[Workaround.org] Preventing backscatter with Postfix
Oliver Ladner
workaround-ml at lugh.ch
Fri Jul 30 14:50:59 CEST 2010
Quoting Dennis Guhl <guhl at ikt.de>:
>> I read http://www.postfix.org/LOCAL_RECIPIENT_README.html#change and
>> so I added this to my main.cf:
>>
>> local_recipient_maps = $virtual_mailbox_maps
>
> Why the heck did you cange your local_transport? Nothing in the
> tutorial tells you to do so.
Because I thought that section in the above URL would be related to my
setup. Obviously this isn't the case ;-(
> Tell us what you want to achieve, what does not happen the way you
> want it to happen and prove your claims. Provide the output from
> postconf -n and show the full log for one mail triggering to send
> backscatter.
OK: so I assumed there must be something wrong with my setup, because
I got listed at that RBL several times (not that I really trust them).
I learned that if someone sends spam with a faked "From:" header and
your server accepts that mail, but in a later stage (ex. amavis)
decides to bounce it, this causes DSNs to uninvolved people. I just
want to be sure my setup is correct.
One thing is coming back to my mind right now: a friend and me we
"play" backup MX for each other. Might this be a source of the
problem? Something with address verification? In our setup, I get most
of his spam, and he most of mine because of the MX priority.
# postconf -n
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
config_directory = /etc/postfix
content_filter = smtp-amavis:[127.0.0.1]:10024
delay_warning_time = 4h
disable_vrfy_command = yes
inet_interfaces = all
local_recipient_maps = $virtual_mailbox_maps
local_transport = virtual
mailbox_command = procmail -a "$EXTENSION"
mailbox_size_limit = 0
mydestination = hostname.example.org, localhost.example.org, localhost
myhostname = foo.example.org
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 x.x.x.x/xx
myorigin = /etc/mailname
readme_directory = no
receive_override_options = no_address_mappings
recipient_delimiter = +
relay_domains = $mydestination, another.ch, someother.ch
relay_recipient_maps =
relayhost =
show_user_unknown_table_name = no
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_banner = $myhostname ESMTP
smtpd_client_restrictions = sleep 5, check_client_access
hash:/etc/postfix/access, permit_mynetworks,
reject_unknown_reverse_client_hostname, permit
smtpd_delay_reject = yes
smtpd_helo_required = yes
smtpd_recipient_restrictions = permit_mynetworks,
permit_sasl_authenticated, reject_unauth_destination,
check_recipient_access hash:/etc/postfix/access, check_policy_service
unix:private/tumgreyspf, check_policy_service
inet:127.0.0.1:12525
smtpd_sasl_auth_enable = yes
smtpd_sasl_path = private/auth
smtpd_sasl_type = dovecot
smtpd_tls_auth_only = no
smtpd_tls_cert_file = /etc/ssl/certs/postfix.pem
smtpd_tls_key_file = /etc/ssl/private/postfix.pem
smtpd_tls_loglevel = 1
smtpd_tls_security_level = may
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_use_tls = yes
virtual_alias_maps =
mysql:/etc/postfix/mysql-virtual-alias-maps.cf,mysql:/etc/postfix/mysql-email2email.cf
virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual-mailbox-domains.cf
virtual_mailbox_maps = mysql:/etc/postfix/mysql-virtual-mailbox-maps.cf
virtual_transport = dovecot
Log (that's all I could find):
Jul 20 18:07:28 mail postfix/qmgr[9895]: C13CA252108: from=<>,
size=10629, nrcpt=1 (queue active)
Jul 20 18:07:28 mail postfix/smtp[19429]: C13CA252108:
to=<foo.bar at another.ch>, relay=mail.another.ch[xx.xx.xx.xx]:25,
delay=118531, delays=118530/0.03/0.34/0.12, dsn=5.1.1, status=bounced
(host mail.another.ch[xx.xx.xx.xx] said: 550 5.1.1
<foo.bar at another.ch>: Recipient address rejected: User unknown (in
reply to RCPT TO command))
> [..]
>
>> I don't think amavis is the problem, my configuration is as follows:
>
> It have nothing to do with this in the form you might belive. But ist
> *is* on of the reasons you are prone to be a source of backscatter:
>
> 1. You don't sufficiently probe for not existing accounts at the SMTP
> level.
> 2. You don't use amavis as smtp_proxy_filter and you don't forbid
> amavis to send NDRs if it can not deliver a mail.
That's exactly what I'd like to know how to achieve that.
Thanks!
More information about the Workaround-chitchat
mailing list