search for: permit_mynetworks

...tes. And that was tagged by spamassassin as spam. 1. Not sure if this setup is perfect, but it is working quite well. Yes, the mail takes a few seconds longer and there is probably more I could do, but this ROCKS!!! smtpd_delay_reject = yes smtpd_helo_required = yes smtpd_client_restrictions = permit_mynetworks,permit smtpd_helo_restrictions = permit_mynetworks, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, permit smtpd_sender_restrictions = permit_mynetworks, reject_non_fqdn_sender, reject_unknown_sender_domain, permit smtpd_recipient_restrictions...

Hello to all members. I am using Dovecot for 5 years, but this is my first post here. I am aware of the various autoresponder scripts for vacation autoreplies (I am using Virtual Vacation 3.1 by Mischa Peters). I have an issue with auto-replies - it is vulnerable to spamming with forged email address. Forging can be prevented with several Postfix settings, which I did in the past - but was forced

...abe.com/mail-server/block-email-spam-postfix https://wiki.centos.org/HowTos/postfix_restrictions After some experimenting, here's what I currently have on my test server: --8<----- /etc/postfix/main.cf ----------------------------- ... smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, check_helo_access hash:/etc/postfix/helo_access reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, reject_unknown_helo_hostname smtpd_sender_restrictions = permit_mynetworks, permit_sasl_authenticated, check_sender_access hash:/etc/postfix/sende...

...tual-mailbox-maps.cf sample_directory = /usr/local/etc/postfix sendmail_path = /usr/local/sbin/sendmail setgid_group = maildrop shlib_directory = /usr/local/lib/postfix smtp_tls_note_starttls_offer = yes smtp_use_tls = yes smtpd_delay_reject = yes smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_invalid_hostname, reject_unknown_hostname, reject_non_fqdn_hostname, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, permit smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_hostname, reject_non_fqdn_sender,...

...l_bcc.cf recipient_delimiter = + relay_domains = proxy:mysql:/etc/postfix/mysql_relay_domains_maps.cf relayhost = sender_bcc_maps = mysql:/etc/postfix/mysql_bcc.cf smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache smtpd_banner = Welcome to $myhostname smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated, check_client_access mysql:/etc/postfix/mysql_access.cf, reject_unknown_client, reject_unknown_client_hostname, reject_unauth_pipelining, reject_rbl_client bl.spamcop.net, reject_rbl_client zen.spamhaus.org, reject_rbl_client b.barracudacentral.org smtpd_end_of_data_restr...

...de = 550 mynetworks = 192.168.230.0/24, 127.0.0.0/8 relay_domains = virtual_alias_domains = hash:/etc/postfix/virtual_alias_domains virtual_alias_maps = hash:/etc/postfix/virtual_alias_maps smtpd_helo_required = yes smtpd_delay_reject = yes strict_rfc821_envelopes = yes smtpd_helo_restrictions = permit_mynetworks, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, permit smtpd_sender_login_maps = hash:/etc/postfix/smtpd_sender_login_map smtpd_client_restrictions = check_client_access hash:/etc/postfix/access smtpd_recipient_restrictions = reject_unauth_pipelining, reject_non_fqdn_re...

All i have is : smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated   I disabled the unknown restriction due to lots of customers of me are missing PTR records, which needs to be set bij the internet provider. So they got blocked, i had to remove these.   The Helo check is often on the IT department can adjust them selfs. And mo...

...th = /usr/bin/newaliases queue_directory = /var/spool/postfix readme_directory = /usr/share/doc/postfix recipient_delimiter = + sample_directory = /etc/postfix sendmail_path = /usr/sbin/sendmail setgid_group = maildrop smtp_tls_note_starttls_offer = yes smtp_use_tls = no smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unknown_reverse_client_hostname, permit smtpd_data_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_pipelining, permit smtpd_delay_reject = yes smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticat...

...c/postfix/main.cf: --8<------------------------------------------------------ # Restrictions SMTP smtpd_helo_restrictions = reject_unknown_helo_hostname smtpd_sender_restrictions = reject_unknown_sender_domain, check_sender_access hash:/etc/postfix/sender_access smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_rbl_client zen.spamhaus.org, reject_rhsbl_reverse_client dbl.spamhaus.org, reject_rhsbl_helo dbl.spamhaus.org, reject_rhsbl_sender dbl.spamhaus.org smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination smt...

...nt get the relay access denied message. In the postfix log i see it is not initiating sasl they all use pop i use dovecot 1.0.13 this is my posfix part of sasl smtpd_sasl_auth_enable = yes smtpd_sasl_exceptions_networks = $mynetworks broken_sasl_auth_clients = yes smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination permit smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth and this is my dovecot sasl part # dovecot SASL socket listen { client { # Assuming the default Postfix $queue_dir...

.../var/spool/postfix readme_directory = /usr/share/doc/postfix sample_directory = /usr/share/doc/postfix sendmail_path = /usr/sbin/sendmail setgid_group = postdrop smtp_tls_note_starttls_offer = yes smtp_tls_security_level = may smtpd_banner = $myhostname ESMTP $mail_name smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unknown_client_hostname smtpd_helo_required = yes smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, reject_unauth_pipelining, reject_non_fqdn_recipient smtpd_relay_restrictions = smtpd_sasl_auth_enable = yes sm...

...to the helo domain name - which does not have a correct rdns. My problem is that I do not specify the helo check?? this is the relevant portion of main.cf <snip> smtpd_helo_required = yes smtpd_delay_reject = yes #added 20090410 strict_rfc821_envelopes = yes smtpd_helo_restrictions = permit_mynetworks, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, permit smtpd_sender_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_sender, reject_unknown_client, reject_unauthenticated_sender_login_mismatch, permit smtpd_sender_login_maps...

Helo hostname MUST have resolvable hostname. Crazy or not, but i use this. The _access-allow parts for server you really trust. smtpd_client_restrictions = permit_mynetworks, reject_unauth_destination, check_client_access cidr:/etc/postfix/check_client_access-allow.cidr, reject_unknown_hostname, reject_non_fqdn_hostname, reject_invalid_hostname, reject_unknown_reverse_client_hostname, check_client_access cidr:/etc/postfix/check_client_access...

...et_Certificate_Authority.pem smtp_tls_cert_file = /etc/ssl/certs/smtp.critter.net.pem smtp_tls_key_file = /etc/ssl/private/smtp.critter.net.pem smtp_tls_session_cache_database = /var/db/postfix/smtp_scache smtp_use_tls = yes smtpd_banner = $myhostname ESMTP $mail_name smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_hostname, reject_non_fqdn_sender, reject_non_fqdn_recipient, reject_unauth_destination, reject_unauth_pipelining, reject_invalid_hostname, reject_rbl_client zen.spamhaus.org, check_policy_service inet:127.0.0.1:10023 smtpd_relay_restr...

...attacks and spam. I found most of it here: https://scottlinux.com/2011/05/26/prevent-postfix-brute-force/ I added the fail2ban rule and modified my postfix main.cf as follows: smtpd_client_connection_rate_limit = 3 smtpd_delay_reject = yes smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, permit smtpd_sender_restrictions = permit_mynetworks, reject_non_fqdn_sender, reject_unknown_sender_domain, permit smtpd_recipient_restrictions = reject_unauth_pipelining, reject_non_fqdn_recipient, r...

...ssive ? For completeness the postfix setup is here : smtpd_sasl_auth_enable = yes broken_sasl_auth_clients = yes smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth smtpd_sasl_security_options = noanonymous # smtpd_delay_reject = yes smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, permit # smtpd_sender_restrictions = permit_mynetworks, reject_non_fqdn_sender, reject_unknown_sender_domain, permit # smtpd_recipient_restrictions = reject_unauth_pipelining, reject_non_fqdn_recipient,...

...nism_filter = smtp_sasl_password_maps = smtp_sasl_path = smtp_sasl_security_options = noplaintext, noanonymous smtp_sasl_tls_security_options = $smtp_sasl_security_options smtp_sasl_tls_verified_security_options = $smtp_sasl_tls_security_options smtp_sasl_type = cyrus smtpd_recipient_restrictions = permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination smtpd_relay_restrictions = permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination smtpd_sasl_auth_enable = yes smtpd_sasl_authenticated_header = no smtpd_sasl_exceptions_networks = smtpd_sasl_local_domain = $myhostname smtpd_sasl_pa...

...oyhile.com sample_directory = /opt/local/share/examples/postfix sender_canonical_maps = hash:/opt/local/etc/postfix/sender_canonical sendmail_path = /opt/local/sbin/sendmail setgid_group = maildrop shlib_directory = /opt/local/lib/postfix smtpd_banner = $myhostname ESMTP smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unknown_reverse_client_hostname smtpd_data_restrictions = permit_mynetworks, reject_unauth_pipelining, permit_sasl_authenticated smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_invalid_helo_hostname, reject_...

...:/etc/postfix/mysql/virtual-alias-maps.cf,mysql:/etc/postfix/mysql/email2email.cf virtual_transport = dovecot dovecot_destination_recipient_limit = 1 #smtpd_sasl_type = dovecot #smtpd_sasl_path = private/auth #smtpd_sasl_auth_enable = yes #smtpd_tls_auth_only = yes #smtpd_recipient_restrictions = permit_mynetworks,permit_auth_destination,permit_sasl_authenticated,reject_unauth_destination smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth smtpd_sasl_auth_enable = yes smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated smtpd_sender_restrictions = permit_mynetworks, permit_sasl_aut...

..._directory = /usr/lib/postfix mail_spool_directory = /var/mail/ message_size_limit = 10240000 myhostname = squeeze.test.ecp.fr mynetworks = 138.195.32.0/23, 127.0.0.1 recipient_delimiter = + setgid_group = postdrop smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU) smtpd_client_restrictions = permit_mynetworks, reject smtpd_helo_required = yes smtpd_recipient_restrictions = permit_mynetworks, reject_unauth_destination smtpd_sender_restrictions = reject_unknown_sender_domain, permit virtual_alias_maps = ldap:ldapxforward,ldap:ldapforward,ldap:ldapvalias virtual_mailbox_domains = test.ecp.fr virtual_mailbo...