Volker Tanger's
W Y A E . D E
Greylisting (http://www.greylisting.org/) is a (relatively) new, resource-preserving measure against SPAM and virus mails. It raises the barrier for unwanted mails by not accepting one-shot mailings, which are common to all current virus and many SPAM injectors. It also narrows the time window for spammers before they are listed on RBLs (blacklists). Intercepting the mails early in the SMTP dialog reduces the unwanted data traffic by a few orders of magnitude.
This is a step-by-step guide on how to implement greylisting on a production Linux server (Debian 3.1 old-stable/Sarge, Debian stable/Etch or Gentoo).
apt-get install postfix-gld |
You will have to enable it by confuguring that in the /etc/default/gld file
#/etc/default/gld ENABLED=1 |
emerge gld |
make make install |
#/etc/gld.conf #------------------------------------------- PORT=2525 # port to listen to LOOPBACKONLY=1 # and only on 127.0.0.1 MAXCON=100 # max. connections MINTIME=300 # 5 minutes greylisting before accepting message LIGHTGREY=0 # do exact host match, don't accept the class C net around it WHITELIST=0 # don't do whitelisting - we use /etc/postfix/access for that ERRACCEPT=1 # fail graciously UPDATE=1 # update "last used" fields for easier maintenance SYSLOG=1 # log to syslog FACILITY=mail # as MAIL facility MESSAGE=Temporarily held back, please try again in one hour or so. ### MySQL SQLHOST=localhost SQLUSER=GREYUSERNAME SQLPASSWD=GREYPASSWORD SQLDB=GREYDATABASE ### user, pwd and db are set to "gld" by default, better change that ### unless you've installed from Debian Sarge which installs the proper ### database along with the script installation |
Then connect to mysql DB, add a database (with proper user permissions), and use the tables.sql script (within the archive) to create the needed tables. You won't need this if you've installed from Sarge archive as the setup script will take care of that.
# mysql mysql -u root -p
> use mysql;
> insert into user values ('%','GREYUSER',password('GREYPASSWORD'),
'N','N','N','N','N','N','N','N','N','N','N','N','N','N');
> insert into db values ('%','GREYDATABASE','GREYUSER',
'Y','Y','Y','Y','Y','Y','Y','Y','Y','Y');
> create database GREYDATABASE;
> use GREYDATABASE;
> source 'tables.sql';
> reload;
> quit
|
The GLD server must be started automatically else postfix will not accept any mail. While on GenToo this already comes with the archive, we'll need to set up the scripts for Debian manually. For this create /etc/init.d/gld and create a symling pointing toward it at /etc/rc2.d/S19gld - if the startup scripts are not installed automatically (*).
# /etc/init.d/gld = /etc/rc2.d/S19gld
#---------------------------------------------------
#!/bin/sh
# gld : Postfix greylist server
# config: /etc/gld.conf
case "$1" in
start)
# Start daemons.
echo -n "Starting gld: "
gld
echo
exit 0
;;
stop)
# Stop daemons.
echo -n
"Stopping gld: "
killall gld
exit 0
;;
restart)
# Stop/Start
$0 stop
sleep 1
$0 start
;;
reload)
# Reload the configuration
killall -HUP gld
exit 0
;;
*)
echo "Usage: gld {start|stop|restart|reload}"
exit 1
esac
exit 0
|
Here is the modified postfix setup, including SASL delivery, manual black-/whitelists and greylisting. You can simply copy and replace or add the corresponding parts in your original setup as needed. Make sure to remove (improper) leading spaces and comments at the end of parameter lines (*).
# snippet from /etc/postfix/main.cf
#---------------------------------------------------------------------
# delete the documenting comments at the end of all lines here!!!
# these smtpd_*_restrictions are basically included in
# smtpd_recipient_restrictions, but only that can have relaying
# restriction capabilities, thus using only that one
smtpd_helo_restrictions =
smtpd_client_restrictions =
smtpd_sender_restrictions =
# one clean, readable first-match list of restrictions
smtpd_recipient_restrictions =
permit_mynetworks, # allow local mail
permit_sasl_authenticated, # allow password auth
reject_unauth_destination, # ease load on greylisting: drop wrong domains...
reject_non_fqdn_sender, # reject forged senders
check_sender_access hash:/etc/postfix/localdomains, # reject fake local senders
check_recipient_access hash:/etc/postfix/recv_access, # check black-/whitelist
check_client_access hash:/etc/postfix/client_access, # check black-/whitelist
reject_rbl_client sbl-xbl.spamhaus.org, # check RBL
reject_rbl_client list.dsbl.org, # check RBL
reject_rbl_client relays.ordb.org # check RBL
reject_unknown_sender_domain, # reject nonexisting domains
reject_rhsbl_sender bogusmx.rfc-ignorant.org # reject domains without existing MX record
reject_unlisted_recipient, # drop unknown users BEFORE greylisting check
check_policy_service inet:127.0.0.1:2525 ### THIS is the GREYLISTING activation
# FYI: "reject_unverified_sender" is incompatible with greylisting
disable_vrfy_command = yes
|
Before reloading the postfix, check that you have included the parts below in your /etc/postfix/recv_access and /etc/postfix/client_access files - there are some broken mail servers around, that we probably do not want to blacklist accidentally.
After editing the file run postmap /etc/postfix/recv_access and reload postfix (/etc/init.d/postfix reload) (*)
# /etc/postfix/recv_access #-------------------------------------------------------- # run "postmap /etc/postfix/recv_access" after each edit ############################################################################# ##### contacting the admin(s) is always allowed ##### ##### WARNING! DARNGER, Will Robinson! DANGER! ##### If you do not filter against sender address forgery your server ##### will be an open relay to all mails sent from one of these addresses! ##### ############################################################################# postmaster@ PERMIT hostmaster@ PERMIT abuse@ PERMIT ##### WARNING! DARNGER, Will Robinson! DANGER! |
After editing the file run postmap /etc/postfix/client_access and reload postfix (/etc/init.d/postfix reload) (*)
# /etc/postfix/client_access #-------------------------------------------------------- # run "postmap /etc/postfix/client_access" after each edit ############################################################################# ############################################################################# ##### Whitelist of non-greylistable servers 2004-07-21 ##### http://cvs.puremagic.com/viewcvs/greylisting/schema/whitelist_ip.txt ############################################################################# ############################################################################# # Southwest Airlines (unique sender, no retry) 12.5.136.141 PERMIT 12.5.136.142 PERMIT # AOL (common pool) 64.12.136 PERMIT 64.12.137 PERMIT 64.12.138 PERMIT 152.163.225 PERMIT 205.188.156 PERMIT # moveon.org (unique sender per attempt) 64.124.204.39 PERMIT # collab.net (unique sender per attempt) 64.125.132.254 PERMIT # Ebay (for time critical alerts) 66.135.209 PERMIT 66.135.197 PERMIT # Yahoo Groups servers (common pool, no retry) 66.218.66 PERMIT 66.218.67 PERMIT # Joker.com email forwarding server 194.245.101.88 PERMIT # skynet.be (wierd retry pattern) 195.238.2.105 PERMIT 195.238.2.124 PERMIT 195.238.3.12 PERMIT 195.238.3.13 PERMIT # Ameritrade (no retry) 204.107.120.10 PERMIT # SecurityFocus.com (unique sender per attempt) 205.206.231 PERMIT # Prodigy - broken software that retries continually (no delay) 207.115.63 PERMIT # Amazon.com 207.171.168 PERMIT 207.171.180 PERMIT 207.171.187 PERMIT 207.171.188 PERMIT 207.171.190 PERMIT # Mysql.com (unique sender) 213.115.162.31 PERMIT # AXKit mailing list (unique sender per attempt) 217.158.50.178 PERMIT ############################################################################# #-------------------------------------------------- # Freshmeat does not retry either 66.35.250.168 PERMIT # Additional Yahoogroups 66.94.237 PERMIT 195.92.246.182 PERMIT returns.groups.yahoo.com PERMIT .scd.yahoo.com PERMIT |
Suggestions and corrections are welcome.
(*) - If you cut/copy/paste from this page, make sure to remove (improper) leading spaces from these samples. Especially Postfix configs are a bit sensitive to this!