141fbaed0Stron<!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" 241fbaed0Stron "http://www.w3.org/TR/html4/loose.dtd"> 341fbaed0Stron 441fbaed0Stron<html> 541fbaed0Stron 641fbaed0Stron<head> 741fbaed0Stron 841fbaed0Stron<title>Postfix Stress-Dependent Configuration</title> 941fbaed0Stron 104a672054Schristos<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> 11*059c16a8Schristos<link rel='stylesheet' type='text/css' href='postfix-doc.css'> 1241fbaed0Stron 1341fbaed0Stron</head> 1441fbaed0Stron 1541fbaed0Stron<body> 1641fbaed0Stron 1741fbaed0Stron<h1><img src="postfix-logo.jpg" width="203" height="98" ALT="">Postfix 1841fbaed0StronStress-Dependent Configuration</h1> 1941fbaed0Stron 2041fbaed0Stron<hr> 2141fbaed0Stron 2241fbaed0Stron<h2>Overview </h2> 2341fbaed0Stron 2441fbaed0Stron<p> This document describes the symptoms of Postfix SMTP server 2541fbaed0Stronoverload. It presents permanent <a href="postconf.5.html">main.cf</a> changes to avoid overload 2641fbaed0Stronduring normal operation, and temporary <a href="postconf.5.html">main.cf</a> changes to cope with 2741fbaed0Stronan unexpected burst of mail. This document makes specific suggestions 2841fbaed0Stronfor Postfix 2.5 and later which support stress-adaptive behavior, 2941fbaed0Stronand for earlier Postfix versions that don't. </p> 3041fbaed0Stron 3141fbaed0Stron<p> Topics covered in this document: </p> 3241fbaed0Stron 3341fbaed0Stron<ul> 3441fbaed0Stron 3541fbaed0Stron<li><a href="#overload"> Symptoms of Postfix SMTP server overload </a> 3641fbaed0Stron 3716d67a18Stron<li><a href="#adapt"> Automatic stress-adaptive behavior </a> 3816d67a18Stron 3941fbaed0Stron<li><a href="#concurrency"> Service more SMTP clients at the same time </a> 4041fbaed0Stron 4141fbaed0Stron<li><a href="#time"> Spend less time per SMTP client </a> 4241fbaed0Stron 4341fbaed0Stron<li><a href="#hangup"> Disconnect suspicious SMTP clients </a> 4441fbaed0Stron 4541fbaed0Stron<li><a href="#legacy"> Temporary measures for older Postfix releases </a> 4641fbaed0Stron 4741fbaed0Stron<li><a href="#feature"> Detecting support for stress-adaptive behavior </a> 4841fbaed0Stron 4941fbaed0Stron<li><a href="#forcing"> Forcing stress-adaptive behavior on or off </a> 5041fbaed0Stron 5141fbaed0Stron<li><a href="#other"> Other measures to off-load zombies </a> 5241fbaed0Stron 5341fbaed0Stron<li><a href="#credits"> Credits </a> 5441fbaed0Stron 5541fbaed0Stron</ul> 5641fbaed0Stron 5741fbaed0Stron<h2><a name="overload"> Symptoms of Postfix SMTP server overload </a></h2> 5841fbaed0Stron 5941fbaed0Stron<p> Under normal conditions, the Postfix SMTP server responds 6041fbaed0Stronimmediately when an SMTP client connects to it; the time to deliver 6141fbaed0Stronmail is noticeable only with large messages. Performance degrades 6241fbaed0Strondramatically when the number of SMTP clients exceeds the number of 6341fbaed0StronPostfix SMTP server processes. When an SMTP client connects while 6441fbaed0Stronall Postfix SMTP server processes are busy, the client must wait 6541fbaed0Stronuntil a server process becomes available. </p> 6641fbaed0Stron 6741fbaed0Stron<p> SMTP server overload may be caused by a surge of legitimate 6841fbaed0Stronmail (example: a DNS registrar opens a new zone for registrations), 6941fbaed0Stronby mistake (mail explosion caused by a forwarding loop) or by malice 7041fbaed0Stron(worm outbreak, botnet, or other illegitimate activity). </p> 7141fbaed0Stron 7241fbaed0Stron<p> Symptoms of Postfix SMTP server overload are: </p> 7341fbaed0Stron 7441fbaed0Stron<ul> 7541fbaed0Stron 7641fbaed0Stron<li> <p> Remote SMTP clients experience a long delay before Postfix 7741fbaed0Stronsends the "220 hostname.example.com ESMTP Postfix" greeting. </p> 7841fbaed0Stron 7941fbaed0Stron<ul> 8041fbaed0Stron 8141fbaed0Stron<li> <p> NOTE: Broken DNS configurations can also cause lengthy 8241fbaed0Strondelays before Postfix sends "220 hostname.example.com ...". These 8341fbaed0Strondelays also exist when Postfix is NOT overloaded. </p> 8441fbaed0Stron 8541fbaed0Stron<li> <p> NOTE: To avoid "overload" delays for end-user mail 8641fbaed0Stronclients, enable the "submission" service entry in <a href="master.5.html">master.cf</a> (present 8741fbaed0Stronsince Postfix 2.1), and tell users to connect to this instead of 8841fbaed0Stronthe public SMTP service. </p> 8941fbaed0Stron 9041fbaed0Stron</ul> 9141fbaed0Stron 9241fbaed0Stron<li> <p> The Postfix SMTP server logs an increased number of "lost 9341fbaed0Stronconnection after CONNECT" events. This happens because remote SMTP 9441fbaed0Stronclients disconnect before Postfix answers the connection. </p> 9541fbaed0Stron 9641fbaed0Stron<ul> 9741fbaed0Stron 9841fbaed0Stron<li> <p> NOTE: A portscan for open SMTP ports can also result in 9941fbaed0Stron"lost connection ..." logfile messages. </p> 10041fbaed0Stron 10141fbaed0Stron</ul> 10241fbaed0Stron 10341fbaed0Stron<li> <p> Postfix 2.3 and later logs a warning that all server ports 10441fbaed0Stronare busy: </p> 10541fbaed0Stron 10641fbaed0Stron<pre> 10741fbaed0StronOct 3 20:39:27 spike postfix/master[28905]: warning: service "smtp" 10841fbaed0Stron (25) has reached its process limit "30": new clients may experience 10941fbaed0Stron noticeable delays 11041fbaed0StronOct 3 20:39:27 spike postfix/master[28905]: warning: to avoid this 11141fbaed0Stron condition, increase the process count in <a href="master.5.html">master.cf</a> or reduce the 11241fbaed0Stron service time per client 11316d67a18StronOct 3 20:39:27 spike postfix/master[28905]: warning: see 11416d67a18Stron <a href="http://www.postfix.org/STRESS_README.html">http://www.postfix.org/STRESS_README.html</a> for examples of 11516d67a18Stron stress-adapting configuration settings 11641fbaed0Stron</pre> 11741fbaed0Stron 11841fbaed0Stron</ul> 11941fbaed0Stron 12041fbaed0Stron<p> Legitimate mail that doesn't get through during an episode of 12141fbaed0StronPostfix SMTP server overload is not necessarily lost. It should 12241fbaed0Stronstill arrive once the situation returns to normal, as long as the 12341fbaed0Stronoverload condition is temporary. </p> 12441fbaed0Stron 12516d67a18Stron<h2><a name="adapt"> Automatic stress-adaptive behavior </a></h2> 12616d67a18Stron 12716d67a18Stron<p> Postfix version 2.5 introduces automatic stress-adaptive behavior. 12816d67a18StronIt works as follows. When a "public" network service such as the 12916d67a18StronSMTP server runs into an "all server ports are busy" condition, the 13016d67a18StronPostfix <a href="master.8.html">master(8)</a> daemon logs a warning, restarts the service 13116d67a18Stron(without interrupting existing network sessions), and runs the 13216d67a18Stronservice with "-o stress=yes" on the server process command line: 13316d67a18Stron</p> 13416d67a18Stron 13516d67a18Stron<blockquote> 13616d67a18Stron<pre> 13716d67a18Stron80821 ?? S 0:00.24 smtpd -n smtp -t inet -u -c -o stress=yes 13816d67a18Stron</pre> 13916d67a18Stron</blockquote> 14016d67a18Stron 14116d67a18Stron<p> Normally, the Postfix <a href="master.8.html">master(8)</a> daemon runs such a service with 14216d67a18Stron"-o stress=" on the command line (i.e. with an empty parameter 14316d67a18Stronvalue): </p> 14416d67a18Stron 14516d67a18Stron<blockquote> 14616d67a18Stron<pre> 14716d67a18Stron83326 ?? S 0:00.28 smtpd -n smtp -t inet -u -c -o stress= 14816d67a18Stron</pre> 14916d67a18Stron</blockquote> 15016d67a18Stron 151f3bc92a4Schristos<p> You won't see "-o stress" command-line parameters with services 152f3bc92a4Schristosthat have local clients only. These include services internal to 15316d67a18StronPostfix such as the queue manager, and services that listen on a 15416d67a18Stronloopback interface only, such as after-filter SMTP services. </p> 15516d67a18Stron 15616d67a18Stron<p> The "stress" parameter value is the key to making <a href="postconf.5.html">main.cf</a> 15716d67a18Stronparameter settings stress adaptive. The following settings are the 15816d67a18Strondefault with Postfix 2.6 and later. </p> 15916d67a18Stron 16016d67a18Stron<blockquote> 16116d67a18Stron<pre> 162e262b48eSchristos1 <a href="postconf.5.html#smtpd_timeout">smtpd_timeout</a> = ${stress?{10}:{300}}s 163e262b48eSchristos2 <a href="postconf.5.html#smtpd_hard_error_limit">smtpd_hard_error_limit</a> = ${stress?{1}:{20}} 164e262b48eSchristos3 <a href="postconf.5.html#smtpd_junk_command_limit">smtpd_junk_command_limit</a> = ${stress?{1}:{100}} 16516d67a18Stron4 # Parameters added after Postfix 2.6: 166e262b48eSchristos5 <a href="postconf.5.html#smtpd_per_record_deadline">smtpd_per_record_deadline</a> = ${stress?{yes}:{no}} 167e262b48eSchristos6 <a href="postconf.5.html#smtpd_starttls_timeout">smtpd_starttls_timeout</a> = ${stress?{10}:{300}}s 168e262b48eSchristos7 <a href="postconf.5.html#address_verify_poll_count">address_verify_poll_count</a> = ${stress?{1}:{3}} 16916d67a18Stron</pre> 17016d67a18Stron</blockquote> 17116d67a18Stron 172e262b48eSchristos<p> Postfix versions before 3.0 use the older form ${stress?x}${stress:y} 173e262b48eSchristosinstead of the newer form ${stress?{x}:{y}}. </p> 174e262b48eSchristos 175f3bc92a4Schristos<p> The syntax of ${name?{value}:{value}}, ${name?value} and 176f3bc92a4Schristos${name:value} is explained at the beginning of the <a href="postconf.5.html">postconf(5)</a> 177f3bc92a4Schristosmanual page. </p> 178f3bc92a4Schristos 17916d67a18Stron<p> Translation: <p> 18016d67a18Stron 18116d67a18Stron<ul> 18216d67a18Stron 18316d67a18Stron<li> <p> Line 1: under conditions of stress, use an <a href="postconf.5.html#smtpd_timeout">smtpd_timeout</a> 18416d67a18Stronvalue of 10 seconds instead of the default 300 seconds. Experience 18516d67a18Stronon the postfix-users list from a variety of sysadmins shows that 18616d67a18Stronreducing the "normal" <a href="postconf.5.html#smtpd_timeout">smtpd_timeout</a> to 60s is unlikely to affect 18716d67a18Stronlegitimate clients. However, it is unlikely to become the Postfix 18816d67a18Strondefault because it's not RFC compliant. Setting <a href="postconf.5.html#smtpd_timeout">smtpd_timeout</a> to 18916d67a18Stron10s or even 5s under stress will still allow most 19016d67a18Stronlegitimate clients to connect and send mail, but may delay mail 19116d67a18Stronfrom some clients. No mail should be lost, as long as this measure 19216d67a18Stronis used only temporarily. </p> 19316d67a18Stron 19416d67a18Stron<li> <p> Line 2: under conditions of stress, use an <a href="postconf.5.html#smtpd_hard_error_limit">smtpd_hard_error_limit</a> 195f3bc92a4Schristosof 1 instead of the default 20. This disconnects clients 19616d67a18Stronafter a single error, giving other clients a chance to connect. 19716d67a18StronHowever, this may cause significant delays with legitimate mail, 19816d67a18Stronsuch as a mailing list that contains a few no-longer-active user 19916d67a18Stronnames that didn't bother to unsubscribe. No mail should be lost, 20016d67a18Stronas long as this measure is used only temporarily. </p> 20116d67a18Stron 20216d67a18Stron<li> <p> Line 3: under conditions of stress, use an 20316d67a18Stron<a href="postconf.5.html#smtpd_junk_command_limit">smtpd_junk_command_limit</a> of 1 instead of the default 100. This 20416d67a18Stronprevents clients from keeping connections open by repeatedly 20516d67a18Stronsending HELO, EHLO, NOOP, RSET, VRFY or ETRN commands. </p> 20616d67a18Stron 20716d67a18Stron<li> <p> Line 5: under conditions of stress, change the behavior 20816d67a18Stronof <a href="postconf.5.html#smtpd_timeout">smtpd_timeout</a> and <a href="postconf.5.html#smtpd_starttls_timeout">smtpd_starttls_timeout</a>, from a time limit per 20916d67a18Stronread or write system call, to a time limit to send or receive a 21016d67a18Stroncomplete record (an SMTP command line, SMTP response line, SMTP 21116d67a18Stronmessage content line, or TLS protocol message). </p> 21216d67a18Stron 21316d67a18Stron<li> <p> Line 6: under conditions of stress, reduce the time limit 21416d67a18Stronfor TLS protocol handshake messages to 10 seconds, from the default 21516d67a18Stronvalue of 300 seconds. See also the <a href="postconf.5.html#smtpd_timeout">smtpd_timeout</a> discussion above. 21616d67a18Stron</p> 21716d67a18Stron 21816d67a18Stron<li> <p> Line 7: under conditions of stress, do not wait up to 6 21916d67a18Stronseconds for the completion of an address verification probe. If the 22016d67a18Stronresult is not already in the address verification cache, reply 22116d67a18Stronimmediately with $<a href="postconf.5.html#unverified_recipient_tempfail_action">unverified_recipient_tempfail_action</a> or 22216d67a18Stron$<a href="postconf.5.html#unverified_sender_tempfail_action">unverified_sender_tempfail_action</a>. No mail should be lost, as long 22316d67a18Stronas this measure is used only temporarily. </p> 22416d67a18Stron 22516d67a18Stron</ul> 22616d67a18Stron 22716d67a18Stron<p> NOTE: Please keep in mind that the stress-adaptive feature is 22816d67a18Strona fairly desperate measure to keep <b>some</b> legitimate mail 22916d67a18Stronflowing under overload conditions. If a site is reaching the SMTP 23016d67a18Stronserver process limit when there isn't an attack or bot flood 23116d67a18Stronoccurring, then either the process limit needs to be raised or more 23216d67a18Stronhardware needs to be added. </p> 23316d67a18Stron 23441fbaed0Stron<h2><a name="concurrency"> Service more SMTP clients at the same time </a> </h2> 23541fbaed0Stron 23616d67a18Stron<p> This section and the ones that follow discuss permanent measures 23716d67a18Stronagainst mail server overload. </p> 23816d67a18Stron 23941fbaed0Stron<p> One measure to avoid the "all server processes busy" condition 24041fbaed0Stronis to service more SMTP clients simultaneously. For this you need 24141fbaed0Stronto increase the number of Postfix SMTP server processes. This will 24241fbaed0Stronimprove the 24341fbaed0Stronresponsiveness for remote SMTP clients, as long as the server machine 24441fbaed0Stronhas enough hardware and software resources to run the additional 24541fbaed0Stronprocesses, and as long as the file system can keep up with the 24641fbaed0Stronadditional load. </p> 24741fbaed0Stron 24841fbaed0Stron<ul> 24941fbaed0Stron 25041fbaed0Stron<li> <p> You increase the number of SMTP server processes either 25141fbaed0Stronby increasing the <a href="postconf.5.html#default_process_limit">default_process_limit</a> in <a href="postconf.5.html">main.cf</a> (line 3 below), 25241fbaed0Stronor by increasing the SMTP server's "maxproc" field in <a href="master.5.html">master.cf</a> 25341fbaed0Stron(line 10 below). Either way, you need to issue a "postfix reload" 25441fbaed0Stroncommand to make the change effective. </p> 25541fbaed0Stron 25641fbaed0Stron<li> <p> Process limits above 1000 require Postfix version 2.4 or 25741fbaed0Stronlater, and an operating system that supports kernel-based event 25841fbaed0Stronfilters (BSD kqueue(2), Linux epoll(4), or Solaris /dev/poll). 25941fbaed0Stron</p> 26041fbaed0Stron 26141fbaed0Stron<li> <p> More processes use more memory. You can reduce the Postfix 26241fbaed0Stronmemory footprint by using <a href="CDB_README.html">cdb</a>: 26316d67a18Stronlookup tables instead of Berkeley DB's <a href="DATABASE_README.html#types">hash</a>: or <a href="DATABASE_README.html#types">btree</a>: tables. </p> 26441fbaed0Stron 26541fbaed0Stron<pre> 26641fbaed0Stron 1 /etc/postfix/<a href="postconf.5.html">main.cf</a>: 26741fbaed0Stron 2 # Raise the global process limit, 100 since Postfix 2.0. 26841fbaed0Stron 3 <a href="postconf.5.html#default_process_limit">default_process_limit</a> = 200 26941fbaed0Stron 4 27041fbaed0Stron 5 /etc/postfix/<a href="master.5.html">master.cf</a>: 27141fbaed0Stron 6 # ============================================================= 27241fbaed0Stron 7 # service type private unpriv chroot wakeup maxproc command 27341fbaed0Stron 8 # ============================================================= 27441fbaed0Stron 9 # Raise the SMTP service process limit only. 27541fbaed0Stron10 smtp inet n - n - 200 smtpd 27641fbaed0Stron</pre> 27741fbaed0Stron 27841fbaed0Stron<li> <p> NOTE: older versions of the <a href="SMTPD_POLICY_README.html">SMTPD_POLICY_README</a> document 27941fbaed0Stroncontain a mistake: they configure a fixed number of policy daemon 28041fbaed0Stronprocesses. When you raise the SMTP server's "maxproc" field in 28141fbaed0Stron<a href="master.5.html">master.cf</a>, SMTP server processes will report problems when connecting 28241fbaed0Stronto policy server processes, because there aren't enough of them. 28341fbaed0StronExamples of errors are "connection refused" or "operation timed 28441fbaed0Stronout". </p> 28541fbaed0Stron 28641fbaed0Stron<p> To fix, edit <a href="master.5.html">master.cf</a> and specify a zero "maxproc" field 28741fbaed0Stronin all policy server entries; see line 6 in the example below. 28841fbaed0StronIssue a "postfix reload" command to make the change effective. </p> 28941fbaed0Stron 29041fbaed0Stron<pre> 29141fbaed0Stron1 /etc/postfix/<a href="master.5.html">master.cf</a>: 29241fbaed0Stron2 # ============================================================= 29341fbaed0Stron3 # service type private unpriv chroot wakeup maxproc command 29441fbaed0Stron4 # ============================================================= 29541fbaed0Stron5 # Disable the policy service process limit. 29641fbaed0Stron6 policy unix - n n - 0 spawn 29741fbaed0Stron7 user=nobody argv=/some/where/policy-server 29841fbaed0Stron</pre> 29941fbaed0Stron 30041fbaed0Stron</ul> 30141fbaed0Stron 30241fbaed0Stron<h2><a name="time"> Spend less time per SMTP client </a></h2> 30341fbaed0Stron 30441fbaed0Stron<p> When increasing the number of SMTP server processes is not 30541fbaed0Stronpractical, you can improve Postfix server responsiveness by eliminating 30641fbaed0Strondelays. When Postfix spends less time per SMTP session, the same 30741fbaed0Stronnumber of SMTP server processes can service more clients in a given 30841fbaed0Stronamount of time. </p> 30941fbaed0Stron 31041fbaed0Stron<ul> 31141fbaed0Stron 31241fbaed0Stron<li> <p> Eliminate non-functional RBL lookups (blocklists that are 31341fbaed0Stronno longer in operation). These lookups can degrade performance. 31441fbaed0StronPostfix logs a warning when an RBL server does not respond. </p> 31541fbaed0Stron 31641fbaed0Stron<li> <p> Eliminate redundant RBL lookups (people often use multiple 31741fbaed0StronSpamhaus RBLs that include each other). To find out whether RBLs 31841fbaed0Stroninclude other RBLs, look up the websites that document the RBL's 31941fbaed0Stronpolicies. </p> 32041fbaed0Stron 32141fbaed0Stron<li> <p> Eliminate <a href="postconf.5.html#header_checks">header_checks</a> and <a href="postconf.5.html#body_checks">body_checks</a>, and keep just a few 32241fbaed0Stronemergency patterns to block the latest worm explosion or backscatter 32341fbaed0Stronmail. See <a href="BACKSCATTER_README.html">BACKSCATTER_README</a> for examples of the latter. 32441fbaed0Stron 32541fbaed0Stron<li> <p> Group your <a href="postconf.5.html#header_checks">header_checks</a> and <a href="postconf.5.html#body_checks">body_checks</a> patterns to avoid 32641fbaed0Stronunnecessary pattern matching operations: 32741fbaed0Stron 32841fbaed0Stron<pre> 32941fbaed0Stron 1 /etc/postfix/header_checks: 33041fbaed0Stron 2 if /^Subject:/ 33141fbaed0Stron 3 /^Subject: virus found in mail from you/ reject 33241fbaed0Stron 4 /^Subject: ..other../ reject 33341fbaed0Stron 5 endif 33441fbaed0Stron 6 33541fbaed0Stron 7 if /^Received:/ 33641fbaed0Stron 8 /^Received: from (postfix\.org) / reject forged client name in received header: $1 33741fbaed0Stron 9 /^Received: from ..other../ reject .... 33841fbaed0Stron10 endif 33941fbaed0Stron</pre> 34041fbaed0Stron 34141fbaed0Stron</ul> 34241fbaed0Stron 34341fbaed0Stron<h2><a name="hangup"> Disconnect suspicious SMTP clients </a></h2> 34441fbaed0Stron 34541fbaed0Stron<p> Under conditions of overload you can improve Postfix SMTP server 34641fbaed0Stronresponsiveness by hanging up on suspicious clients, so that other 34741fbaed0Stronclients get a chance to talk to Postfix. </p> 34841fbaed0Stron 34941fbaed0Stron<ul> 35041fbaed0Stron 35141fbaed0Stron<li> <p> Use "521" SMTP reply codes (Postfix 2.6 and later) or "421" 35241fbaed0Stron(Postfix 2.3-2.5) to hang up on clients that that match botnet-related 35341fbaed0StronRBLs (see next bullet) or that match selected non-RBL restrictions 35441fbaed0Stronsuch as SMTP access maps. The Postfix SMTP server will reject mail 35541fbaed0Stronand disconnect without waiting for the remote SMTP client to send 35641fbaed0Strona QUIT command. </p> 35741fbaed0Stron 3584a672054Schristos<li> <p> To hang up connections from denylisted zombies, you can 35941fbaed0Stronset specific Postfix SMTP server reject codes for specific RBLs, 36041fbaed0Stronand for individual responses from specific RBLs. We'll use 36141fbaed0Stronzen.spamhaus.org as an example; by the time you read this document, 36241fbaed0Strondetails may have changed. Right now, their documents say that a 36341fbaed0Stronresponse of 127.0.0.10 or 127.0.0.11 indicates a dynamic client IP 36441fbaed0Stronaddress, which means that the machine is probably running a bot of 36541fbaed0Stronsome kind. To give a 521 response instead of the default 554 36641fbaed0Stronresponse, use something like: </p> 36741fbaed0Stron 36841fbaed0Stron<pre> 36941fbaed0Stron 1 /etc/postfix/<a href="postconf.5.html">main.cf</a>: 37041fbaed0Stron 2 <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> = 37141fbaed0Stron 3 <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a> 37241fbaed0Stron 4 <a href="postconf.5.html#reject_rbl_client">reject_rbl_client</a> zen.spamhaus.org=127.0.0.10 37341fbaed0Stron 5 <a href="postconf.5.html#reject_rbl_client">reject_rbl_client</a> zen.spamhaus.org=127.0.0.11 37441fbaed0Stron 6 <a href="postconf.5.html#reject_rbl_client">reject_rbl_client</a> zen.spamhaus.org 37541fbaed0Stron 7 37616d67a18Stron 8 <a href="postconf.5.html#rbl_reply_maps">rbl_reply_maps</a> = <a href="DATABASE_README.html#types">hash</a>:/etc/postfix/rbl_reply_maps 37741fbaed0Stron 9 37841fbaed0Stron10 /etc/postfix/rbl_reply_maps: 37941fbaed0Stron11 # With Postfix 2.3-2.5 use "421" to hang up connections. 38041fbaed0Stron12 zen.spamhaus.org=127.0.0.10 521 4.7.1 Service unavailable; 38141fbaed0Stron13 $rbl_class [$rbl_what] blocked using 38241fbaed0Stron14 $rbl_domain${rbl_reason?; $rbl_reason} 38341fbaed0Stron15 38441fbaed0Stron16 zen.spamhaus.org=127.0.0.11 521 4.7.1 Service unavailable; 38541fbaed0Stron17 $rbl_class [$rbl_what] blocked using 38641fbaed0Stron18 $rbl_domain${rbl_reason?; $rbl_reason} 38741fbaed0Stron</pre> 38841fbaed0Stron 38941fbaed0Stron<p> Although the above example shows three RBL lookups (lines 4-6), 39041fbaed0StronPostfix will only do a single DNS query, so it does not affect the 39141fbaed0Stronperformance. </p> 39241fbaed0Stron 39341fbaed0Stron<li> <p> With Postfix 2.3-2.5, use reply code 421 (521 will not 39441fbaed0Stroncause Postfix to disconnect). The down-side of replying with 421 39541fbaed0Stronis that it works only for zombies and other malware. If the client 39641fbaed0Stronis running a real MTA, then it may connect again several times until 39741fbaed0Stronthe mail expires in its queue. When this is a problem, stick with 39841fbaed0Stronthe default 554 reply, and use "<a href="postconf.5.html#smtpd_hard_error_limit">smtpd_hard_error_limit</a> = 1" as 39941fbaed0Strondescribed below. </p> 40041fbaed0Stron 40141fbaed0Stron<li> <p> You can automatically turn on the above overload measure 40241fbaed0Stronwith Postfix 2.5 and later, or with earlier releases that contain 40341fbaed0Stronthe stress-adaptive behavior source code patch from the mirrors 40441fbaed0Stronlisted at <a href="http://www.postfix.org/download.html">http://www.postfix.org/download.html</a>. Simply replace line 40541fbaed0Stronabove 8 with: </p> 40641fbaed0Stron 40741fbaed0Stron<pre> 40816d67a18Stron 8 <a href="postconf.5.html#rbl_reply_maps">rbl_reply_maps</a> = ${stress?<a href="DATABASE_README.html#types">hash</a>:/etc/postfix/rbl_reply_maps} 40941fbaed0Stron</pre> 41041fbaed0Stron 41141fbaed0Stron</ul> 41241fbaed0Stron 41341fbaed0Stron<p> More information about automatic stress-adaptive behavior is 41441fbaed0Stronin section "<a href="#adapt">Automatic stress-adaptive behavior</a>". 41541fbaed0Stron</p> 41641fbaed0Stron 41741fbaed0Stron<h2><a name="legacy"> Temporary measures for older Postfix releases </a></h2> 41841fbaed0Stron 419f3bc92a4Schristos<p> See the section "<a href="#adapt">Automatic stress-adaptive 420f3bc92a4Schristosbehavior</a>" if you are running Postfix version 2.5 or later, or 42141fbaed0Stronif you have applied the source code patch for stress-adaptive 42241fbaed0Stronbehavior from the mirrors listed at <a href="http://www.postfix.org/download.html">http://www.postfix.org/download.html</a>. 42341fbaed0Stron</p> 42441fbaed0Stron 42541fbaed0Stron<p> The following measures can be applied temporarily during overload. 42641fbaed0StronThey still allow <b>most</b> legitimate clients to connect and send 42741fbaed0Stronmail, but may affect some legitimate clients. </p> 42841fbaed0Stron 42941fbaed0Stron<ul> 43041fbaed0Stron 43141fbaed0Stron<li> <p> Reduce <a href="postconf.5.html#smtpd_timeout">smtpd_timeout</a> (default: 300s). Experience on the 43241fbaed0Stronpostfix-users list from a variety of sysadmins shows that reducing 43341fbaed0Stronthe "normal" <a href="postconf.5.html#smtpd_timeout">smtpd_timeout</a> to 60s is unlikely to affect legitimate 43441fbaed0Stronclients. However, it is unlikely to become the Postfix default 43541fbaed0Stronbecause it's not RFC compliant. Setting <a href="postconf.5.html#smtpd_timeout">smtpd_timeout</a> to 10s (line 43641fbaed0Stron2 below) or even 5s under stress will still allow <b>most</b> 43741fbaed0Stronlegitimate clients to connect and send mail, but may delay mail 43841fbaed0Stronfrom some clients. No mail should be lost, as long as this measure 43941fbaed0Stronis used only temporarily. </p> 44041fbaed0Stron 44141fbaed0Stron<li> <p> Reduce <a href="postconf.5.html#smtpd_hard_error_limit">smtpd_hard_error_limit</a> (default: 20). Setting this 44241fbaed0Stronto 1 under stress (line 3 below) helps by disconnecting clients 44341fbaed0Stronafter a single error, giving other clients a chance to connect. 44441fbaed0StronHowever, this may cause significant delays with legitimate mail, 44541fbaed0Stronsuch as a mailing list that contains a few no-longer-active user 44641fbaed0Stronnames that didn't bother to unsubscribe. No mail should be lost, 44741fbaed0Stronas long as this measure is used only temporarily. </p> 44841fbaed0Stron 44941fbaed0Stron<li> <p> Use an <a href="postconf.5.html#smtpd_junk_command_limit">smtpd_junk_command_limit</a> of 1 instead of the default 45041fbaed0Stron100. This prevents clients from keeping idle connections open by 45141fbaed0Stronrepeatedly sending NOOP or RSET commands. </p> 45241fbaed0Stron 45341fbaed0Stron</ul> 45441fbaed0Stron 45541fbaed0Stron<blockquote> 45641fbaed0Stron<pre> 45741fbaed0Stron1 /etc/postfix/<a href="postconf.5.html">main.cf</a>: 45841fbaed0Stron2 <a href="postconf.5.html#smtpd_timeout">smtpd_timeout</a> = 10 45941fbaed0Stron3 <a href="postconf.5.html#smtpd_hard_error_limit">smtpd_hard_error_limit</a> = 1 46041fbaed0Stron4 <a href="postconf.5.html#smtpd_junk_command_limit">smtpd_junk_command_limit</a> = 1 46141fbaed0Stron</pre> 46241fbaed0Stron</blockquote> 46341fbaed0Stron 46441fbaed0Stron<p> With these measures, no mail should be lost, as long 46541fbaed0Stronas these measures are used only temporarily. The next section of 46641fbaed0Stronthis document introduces a way to automate this process. </p> 46741fbaed0Stron 46841fbaed0Stron<h2><a name="feature"> Detecting support for stress-adaptive behavior </a></h2> 46941fbaed0Stron 47041fbaed0Stron<p> To find out if your Postfix installation supports stress-adaptive 47141fbaed0Stronbehavior, use the "ps" command, and look for the smtpd processes. 47241fbaed0StronPostfix has stress-adaptive support when you see "-o stress=" or 47341fbaed0Stron"-o stress=yes" command-line options. Remember that Postfix never 47441fbaed0Stronenables stress-adaptive behavior on servers that listen on local 47541fbaed0Stronaddresses only. </p> 47641fbaed0Stron 47741fbaed0Stron<p> The following example is for FreeBSD or Linux. On Solaris, HP-UX 47841fbaed0Stronand other System-V flavors, use "ps -ef" instead of "ps ax". </p> 47941fbaed0Stron 48041fbaed0Stron<blockquote> 48141fbaed0Stron<pre> 48241fbaed0Stron$ ps ax|grep smtpd 48341fbaed0Stron83326 ?? S 0:00.28 smtpd -n smtp -t inet -u -c -o stress= 48441fbaed0Stron84345 ?? Ss 0:00.11 /usr/bin/perl /usr/libexec/postfix/smtpd-policy.pl 48541fbaed0Stron</pre> 48641fbaed0Stron</blockquote> 48741fbaed0Stron 48841fbaed0Stron<p> You can't use <a href="postconf.1.html">postconf(1)</a> to detect stress-adaptive support. 48941fbaed0StronThe <a href="postconf.1.html">postconf(1)</a> command ignores the existence of the stress parameter 49041fbaed0Stronin <a href="postconf.5.html">main.cf</a>, because the parameter has no effect there. Command-line 49141fbaed0Stron"-o parameter" settings always take precedence over <a href="postconf.5.html">main.cf</a> parameter 49241fbaed0Stronsettings. <p> 49341fbaed0Stron 49441fbaed0Stron<p> If you configure stress-adaptive behavior in <a href="postconf.5.html">main.cf</a> when it 49541fbaed0Stronisn't supported, nothing bad will happen. The processes will run 49641fbaed0Stronas if the stress parameter always has an empty value. </p> 49741fbaed0Stron 49841fbaed0Stron<h2><a name="forcing"> Forcing stress-adaptive behavior on or off </a></h2> 49941fbaed0Stron 50041fbaed0Stron<p> You can manually force stress-adaptive behavior on, by adding 50141fbaed0Strona "-o stress=yes" command-line option in <a href="master.5.html">master.cf</a>. This can be 50241fbaed0Stronuseful for testing overrides on the SMTP service. Issue "postfix 50341fbaed0Stronreload" to make the change effective. </p> 50441fbaed0Stron 50541fbaed0Stron<p> Note: setting the stress parameter in <a href="postconf.5.html">main.cf</a> has no effect for 50641fbaed0Stronservices that accept remote connections. </p> 50741fbaed0Stron 50841fbaed0Stron<blockquote> 50941fbaed0Stron<pre> 51041fbaed0Stron1 /etc/postfix/<a href="master.5.html">master.cf</a>: 51141fbaed0Stron2 # ============================================================= 51241fbaed0Stron3 # service type private unpriv chroot wakeup maxproc command 51341fbaed0Stron4 # ============================================================= 51441fbaed0Stron5 # 51541fbaed0Stron6 smtp inet n - n - - smtpd 51641fbaed0Stron7 -o stress=yes 51741fbaed0Stron8 -o . . . 51841fbaed0Stron</pre> 51941fbaed0Stron</blockquote> 52041fbaed0Stron 52141fbaed0Stron<p> To permanently force stress-adaptive behavior off with a specific 52241fbaed0Stronservice, specify "-o stress=" on its <a href="master.5.html">master.cf</a> command line. This 52341fbaed0Stronmay be desirable for the "submission" service. Issue "postfix reload" 52441fbaed0Stronto make the change effective. </p> 52541fbaed0Stron 52641fbaed0Stron<p> Note: setting the stress parameter in <a href="postconf.5.html">main.cf</a> has no effect for 52741fbaed0Stronservices that accept remote connections. </p> 52841fbaed0Stron 52941fbaed0Stron<blockquote> 53041fbaed0Stron<pre> 53141fbaed0Stron1 /etc/postfix/<a href="master.5.html">master.cf</a>: 53241fbaed0Stron2 # ============================================================= 53341fbaed0Stron3 # service type private unpriv chroot wakeup maxproc command 53441fbaed0Stron4 # ============================================================= 53541fbaed0Stron5 # 53641fbaed0Stron6 submission inet n - n - - smtpd 53741fbaed0Stron7 -o stress= 53841fbaed0Stron8 -o . . . 53941fbaed0Stron</pre> 54041fbaed0Stron</blockquote> 54141fbaed0Stron 54241fbaed0Stron<h2><a name="other"> Other measures to off-load zombies </a> </h2> 54341fbaed0Stron 544e6ca80d4Stron<p> The <a href="postscreen.8.html">postscreen(8)</a> daemon, introduced with Postfix 2.8, provides 545e6ca80d4Stronadditional protection against mail server overload. One <a href="postscreen.8.html">postscreen(8)</a> 546e6ca80d4Stronprocess handles multiple inbound SMTP connections, and decides which 5474a672054Schristosclients may talk to a Postfix SMTP server process. By keeping 548e6ca80d4Stronspambots away, <a href="postscreen.8.html">postscreen(8)</a> leaves more SMTP server processes 549e6ca80d4Stronavailable for legitimate clients, and delays the onset of server 550e6ca80d4Stronoverload conditions. </p> 55141fbaed0Stron 55241fbaed0Stron<h2><a name="credits"> Credits </a></h2> 55341fbaed0Stron 55441fbaed0Stron<ul> 55541fbaed0Stron 55641fbaed0Stron<li> Thanks to the postfix-users mailing list members for sharing 55741fbaed0Stronearly experiences with the stress-adaptive feature. 55841fbaed0Stron 55941fbaed0Stron<li> The RBL example and several other paragraphs of text were 56041fbaed0Stronadapted from postfix-users postings by Noel Jones. 56141fbaed0Stron 56241fbaed0Stron<li> Wietse implemented stress-adaptive behavior as the smallest 56341fbaed0Stronpossible patch while he should be working on other things. 56441fbaed0Stron 56541fbaed0Stron</ul> 56641fbaed0Stron 56741fbaed0Stron</body> </html> 568
