[pfx] Re: Dynamic content filter allows for forged mails to be signed with DKIM

>>On 13.08.26 15:48, Peymaneh Nejad via Postfix-users wrote:
>>>main.cf:
>>>```
>>>smtpd_recipient_restrictions =
>>>   check_recipient_access hash:/etc/postfix/spamfilter_access,
>>>   permit_mynetworks,
>>>   permit_sasl_authenticated,
>>>   reject_unauth_destination,
>>>   check_policy_service unix:private/policy-spf
>>>```
>>>
>>>Where this is the content of /etc/postfix/spamfilter_access:
>>>```
>>>[email protected]  FILTER spamassassin:
>>>...
>>>```
>>>
>>>Now it seems that this setups allows unauthenticated and forged 
>>>mails from a nonexistent user via port 25 to be signed with a DKIM 
>>>signature by us:

>On 8/13/26 16:39, Matus UHLAR - fantomas via Postfix-users wrote:
>>Neither of these calls opendkim

On 13.08.26 18:28, Peymaneh Nejad via Postfix-users wrote:
>Sorry, I did not include that part of main.cf:
>```
>milter_default_action = accept
>milter_protocol = 6
>smtpd_milters =
>    inet:127.0.0.1:12301 # opendkim
>    inet:127.0.0.1:8893  # opendmarc
>non_smtpd_milters = inet:localhost:12301
>```


>To me the https://www.postfix.org/FILTER_README.html suggests that the 
>"FILTER" is a "after queue" filter action, is the current placement 
>(smtpd_recipient_restriction) an issue?

the FILTER is not an issue.
The FILTER passes incoming mail to "spamassassin" service defined in 
main.cf, which is then expected to pass mail back to postfix somehow.

According to your logs, the "spamassassin" uses pickup service, which 
indicates that the mail is send via sendmail binary
Mail received locally via sendmail then connects to opendkim which signs the 
e-mail  and this is your problem.

>>And what does your spamassassin filter do?

I mean, what exactly does "sendmail" service in master.cf do?

>>Perhaps it could feed mail back to postfix on a port where opendkim does not run
>Excuse me if this is an ignorant question, but would you know how to 
>let spamassassin do that?
>
>The postfix manpage states:
>>       FILTER transport:destination
>>              After the message is queued, send the entire message through the
>>              specified  external content filter. The transport name specifies
>>              the first field of a mail  delivery  agent  definition  in  mas-
>>              ter.cf;  the  syntax of the next-hop destination is described in
>>              the manual page  of  the  corresponding  delivery  agent.   More
>>              information  about  external  content  filters is in the Postfix
>>              FILTER_README file.
>
>The spamassassin documentation does not provide any hints on its 
>usage/configuration as a "delivery agent"

spamassassin is only a mail filter, it does not receive nor deliver mail.
You need a glue application that pushed mail to spamassassin and back.
Common glue apps are amavis, spamass-milter, rspamd.

your glue application causes mail being reinjected to postfix the way it 
get's DKIM-signed.


-- 
Matus UHLAR - fantomas, [email protected] ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
It's now safe to throw off your computer.
_______________________________________________
Postfix-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]