From aca3e2b4db9bf1a427b1d2d7ef250e812947213a Mon Sep 17 00:00:00 2001 From: Michael Date: Tue, 10 Mar 2020 13:23:30 +0100 Subject: [PATCH] mail/postfix: add more antispam features (#1723) --- mail/postfix/Makefile | 2 +- mail/postfix/pkg-descr | 3 ++ .../OPNsense/Postfix/forms/general.xml | 30 +++++++++++++++++++ .../app/models/OPNsense/Postfix/General.xml | 24 +++++++++++++++ .../templates/OPNsense/Postfix/main.cf | 28 +++++++++++++++++ 5 files changed, 86 insertions(+), 1 deletion(-) diff --git a/mail/postfix/Makefile b/mail/postfix/Makefile index ca8860ddb..a86fe025c 100644 --- a/mail/postfix/Makefile +++ b/mail/postfix/Makefile @@ -1,5 +1,5 @@ PLUGIN_NAME= postfix -PLUGIN_VERSION= 1.13 +PLUGIN_VERSION= 1.14 PLUGIN_COMMENT= SMTP mail relay PLUGIN_DEPENDS= postfix-sasl PLUGIN_MAINTAINER= m.muenz@gmail.com diff --git a/mail/postfix/pkg-descr b/mail/postfix/pkg-descr index b319d4237..38f254a7d 100644 --- a/mail/postfix/pkg-descr +++ b/mail/postfix/pkg-descr @@ -6,6 +6,9 @@ is completely different. Plugin Changelog ================ +1.14 + +* Add more anti-spam features into postfix itself 1.13 diff --git a/mail/postfix/src/opnsense/mvc/app/controllers/OPNsense/Postfix/forms/general.xml b/mail/postfix/src/opnsense/mvc/app/controllers/OPNsense/Postfix/forms/general.xml index 2432b7b13..008bd8eab 100644 --- a/mail/postfix/src/opnsense/mvc/app/controllers/OPNsense/Postfix/forms/general.xml +++ b/mail/postfix/src/opnsense/mvc/app/controllers/OPNsense/Postfix/forms/general.xml @@ -150,6 +150,36 @@ true If you enable this, every entry in Recipients will be checked against. When there is no match mail will be rejected. Be aware that it does not matter if the action is "OK" or "REJECT". This setup allows you to run postfix in front of an internal system and already rejecting unsolicited mail at the border. + + general.extensive_helo_restrictions + + checkbox + + + general.extensive_sender_restrictions + + checkbox + + + general.reject_unknown_client_hostname + + checkbox + + + general.reject_non_fqdn_helo_hostname + + checkbox + + + general.reject_invalid_helo_hostname + + checkbox + + + general.reject_unknown_helo_hostname + + checkbox + general.reject_unauth_pipelining diff --git a/mail/postfix/src/opnsense/mvc/app/models/OPNsense/Postfix/General.xml b/mail/postfix/src/opnsense/mvc/app/models/OPNsense/Postfix/General.xml index e2d2a99e5..4a0bd65e4 100644 --- a/mail/postfix/src/opnsense/mvc/app/models/OPNsense/Postfix/General.xml +++ b/mail/postfix/src/opnsense/mvc/app/models/OPNsense/Postfix/General.xml @@ -111,6 +111,30 @@ 0 Y + + 0 + Y + + + 0 + Y + + + 0 + Y + + + 0 + Y + + + 0 + Y + + + 0 + Y + 1 Y diff --git a/mail/postfix/src/opnsense/service/templates/OPNsense/Postfix/main.cf b/mail/postfix/src/opnsense/service/templates/OPNsense/Postfix/main.cf index fed2225db..d74434602 100644 --- a/mail/postfix/src/opnsense/service/templates/OPNsense/Postfix/main.cf +++ b/mail/postfix/src/opnsense/service/templates/OPNsense/Postfix/main.cf @@ -134,6 +134,18 @@ relay_recipient_maps = hash:/usr/local/etc/postfix/recipient_access {% if helpers.exists('OPNsense.postfix.recipient.recipients.recipient') %} {% do smtpd_recipient_restrictions.append('check_recipient_access hash:/usr/local/etc/postfix/recipient_access') %} {% endif %} +{% if helpers.exists('OPNsense.postfix.general.reject_unknown_client_hostname') and OPNsense.postfix.general.reject_unknown_client_hostname == '1' %} +{% do smtpd_recipient_restrictions.append('reject_unknown_client_hostname') %} +{% endif %} +{% if helpers.exists('OPNsense.postfix.general.reject_non_fqdn_helo_hostname') and OPNsense.postfix.general.reject_non_fqdn_helo_hostname == '1' %} +{% do smtpd_recipient_restrictions.append('reject_non_fqdn_helo_hostname') %} +{% endif %} +{% if helpers.exists('OPNsense.postfix.general.reject_invalid_helo_hostname') and OPNsense.postfix.general.reject_invalid_helo_hostname == '1' %} +{% do smtpd_recipient_restrictions.append('reject_invalid_helo_hostname') %} +{% endif %} +{% if helpers.exists('OPNsense.postfix.general.reject_unknown_helo_hostname') and OPNsense.postfix.general.reject_unknown_helo_hostname == '1' %} +{% do smtpd_recipient_restrictions.append('reject_unknown_helo_hostname') %} +{% endif %} {% if helpers.exists('OPNsense.postfix.general.reject_unauth_pipelining') and OPNsense.postfix.general.reject_unauth_pipelining == '1' %} {% do smtpd_recipient_restrictions.append('reject_unauth_pipelining') %} {% endif %} @@ -168,6 +180,22 @@ smtpd_recipient_restrictions = {{ smtpd_recipient_restrictions | join(', ') }} smtpd_helo_required = yes +{% if helpers.exists('OPNsense.postfix.general.extensive_helo_restrictions') and OPNsense.postfix.general.extensive_helo_restrictions == '1' %} +smtpd_helo_restrictions = + permit_mynetworks, + permit_sasl_authenticated, + reject_invalid_helo_hostname, + reject_non_fqdn_hostname, + reject_unknown_hostname +{% endif %} +{% if helpers.exists('OPNsense.postfix.general.extensive_sender_restrictions') and OPNsense.postfix.general.extensive_sender_restrictions == '1' %} +smtpd_sender_restrictions = + permit_mynetworks, + permit_sasl_authenticated, + reject_unknown_reverse_client_hostname, + reject_unknown_sender_domain, + reject_non_fqdn_sender +{% endif %} syslog_facility = mail syslog_name = postfix