1<!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" 2 "http://www.w3.org/TR/html4/loose.dtd"> 3 4<html> 5 6<head> 7 8<title>Postfix SMTP Access Policy Delegation </title> 9 10<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> 11<link rel='stylesheet' type='text/css' href='postfix-doc.css'> 12 13</head> 14 15<body> 16 17<h1><img src="postfix-logo.jpg" width="203" height="98" ALT="">Postfix SMTP Access Policy Delegation </h1> 18 19<hr> 20 21<h2>Purpose of Postfix SMTP access policy delegation</h2> 22 23<p> The Postfix SMTP server has a number of built-in mechanisms to 24block or accept mail at specific SMTP protocol stages. In addition, 25the Postfix SMTP server can delegate decisions to an external policy 26server (Postfix 2.1 and later). </p> 27 28<p> With this policy delegation mechanism, a simple 29<a href="#greylist">greylist</a> policy can be implemented with only a dozen lines of 30Perl, as is shown at the end of this document. A complete example 31can be found in the Postfix source code, in the directory 32examples/smtpd-policy. </p> 33 34<p> Another example of policy delegation is the SPF policy server 35at https://web.archive.org/web/20190221142057/http://www.openspf.org/Software. </p> 36 37<p> Policy delegation is now the preferred method for adding policies 38to Postfix. It's much easier to develop a new feature in few lines 39of Perl, Python, Ruby, or TCL, than trying to do the same in C code. 40The difference in 41performance will be unnoticeable except in the most demanding 42environments. On active systems a policy daemon process is used 43multiple times, for up to $max_use incoming SMTP connections. </p> 44 45<p> This document covers the following topics: </p> 46 47<ul> 48 49<li><a href="#protocol">Policy protocol description</a> 50 51<li><a href="#client_config">Simple policy client/server configuration</a> 52 53<li><a href="#advanced">Advanced policy client configuration</a> 54 55<li><a href="#greylist">Example: greylist policy server</a> 56 57<li><a href="#frequent">Greylisting mail from frequently forged domains</a> 58 59<li><a href="#all_mail">Greylisting all your mail</a> 60 61<li><a href="#maintenance">Routine greylist maintenance</a> 62 63<li><a href="#greylist_code">Example Perl greylist server</a> 64 65</ul> 66 67<h2><a name="protocol">Protocol description</a></h2> 68 69<p> The Postfix policy delegation protocol is really simple. The client 70sends a request and the server sends a response. Unless there was an 71error, the server must not close the connection, so that the same 72connection can be used multiple times. </p> 73 74<p> The client request is a sequence of name=value attributes separated 75by newline, and is terminated by an empty line. The server reply is one 76name=value attribute and it, too, is terminated by an empty line. </p> 77 78<p> Here is an example of all the attributes that the Postfix SMTP 79server sends in a delegated SMTPD access policy request: </p> 80 81<blockquote> 82<pre> 83<b>Postfix version 2.1 and later:</b> 84request=smtpd_access_policy 85protocol_state=RCPT 86protocol_name=SMTP 87helo_name=some.domain.tld 88queue_id=8045F2AB23 89sender=foo@bar.tld 90recipient=bar@foo.tld 91recipient_count=0 92client_address=1.2.3.4 93client_name=another.domain.tld 94reverse_client_name=another.domain.tld 95instance=123.456.7 96<b>Postfix version 2.2 and later:</b> 97sasl_method=plain 98sasl_username=you 99sasl_sender= 100size=12345 101ccert_subject=solaris9.porcupine.org 102ccert_issuer=Wietse+20Venema 103ccert_fingerprint=C2:9D:F4:87:71:73:73:D9:18:E7:C2:F3:C1:DA:6E:04 104<b>Postfix version 2.3 and later:</b> 105encryption_protocol=TLSv1/SSLv3 106encryption_cipher=DHE-RSA-AES256-SHA 107encryption_keysize=256 108etrn_domain= 109<b>Postfix version 2.5 and later:</b> 110stress= 111<b>Postfix version 2.9 and later:</b> 112ccert_pubkey_fingerprint=68:B3:29:DA:98:93:E3:40:99:C7:D8:AD:5C:B9:C9:40 113<b>Postfix version 3.0 and later:</b> 114client_port=1234 115<b>Postfix version 3.1 and later:</b> 116policy_context=submission 117<b>Postfix version 3.2 and later:</b> 118server_address=10.3.2.1 119server_port=54321 120<b>Postfix version 3.8 and later:</b> 121compatibility_level=<i>major</i>.<i>minor</i>.<i>patch</i> 122mail_version=3.8.0 123[empty line] 124</pre> 125</blockquote> 126 127<p> Notes: </p> 128 129<ul> 130 131 <li> <p> The "request" attribute is required. In this example 132 the request type is "smtpd_access_policy". </p> 133 134 <li> <p> The order of the attributes does not matter. The policy 135 server should ignore any attributes that it does not care about. 136 </p> 137 138 <li> <p> When the same attribute name is sent more than once, 139 the server may keep the first value or the last attribute value. 140 </p> 141 142 <li> <p> When an attribute value is unavailable, the client 143 either does not send the attribute, sends the attribute with 144 an empty value ("name="), or sends a zero value ("name=0") in 145 the case of a numerical attribute. </p> 146 147 <li> <p> The "recipient" attribute is available in the "RCPT 148 TO" stage. It is also available in the "DATA" and "END-OF-MESSAGE" 149 stages if Postfix accepted only one recipient for the current 150 message. 151 The DATA protocol state also applies to email that is received 152 with BDAT commands (Postfix 3.4 and later). </p> 153 154 <li> <p> The "recipient_count" attribute (Postfix 2.3 and later) 155 is non-zero only in the "DATA" and "END-OF-MESSAGE" stages. It 156 specifies the number of recipients that Postfix accepted for 157 the current message. 158 The DATA protocol state also applies to email that is received 159 with BDAT commands (Postfix 3.4 and later). </p> 160 161 <li> <p> The remote client or local server IP address is an 162 IPv4 dotted quad in the form 1.2.3.4 or it is an IPv6 address 163 in the form 1:2:3::4:5:6. </p> 164 165 <li> <p> The remote client or local server port is a decimal 166 number in the range 0-65535. </p> 167 168 <li> <p> For a discussion of the differences between reverse 169 and verified client_name information, see the 170 reject_unknown_client_hostname discussion in the postconf(5) 171 document. </p> 172 173 <li> <p> An attribute name must not contain "=", null or newline, 174 and an attribute value must not contain null or newline. </p> 175 176 <li> <p> The "instance" attribute value can be used to correlate 177 different requests regarding the same message delivery. These 178 requests are sent over the same policy connection (unless the 179 policy daemon terminates the connection). Once Postfix sends 180 a query with a different instance attribute over that same 181 policy connection, the previous message delivery is either 182 completed or aborted. </p> 183 184 <li> <p> The "size" attribute value specifies the message size 185 that the client specified in the MAIL FROM command (zero if 186 none was specified). With Postfix 2.2 and later, it specifies 187 the actual message size after the client sends the END-OF-MESSAGE. 188 </p> 189 190 <li> <p> The "sasl_*" attributes (Postfix 2.2 and later) specify 191 information about how the client was authenticated via SASL. 192 These attributes are empty in case of no SASL authentication. 193 </p> 194 195 <li> <p> The "ccert_*" attributes (Postfix 2.2 and later) specify 196 information about how the client was authenticated via TLS. 197 These attributes are empty in case of no certificate authentication. 198 As of Postfix 2.2.11 these attribute values are encoded as 199 xtext: some characters are represented by +XX, where XX is the 200 two-digit hexadecimal representation of the character value. With 201 Postfix 2.6 and later, the decoded string is an UTF-8 string 202 without non-printable ASCII characters. </p> 203 204 <li> <p> The "encryption_*" attributes (Postfix 2.3 and later) 205 specify information about how the connection is encrypted. With 206 plaintext connections the protocol and cipher attributes are 207 empty and the keysize is zero. </p> 208 209 <li> <p> The "etrn_domain" attribute is defined only in the 210 context of the ETRN command, and specifies the ETRN command 211 parameter. </p> 212 213 <li> <p> The "stress" attribute is either empty or "yes". See 214 the STRESS_README document for further information. </p> 215 216 <li> <p> The "policy_context" attribute provides a way to pass 217 information that is not available via other attributes (Postfix 218 version 3.1 and later). </p> 219 220 <li> <p> The "compatibility_level" attribute corresponds to the 221 compatibility_level parameter value. It has the form 222 <i>major</i>.<i>minor</i>.<i>patch</i> where <i>minor</i> and 223 <i>patch</i> may be absent. </p> 224 225 <li> <p> The "mail_version" attribute corresponds to the 226 mail_version parameter value. It has the form 227 <i>major</i>.<i>minor</i>.<i>patch</i> for stable releases, and 228 <i>major</i>.<i>minor</i>-<i>yyyymmdd</i> for unstable releases. 229 </p> 230 231</ul> 232 233<p> The following is specific to SMTPD delegated policy requests: 234</p> 235 236<ul> 237 238 <li> <p> Protocol names are ESMTP or SMTP. </p> 239 240 <li> <p> Protocol states are CONNECT, EHLO, HELO, MAIL, RCPT, 241 DATA, END-OF-MESSAGE, VRFY or ETRN; these are the SMTP protocol 242 states where 243 the Postfix SMTP server makes an OK/REJECT/HOLD/etc. decision. 244 The DATA protocol state also applies to email that is received 245 with BDAT commands (Postfix 3.4 and later). 246 </p> 247 248</ul> 249 250<p> The policy server replies with any action that is allowed in a 251Postfix SMTPD access(5) table. Example: </p> 252 253<blockquote> 254<pre> 255action=defer_if_permit Service temporarily unavailable 256[empty line] 257</pre> 258</blockquote> 259 260<p> This causes the Postfix SMTP server to reject the request with 261a 450 temporary error code and with text "Service temporarily 262unavailable", if the Postfix SMTP server finds no reason to reject 263the request permanently. </p> 264 265<p> In case of trouble the policy server must not send a reply. 266Instead the server must log a warning and disconnect. Postfix will 267retry the request at some later time. </p> 268 269<h2><a name="client_config">Simple policy client/server configuration</a></h2> 270 271<p> The Postfix delegated policy client can connect to a TCP socket 272or to a UNIX-domain socket. Examples: </p> 273 274<blockquote> 275<pre> 276inet:127.0.0.1:9998 277unix:/some/where/policy 278unix:private/policy 279</pre> 280</blockquote> 281 282<p> The first example specifies that the policy server listens on 283a TCP socket at 127.0.0.1 port 9998. The second example specifies 284an absolute pathname of a UNIX-domain socket. The third example 285specifies a pathname relative to the Postfix queue directory; use 286this for policy servers that are spawned by the Postfix master 287daemon. On many systems, "local" is a synonym for "unix".</p> 288 289<p> To create a policy service that listens on a UNIX-domain socket 290called "policy", and that runs under control of the Postfix spawn(8) 291daemon, you would use something like this: </p> 292 293<blockquote> 294<pre> 295 1 /etc/postfix/master.cf: 296 2 policy unix - n n - 0 spawn 297 3 user=nobody argv=/some/where/policy-server 298 4 299 5 /etc/postfix/main.cf: 300 6 smtpd_recipient_restrictions = 301 7 ... 302 8 reject_unauth_destination 303 9 check_policy_service unix:private/policy 30410 ... 30511 policy_time_limit = 3600 30612 # smtpd_policy_service_request_limit = 1 307</pre> 308</blockquote> 309 310<p> NOTES: </p> 311 312<ul> 313 314<li> <p> Lines 2-3: this creates the service called "policy" that 315listens on a UNIX-domain socket. The service is implemented by the 316Postfix spawn(8) daemon, which executes the policy server program 317that is specified with the <b>argv</b> attribute, using the privileges 318specified with the <b>user</b> attribute. </p> 319 320<li> <p> Line 2: specify a "0" process limit instead of the default 321"-", to avoid "connection refused" and other problems when you 322increase the smtpd process limit. </p> 323 324<li> <p> Line 8: reject_unauth_destination is not needed here if 325the mail relay policy is specified with smtpd_relay_restrictions 326(available with Postfix 2.10 and later). </p> 327 328<li> <p> Lines 8, 9: always specify "check_policy_service" AFTER 329"reject_unauth_destination" or else your system could become an 330open relay. </p> 331 332<li> <p> Line 11: this increases the time that a policy server 333process may run to 3600 seconds. The default time limit of 1000 334seconds is too short; the policy daemon needs to run as long as the 335SMTP server process that talks to it. 336See the spawn(8) manpage for more information about the 337<i>transport</i>_time_limit parameter. </p> 338 339<blockquote> <p> Note: the "policy_time_limit" parameter will not 340show up in "postconf" command output before Postfix version 2.9. 341This limitation applies to many parameters whose name is a combination 342of a master.cf service name (in the above example, "policy") and a 343built-in suffix (in the above example: "_time_limit"). </p> 344</blockquote> 345 346<li> <p> Line 12: specify smtpd_policy_service_request_limit to 347avoid error-recovery delays with policy servers that cannot 348maintain a persistent connection. </p> 349 350<li> <p> With Solaris < 9, or Postfix < 2.10 on any Solaris 351version, use TCP sockets instead of UNIX-domain sockets: </p> 352 353</ul> 354 355<blockquote> 356<pre> 357 1 /etc/postfix/master.cf: 358 2 127.0.0.1:9998 inet n n n - 0 spawn 359 3 user=nobody argv=/some/where/policy-server 360 4 361 5 /etc/postfix/main.cf: 362 6 smtpd_recipient_restrictions = 363 7 ... 364 8 reject_unauth_destination 365 9 check_policy_service inet:127.0.0.1:9998 36610 ... 36711 127.0.0.1:9998_time_limit = 3600 36812 # smtpd_policy_service_request_limit = 1 369</pre> 370</blockquote> 371 372<p> Configuration parameters that control the client side of the 373policy delegation protocol: </p> 374 375<ul> 376 377<li> <p> smtpd_policy_service_default_action (default: 451 4.3.5 378Server configuration problem): The default action when an SMTPD 379policy service request fails. Available with Postfix 3.0 and 380later. </p> 381 382<li> <p> smtpd_policy_service_max_idle (default: 300s): The amount 383of time before the Postfix SMTP server closes an unused policy 384client connection. </p> 385 386<li> <p> smtpd_policy_service_max_ttl (default: 1000s): The amount 387of time before the Postfix SMTP server closes an active policy 388client connection. </p> 389 390<li> <p> smtpd_policy_service_request_limit (default: 0): The maximal 391number of requests per policy connection, or zero (no limit). 392Available with Postfix 3.0 and later. </p> 393 394<li> <p> smtpd_policy_service_timeout (default: 100s): The time 395limit to connect to, send to or receive from a policy server. </p> 396 397<li> <p> smtpd_policy_service_try_limit (default: 2): The maximal 398number of attempts to send an SMTPD policy service request before 399giving up. Available with Postfix 3.0 and later. </p> 400 401<li> <p> smtpd_policy_service_retry_delay (default: 1s): The delay 402between attempts to resend a failed SMTPD policy service request. 403Available with Postfix 3.0 and later. </p> 404 405<li> <p> smtpd_policy_service_policy_context (default: empty): 406Optional information that is passed in the "policy_context" attribute 407of an SMTPD policy service request (originally, to share the same 408SMTPD service endpoint among multiple check_policy_service clients). 409Available with Postfix 3.1 and later. </p> 410 411</ul> 412 413<p> Configuration parameters that control the server side of the 414policy delegation protocol: </p> 415 416<ul> 417 418<li> <p> <i>transport</i>_time_limit ($command_time_limit): The 419maximal amount of time the policy daemon is allowed to run before 420it is terminated. The <i>transport</i> is the service name of the 421master.cf entry for the policy daemon service. In the above 422examples, the service name is "policy" or "127.0.0.1:9998". </p> 423 424</ul> 425 426<h2><a name="advanced">Advanced policy client configuration</a></h2> 427 428<p> The previous section lists a number of Postfix main.cf parameters 429that control time limits and other settings for all policy clients. 430This is sufficient for simple configurations. With more complex 431configurations it becomes desirable to have different settings per 432policy client. This is supported with Postfix 3.0 and later. </p> 433 434<p> The following example shows a "non-critical" policy service 435with a short timeout, and with "DUNNO" as default action when the 436service is unvailable. The "DUNNO" action causes Postfix to ignore 437the result. </p> 438 439<blockquote> 440<pre> 4411 /etc/postfix/main.cf: 4422 mua_recipient_restrictions = 4433 ... 4444 reject_unauth_destination 4455 check_policy_service { inet:host:port, 4466 timeout=10s, default_action=DUNNO 4477 policy_context=submission } 4488 ... 449</pre> 450</blockquote> 451 452<p> Instead of a server endpoint, we now have a list enclosed in {}. </p> 453 454<ul> 455 456<li> <p> Line 5: The first item in the list is the server endpoint. 457This supports the exact same "inet" and "unix" syntax as described 458earlier. </p> 459 460<li> <p> Line 6-7: The remainder of the list contains per-client 461settings. These settings override global main.cf parameters, 462and have the same name as those parameters, without the 463"smtpd_policy_service_" prefix. </p> 464 465</ul> 466 467<p> Inside the list, syntax is similar to what we already know from 468main.cf: items separated by space or comma. There is one difference: 469<b>you must enclose a setting in parentheses, as in "{ name = value 470}", if you want to have space or comma within a value or around 471"="</b>. This comes in handy when different policy servers require 472different default actions with different SMTP status codes or text: 473</p> 474 475<blockquote> 476<pre> 4771 /etc/postfix/main.cf: 4782 smtpd_recipient_restrictions = 4793 ... 4804 reject_unauth_destination 4815 check_policy_service { 4826 inet:host:port1, 4837 { default_action = 451 4.3.5 See http://www.example.com/support1 } 4848 } 4859 ... 486</pre> 487</blockquote> 488 489<h2><a name="greylist">Example: greylist policy server</a></h2> 490 491<p> Greylisting is a defense against junk email that is described at 492http://www.greylisting.org/. The idea was discussed on the 493postfix-users mailing list <a 494href="http://archives.neohapsis.com/archives/postfix/2002-03/0846.html"> 495one year before it was popularized</a>. </p> 496 497<p> The file examples/smtpd-policy/greylist.pl in the Postfix source 498tree implements a simplified greylist policy server. This server 499stores a time stamp for every (client, sender, recipient) triple. 500By default, mail is not accepted until a time stamp is more than 50160 seconds old. This stops junk mail with randomly selected sender 502addresses, and mail that is sent through randomly selected open 503proxies. It also stops junk mail from spammers that change their 504IP address frequently. </p> 505 506<p> Copy examples/smtpd-policy/greylist.pl to /usr/libexec/postfix 507or whatever location is appropriate for your system. </p> 508 509<p> In the greylist.pl Perl script you need to specify the 510location of the greylist database file, and how long mail will 511be delayed before it is accepted. The default settings are: 512</p> 513 514<blockquote> 515<pre> 516$database_name="/var/mta/greylist.db"; 517$greylist_delay=60; 518</pre> 519</blockquote> 520 521<p> The /var/mta directory (or whatever you choose) should be 522writable by "nobody", or by whatever username you configure below 523in master.cf for the policy service. </p> 524 525<p> Example: </p> 526 527<blockquote> 528<pre> 529# mkdir /var/mta 530# chown nobody /var/mta 531</pre> 532</blockquote> 533 534<p> Note: DO NOT create the greylist database in a world-writable 535directory such as /tmp or /var/tmp, and DO NOT create the greylist 536database in a file system that may run out of space. Postfix can 537survive "out of space" conditions with the mail queue and with the 538mailbox store, but it cannot survive a corrupted greylist database. 539If the file becomes corrupted you may not be able to receive mail 540at all until you delete the file by hand. </p> 541 542<p> The greylist.pl Perl script can be run under control by 543the Postfix master daemon. For example, to run the script as user 544"nobody", using a UNIX-domain socket that is accessible by Postfix 545processes only: </p> 546 547<blockquote> 548<pre> 549 1 /etc/postfix/master.cf: 550 2 greylist unix - n n - 0 spawn 551 3 user=nobody argv=/usr/bin/perl /usr/libexec/postfix/greylist.pl 552 4 553 5 /etc/postfix/main.cf: 554 6 greylist_time_limit = 3600 555 7 smtpd_recipient_restrictions = 556 8 ... 557 9 reject_unauth_destination 55810 check_policy_service unix:private/greylist 55911 ... 56012 # smtpd_policy_service_request_limit = 1 561</pre> 562</blockquote> 563 564<p> Notes: </p> 565 566<ul> 567 568<li> <p> Lines 2-3: this creates the service called "greylist" that 569listens on a UNIX-domain socket. The service is implemented by the 570Postfix spawn(8) daemon, which executes the greylist.pl script that 571is specified with the <b>argv</b> attribute, using the privileges 572specified with the <b>user</b> attribute. </p> 573 574<li> <p> Line 2: specify a "0" process limit instead of the default 575"-", to avoid "connection refused" and other problems when you 576increase the smtpd process limit. </p> 577 578<li> <p> Line 3: Specify "greylist.pl -v" for verbose logging of 579each request and reply. </p> 580 581<li> <p> Line 6: this increases the time that a greylist server 582process may run to 3600 seconds. The default time limit of 1000 583seconds is too short; the greylist daemon needs to run as long as the 584SMTP server process that talks to it. 585See the spawn(8) manpage for more information about the 586<i>transport</i>_time_limit parameter. </p> 587 588<li> <p> Line 9: reject_unauth_destination is not needed here if 589the mail relay policy is specified with smtpd_relay_restrictions 590(available with Postfix 2.10 and later). </p> 591 592<blockquote> <p> Note: the "greylist_time_limit" parameter will not 593show up in "postconf" command output before Postfix version 2.9. 594This limitation applies to many parameters whose name is a combination 595of a master.cf service name (in the above example, "greylist") and 596a built-in suffix (in the above example: "_time_limit"). </p> 597</blockquote> 598 599<li> <p> Line 12: specify smtpd_policy_service_request_limit to 600avoid error-recovery delays with policy servers that cannot 601maintain a persistent connection. </p> 602 603</ul> 604 605<p> With Solaris < 9, or Postfix < 2.10 on any Solaris 606version, use inet: style sockets instead of unix: 607style, as detailed in the "<a href="#client_config">Policy 608client/server configuration</a>" section above. </p> 609 610<blockquote> 611<pre> 612 1 /etc/postfix/master.cf: 613 2 127.0.0.1:9998 inet n n n - 0 spawn 614 3 user=nobody argv=/usr/bin/perl /usr/libexec/postfix/greylist.pl 615 4 616 5 /etc/postfix/main.cf: 617 6 127.0.0.1:9998_time_limit = 3600 618 7 smtpd_recipient_restrictions = 619 8 ... 620 9 reject_unauth_destination 62110 check_policy_service inet:127.0.0.1:9998 62211 ... 62312 # smtpd_policy_service_request_limit = 1 624</pre> 625</blockquote> 626 627<h2><a name="frequent">Greylisting mail from frequently forged domains</a></h2> 628 629<p> It is relatively safe to turn on greylisting for specific 630domains that often appear in forged email. At some point 631in cyberspace/time a list of frequently 632forged MAIL FROM domains could be found at 633https://web.archive.org/web/20080526153208/http://www.monkeys.com/anti-spam/filtering/sender-domain-validate.in. 634 635<blockquote> 636<pre> 637 1 /etc/postfix/main.cf: 638 2 smtpd_recipient_restrictions = 639 3 reject_unlisted_recipient 640 4 ... 641 5 reject_unauth_destination 642 6 check_sender_access hash:/etc/postfix/sender_access 643 7 ... 644 8 smtpd_restriction_classes = greylist 645 9 greylist = check_policy_service unix:private/greylist 64610 64711 /etc/postfix/sender_access: 64812 aol.com greylist 64913 hotmail.com greylist 65014 bigfoot.com greylist 65115 ... <i>etcetera</i> ... 652</pre> 653</blockquote> 654 655<p> NOTES: </p> 656 657<ul> 658 659<li> <p> Line 9: On Solaris < 9, or Postfix < 2.10 on any 660Solaris version, use inet: style sockets 661instead of unix: style, as detailed in the "<a href="#greylist">Example: 662greylist policy server</a>" section above. </p> 663 664<li> <p> Line 5: reject_unauth_destination is not needed here if 665the mail relay policy is specified with smtpd_relay_restrictions 666(available with Postfix 2.10 and later). </p> 667 668<li> <p> Line 6: Be sure to specify "check_sender_access" AFTER 669"reject_unauth_destination" or else your system could become an 670open mail relay. </p> 671 672<li> <p> Line 3: With Postfix 2.0 snapshot releases, 673"reject_unlisted_recipient" is called "check_recipient_maps". 674Postfix 2.1 understands both forms. </p> 675 676<li> <p> Line 3: The greylist database gets polluted quickly with 677bogus addresses. It helps if you protect greylist lookups with 678other restrictions that reject unknown senders and/or recipients. 679</p> 680 681</ul> 682 683<h2><a name="all_mail">Greylisting all your mail</a></h2> 684 685<p> If you turn on greylisting for all mail you may want to make 686exceptions for mailing lists that use one-time sender addresses, 687because each message will be delayed due to greylisting, and the 688one-time sender addresses can pollute your greylist database 689relatively quickly. Instead of making exceptions, you can automatically 690allowlist clients that survive greylisting repeatedly; this avoids 691most of the delays and most of the database pollution problem. </p> 692 693<blockquote> 694<pre> 695 1 /etc/postfix/main.cf: 696 2 smtpd_recipient_restrictions = 697 3 reject_unlisted_recipient 698 4 ... 699 5 reject_unauth_destination 700 6 check_sender_access hash:/etc/postfix/sender_access 701 7 check_policy_service unix:private/policy 702 8 ... 703 9 70410 /etc/postfix/sender_access: 70511 securityfocus.com OK 70612 ... 707</pre> 708</blockquote> 709 710<p> NOTES: </p> 711 712<ul> 713 714<li> <p> Line 7: On Solaris < 9, or Postfix < 2.10 on any 715Solaris version, use inet: style sockets 716instead of unix: style, as detailed in the "<a href="#greylist">Example: 717greylist policy server</a>" section above. </p> 718 719<li> <p> Line 5: reject_unauth_destination is not needed here if 720the mail relay policy is specified with smtpd_relay_restrictions 721(available with Postfix 2.10 and later). </p> 722 723<li> <p> Lines 6-7: Be sure to specify check_sender_access and 724check_policy_service AFTER reject_unauth_destination or else your 725system could become an open mail relay. </p> 726 727<li> <p> Line 3: The greylist database gets polluted quickly with 728bogus addresses. It helps if you precede greylist lookups with 729restrictions that reject unknown senders and/or recipients. </p> 730 731</ul> 732 733<h2><a name="maintenance">Routine greylist maintenance</a></h2> 734 735<p> The greylist database grows over time, because the greylist server 736never removes database entries. If left unattended, the greylist 737database will eventually run your file system out of space. </p> 738 739<p> When the status file size exceeds some threshold you can simply 740rename or remove the file without adverse effects; Postfix 741automatically creates a new file. In the worst case, new mail will 742be delayed by an hour or so. To lessen the impact, rename or remove 743the file in the middle of the night at the beginning of a weekend. 744</p> 745 746<h2><a name="greylist_code">Example Perl greylist server</a></h2> 747 748<p> This is the Perl subroutine that implements the example greylist 749policy. It is part of a general purpose sample policy server that 750is distributed with the Postfix source as 751examples/smtpd-policy/greylist.pl. </p> 752 753<pre> 754# 755# greylist status database and greylist time interval. DO NOT create the 756# greylist status database in a world-writable directory such as /tmp 757# or /var/tmp. DO NOT create the greylist database in a file system 758# that can run out of space. 759# 760$database_name="/var/mta/greylist.db"; 761$greylist_delay=60; 762 763# 764# Auto-allowlist threshold. Specify 0 to disable, or the number of 765# successful "come backs" after which a client is no longer subject 766# to greylisting. 767# 768$auto_allowlist_threshold = 10; 769 770# 771# Demo SMTPD access policy routine. The result is an action just like 772# it would be specified on the right-hand side of a Postfix access 773# table. Request attributes are available via the %attr hash. 774# 775sub smtpd_access_policy { 776 my($key, $time_stamp, $now); 777 778 # Open the database on the fly. 779 open_database() unless $database_obj; 780 781 # Search the auto-allowlist. 782 if ($auto_allowlist_threshold > 0) { 783 $count = read_database($attr{"client_address"}); 784 if ($count > $auto_allowlist_threshold) { 785 return "dunno"; 786 } 787 } 788 789 # Lookup the time stamp for this client/sender/recipient. 790 $key = 791 lc $attr{"client_address"}."/".$attr{"sender"}."/".$attr{"recipient"}; 792 $time_stamp = read_database($key); 793 $now = time(); 794 795 # If new request, add this client/sender/recipient to the database. 796 if ($time_stamp == 0) { 797 $time_stamp = $now; 798 update_database($key, $time_stamp); 799 } 800 801 # The result can be any action that is allowed in a Postfix access(5) map. 802 # 803 # To label the mail, return ``PREPEND headername: headertext'' 804 # 805 # In case of success, return ``DUNNO'' instead of ``OK'', so that the 806 # check_policy_service restriction can be followed by other restrictions. 807 # 808 # In case of failure, return ``DEFER_IF_PERMIT optional text...'', 809 # so that mail can still be blocked by other access restrictions. 810 # 811 syslog $syslog_priority, "request age %d", $now - $time_stamp if $verbose; 812 if ($now - $time_stamp > $greylist_delay) { 813 # Update the auto-allowlist. 814 if ($auto_allowlist_threshold > 0) { 815 update_database($attr{"client_address"}, $count + 1); 816 } 817 return "dunno"; 818 } else { 819 return "defer_if_permit Service temporarily unavailable"; 820 } 821} 822</pre> 823 824</body> 825 826</html> 827
