Congifuring Postfix
-------------------
2005-07-17


Configure SMTP Relay
--------------------

This is an effective way to send out your SMTP email when you are on a dynamic IP.
(in /etc/postfix/main.cf)
Add:
relayhost = [smtp-server.example.com]


View Mail Queue
---------------
mailq


Purge SMTP Queue Immediately
----------------------------
postsuper -d ALL


Configure SPAM Control
----------------------

(in /etc/postfix/main.cf)

Add:

# SPAM helper stuff
#
# possible blacklists - sbl.spamhaus.org, relays.ordb.org, bl.spamcop.net, dnsbl.sorbs.net
smtpd_client_restrictions = reject_rbl_client sbl.spamhaus.org
smtpd_client_restrictions = reject_rbl_client relays.ordb.org
smtpd_sender_restrictions = reject_unknown_sender_domain
smtpd_helo_restrictions = reject_invalid_hostname
smtpd_helo_required = yes

Additional SPAM Control
-----------------------

--
body_checks = regexp:/etc/postfix/body_checks
(in /etc/postfix/body_checks)
/^(.*)name\=\"(.*)\.(com|pif|vbs|vbe|exe|bat|cmd|scr|lnk|vbs|js|hta|cpl)\"$/ REJECT  For security reasons we reject attachments of this type

--
header_checks = regexp:/etc/postfix/header_checks
(in /etc/postfix/header_checks)
/^Subject:.Re:.Approved/           REJECT Likely SOBIG.F Virus
/^Subject:.Re:.Details/            REJECT Likely SOBIG.F Virus
/^Subject:.Re:.Re:.My.details/     REJECT Likely SOBIG.F Virus
/^Subject:.Re:.My.details/         REJECT Likely SOBIG.F Virus
/^Subject:.Re:.Thank.you!/         REJECT Likely SOBIG.F Virus
/^Subject:.Re:.That.movie/         REJECT Likely SOBIG.F Virus
/^Subject:.Re:.Wicked.screensaver/ REJECT Likely SOBIG.F Virus
/^Subject:.Re:.Your.application/   REJECT Likely SOBIG.F Virus
/^Subject:.Your.details/           REJECT Likely SOBIG.F Virus
/^Subject:.\%RND_UC_CHAR\[2-8\]/   REJECT SPAM

#more SPAM control
smtpd_helo_required = yes
disable_vrfy_command = yes
smtpd_client_restrictions = 
					permit_mynetworks, 
					check_client_access hash:/etc/postfix/pop-before-smtp, 
#                                       reject_rbl_client rbl.maps.vix.com,
#                                       reject_rbl_client dul.maps.vix.com,
#			    		reject_rbl_client zombie.dnsbl.sorbs.net,
#	    				reject_rbl_client relays.ordb.org,
#	    				reject_rbl_client opm.blitzed.org,
#	    				reject_rbl_client list.dsbl.org,
	    				reject_rbl_client sbl.spamhaus.org,
#	    				reject_rbl_client blackholes.easynet.nl,
#	    				reject_rbl_client cbl.abuseat.org,
#					reject_rhsbl_client dsn.rfc-ignorant.org, 
					reject_unauth_pipelining
 
smtpd_sender_restrictions = 
					permit_mynetworks, 
					check_sender_access hash:/etc/postfix/pop-before-smtp, 
					reject_unknown_sender_domain, 
#                                       reject_rbl_client rbl.maps.vix.com,
#                                       reject_rbl_client dul.maps.vix.com,
#			    		reject_rbl_client zombie.dnsbl.sorbs.net,
#	    				reject_rbl_client relays.ordb.org,
#	    				reject_rbl_client opm.blitzed.org,
#	    				reject_rbl_client list.dsbl.org,
	    				reject_rbl_client sbl.spamhaus.org,
#	    				reject_rbl_client blackholes.easynet.nl,
#	    				reject_rbl_client cbl.abuseat.org,
#                                       reject_rhsbl_client dsn.rfc-ignorant.org

 

smtpd_recipient_restrictions =
			  		reject_invalid_hostname,
	    				reject_non_fqdn_hostname,
	    				reject_non_fqdn_sender,
					reject_non_fqdn_recipient,
	    				reject_unknown_sender_domain,
	    				reject_unknown_recipient_domain,
	    				reject_unauth_pipelining,
	    				permit_mynetworks,
	    				reject_unauth_destination,
#                                       reject_rbl_client rbl.maps.vix.com,
#                                       reject_rbl_client dul.maps.vix.com,
#			    		reject_rbl_client zombie.dnsbl.sorbs.net,
#	    				reject_rbl_client relays.ordb.org,
#	    				reject_rbl_client opm.blitzed.org,
#	    				reject_rbl_client list.dsbl.org,
	    				reject_rbl_client sbl.spamhaus.org,
#	    				reject_rbl_client blackholes.easynet.nl,
#	    				reject_rbl_client cbl.abuseat.org,
	    				permit


--
smtpd_client_restrictions = permit_sasl_authenticated, hash:/etc/postfix/access, reject_rbl_client sbl.spamhaus.org
(in /etc/postfix/access)
# Domains and email addresses (samples) known to send spam not already detected
trafficmagnet.net       554 UCE
breyer762@cityweb.de    554 UCE
url.com.tw              554 UCE
166.104.233             554 UCE
205.138.96.61           554 UCE
eartoaster@gmx.net      554 UCE
 
# Whoa, we're actually going to force an accept.
# Of course, they are stoopid and should fix their DNS
 
# TLG Productions, Inc.  Computer show people in Toledo
tlgpi.com               OK