RE: New distro

Thats also a way for spammer to verify if the email address exists.. 

I would recommend enabling postscreen in postfix also, that stops
some scans on email adresses.  See the addition below in the mail. 

Greetz, 

Louis


> -----Oorspronkelijk bericht-----
> Van: MailScanner 
> [mailto:mailscanner-bounces+belle=bazuin.nl-qhrM8SXbD5JTOyd/[email protected]
> info] Namens Ian
> Verzonden: woensdag 9 juni 2021 10:38
> Aan: mailscanner-qhrM8SXbD5JTOyd/[email protected]
> Onderwerp: Re: New distro
> 
> On 08/06/2021 15:30, Remco Barendse wrote:
> 
> > I yet need to figure out some things. Can I forward scanned mail to 
> > exchange by putting this in /etc/postfix/transport :
> > mynicedomain.com         smtp:[10.1.0.60]
> 
> Hi,
> 
> Yes, that's exactly what I use.
> 
> If forwarding to exchange you might be interested in 'address 
> verification'*.  This allows postfix to verify an email address with 
> exchange before accepting it on the MailScanner.  Which means 
> that you 
> don't have to maintain a local list of acceptable addresses.
> 
> * http://www.postfix.org/ADDRESS_VERIFICATION_README.html
> 
> 
> Regards
> 
> Ian
> -- 
> 

Im using this for years now, on debian 8/9 and now 10, soon debian 11. :-) 

For postscreen you need (something) like this: 
/etc/postfix/postscreen_dnsbl_reply_map.pcre
# Example content 
!/^fakename\.spamhaus\.org$/         multiple DNS-based blocklists used.

# /etc/postfix/postscreen_access_list.cidr 
# Example content 
# https://mailchimp.com/about/ips/
205.201.128.0/20        permit
198.2.128.0/18          permit
148.105.0.0/16          permit

# /etc/postfix/postscreen_access_list-reject.fqrdns.pcre
see : https://github.com/stevejenkins/hardwarefreak.com-fqrdns.pcre


Add this in main.cf and please do read what postscreen is and does before you add it. 

Now, below part. you see a big list of DNSBL servers. 
so what it does, it give values to the connections, checked per RBL server.
if you hit treshold 7 then its seen as a RBL listed hosts. 
it adds and subtracts.. 

An example rejection. 
Jun  9 11:46:01 mail postfix/postscreen[126750]: DNSBL rank 10 for [94.152.193.19]:45170
Jun  9 11:46:01 mail postfix/postscreen[126750]: NOQUEUE: reject: RCPT from [94.152.193.19]:45170: 550 5.7.1 Service unavailable; client [94.152.193.19] blocked using multiple DNS-based blocklists, please check http://multirbl.valli.org/; from=<[email protected]>, to=<[email protected]>, proto=ESMTP, helo=<smtp.5119.niebieski.net>

So Rank 10, above treshold 7.. and we can use these treshold numbers with fail2ban. 
by doing that your server get less stress/hammered, because i block them in the firewalls after rejections. 
The fail2ban part i'll add on the bottom. 


### Before-220 tests (postscreen / DNSBL)
postscreen_tls_security_level=encrypt
postscreen_greet_banner =
	$myhostname, checking blacklists, please wait.
# Drop connections if other server is sending too quickly
postscreen_greet_action = enforce
postscreen_greet_wait = 5s
postscreen_greet_ttl = 2d
postscreen_access_list =
    permit_mynetworks,
    cidr:/etc/postfix/postscreen_access_list.cidr,
    pcre:/etc/postfix/postscreen_access_list-reject.fqrdns.pcre
postscreen_whitelist_interfaces = $mynetworks, static:all
postscreen_blacklist_action     = drop
postscreen_dnsbl_reply_map      = pcre:/etc/postfix/postscreen_dnsbl_reply_map.pcre
postscreen_dnsbl_action         = enforce
postscreen_dnsbl_ttl            = 2h
postscreen_dnsbl_threshold      = 7
postscreen_dnsbl_sites =
        zen.spamhaus.org*5
        b.barracudacentral.org=127.0.0.2*2
        dnsbl.cobion.com*2
        bl.spameatingmonkey.net*2
        fresh.spameatingmonkey.net*2
        rhsbl.rbl.polspam.pl=127.0.0.1*2
        rbl.rbldns.ru=127.0.0.1*1
        dnsbl.kempt.net*1
        dnsbl.inps.de*2
        bl.spamcop.net*2
        spam.dnsbl.sorbs.net=127.0.0.6*2
        problems.sorbs.net=127.0.0.6*2
        new.spam.sorbs.net=127.0.0.6*2
        psbl.surriel.com*2
        bl.mailspike.net*2
        rep.mailspike.net=127.0.0.[13;14]*1
        bl.suomispam.net*1
        bl.blocklist.de*2
        ix.dnsbl.manitu.net*2
        dnsbl-1.uceprotect.net*1
        dnsbl-2.uceprotect.net*1
        dnsbl.justspam.org=127.0.0.2*2
        multi.surbl.org*2
        black.junkemailfilter.com=127.0.0.2*2
        rbl.metunet.com=127.0.0.2*2
        all.s5h.net=127.0.0.2*1
        hostkarma.junkemailfilter.com=127.0.0.[2;4]*2
        rbl.abuse.ro=127.0.0.[2;4]*2
        gl.suomispam.net=127.0.0.2*1
        truncate.gbudb.net=127.0.0.2*1
        dnsbl.zapbl.net=127.0.0.2*1
        spamsources.fabel.dk=127.0.0.2*1
        dnsbl.spfbl.net=127.0.0.[2;4]*2
        dnsbl-3.uceprotect.net=127.0.0.2*2
        # No RDNS
        dnsbl.spfbl.net=127.0.0.3*1
        hostkarma.junkemailfilter.com=127.0.0.3*1
        # whitelists
        swl.spamhaus.org*-6
        dnswl.spfbl.net=127.0.0.[2;3;4]*-3
        list.dnswl.org=127.0.[0..254].[0..3]*-4
        rep.mailspike.net=127.0.0.[17;18]*-1
        rep.mailspike.net=127.0.0.[19;20]*-2
        hostkarma.junkemailfilter.com=127.0.0.1*-4
        nobl.junkemailfilter.com=127.0.0.5*-4
#
### End of before-220 tests
### After-220 tests
### WARNING -- See "Tests after the 220 SMTP server greeting" in the
### Postscreen Howto and *UNDERSTAND* it *BEFORE* you enable the
### following tests! This basically enables some kind of greylisting!
#postscreen_bare_newline_action = enforce
#postscreen_bare_newline_enable = yes
#postscreen_non_smtp_command_enable = yes
#postscreen_pipelining_enable = yes
### ADDENDUM: Any one of the foregoing three *_enable settings may cause
### significant and annoying mail delays.



###  Fail2ban addition added in : jail.local 
[postfix-postscreen]
port     = smtp
logpath  = /var/log/mail.log
maxretry = 1
bantime = 86400
findtime = 3600
banaction = ufw-all

###  Fail2ban addition added in : /etc/fail2ban/jail.local 
#
# Fail2Ban filter for Postfix's Postscreen blocks.
#
# you need to adjust the Rank number to what you please.
# make sure you match the first number [7-9] so the 7 with postfix/postscreen_dnsbl_threshold value=
# For now we have set rank 7 and up are getting blocked and put in the firewall

[INCLUDES]

# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf

[Definition]

_daemon = postfix(-\w+)?/postscreen

failregex = DNSBL rank ([7-9]|[1-9][0-9]) for \[<HOST>\]

ignoreregex =

# Author: Me.. ;-) 

###  Fail2ban addition added in : /etc/fail2ban/jail.d/personal-enabled.conf
[postfix-postscreen]
enabled = true
ignoreip = 127.0.0.1/8 
# add ips in ignore if needed, you most probley want to add some. 

and last.. i use ufw as firewall.. 
###  Fail2ban addition added in : /etc/fail2ban/action.d/ufw-all.conf
# Fail2Ban configuration file
#
# We add the rules to ufw for better control and management
# official ufw version uses ufw insert 1 .. that errors with IPv6. 

[Definition]
actionstart =
actionstop =
actioncheck =
actionban = ufw prepend deny from <ip> to any
actionunban = ufw delete deny from <ip> to any




-- 
MailScanner mailing list
mailscanner-qhrM8SXbD5JTOyd/[email protected]
http://lists.mailscanner.info/mailman/listinfo/mailscanner