smtpd_tls_mandatory_ciphers = medium smtpd_tls_mandatory_exclude_ciphers = CAMELLIA SEED IDEA RC2 RC4 aDSS kECDHe kECDHr kDHd kDHr eNULL aNULL MEDIUM LOW EXPORT smtpd_tls_received_header = yes smtpd_tls_security_level = may smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache strict_rfc821_envelopes = yes swap_bangpath = no tls_daemon_random_bytes = 64 tls_high_cipherlist = EECDH+ECDSA+CHACHA20 EECDH+CHACHA20 EECDH+ECDSA+AESGCM EECDH+AESGCM EECDH+ECDSA+AES256 EECDH+AES256 EECDH+ECDSA+AES128 EECDH+AES128 EECDH+ECDSA+3DES EECDH+3DES EDH+CHACHA20 EDH+AESGCM EDH+AES256 EDH+AES128 EDH+3DES tls_medium_cipherlist = EECDH+ECDSA+CHACHA20 EECDH+CHACHA20 EECDH+ECDSA+AESGCM EECDH+AESGCM EECDH+ECDSA+AES256 EECDH+AES256 EECDH+ECDSA+AES128 EECDH+AES128 EECDH+ECDSA+3DES EECDH+3DES EDH+CHACHA20 EDH+AESGCM EDH+AES256 EDH+AES128 EDH+3DES AESGCM AES256 AES128 3DES tls_preempt_cipherlist = yes tls_random_bytes = 64 tls_ssl_options = NO_COMPRESSION virtual_alias_domains = hash:${config_directory}/virtual_alias_domains virtual_alias_maps = hash:${config_directory}/virtual_alias_maps virtual_gid_maps = static:5000 virtual_mailbox_base = /var/vmail virtual_mailbox_domains = hash:${config_directory}/virtual_mailbox_domains virtual_mailbox_limit = 0 virtual_mailbox_maps = hash:${config_directory}/virtual_mailbox_maps virtual_minimum_uid = 5000 virtual_transport = dovecot virtual_uid_maps = static:5000
master.cf
Code:smtp inet n - n - 1 postscreen smtpd pass - - n - - smtpd dnsblog unix - - n - 0 dnsblog tlsproxy unix - - n - 0 tlsproxy submission inet n - n - - smtpd -o syslog_name=postfix/submission -o smtpd_tls_security_level=encrypt -o milter_macro_daemon_name=ORIGINATING pickup unix n - n 60 1 pickup cleanup unix n - n - 0 cleanup qmgr unix n - n 300 1 qmgr tlsmgr unix - - n 1000? 1 tlsmgr rewrite unix - - n - - trivial-rewrite bounce unix - - n - 0 bounce defer unix - - n - 0 bounce trace unix - - n - 0 bounce verify unix - - n - 1 verify flush unix n - n 1000? 0 flush proxymap unix - - n - - proxymap proxywrite unix - - n - 1 proxymap smtp unix - - n - - smtp relay unix - - n - - smtp showq unix n - n - - showq error unix - - n - - error retry unix - - n - - error discard unix - - n - - discard local unix - n n - - local virtual unix - n n - - virtual lmtp unix - - n - - lmtp anvil unix - - n - 1 anvil scache unix - - n - 1 scache dovecot unix - n n - - pipe flags=DRhu user=vmail:vmail argv=/usr/libexec/dovecot/dovecot-lda -f ${sender} -a ${recipient} -d ${user}@${nexthop}
recipient_checks.pcre
Code:/^\@/ 550 Invalid address format. /[!%\@].*\@/ 550 This server disallows weird address syntax. /^postmaster\@/ OK /^hostmaster\@/ OK /^security\@/ OK /^abuse\@/ OK /^admin\@/ OK
Das erschlägt zwar nicht alle Spams, aber mit den aktuell circa 1%-2% durchschlüpfenden Spam kann ich durchaus leben.
We use essential cookies to make this site work, and optional cookies to enhance your experience.