mainly postfwd konfigurations.
This commit is contained in:
@@ -1,221 +1,229 @@
|
||||
# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
|
||||
|
||||
#======= Definitions ============
|
||||
|
||||
# Match messages with an associated SASL username
|
||||
&&SASL_AUTH {
|
||||
sasl_username!~^$
|
||||
}
|
||||
|
||||
# Trusted networks
|
||||
&&TRUSTED_NETS {
|
||||
client_address==file:/etc/postfix/postfwd.wl-nets
|
||||
}
|
||||
|
||||
# Trusted hostnames
|
||||
# client_name~=.warenform.de$
|
||||
&&TRUSTED_HOSTS {
|
||||
client_name=~file:/etc/postfix/postfwd.wl-hosts
|
||||
}
|
||||
|
||||
# Trusted users
|
||||
&&TRUSTED_USERS {
|
||||
sasl_username==file:/etc/postfix/postfwd.wl-user
|
||||
}
|
||||
|
||||
# Trusted senders
|
||||
&&TRUSTED_SENDERS {
|
||||
sender=~file:/etc/postfix/postfwd.wl-sender
|
||||
}
|
||||
|
||||
# Blacklist networks
|
||||
&&BLOCK_NETS {
|
||||
client_address==file:/etc/postfix/postfwd.bl-nets
|
||||
}
|
||||
|
||||
# Blacklist hostnames
|
||||
&&BLOCK_HOSTS {
|
||||
client_name=~file:/etc/postfix/postfwd.bl-hosts
|
||||
}
|
||||
|
||||
# Blacklist users
|
||||
&&BLOCK_USERS {
|
||||
sasl_username==file:/etc/postfix/postfwd.bl-user
|
||||
}
|
||||
|
||||
# Blacklist sender adresses
|
||||
&&BLOCK_SENDER {
|
||||
# =~
|
||||
# using '=~' allows also matching entries for domains (i.e. @acieu.co.uk)
|
||||
sender=~file:/etc/postfix/postfwd.bl-sender
|
||||
}
|
||||
|
||||
# Block messages exceedds size of 20MB
|
||||
&&BLOCK_CLIENT_NAME_MSG_SIZE_20MB {
|
||||
protocol_state==END-OF-MESSAGE
|
||||
recipient=~file:/etc/postfix/postfwd.bl-recipient-exeeds-msg-size-20mb
|
||||
size=20971520
|
||||
}
|
||||
|
||||
# Inbound emails only
|
||||
&&INCOMING {
|
||||
client_address!=127.0.0.1
|
||||
}
|
||||
|
||||
|
||||
#======= Rule Sets ============
|
||||
|
||||
# ---
|
||||
#
|
||||
# Processing of the Rule Sets
|
||||
# Statische Vorlage fuer postfwd 1.35, ohne Jinja-Variablen.
|
||||
#
|
||||
# The parser checks the elements of a policy delegation request against the postfwd set
|
||||
# of rules and, if necessary, triggers the configured action (action=). Similar to a
|
||||
# classic firewall, a rule is considered true if every element of the set of rules (or
|
||||
# one from every element list) applies to the comparison. I.e. the following rule:
|
||||
# POSTFIX-EINBINDUNG
|
||||
# main.cf: smtpd_end_of_data_restrictions =
|
||||
# check_policy_service inet:127.0.0.1:10040
|
||||
# Amavis-Rueckgabeport localhost:10025 in master.cf:
|
||||
# -o smtpd_end_of_data_restrictions=
|
||||
# Sonst kann die Wiedereinlieferung mit XFORWARD erneut gezaehlt werden.
|
||||
# /etc/default/postfwd: ARGS="--summary=600 --cache=0"
|
||||
#
|
||||
# client_address=1.1.1.1, 1.1.1.2; client_name==unknown; action=REJECT
|
||||
# AUSWERTUNG
|
||||
# Verschiedene Attribute einer Regel: UND. Gleiches Attribut mehrfach: ODER.
|
||||
# DUNNO beendet diesen postfwd-Aufruf; Postfix setzt eigene Pruefungen fort.
|
||||
# REJECT lehnt permanent, 450 temporaer ab. rate()/rcpt() laufen unterhalb
|
||||
# des Limits weiter. jump(ID) springt zur bezeichneten Regel.
|
||||
# final=yes ist keine Steueranweisung und wird NICHT verwendet.
|
||||
#
|
||||
# triggers a REJECT if the
|
||||
# LIMITS (fuer nicht vollstaendig freigestellte, nicht lokale SMTP-Clients)
|
||||
#
|
||||
# Client address is equal (1.1.1.1 OR 1.1.1.2) AND the client name 'unknown'
|
||||
# +--------------------------------+-----------+-----------+------------------+
|
||||
# | Limit | Standard | Benutzer | Benutzer nur in |
|
||||
# | | | 500er- | Empfaenger- |
|
||||
# | | | Liste | Ausnahmeliste |
|
||||
# +--------------------------------+-----------+-----------+------------------+
|
||||
# | Nachrichten / Stunde / Benutzer| 50 | 500 | 50 |
|
||||
# | Empfaenger / Stunde / Benutzer| 250 | 1000 | 1000 |
|
||||
# | Empfaenger / Nachricht | 89 | 89 | 89 |
|
||||
# +--------------------------------+-----------+-----------+------------------+
|
||||
#
|
||||
# Zusaetzlich fuer alle oben genannten Benutzer:
|
||||
#
|
||||
# +------------------------------------------+----------------------------+
|
||||
# | Client-IP | Nachrichten / Minute / IP |
|
||||
# +------------------------------------------+----------------------------+
|
||||
# | Weder IP noch Hostname in Ausnahmeliste | 50 |
|
||||
# | IP ODER Hostname in Ausnahmeliste | 100 |
|
||||
# +------------------------------------------+----------------------------+
|
||||
#
|
||||
# Zusaetzlich fuer nicht authentifizierte Clients:
|
||||
#
|
||||
# +------------------------------------------+----------------------------+
|
||||
# | client_name = unknown | 5 Nachrichten / 5 Minuten |
|
||||
# | | je Client-IP |
|
||||
# +------------------------------------------+----------------------------+
|
||||
#
|
||||
# Unauthentifiziert + client_name=unknown: 5 Nachrichten / 300 Sekunden / IP.
|
||||
# SASL: 50 Nachrichten / 3600 Sekunden / Benutzer; Ausnahme: 500.
|
||||
# IP: 50 Nachrichten / 60 Sekunden; Ausnahme ueber IP ODER Hostname: 100.
|
||||
# SASL: maximal 89 Empfaenger pro Nachricht (Ablehnung ab 90).
|
||||
# SASL: 250 Empfaenger / 3600 Sekunden; Ausnahme: 1000.
|
||||
# Jeder Benutzer der 500er-Nachrichtenliste bekommt auch die 1000er-
|
||||
# Empfaengerausnahme. Die separate Empfaengerliste erlaubt nur 1000 statt
|
||||
# 250 Empfaenger/Stunde, erhoeht aber nicht das Nachrichtenlimit.
|
||||
# Benutzer der 500er-Nachrichtenliste sind vom IP-Minutenlimit (50 bzw.
|
||||
# 100 Nachrichten / 60 Sekunden) ausgenommen: sie versenden meist
|
||||
# automatisiert in Schueben und wuerden sonst trotz 500er-Ausnahme am
|
||||
# Minutenlimit haengen bleiben. Fuer alle anderen bleibt das Minutenlimit
|
||||
# aktiv. Die Empfaengerzahl pro Nachricht (max. 89) gilt fuer alle.
|
||||
#
|
||||
# Note:
|
||||
# If an element occurs more than once, an element list is formed:
|
||||
# ZAEHLWEISE
|
||||
# rate() zaehlt END-OF-MESSAGE-Anfragen, rcpt() addiert recipient_count.
|
||||
# Es sind Versandversuche, keine bestaetigten Zustellungen. Wiederholungen
|
||||
# und spaeter abgelehnte Versuche koennen mitgezaehlt werden. Empfaenger
|
||||
# werden aufsummiert, nicht dedupliziert. Kein gleitendes Kalenderstunden-
|
||||
# budget: postfwd verwaltet befristete Zaehler ab ihrer Anlage.
|
||||
# Gemeinsame IPs teilen sich das Minutenlimit, auch bei mehreren Benutzern.
|
||||
#
|
||||
# The following rule set is equivalent to the above:
|
||||
#
|
||||
# client_address=1.1.1.1; client_address=1.1.1.2; client_name==unknown; action=REJECT
|
||||
#
|
||||
#
|
||||
# triggers a REJECT if (as above) the
|
||||
#
|
||||
# Client address (1.1.1.1 OR 1.1.1.2) AND the client name 'unknown'
|
||||
#
|
||||
# ---
|
||||
# DATEIEN
|
||||
# file: liest Listen beim Laden der Konfiguration. Danach neu laden/starten.
|
||||
# Fuer IPs/Netze: client_address==file:... (CIDR-Vergleich).
|
||||
# Fuer SASL: sasl_username==file:... (exakte Namen, keine Regex).
|
||||
# Fuer Namen/Adressen: =~file:... (Perl-Regex, keine Postfix-pcre:-Tabelle).
|
||||
# Alle referenzierten Dateien muessen fuer den Benutzer postfw lesbar sein.
|
||||
# Keine Ausnahmeliste mit &&SASL_AUTH in derselben Regel kombinieren:
|
||||
# das waere eine ODER-Verknuepfung auf sasl_username!
|
||||
|
||||
# Whitelists
|
||||
# Nur diese Phase verwenden; keine Zaehleranlage in anderen SMTP-Phasen.
|
||||
id=CHECK_PHASE
|
||||
protocol_state!=END-OF-MESSAGE
|
||||
action=DUNNO
|
||||
|
||||
# Whitelist trusted networks
|
||||
# Lokaler SMTP-Verkehr wird ausgenommen, IPv4-Loopback und IPv6-Loopback.
|
||||
# Dies ersetzt NICHT die Abschaltung am Amavis-Rueckgabeport: XFORWARD
|
||||
# kann dort die urspruengliche externe Clientadresse wiederherstellen.
|
||||
id=SKIP_LOOPBACK
|
||||
client_address==127.0.0.0/8, ::1
|
||||
action=DUNNO
|
||||
|
||||
# 1. VOLLSTAENDIGE AUSNAHMEN
|
||||
# Bewusst vor den Sperrlisten wie in der bisherigen Konfiguration.
|
||||
# Diese Listen umgehen ALLE folgenden postfwd-Regeln, auch Blacklists.
|
||||
# Fuer nur hoehere Versandlimits ausschliesslich die high-rate-Listen nutzen.
|
||||
id=WHL_NETS
|
||||
&&TRUSTED_NETS
|
||||
action=DUNNO
|
||||
client_address==file:/etc/postfix/postfwd.wl-nets
|
||||
action=DUNNO
|
||||
|
||||
# Whitelist trusted hostnames
|
||||
id=WHL_HOSTS
|
||||
&&TRUSTED_HOSTS
|
||||
action=DUNNO
|
||||
client_name=~file:/etc/postfix/postfwd.wl-hosts
|
||||
action=DUNNO
|
||||
|
||||
# Whitelist sasl users
|
||||
id=WHL_USERS
|
||||
&&TRUSTED_USERS
|
||||
action=DUNNO
|
||||
sasl_username==file:/etc/postfix/postfwd.wl-user
|
||||
action=DUNNO
|
||||
|
||||
# Whitelist senders
|
||||
# Achtung: Envelope-Absender ist keine authentifizierte Identitaet.
|
||||
# Bestehende Freistellung bleibt erhalten; kein SPF-/DKIM-Nachweis hier.
|
||||
id=WHL_SENDERS
|
||||
&&INCOMING
|
||||
&&TRUSTED_SENDERS
|
||||
action=DUNNO
|
||||
sender=~file:/etc/postfix/postfwd.wl-sender
|
||||
action=DUNNO
|
||||
|
||||
|
||||
# Blacklists
|
||||
|
||||
# Block networks
|
||||
# 2. SPERRLISTEN: permanente Ablehnung, kein stilles DISCARD.
|
||||
id=BL_NETS
|
||||
&&BLOCK_NETS
|
||||
action=REJECT Network Address $$client_address blocked by Mailserver admins. Error: BL_NETS
|
||||
client_address==file:/etc/postfix/postfwd.bl-nets
|
||||
action=REJECT Network $$client_address blocked by mailserver admins. Error:BL_NETS
|
||||
|
||||
# Block hostname
|
||||
id=BL_HOSTS
|
||||
&&BLOCK_HOSTS
|
||||
action=REJECT $$client_name blocked by Mailserver admins. Error: BL_HOSTS
|
||||
client_name=~file:/etc/postfix/postfwd.bl-hosts
|
||||
action=REJECT Client $$client_name blocked by mailserver admins. Error:BL_HOSTS
|
||||
|
||||
# Block users
|
||||
id=BL_USERS
|
||||
&&BLOCK_USERS
|
||||
action=REJECT User is blocked by Mailserver admins. Error: BL_USERS
|
||||
sasl_username==file:/etc/postfix/postfwd.bl-user
|
||||
action=REJECT User blocked by mailserver admins. Error:BL_USERS
|
||||
|
||||
# Blacklist sender
|
||||
#
|
||||
# Claim successful delivery and silently discard the message.
|
||||
#
|
||||
id=BL_SENDER
|
||||
&&BLOCK_SENDER
|
||||
#action=DISCARD
|
||||
action=REJECT Sender address is blocked by Mailserver admins. Error: BL_SENDER
|
||||
sender=~file:/etc/postfix/postfwd.bl-sender
|
||||
action=REJECT Sender blocked by mailserver admins. Error:BL_SENDER
|
||||
|
||||
|
||||
# Block messages for given recipients exceeds size of 20 MB
|
||||
# 3. EMPFAENGERBEZOGENE GROESSE, NUR BEI GENAU EINEM EMPFAENGER
|
||||
# 20 MiB = 20971520 Bytes; mit > bleibt genau dieser Wert erlaubt.
|
||||
# Postfix liefert recipient am Nachrichtenende nur bei einem Empfaenger.
|
||||
# Bei mehreren Empfaengern kann diese Regel KEIN Limit durchsetzen.
|
||||
# Die bisher leere Empfaengerliste bleibt erhalten; solange sie leer ist,
|
||||
# ist diese Zusatzpruefung inaktiv. Global gilt weiter message_size_limit.
|
||||
# Fuer verbindliche empfaengerbezogene Limits auch bei Mehrfachadressierung
|
||||
# ist eine andere Loesung, z.B. ein geeigneter Milter, erforderlich.
|
||||
id=BLOCK_MSG_SIZE_20MB
|
||||
&&BLOCK_CLIENT_NAME_MSG_SIZE_20MB
|
||||
action=REJECT message exceeds the size of 20 MB ($$size). Error: BLOCK_MSG_SIZE_20MB
|
||||
recipient_count==1
|
||||
recipient=~file:/etc/postfix/postfwd.bl-recipient-exeeds-msg-size-20mb
|
||||
size>20971520
|
||||
action=REJECT Message exceeds 20 MiB ($$size bytes). Error:BLOCK_MSG_SIZE_20MB
|
||||
|
||||
|
||||
# Rate Limits
|
||||
|
||||
# Throttle unknown clients to 5 recipients per 5 minutes:
|
||||
id=RATE_UNKNOWN_CLIENT_ADDR
|
||||
sasl_username =~ /^$/
|
||||
client_name==unknown
|
||||
action=rate(client_address/5/300/450 4.7.1 only 5 recipients per 5 minutes allowed)
|
||||
|
||||
# Ausnahme vom 50/Minute-Limit: IPs aus der Whitelist-Datei
|
||||
# duerfen bis zu 100 Nachrichten/Minute senden. 'final=yes'
|
||||
# sorgt dafuer, dass fuer diese IPs die nachfolgende
|
||||
# RATE_CLIENT_ADDR-Regel NICHT mehr zusaetzlich ausgewertet wird.
|
||||
id=HIGH_RATE_CLIENT_ADDR
|
||||
&&INCOMING
|
||||
client_address=cidr:/etc/postfix/postfwd.high_rate_ip
|
||||
action=rate($$client_address/100/60/421 421 4.7.0 Too many connections (150/m) from $$client_address)
|
||||
final=yes
|
||||
|
||||
# Ausnahme vom 50/Minute-Limit auf Basis des Client-Hostnamens
|
||||
# (Reverse-DNS/PTR). 'final=yes' verhindert die zusaetzliche
|
||||
# Auswertung der nachfolgenden RATE_CLIENT_ADDR-Regel.
|
||||
id=HIGH_RATE_CLIENT_NAME
|
||||
&&INCOMING
|
||||
client_name=pcre:/etc/postfix/postfwd.high_rate_hostname
|
||||
action=rate($$client_address/100/60/421 421 4.7.0 Too many connections (150/m) from $$client_address ($$client_name))
|
||||
final=yes
|
||||
|
||||
# Block clients (ip-addresses) sending more than 50 messages per minute exceeded. Error:RATE_CLIENT)
|
||||
id=RATE_CLIENT_ADDR
|
||||
&&INCOMING
|
||||
action=rate($$client_address/50/60/421 421 4.7.0 Too many connections (50/m) from $$client_address)
|
||||
|
||||
# Block messages with more than 50 recipients
|
||||
# Permanente Empfaengerzahl-Pruefung vor die Rate-Zaehler stellen.
|
||||
# Das bisher wirksame Limit bleibt erhalten: 89 erlaubt, ab 90 ablehnen.
|
||||
id=BLOCK_MSG_RCPT
|
||||
&&INCOMING
|
||||
&&SASL_AUTH
|
||||
recipient_count=90
|
||||
action=REJECT Too many recipients, please reduce to less than 90 or consider using a mailing list. Error: BLOCK_MSG_RCPT
|
||||
sasl_username!~^$
|
||||
recipient_count=>90
|
||||
action=REJECT Too many recipients, maximum is 89 per message. Error:BLOCK_MSG_RCPT
|
||||
|
||||
# Higher rate limit for users in exception list (limit: 500 messages/hour)
|
||||
id=RATE_MSG_EXCEPTION
|
||||
&&INCOMING
|
||||
&&SASL_AUTH
|
||||
# 4. UNBEKANNTE, UNAUTHENTIFIZIERTE CLIENTS
|
||||
# 5 Nachrichten, NICHT 5 Empfaenger oder 5 TCP-Verbindungen.
|
||||
id=RATE_UNKNOWN_CLIENT_ADDR
|
||||
sasl_username=~^$
|
||||
client_name==unknown
|
||||
action=rate(client_address/5/300/450 4.7.1 Only 5 messages per 5 minutes allowed. Error:RATE_UNKNOWN_CLIENT_ADDR)
|
||||
|
||||
# 5. NACHRICHTEN PRO STUNDE UND SASL-BENUTZER
|
||||
# Auswahl VOR dem Zaehlen. Die Ausnahme springt an der 50er-Regel vorbei.
|
||||
# Unterhalb 500 wird nach RATE_MSG_EXCEPTION direkt mit der Empfaenger-
|
||||
# summe (Abschnitt 7) fortgesetzt; die IP-Minutenlimits entfallen bewusst.
|
||||
id=SELECT_MSG_EXCEPTION
|
||||
sasl_username==file:/etc/postfix/postfwd.high-rate-number-messages
|
||||
action=rate($$sasl_username/500/3600/450 4.7.1 Number messages per hour exceeded. Error:RATE_MSG_EXCEPTION)
|
||||
final=yes
|
||||
action=jump(RATE_MSG_EXCEPTION)
|
||||
|
||||
# Block users sending more than 50 messages/hour
|
||||
id=RATE_MSG
|
||||
&&INCOMING
|
||||
&&SASL_AUTH
|
||||
action=rate($$sasl_username/50/3600/450 4.7.1 Number messages per hour exceeded. Error:RATE_MSG)
|
||||
sasl_username!~^$
|
||||
action=rate(sasl_username/50/3600/450 4.7.1 Maximum 50 messages per hour exceeded. Error:RATE_MSG)
|
||||
|
||||
# Higher recipient rate limit for specific users from file (limit: 1000 recipients total/hour)
|
||||
id=RATE_RCPT_HIGH
|
||||
&&INCOMING
|
||||
&&SASL_AUTH
|
||||
sasl_username==file:/etc/postfix/postfwd.rate-msg-exceptions
|
||||
action=rcpt($$sasl_username/1000/3600/450 4.7.1 Number recipients per hour exceeded. Error:RATE_RCPT_HIGH)
|
||||
final=yes
|
||||
# Standardpfad muss die nachfolgende 500er-Regel ueberspringen.
|
||||
id=AFTER_RATE_MSG
|
||||
action=jump(SELECT_HIGH_RATE_IP)
|
||||
|
||||
id=RATE_MSG_EXCEPTION
|
||||
sasl_username!~^$
|
||||
action=rate(sasl_username/500/3600/450 4.7.1 Maximum 500 messages per hour exceeded. Error:RATE_MSG_EXCEPTION)
|
||||
|
||||
# Nach erfolgreicher 500er-Pruefung die IP-Minutenlimits (Abschnitt 6)
|
||||
# bewusst ueberspringen: automatisierte Versender wuerden sonst am
|
||||
# Minutenlimit scheitern. Empfaengerlimit pro Stunde weiterhin pruefen.
|
||||
id=AFTER_RATE_MSG_EXCEPTION
|
||||
action=jump(SELECT_RCPT_EXCEPTION_MSG)
|
||||
|
||||
# 6. NACHRICHTEN PRO MINUTE UND IP
|
||||
# IP oder Hostname waehlen denselben 100er-Zaehler. Auch bei zwei Treffern
|
||||
# nur eine Zaehlung. Hostname ist der von Postfix gelieferte client_name;
|
||||
# nicht identisch mit einem ungeprueften HELO oder bloss irgendeinem PTR.
|
||||
id=SELECT_HIGH_RATE_IP
|
||||
client_address==file:/etc/postfix/postfwd.high_rate_ip
|
||||
action=jump(HIGH_RATE_CLIENT_ADDR)
|
||||
|
||||
id=SELECT_HIGH_RATE_HOST
|
||||
client_name=~file:/etc/postfix/postfwd.high_rate_hostname
|
||||
action=jump(HIGH_RATE_CLIENT_ADDR)
|
||||
|
||||
id=RATE_CLIENT_ADDR
|
||||
action=rate(client_address/50/60/450 4.7.1 Maximum 50 messages per minute per IP exceeded. Error:RATE_CLIENT_ADDR)
|
||||
|
||||
id=AFTER_RATE_CLIENT_ADDR
|
||||
action=jump(SELECT_RCPT_EXCEPTION_MSG)
|
||||
|
||||
id=HIGH_RATE_CLIENT_ADDR
|
||||
action=rate(client_address/100/60/450 4.7.1 Maximum 100 messages per minute per IP exceeded. Error:HIGH_RATE_CLIENT_ADDR)
|
||||
|
||||
# 7. EMPFAENGERSUMME PRO STUNDE UND SASL-BENUTZER
|
||||
# 500er-Nachrichtenausnahme erhaelt automatisch auch 1000 Empfaenger/Stunde.
|
||||
# So scheitert sie nicht nach spaetestens 250 Ein-Empfaenger-Nachrichten.
|
||||
# Die zweite Liste kann weitere Benutzer NUR fuer die Empfaengersumme nennen.
|
||||
id=SELECT_RCPT_EXCEPTION_MSG
|
||||
sasl_username==file:/etc/postfix/postfwd.high-rate-number-messages
|
||||
action=jump(RATE_RCPT_HIGH)
|
||||
|
||||
id=SELECT_RCPT_EXCEPTION_LIST
|
||||
sasl_username==file:/etc/postfix/postfwd.high-rate-number-recipients
|
||||
action=jump(RATE_RCPT_HIGH)
|
||||
|
||||
# Block users sending more than 250 recipients total/hour
|
||||
id=RATE_RCPT
|
||||
&&INCOMING
|
||||
&&SASL_AUTH
|
||||
action=rcpt($$sasl_username/250/3600/450 4.7.1 Number recipients per hour exceeded. Error:RATE_RCPT)
|
||||
sasl_username!~^$
|
||||
action=rcpt(sasl_username/250/3600/450 4.7.1 Maximum 250 recipients per hour exceeded. Error:RATE_RCPT)
|
||||
|
||||
id=AFTER_RATE_RCPT
|
||||
action=jump(END)
|
||||
|
||||
id=RATE_RCPT_HIGH
|
||||
sasl_username!~^$
|
||||
action=rcpt(sasl_username/1000/3600/450 4.7.1 Maximum 1000 recipients per hour exceeded. Error:RATE_RCPT_HIGH)
|
||||
|
||||
id=END
|
||||
action=DUNNO
|
||||
|
||||
Reference in New Issue
Block a user