search for: reject_invalid_helo_hostnam

...ning smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks, reject_unauth_destination, check_helo_access pcre:/etc/postfix/check_helo_access-hostname-checks.pcre, check_helo_access hash:/etc/postfix/check_helo_access-allow.map, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, reject_unknown_helo_hostname, reject_unauth_pipelining Resulting in more happy customers since after my adviced changes to there servers, they now also have less spam.. Greetz, Louis > -----Oorspronkelijk bericht----- > Van: phils at caerllewys.net > [mailto:owner-postfi...

...fter some experimenting, here's what I currently have on my test server: --8<----- /etc/postfix/main.cf ----------------------------- ... smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, check_helo_access hash:/etc/postfix/helo_access reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, reject_unknown_helo_hostname smtpd_sender_restrictions = permit_mynetworks, permit_sasl_authenticated, check_sender_access hash:/etc/postfix/sender_access, reject_unknown_sender_domain, reject_unknown_reverse_client_hostname, reject_unknown_client_ho...

.... Yes, the mail takes a few seconds longer and there is probably more I could do, but this ROCKS!!! smtpd_delay_reject = yes smtpd_helo_required = yes smtpd_client_restrictions = permit_mynetworks,permit smtpd_helo_restrictions = permit_mynetworks, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, permit smtpd_sender_restrictions = permit_mynetworks, reject_non_fqdn_sender, reject_unknown_sender_domain, permit smtpd_recipient_restrictions = reject_non_fqdn_recipient, reject_unknown_recipient_domain, permit_mynetworks, permit_sasl_authenticated...

...s: > > smtpd_helo_required = yes > > smtpd_helo_restrictions = >    permit_mynetworks, >    permit_sasl_authenticated, >    reject_unlisted_recipient, > # check_client_access hash:/etc/postfix/ >    check_helo_access hash:/etc/postfix/check_helo_access >    reject_invalid_helo_hostname >    reject_non_fqdn_helo_hostname >    reject_unknown_helo_hostname > > unknown_hostname_reject_code = 550 > > in the "check_helo_access" map there are only certain senders with their > special invalid HELOs whitelisted, but no "unknown" or the me...

...check_policy_service inet:127.0.0.1:12340 ziemlich am Anfang der recipient_restrictions gesetzt nachdem ich den check am Ende hatte noch nach postgrey. smtpd_recipient_restrictions = check_sender_access hash:/etc/postfix/access_sender, permit_mynetworks, permit_sasl_authenticated, reject_invalid_helo_hostname, reject_unlisted_recipient, warn_if_reject check_policy_service inet:127.0.0.1:12340 reject_unknown_sender_domain, check_sender_access pcre:/etc/postfix/umlaute.pcre, check_recipient_access pcre:/etc/postfix/umlaute.pcre, reject_unauth_destination, reject_rbl_client bl....

...cal/lib/postfix smtp_tls_note_starttls_offer = yes smtp_use_tls = yes smtpd_delay_reject = yes smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_invalid_hostname, reject_unknown_hostname, reject_non_fqdn_hostname, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, permit smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_hostname, reject_non_fqdn_sender, reject_non_fqdn_recipient, reject_unauth_destination, reject_unauth_pipelining, reject_rbl_client bl.spamcop.net, reject_rbl_client sbl-xbl.spamhaus.org, reject_rb...

...nt bl.spamcop.net, reject_rbl_client zen.spamhaus.org, reject_rbl_client b.barracudacentral.org smtpd_end_of_data_restrictions = check_policy_service inet:127.0.0.1:10031 smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, reject_invalid_hostname smtpd_recipient_restrictions = reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_non_fqdn_sender, reject_non_fqdn_recipient, reject_unlisted_recipient, check_policy_service inet:127.0.0.1:10031, permit_mynetworks, permit_sasl_authenticated, reject_unaut...

...ecipient_delimiter = + relayhost = sample_directory = /usr/share/doc/postfix/examples sendmail_path = /usr/sbin/sendmail setgid_group = _postdrop smtpd_client_restrictions = permit_mynetworks permit_sasl_authenticated reject smtpd_enforce_tls = no smtpd_helo_required = yes smtpd_helo_restrictions = reject_invalid_helo_hostname reject_non_fqdn_helo_hostname smtpd_pw_server_security_options = plain, login cram-md5 smtpd_recipient_restrictions = permit_sasl_authenticated permit_mynetworks reject_unauth_destination check_policy_service unix:private/policy reject smtpd_sasl_auth_enable = yes smtpd_sasl_path = private/auth sm...

...rdns. My problem is that I do not specify the helo check?? this is the relevant portion of main.cf <snip> smtpd_helo_required = yes smtpd_delay_reject = yes #added 20090410 strict_rfc821_envelopes = yes smtpd_helo_restrictions = permit_mynetworks, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, permit smtpd_sender_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_sender, reject_unknown_client, reject_unauthenticated_sender_login_mismatch, permit smtpd_sender_login_maps = hash:/etc/postfix/smtpd_sender_login_map smtpd_client_restriction...

...linux.com/2011/05/26/prevent-postfix-brute-force/ I added the fail2ban rule and modified my postfix main.cf as follows: smtpd_client_connection_rate_limit = 3 smtpd_delay_reject = yes smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, permit smtpd_sender_restrictions = permit_mynetworks, reject_non_fqdn_sender, reject_unknown_sender_domain, permit smtpd_recipient_restrictions = reject_unauth_pipelining, reject_non_fqdn_recipient, reject_unknown_recipient_domain, permit_mynetworks, reject_unau...

...smtpd_sasl_auth_enable = yes broken_sasl_auth_clients = yes smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth smtpd_sasl_security_options = noanonymous # smtpd_delay_reject = yes smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, permit # smtpd_sender_restrictions = permit_mynetworks, reject_non_fqdn_sender, reject_unknown_sender_domain, permit # smtpd_recipient_restrictions = reject_unauth_pipelining, reject_non_fqdn_recipient, reject_unknown_recipient_domain, permit_mynetworks, permit_...

...0024 home_mailbox = maildir/ mailbox_size_limit = 0 mydestination = $myhostname, mail.silvio-siefke.de, server1.silviosiefke.de myhostname = server1.silviosiefke.de recipient_delimiter = + smtp_sasl_auth_enable = no smtpd_recipient_restrictions = reject_non_fqdn_sender reject_non_fqdn_recipient reject_invalid_helo_hostname reject_non_fqdn_helo_hostname permit_sasl_authenticated permit_mynetworks reject_unauth_destination reject_unlisted_recipient reject_rbl_client zen.spamhaus.org reject_rbl_client dul.dnsbl.sorbs.net reject_rbl_client bl.spamcop.net check_policy_service inet:127.0.0.1:10031 reject...

...= yes # smtpd_sasl_auth_enable = yes smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unknown_helo_hostname, reject_invalid_helo_hostname # debug_peer_level = 1 sendmail_path = /usr/sbin/sendmail newaliases_path = /usr/bin/newaliases mailq_path = /usr/bin/mailq setgid_group = postdrop html_directory = no manpage_directory = /usr/local/man sample_directory = /etc/postfix readme_directory = no queue_directory = /var/spool/postfix comm...

...; smtpd_helo_restrictions = > >> permit_mynetworks, > >> permit_sasl_authenticated, > >> reject_unlisted_recipient, > >> # check_client_access hash:/etc/postfix/ > >> check_helo_access hash:/etc/postfix/check_helo_access > >> reject_invalid_helo_hostname > >> reject_non_fqdn_helo_hostname > >> reject_unknown_helo_hostname > >> unknown_hostname_reject_code = 550 > >> in the "check_helo_access" map there are only certain senders with > their > >> special invalid HELOs whitelisted, but...

...rmit_sasl_authenticated, reject_unknown_reverse_client_hostname, permit smtpd_data_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_pipelining, permit smtpd_delay_reject = yes smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, permit smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_recipient, reject_unknown_recipient_domain, reject_unauth_destination, reject_rbl_client bl.spamcop.net, reject_rbl_client sbl-xbl.spamhaus.org, permit smtpd_sasl_aut...

...y_domains = virtual_alias_domains = hash:/etc/postfix/virtual_alias_domains virtual_alias_maps = hash:/etc/postfix/virtual_alias_maps smtpd_helo_required = yes smtpd_delay_reject = yes strict_rfc821_envelopes = yes smtpd_helo_restrictions = permit_mynetworks, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, permit smtpd_sender_login_maps = hash:/etc/postfix/smtpd_sender_login_map smtpd_client_restrictions = check_client_access hash:/etc/postfix/access smtpd_recipient_restrictions = reject_unauth_pipelining, reject_non_fqdn_recipient, reject_non_fqdn_sender, reject_unknown_sender_domain,...

...reject_rhsbl_sender dbl.spamhaus.org reject_rbl_client bl.spamcop.net reject_rbl_client cbl.abuseat.org reject_rbl_client b.barracudacentral.org check_client_access hash:/etc/postfix/whitelist reject_rhsbl_helo dbl.spamhaus.org reject_rhsbl_client dbl.spamhaus.org reject_unknown_helo_hostname reject_invalid_helo_hostname reject_non_fqdn_helo_hostname check_client_access pcre:/etc/postfix/ptr-tld.pcre check_client_access cidr:/etc/postfix/sinokorea.cidr check_client_access cidr:/etc/postfix/taiwancidr.cidr check_client_access regexp:/etc/postfix/blacklist_clients check_client_access cidr:/etc/postfix/asian-ip.ci...

...nner = $myhostname ESMTP $mail_name (Debian/GNU) smtpd_client_restrictions = check_client_access hash:/etc/postfix/access, permit_sasl_authenticated, reject_rbl_client zen.spamhaus.org, reject_rbl_client dnsbl.sorbs.net,reject_unauth_pipelining smtpd_helo_required = yes smtpd_helo_restrictions = reject_invalid_helo_hostname,reject_non_fqdn_helo_hostname,reject_unknown_helo_hostname smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_recipient, reject_unauth_destination, reject_unknown_recipient_domain smtpd_sasl_auth_enable = yes smtpd_sasl_path = private/auth smtpd_sasl_typ...

...reject_rhsbl_sender dbl.spamhaus.org reject_rbl_client bl.spamcop.net reject_rbl_client cbl.abuseat.org reject_rbl_client b.barracudacentral.org check_client_access hash:/etc/postfix/whitelist reject_rhsbl_helo dbl.spamhaus.org reject_rhsbl_client dbl.spamhaus.org reject_unknown_helo_hostname reject_invalid_helo_hostname reject_non_fqdn_helo_hostname check_client_access pcre:/etc/postfix/ptr-tld.pcre check_client_access cidr:/etc/postfix/sinokorea.cidr check_client_access cidr:/etc/postfix/taiwancidr.cidr check_client_access regexp:/etc/postfix/blacklist_clients check_client_access cidr:/etc/postfix/asian-ip.ci...

...er_unknown_table_name = no smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt smtp_tls_note_starttls_offer = yes smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache smtp_use_tls = yes smtpd_banner = $myhostname ESMTP $mail_name smtpd_helo_required = yes smtpd_helo_restrictions = reject_invalid_helo_hostname smtpd_recipient_restrictions = reject_unknown_recipient_domain, reject_unauth_pipelining, permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination smtpd_sasl_auth_enable = yes smtpd_sasl_local_domain = $myhostname smtpd_sasl_path = private/auth smtpd_sasl_security_options = noanonym...