search for: reject_non_fqdn_helo_hostnam

...9;s what I currently have on my test server: --8<----- /etc/postfix/main.cf ----------------------------- ... smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, check_helo_access hash:/etc/postfix/helo_access reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, reject_unknown_helo_hostname smtpd_sender_restrictions = permit_mynetworks, permit_sasl_authenticated, check_sender_access hash:/etc/postfix/sender_access, reject_unknown_sender_domain, reject_unknown_reverse_client_hostname, reject_unknown_client_hostname smtpd_recipient_restrictio...

...ject.cidr, reject_unauth_pipelining smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks, reject_unauth_destination, check_helo_access pcre:/etc/postfix/check_helo_access-hostname-checks.pcre, check_helo_access hash:/etc/postfix/check_helo_access-allow.map, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, reject_unknown_helo_hostname, reject_unauth_pipelining Resulting in more happy customers since after my adviced changes to there servers, they now also have less spam.. Greetz, Louis > -----Oorspronkelijk bericht----- > Van: phils at caerlle...

...e - which does not have a correct rdns. My problem is that I do not specify the helo check?? this is the relevant portion of main.cf <snip> smtpd_helo_required = yes smtpd_delay_reject = yes #added 20090410 strict_rfc821_envelopes = yes smtpd_helo_restrictions = permit_mynetworks, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, permit smtpd_sender_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_sender, reject_unknown_client, reject_unauthenticated_sender_login_mismatch, permit smtpd_sender_login_maps = hash:/etc/postfix/smtpd_sender_l...

...erfect, but it is working quite well. Yes, the mail takes a few seconds longer and there is probably more I could do, but this ROCKS!!! smtpd_delay_reject = yes smtpd_helo_required = yes smtpd_client_restrictions = permit_mynetworks,permit smtpd_helo_restrictions = permit_mynetworks, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, permit smtpd_sender_restrictions = permit_mynetworks, reject_non_fqdn_sender, reject_unknown_sender_domain, permit smtpd_recipient_restrictions = reject_non_fqdn_recipient, reject_unknown_recipient_domain, permit_mynetwo...

...yes > > smtpd_helo_restrictions = >    permit_mynetworks, >    permit_sasl_authenticated, >    reject_unlisted_recipient, > # check_client_access hash:/etc/postfix/ >    check_helo_access hash:/etc/postfix/check_helo_access >    reject_invalid_helo_hostname >    reject_non_fqdn_helo_hostname >    reject_unknown_helo_hostname > > unknown_hostname_reject_code = 550 > > in the "check_helo_access" map there are only certain senders with their > special invalid HELOs whitelisted, but no "unknown" or the mentioned IP > adress. > > M...

...ldrop shlib_directory = /usr/local/lib/postfix smtp_tls_note_starttls_offer = yes smtp_use_tls = yes smtpd_delay_reject = yes smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_invalid_hostname, reject_unknown_hostname, reject_non_fqdn_hostname, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, permit smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_hostname, reject_non_fqdn_sender, reject_non_fqdn_recipient, reject_unauth_destination, reject_unauth_pipelining, reject_rbl_client bl.spamcop.net, reject_rbl_client s...

...uth_pipelining, reject_rbl_client bl.spamcop.net, reject_rbl_client zen.spamhaus.org, reject_rbl_client b.barracudacentral.org smtpd_end_of_data_restrictions = check_policy_service inet:127.0.0.1:10031 smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, reject_invalid_hostname smtpd_recipient_restrictions = reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_non_fqdn_sender, reject_non_fqdn_recipient, reject_unlisted_recipient, check_policy_service inet:127.0.0.1:10031, permit_mynetworks, permit_sa...

...ost = sample_directory = /usr/share/doc/postfix/examples sendmail_path = /usr/sbin/sendmail setgid_group = _postdrop smtpd_client_restrictions = permit_mynetworks permit_sasl_authenticated reject smtpd_enforce_tls = no smtpd_helo_required = yes smtpd_helo_restrictions = reject_invalid_helo_hostname reject_non_fqdn_helo_hostname smtpd_pw_server_security_options = plain, login cram-md5 smtpd_recipient_restrictions = permit_sasl_authenticated permit_mynetworks reject_unauth_destination check_policy_service unix:private/policy reject smtpd_sasl_auth_enable = yes smtpd_sasl_path = private/auth smtpd_sasl_type = dovecot smtpd_...

...ound most of it here: https://scottlinux.com/2011/05/26/prevent-postfix-brute-force/ I added the fail2ban rule and modified my postfix main.cf as follows: smtpd_client_connection_rate_limit = 3 smtpd_delay_reject = yes smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, permit smtpd_sender_restrictions = permit_mynetworks, reject_non_fqdn_sender, reject_unknown_sender_domain, permit smtpd_recipient_restrictions = reject_unauth_pipelining, reject_non_fqdn_recipient, reject_unknown_recipient_domain,...

...eness the postfix setup is here : smtpd_sasl_auth_enable = yes broken_sasl_auth_clients = yes smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth smtpd_sasl_security_options = noanonymous # smtpd_delay_reject = yes smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, permit # smtpd_sender_restrictions = permit_mynetworks, reject_non_fqdn_sender, reject_unknown_sender_domain, permit # smtpd_recipient_restrictions = reject_unauth_pipelining, reject_non_fqdn_recipient, reject_unknown_recipient_domain...

...ailbox_size_limit = 0 mydestination = $myhostname, mail.silvio-siefke.de, server1.silviosiefke.de myhostname = server1.silviosiefke.de recipient_delimiter = + smtp_sasl_auth_enable = no smtpd_recipient_restrictions = reject_non_fqdn_sender reject_non_fqdn_recipient reject_invalid_helo_hostname reject_non_fqdn_helo_hostname permit_sasl_authenticated permit_mynetworks reject_unauth_destination reject_unlisted_recipient reject_rbl_client zen.spamhaus.org reject_rbl_client dul.dnsbl.sorbs.net reject_rbl_client bl.spamcop.net check_policy_service inet:127.0.0.1:10031 reject_unknown_sender_domain smtpd_sa...

...ermit_mynetworks, > >> permit_sasl_authenticated, > >> reject_unlisted_recipient, > >> # check_client_access hash:/etc/postfix/ > >> check_helo_access hash:/etc/postfix/check_helo_access > >> reject_invalid_helo_hostname > >> reject_non_fqdn_helo_hostname > >> reject_unknown_helo_hostname > >> unknown_hostname_reject_code = 550 > >> in the "check_helo_access" map there are only certain senders with > their > >> special invalid HELOs whitelisted, but no "unknown" or the mentioned IP >...

...t_unknown_reverse_client_hostname, permit smtpd_data_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_pipelining, permit smtpd_delay_reject = yes smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, permit smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_recipient, reject_unknown_recipient_domain, reject_unauth_destination, reject_rbl_client bl.spamcop.net, reject_rbl_client sbl-xbl.spamhaus.org, permit smtpd_sasl_auth_enable = yes smtpd_sasl_path...

...192.168.230.0/24, 127.0.0.0/8 relay_domains = virtual_alias_domains = hash:/etc/postfix/virtual_alias_domains virtual_alias_maps = hash:/etc/postfix/virtual_alias_maps smtpd_helo_required = yes smtpd_delay_reject = yes strict_rfc821_envelopes = yes smtpd_helo_restrictions = permit_mynetworks, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, permit smtpd_sender_login_maps = hash:/etc/postfix/smtpd_sender_login_map smtpd_client_restrictions = check_client_access hash:/etc/postfix/access smtpd_recipient_restrictions = reject_unauth_pipelining, reject_non_fqdn_recipient, reject_non_fqdn_sender...

...mhaus.org reject_rbl_client bl.spamcop.net reject_rbl_client cbl.abuseat.org reject_rbl_client b.barracudacentral.org check_client_access hash:/etc/postfix/whitelist reject_rhsbl_helo dbl.spamhaus.org reject_rhsbl_client dbl.spamhaus.org reject_unknown_helo_hostname reject_invalid_helo_hostname reject_non_fqdn_helo_hostname check_client_access pcre:/etc/postfix/ptr-tld.pcre check_client_access cidr:/etc/postfix/sinokorea.cidr check_client_access cidr:/etc/postfix/taiwancidr.cidr check_client_access regexp:/etc/postfix/blacklist_clients check_client_access cidr:/etc/postfix/asian-ip.cidr reject_rbl_client relays.o...

...l_name (Debian/GNU) smtpd_client_restrictions = check_client_access hash:/etc/postfix/access, permit_sasl_authenticated, reject_rbl_client zen.spamhaus.org, reject_rbl_client dnsbl.sorbs.net,reject_unauth_pipelining smtpd_helo_required = yes smtpd_helo_restrictions = reject_invalid_helo_hostname,reject_non_fqdn_helo_hostname,reject_unknown_helo_hostname smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_recipient, reject_unauth_destination, reject_unknown_recipient_domain smtpd_sasl_auth_enable = yes smtpd_sasl_path = private/auth smtpd_sasl_type = dovecot smtpd_sender_restr...

...mhaus.org reject_rbl_client bl.spamcop.net reject_rbl_client cbl.abuseat.org reject_rbl_client b.barracudacentral.org check_client_access hash:/etc/postfix/whitelist reject_rhsbl_helo dbl.spamhaus.org reject_rhsbl_client dbl.spamhaus.org reject_unknown_helo_hostname reject_invalid_helo_hostname reject_non_fqdn_helo_hostname check_client_access pcre:/etc/postfix/ptr-tld.pcre check_client_access cidr:/etc/postfix/sinokorea.cidr check_client_access cidr:/etc/postfix/taiwancidr.cidr check_client_access regexp:/etc/postfix/blacklist_clients check_client_access cidr:/etc/postfix/asian-ip.cidr reject_rbl_client relays.o...

hello list hello dovecot network hello all the reader here is a sieve script this ######################################## require ["fileinto","regex","comparator-i;ascii-numeric","reject","relational"]; # rule:[spammanage] if header :value "ge" :comparator "i;ascii-numeric" ["X-Spam-score"] ["500"] {

...6.0.3790.1830 ready. smtpd_data_restrictions = reject_unauth_pipelining, reject_multi_recipient_bounce permit smtpd_helo_required = yes smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, permit_sasl_authenticated, reject_invalid_hostname, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, reject_non_fqdn_hostname, reject_non_fqdn_sender, reject_non_fqdn_recipient, reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_unauth_destination, check_recipient_access hash:/etc/postfix/recipient_access.hash, check_recipient_access pcre:/etc/postfix/recipient_access.pcr...

...etworks, permit_sasl_authenticated, reject_unknown_reverse_client_hostname smtpd_data_restrictions = permit_mynetworks, reject_unauth_pipelining, permit_sasl_authenticated smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unlisted_recipient, reject_non_fqdn_recipient, reject_unauth_destination, reject_unknown_recipient_domain, check_recipient_access hash:/opt/local/etc/postfix/filtered_domains smtpd_sasl_auth_enable = yes smtpd_sasl...