Unterschiede
Hier werden die Unterschiede zwischen zwei Versionen angezeigt.
| Beide Seiten der vorigen Revision Vorhergehende Überarbeitung Nächste Überarbeitung | Vorhergehende Überarbeitung | ||
| centos:mail_c6:mta_10 [16.03.2014 21:49. ] – django | centos:mail_c6:mta_10 [22.07.2019 15:07. ] (aktuell) – Externe Bearbeitung 127.0.0.1 | ||
|---|---|---|---|
| Zeile 1: | Zeile 1: | ||
| ====== SPF - Sender Policy Framework ====== | ====== SPF - Sender Policy Framework ====== | ||
| {{: | {{: | ||
| - | Mit Hilfe von SPF((**S**ender **P**olicy **F**rameworks)) kann definiert werden, welche Mailserver für welche Domains eMails verschickt werden (können), oder nicht, oder anders ausgedrückt, | + | Mit Hilfe von SPF((**S**ender **P**olicy **F**rameworks)) kann definiert werden, welche Mailserver für welche Domains eMails verschickt werden (können), oder nicht, oder anders ausgedrückt, |
| Mit SPF soll hauptsächlich Absenderadressfälschungen verhindert werden, nicht jedoch direkt Spam zu bekämpfen. Dieses here Ziel wirft bei genauerer Betrachtung viele Fragen auf und erzeugt bei manchen Mailserver-Betreibern nicht gerade viel Begeisterungsstürme. Probleme tauchen mit unter bei Mailumleitungen, | Mit SPF soll hauptsächlich Absenderadressfälschungen verhindert werden, nicht jedoch direkt Spam zu bekämpfen. Dieses here Ziel wirft bei genauerer Betrachtung viele Fragen auf und erzeugt bei manchen Mailserver-Betreibern nicht gerade viel Begeisterungsstürme. Probleme tauchen mit unter bei Mailumleitungen, | ||
| Beim **SPF** wird ein TXT-Record in der Zonendatei der betreffenden (Mail)Domain eingetragen. Dort wird definiert, welche SMTP-Server berechtigt sind, Nachrichten der (Mail)Domain zu verschicken. Mailserver können dann bei der Annahme der eMails abfragen, ob der sendende Mailserver überhaupt berechtigt ist, diese Nachricht zu verschicken. | Beim **SPF** wird ein TXT-Record in der Zonendatei der betreffenden (Mail)Domain eingetragen. Dort wird definiert, welche SMTP-Server berechtigt sind, Nachrichten der (Mail)Domain zu verschicken. Mailserver können dann bei der Annahme der eMails abfragen, ob der sendende Mailserver überhaupt berechtigt ist, diese Nachricht zu verschicken. | ||
| + | |||
| + | <uml w=800> | ||
| + | |||
| + | title Mailversand einer eMail\n | ||
| + | skin BlueModern | ||
| + | participant " | ||
| + | participant " | ||
| + | participant " | ||
| + | |||
| + | links -> mitte : connect von mx01.nausch.org zu mx1.tachtler.net | ||
| + | note left : \n Verbindungsaufbau \n vom Quell- zum \n Zielserver \n | ||
| + | links <-- mitte : . 220 mx1.tachtler.net ESMTP Postfix | ||
| + | links --> mitte : HELO mx01.nausch.org | ||
| + | links <-- mitte : . 250 mx1.tachtler.net | ||
| + | links --> mitte : MAIL FROM:< | ||
| + | |||
| + | mitte -> rechts : host -t TXT nausch.org | ||
| + | note right : \n Abfrage der \n SPF-Records \n | ||
| + | mitte <- rechts : nausch.org descriptive text " | ||
| + | note left : \n Der Mailserver mit der \n IP 217.91.103.190 ist berechtigt \n eMails der Mail-Domain \n nausch.org zu versenden \n | ||
| + | links <-- mitte : . 250 2.1.0 Ok | ||
| + | |||
| + | links --> mitte : RCPT TO:< | ||
| + | links <-- mitte : . 250 2.1.0 Ok | ||
| + | |||
| + | links --> mitte : Übermittlung der Nachricht | ||
| + | links <-- mitte : 250 2.0.0 Ok: queued as 5950581 | ||
| + | note left : \n Beenden der Verbindung \n | ||
| + | |||
| + | </ | ||
| Weitere Informationen rund um SPF findet man im übrigen auf der [[http:// | Weitere Informationen rund um SPF findet man im übrigen auf der [[http:// | ||
| Zeile 25: | Zeile 55: | ||
| * **include** Einbinden einer weiteren SPF-Abfrage. | * **include** Einbinden einer weiteren SPF-Abfrage. | ||
| - | In der Regel wird man bei der Definition folgenden Festlegung treffen: //**eMails werden normalerweise immer von den IP-Adressen des zuständigen Mailserver versandt, können aber auch von anderen Servern verschickt werden.**// Als SPF-Record ergibt das dann "// | + | In der Regel wird man bei der Definition folgenden Festlegung treffen: //**eMails werden normalerweise immer von den IP-Adressen des zuständigen Mailserver versandt, können aber auch von anderen Servern verschickt werden.**// Als SPF-Record ergibt das dann "// |
| | | ||
| Wir tragen also bei unserem zuständigen DNS entsprechend die richtigen Daten ein. | Wir tragen also bei unserem zuständigen DNS entsprechend die richtigen Daten ein. | ||
| - | | + | |
| + | Über die URL [[http:// | ||
| ===== SPF-Bewertung bei der Mailannahme ===== | ===== SPF-Bewertung bei der Mailannahme ===== | ||
| - | Neben der Befragung von [[centos: | + | Neben der Befragung von [[centos: |
| - | ==== Installation ==== | + | <WRAP round tip> \\ Auf den ersten Blick erscheint der Postfix Poliyd-Daemon **pypolicyd-spf** |
| - | Das RPM-Paket aus dem EPEL-Repository | + | |
| - | # yum install pypolicyd-spf | + | |
| - | Was uns das Paket alles mitbringt, zeigt uns wie immer der Aufruf | + | Möchte man aber hingegen später **[[centos: |
| - | # rpm -qil pypolicyd-spf | + | |
| - | < | + | |
| - | Version | + | |
| - | Release | + | |
| - | Install Date: Sun 16 Mar 2014 10:33:12 AM CET Build Host: buildvm-05.phx2.fedoraproject.org | + | |
| - | Group : Unspecified | + | |
| - | Size : 102907 | + | |
| - | Signature | + | |
| - | Packager | + | |
| - | URL : https:// | + | |
| - | Summary | + | |
| - | Description : | + | |
| - | pypolicyd-spf is a Postfix policy engine for Sender Policy Framework (SPF) | + | |
| - | checking. It is implemented in pure Python and uses the python-spf (pyspf) | + | |
| - | module. | + | |
| - | This SPF policy server implementation provides flexible options for different | + | </WRAP> |
| - | receiver policies and sender whitelisting to enable it to support a very wide | + | |
| - | range of requirements. | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | </code> | + | |
| - | ==== Hinweise zur Konfiguration | + | ==== Installation |
| - | Hilfreiche Hinweise zur nötigen Konfiguration finden | + | Als laden wir uns das aktuelle RPM auf unseren Server. |
| - | # | + | # |
| - | < | + | |
| - | Python based policy daemon for Postfix SPF checking | + | |
| - | Tumgreyspf source | + | |
| - | | + | |
| - | < | + | |
| - | python-policyd-spf changes | + | |
| - | | + | |
| - | < | + | |
| - | Documentation inputs: | + | |
| - | | + | |
| - | < | + | |
| - | | + | |
| - | | + | |
| - | Licensed under the Apache License, Version | + | # wget http:// |
| - | you may not use this file except in compliance with the License. | + | |
| - | You may obtain a copy of the License at | + | |
| - | | + | Dann installieren wir das Paket. |
| + | # yum localinstall smf-spf-2.0.4-1.el6.x86_64.rpm | ||
| - | | + | Altenativ können wir das Paket natürlich auch direkt von [[http:// |
| - | | + | # yum localinstall http:// |
| - | | + | |
| - | See the License for the specific language governing permissions and | + | |
| - | | + | |
| - | ================= | + | Ein Update des Paketes geht entsprechend der Installation. |
| + | # yum localupdate http:// | ||
| - | This is python-policyd-spf, an external policy checker for the postfix mail | + | Was uns das Paket alles mitbringt, zeigt uns wie immer der Aufruf von **rpm -qil < |
| - | server. | + | # rpm -qil smf-spf |
| - | be rejected by your server. | + | < |
| - | + | Version | |
| - | To install from the tar.gz (if this software has been packaged for your | + | Release |
| - | distribution, | + | Install Date: Tue 01 Apr 2014 10:41:43 PM CEST Build Host: vml010039.intra.nausch.org |
| - | using your normal distribution packaging tools): | + | Group : System Environment/ |
| - | + | Size : 50591 License: GPLv2+ | |
| - | 1. | + | Signature |
| - | 2. Enter the package directory (cd ...) | + | Packager |
| - | 3. python setup.py build | + | URL : http://smfs.sourceforge.net/ |
| - | 4. As root python setup.py install | + | Summary |
| - | + | Description : | |
| - | It requires Python (python2.6, python2.7, or python3.2+), | + | smf-spf is a lightweight, fast and reliable Sendmail milter that implements the |
| - | (python-spf) library version 2.0 or higher, and (for Python versions before | + | Sender Policy Framework technology with the help of the libspf2 library. It |
| - | python3.3, | + | checks SPF records to make sure that e-mail messages are authorized by the |
| - | module | + | domain that it is coming from. It's an alternative for the spfmilter, |
| - | be downloaded from: | + | spf-milter, and milter-spiff milters. |
| - | + | / | |
| - | http://sourceforge.net/projects/pymilter/ | + | /etc/mail/ |
| - | + | /etc/rc.d/init.d/ | |
| - | If ipaddr not available through your packaging system, it can be downloaded | + | / |
| - | from: | + | /usr/share/ |
| - | + | /usr/share/doc/smf-spf-2.0.4/COPYING | |
| - | http://code.google.com/p/ipaddr-py/downloads/list | + | /usr/share/doc/smf-spf-2.0.4/ |
| - | + | / | |
| - | To use the optional RFC 5451 Authentication-Results header, the authres module | + | / |
| - | is also needed. It can be downloaded from pypi or from: | + | / |
| - | + | ||
| - | https://launchpad.net/authentication-results-python | + | |
| - | + | ||
| - | Nothing is configured by default, so this will not interact with Postfix until | + | |
| - | it has been set up. | + | |
| - | + | ||
| - | See man 1 policyd-spf for information on setting up and using this policy | + | |
| - | server. | + | |
| - | + | ||
| - | See man 5 policyd-spf.conf for configuration file information. | + | |
| </ | </ | ||
| - | === policyd-spf | + | ==== Konfiguration ==== |
| - | # man policyd-spf | + | Die Konfiguration des **smf-spf**-Daemons gestaltet sich vergleichsweise einfach und erfolgt lediglich mit Hilfe Der Datei // |
| - | < | + | |
| - | NAME | + | Mit unserem Editor der Wahl, z.B. **vim** bearbeiten wir diese Konfigurationsdatei. |
| - | python-policyd-spf - pure-Python Postfix policy daemon for SPF checking | + | # vim / |
| - | VERSION | + | <file bash / |
| - | 1.1.1 | + | # |
| + | # smf-spf configuration file v2.0.2 (it's read at start) | ||
| + | # | ||
| - | USAGE | + | # Whitelist by a sender IP address |
| - | NOTE: Depending on the packaging | + | # |
| + | # The syntax is an IP address followed by a slash | ||
| + | # and a CIDR netmask (if the netmask is omitted, /32 is assumed) | ||
| + | # | ||
| + | WhitelistIP 127.0.0.0/ | ||
| + | WhitelistIP 10.0.0.0/ | ||
| + | # Django : 2014-02-26 | ||
| + | # nicht benutzte (private) Netzbereiche entfernt | ||
| + | # WhitelistIP 172.16.0.0/ | ||
| + | # WhitelistIP 192.168.0.0/16 | ||
| - | $ policyd-spf | + | # Whitelist by a sender PTR record |
| + | # | ||
| + | # Performs a case insensitive substring match | ||
| + | # | ||
| + | # | ||
| + | # | ||
| - | $ policyd-spf -h (Display usage message) | + | # Whitelist by an envelope sender e-Mail address |
| + | # | ||
| + | # Performs a case insensitive substring match | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| - | $ policyd-spf / | + | # Whitelist by an envelope recipient e-Mail address |
| + | # | ||
| + | # Performs a case insensitive substring match | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| - | | + | # Refuse e-Mail messages at SPF Fail results |
| - | | + | # |
| - | an uncommented configuration file in / | + | # Default: on |
| + | # | ||
| + | # | ||
| + | # | ||
| - | | ||
| - | SPF checks is supported. | ||
| - | | ||
| - | OTHER DOCUMENTATION | + | # Subject tagging of e-Mail messages at SPF SoftFail |
| - | This documentation assumes you have read Postfix’s README_FILES/ | + | # and Fail (if RefuseFail set to off) results |
| - | generally familiar with Sender Policy Framework | + | # |
| + | # Default: on | ||
| + | # | ||
| + | # | ||
| - | See man 5 policyd-spf.conf for configuration file information. | + | # Subject tagging string |
| + | # | ||
| + | # Default: [SPF: | ||
| + | # | ||
| + | # | ||
| - | man 5 policyd-spf.peruser provides documentation | + | # Build a standard Received-SPF: header |
| - | tion options | + | # |
| + | # Default: | ||
| + | # | ||
| + | #AddHeader on # (on|off) | ||
| - | SYNOPSIS | + | # Quarantine of e-Mail messages at SPF SoftFail |
| - | | + | # and Fail (if RefuseFail set to off) results |
| - | pure Python | + | # |
| - | Postfix configuration must be changed to check SPF. | + | # Default: off |
| + | # | ||
| + | # | ||
| - | DESCRIPTION | + | # Quarantine mailbox |
| - | Logging is sent to syslogd. | + | # |
| + | # Default: postmaster | ||
| + | # | ||
| + | # | ||
| + | # | ||
| - | | + | # In-memory cache engine TTL settings |
| - | and Postfix runs one instance of this Python script. | + | # |
| - | cess terminates after 100 seconds of idle time, or after serving 100 clients. | + | # The time is given in seconds, except if a unit is given: |
| - | of starting this Python script is smoothed over time | + | # m for minutes, h for hours, and d for days |
| + | # Specify zero to disable caching | ||
| + | # | ||
| + | # Default: 1h | ||
| + | # | ||
| + | #TTL 1h | ||
| - | The default policy_time_limit is 1000 seconds. | + | # Run as a selected user (smf-spf must be started by root) |
| - | tions to complete. | + | # |
| - | seconds. | + | # Default: smfs |
| + | # | ||
| + | #User smfs | ||
| - | | + | # Socket used to communicate with Sendmail daemon |
| - | default, treated as if they had no SPF record. | + | # |
| - | default, treated as if they had no SPF record, but can (and probably should) be deferred if | + | # Default: unix:/ |
| - | | + | # |
| - | will have the SPF Received header prepended. | + | # |
| - | header for spam scoring so there is no need to configure a separate SPF check in these Spa- | + | # Django : 2014-03-25 |
| - | massassin versions. See Spamassassin documentation for details. | + | Socket inet: |
| - | Default | + | # Facility for logging via Syslog daemon |
| - | check actions are to reject | + | # |
| - | than Mail From records and rejecting based on HELO checking does not present a false positive | + | # Default: mail |
| - | risk. These settings are a matter of local policy and should be adjusted to meet the | + | # |
| - | | + | # |
| - | LOGGING | + | |
| - | | + | |
| - | " | + | |
| - | a value of " | + | |
| - | | + | |
| - | " | + | |
| - | TESTING THE POLICY DAEMON | + | </ |
| - | | + | |
| - | To test the policy daemon by hand, execute: | + | In der Konfigurationsdatei **main.cf** unseres Postfix-Mailserver tragen wir nun noch am Ende nachfolgende Zeilen ein. |
| + | # vim / | ||
| + | <file bash / | ||
| - | | + | # Django : 2014-03-16 |
| + | # SPF-Check via SMF-SPF-Milter einbinden. | ||
| + | smtpd_milters = inet: | ||
| - | Each query is a bunch of attributes. Order does not matter, and the daemon uses only a few | + | ... |
| - | of all the attributes shown below: | + | </ |
| - | | + | ==== Programmstart |
| - | | + | === erster manueller Start === |
| - | | + | Nun können wir das erste mal den Daemon anstarten. |
| - | | + | # service smf-spf start |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | client_address=1.2.3.4 | + | |
| - | client_name=another.domain.tld | + | |
| - | [empty line] | + | |
| - | The policy daemon will answer in the same style, with an attribute list followed by a empty | + | Starting smf-spf: |
| - | line: | + | |
| - | | + | In der Prozessliste finden wir nun unseren Prozess smf-spf, der mit den Rechten des Users smf läuft: |
| - | [empty line] | + | # ps auxw | grep smf-spf |
| - | POSTFIX INTEGRATION | + | smfs |
| - | 1. Add the following to / | + | |
| - | | + | Mittels lsof können wir nun noch überprüfen, |
| - | user=nobody argv=/ | + | # lsof -i :10010 |
| - | NOTE: Check the path to both the installed Python interpreter and | + | COMMAND |
| - | policyd-spf. These vary from system to system. | + | smf-spf 28462 smfs 4u IPv4 2597844 |
| - | | + | |
| - | | + | |
| - | user nobody, create a dedicated user for this policy server and use | + | |
| - | that instead. | + | |
| - | 2. Configure the Postfix policy service in /etc/postfix/main.cf: | + | === automatisches Starten des Dienste beim Systemstart |
| + | Damit der smf-spf-Daemon automatisch bei jedem Systemstart startet, denn ohne laufenden **smf-spf-daemon** verweigert nun unser **postfix** die Annahme der Nachrichten, | ||
| + | # chkconfig smf-spf on | ||
| - | | + | Die Überprüfungung ob der Dienst (Daemon) smf-spfwirklich bei jedem Systemstart automatisch mit gestartet wird, kann durch folgenden Befehle erreicht werden: |
| - | ... | + | # chkconfig --list | grep smf-spf* |
| - | | + | |
| - | | + | |
| - | ... | + | |
| - | | + | |
| - | NOTE: | + | smf-spf |
| - | else your system can become an open relay. | + | |
| - | | + | Wichtig sind jeweils die Schalter **on** bei den Runleveln - **2 3 4 5**. |
| - | SEE ALSO | + | Anschließend starten wir unseren Postfix-Mailserver einmal durch, damit unsere zuvor eingetragene Konfigurationsänderung aktiv werden kann. |
| - | | + | # service postfix condrestart |
| - | AUTHORS | + | |
| - | This version of python-policyd-spf was written by Copyright © 2007-2012 Scott Kitterman | + | |
| - | < | + | |
| - | | + | |
| - | < | + | |
| - | This man-page was created by Scott Kitterman < | + | Shutting down postfix: |
| + | Starting postfix: | ||
| - | 2012-03-17 | + | ==== Tests und Logging ==== |
| - | </code> | + | Zum Testen schicken wir uns von einem fremden Mailserver aus, der einen gültigen SPF-Record vorweisen kann eine eMail an unseren Mailserver und beobachten unser Maillog. |
| + | # less /var/log/maillog | ||
| - | === policyd-spf.conf === | + | |
| - | | + | |
| - | <code> | + | |
| - | NAME | + | Damit nicht bei jeder Anfrage, der SPF-Record beim DNS abgerufen werden muss, cacht der Daemon auch entsprechend den SPF-Record. Wir sehen dann bei der Nutzung dieser gecachten Daten im maillog. |
| - | | + | Mar 26 14:40:18 vml000080 smf-spf[26416]: |
| - | VERSION | + | Natürlich wird ein Fehler beim Überprüfen des SPF-records auch im maillog vermerkt. |
| - | 1.1.1 | + | Dec 15 14:39:49 vml000080 smf-spf[1501]: |
| - | USAGE | + | Im Mailheader der empfangenen eMail findet sich dann auch die entsprechenden Einträge: |
| - | Usage: | + | |
| - | policyd-spf [/ | + | |
| + | ===== SRS - Sender Rewriting Scheme ===== | ||
| + | Zu Beginn dieses Artikels wurde bereits darauf hingewiesen, | ||
| - | OTHER DOCUMENTATION | + | ====== Links ====== |
| - | This documentation assumes you have read Postfix’s README_FILES/ | + | * **[[[[centos: |
| - | | + | * **[[centos: |
| + | * **[[wiki: | ||
| + | * **[[http:// | ||
| - | man 1 policyd-spf provides general operation documentation for this package. | ||
| - | |||
| - | man 5 policyd-spf.peruser provides documentation on setting up and using different configura- | ||
| - | tion options on a per user (mail reciepient) basis. | ||
| - | |||
| - | SYNOPSIS | ||
| - | | ||
| - | | ||
| - | can be changed by changing the installed configuration files or through giving a path to an | ||
| - | | ||
| - | |||
| - | DESCRIPTION | ||
| - | | ||
| - | | ||
| - | |||
| - | | ||
| - | and the sample configuration file show the format to use. These options can be adjusted on a | ||
| - | per user (mail recipient) basis. | ||
| - | | ||
| - | |||
| - | OPTIONS | ||
| - | LOGGING | ||
| - | " | ||
| - | |||
| - | The default, 1, logs no debugging messages, just basic SPF results and errors generated | ||
| - | | ||
| - | not cause an error, but will not log any additional information). | ||
| - | |||
| - | debug level 2 adds a log message if no client address (IP address from which the connection | ||
| - | was made), Mail From addresss, or HELO/EHLO name is received by the policy server, and logs | ||
| - | SPF results for each Mail From and HELO check. | ||
| - | |||
| - | debug level 3 generates a log message each time the policy server starts and each time it | ||
| - | | ||
| - | the message. | ||
| - | | ||
| - | |||
| - | debug level 4 logs the complete data set received by Postfix via the policy interface and | ||
| - | when the end of the entry is read. | ||
| - | |||
| - | debug level 5 is used to debug config file processing and can only be set in code and not via | ||
| - | the config file. | ||
| - | |||
| - | If debug level is 0, then the policy server logs errors only. | ||
| - | |||
| - | | ||
| - | |||
| - | | ||
| - | |||
| - | TEST OPERATION | ||
| - | The policy server can operate in a test only mode. This allows you to see the potential | ||
| - | | ||
| - | | ||
| - | | ||
| - | |||
| - | | ||
| - | |||
| - | | ||
| - | |||
| - | HELO/EHLO CHECKING | ||
| - | HELO check rejection policy options are: | ||
| - | |||
| - | | ||
| - | | ||
| - | there are no standard e-mail use cases where a HELO check should not Pass if there is an SPF | ||
| - | | ||
| - | this option is not fully RFC 4408 compliant since the SPF check for the Mail From identity is | ||
| - | | ||
| - | the SMTP dialogue and there is no practical reason to waste resources on Mail From checks if | ||
| - | the HELO check will already cause the message to be rejected. These deviations should not | ||
| - | cause interoperability problems when used for HELO. | ||
| - | |||
| - | | ||
| - | | ||
| - | SMTP dialogue and there is no practical reason to waste resources on Mail From checks if the | ||
| - | HELO check will already cause the message to be rejected. | ||
| - | |||
| - | Fail - Reject only on HELO Fail. Technically this option is not fully RFC 4408 compliant | ||
| - | since the Mail From identity is mandatory, but HELO/EHLO is known first in the SMTP dialogue | ||
| - | and there is no practical reason to waste resources on Mail From checks if the HELO check | ||
| - | will already cause the message to be rejected. | ||
| - | |||
| - | Null - Only reject HELO Fail for Null sender (SPF Classic). | ||
| - | | ||
| - | least this option (SPF_Not_Pass or Fail) are preferred) is highly recommended. | ||
| - | |||
| - | False - Never reject on HELO, append header only. This is useful for post-SMTP spam filters | ||
| - | such as SpamAssassin. | ||
| - | |||
| - | | ||
| - | twice (once for HELO checks and once for Mail From) with two different configuration files. | ||
| - | This approach is useful to get both the HELO and Mail From headers prepended to a message. | ||
| - | |||
| - | | ||
| - | |||
| - | | ||
| - | |||
| - | HELO/EHLO PASS RESTRICTION | ||
| - | HELO Pass Restriction allows integration with other Postfix access controls by provding a | ||
| - | user supplied name of a postfix access restriction to be applied to a message when the HELO | ||
| - | | ||
| - | fix SMTP server access table access(5) and explained in the Postfix RESTRICTION CLASS README. | ||
| - | The README.per_user_whitelisting file provided with this distribution provides examples. | ||
| - | Note: A helo pass restriction will be the returned result even if the mail from result would | ||
| - | cause the message to be rejected. | ||
| - | |||
| - | | ||
| - | |||
| - | | ||
| - | |||
| - | | ||
| - | |||
| - | None | ||
| - | Mail From CHECKING | ||
| - | Mail From rejection policy options are: | ||
| - | |||
| - | | ||
| - | since the mail with an SPF Neutral result is treated differently than mail with no SPF record | ||
| - | and Softfail results are not supposed to cause mail rejection. | ||
| - | not recommended. Use per-domain if needed (per-domain usage described below). | ||
| - | |||
| - | | ||
| - | | ||
| - | this option is not recommended. Use per-domain if needed (per-domain usage described below). | ||
| - | |||
| - | Fail (default) - Reject on Mail From Fail. | ||
| - | |||
| - | False - Never reject on Mail From, append header only. This is useful for post-SMTP spam | ||
| - | | ||
| - | |||
| - | | ||
| - | the policy server twice (once for HELO checks and once for Mail From) with two different con- | ||
| - | | ||
| - | | ||
| - | ing has a lower false positive risk than Mail From checking), but this approach would not be | ||
| - | fully RFC 4408 compliant since the Mail From identity is mandatory. | ||
| - | |||
| - | | ||
| - | |||
| - | | ||
| - | |||
| - | Mail From PASS RESTRICTION | ||
| - | Mail From Pass Restriction allows integration with other Postfix access contlols by provding | ||
| - | a user supplied name of a postfix access restriction to be applied to a message when the HELO | ||
| - | | ||
| - | fix SMTP server access table access(5) and explained in the Postfix RESTRICTION CLASS README. | ||
| - | Note: A mail from pass restriction will be the returned result even if the helo result would | ||
| - | cause the message to be rejected. | ||
| - | |||
| - | | ||
| - | |||
| - | | ||
| - | |||
| - | | ||
| - | |||
| - | None | ||
| - | |||
| - | Limit Rejections To Domains That Send No Mail | ||
| - | | ||
| - | cause mail to be rejected if the HELO/Mail From record is " | ||
| - | ful for rejecting mail in situations where the tolerance for rejecting wanted mail is very | ||
| - | low. It operates on both HELO and Mail From identities if set. | ||
| - | |||
| - | | ||
| - | |||
| - | | ||
| - | |||
| - | Domain Specific Receiver Policy | ||
| - | Using this option, a list of domains can be defined for special processing when messages do | ||
| - | not Pass SPF. This can be useful for commonly spoofed domains that are not yet publishing | ||
| - | SPF records with -all. Specifically, | ||
| - | fail result, it will be rejected (as if it had a Fail result). | ||
| - | by RFC 4408, but if needed, it is better to do it on a per-domain basis rather than globally. | ||
| - | |||
| - | | ||
| - | |||
| - | | ||
| - | |||
| - | | ||
| - | |||
| - | None | ||
| - | |||
| - | Permanent Error Processing | ||
| - | | ||
| - | |||
| - | True - Reject the message if the SPF result (for HELO or Mail From) is PermError. | ||
| - | | ||
| - | have a problem with their SPF record. | ||
| - | |||
| - | False - Treat PermError the same as no SPF record at all. This is consistet with the pre-RFC | ||
| - | usage (the pre-RFC name for this error was " | ||
| - | |||
| - | This is a global option that affects both HELO and Mail From scopes when checks for that | ||
| - | scope are enabled. The only per scope setting that can over-ride this is | ||
| - | | ||
| - | |||
| - | | ||
| - | |||
| - | | ||
| - | |||
| - | Temporary Error Processing | ||
| - | | ||
| - | |||
| - | True - Defer the message if the SPF result (for HELO or Mail From) is TempError. | ||
| - | | ||
| - | times spam senders do not retry. | ||
| - | has made it onto a DNS RBL and can then be rejected. | ||
| - | | ||
| - | in the sense that they require operator intervention to correct. | ||
| - | |||
| - | This is a global option that affects both HELO and Mail From scopes when checks for that | ||
| - | scope are enabled. The only per scope setting that can over-ride this is | ||
| - | | ||
| - | |||
| - | False - Treat TempError the same as no SPF record at all. This is the default to minimize | ||
| - | false positive risk. | ||
| - | |||
| - | | ||
| - | |||
| - | | ||
| - | |||
| - | Prospective SPF Check | ||
| - | | ||
| - | This is useful for outbound MTAs to avoid sending mail that would Fail SPF checks when | ||
| - | | ||
| - | Mail From checking. SPF Received headers are not added when this option is used. | ||
| - | |||
| - | | ||
| - | |||
| - | | ||
| - | |||
| - | None | ||
| - | |||
| - | LOCAL SPF BYPASS LIST | ||
| - | Do not check SPF for localhost addresses - add to skip addresses to skip SPF for internal | ||
| - | | ||
| - | be used, to allow mail from local clients submitting mail to an MTA also acting as a Mail | ||
| - | | ||
| - | | ||
| - | list. | ||
| - | |||
| - | | ||
| - | |||
| - | | ||
| - | |||
| - | SPF IP WHITELIST | ||
| - | A comma separated CIDR Notation list of IP addresses to skip SPF checks for. Use this list | ||
| - | to whitelist trusted relays (such as a secondary MX and trusted forwarders). | ||
| - | | ||
| - | Note the lack of spaces in the list. | ||
| - | |||
| - | | ||
| - | |||
| - | | ||
| - | |||
| - | | ||
| - | |||
| - | None | ||
| - | |||
| - | SPF DOMAIN WHITELIST | ||
| - | | ||
| - | Use this to list trusted forwarders by domain name. Client IP addresses are tested against | ||
| - | SPF records published by the listed domains. | ||
| - | plex outbound infrastructures and SPF records. | ||
| - | | ||
| - | This is a trace header only. This option does nothing if the domain does not have an SPF | ||
| - | | ||
| - | | ||
| - | |||
| - | | ||
| - | |||
| - | | ||
| - | |||
| - | | ||
| - | |||
| - | None | ||
| - | PTR DOMAIN WHITELIST | ||
| - | | ||
| - | | ||
| - | | ||
| - | | ||
| - | | ||
| - | done using the same rules as the SPF PTR mechanism as described in RFC 4408. List the parent | ||
| - | | ||
| - | An x-header is prepended indicating the IP was whitelisted against SPF checks. | ||
| - | trace header only. This option does nothing if the host does not have a PTR record record. | ||
| - | In this case use the SPF IP Whitelist described above. Note the lack of spaces in the list. | ||
| - | |||
| - | | ||
| - | |||
| - | | ||
| - | |||
| - | | ||
| - | |||
| - | None | ||
| - | |||
| - | RESULTS HEADER | ||
| - | The standard method for documenting SPF results in a message (for consumption by downstream | ||
| - | | ||
| - | | ||
| - | | ||
| - | | ||
| - | |||
| - | If there is a requirement to prepend both Received-SPF and Authentication- Results headers, | ||
| - | then it must be done by processing the message with more than one instance of the policy | ||
| - | | ||
| - | |||
| - | | ||
| - | | ||
| - | |||
| - | | ||
| - | |||
| - | SPF | ||
| - | |||
| - | Authentications Results Authentication Identifier | ||
| - | Every Authentication-Results header field has an authentication identifier field (’Auth- | ||
| - | | ||
| - | and RFC 5451 paragraph 2.3 for details. | ||
| - | | ||
| - | |||
| - | The authentication identifier field provides a unique identifier that refers to the authenti- | ||
| - | | ||
| - | | ||
| - | | ||
| - | |||
| - | | ||
| - | |||
| - | | ||
| - | |||
| - | SEE ALSO | ||
| - | man 1 policyd-spf, | ||
| - | RFC 5451 | ||
| - | |||
| - | AUTHORS | ||
| - | This version of pypolicyd-spf was written by Copyright © 2007-2012, Scott Kitterman | ||
| - | < | ||
| - | | ||
| - | < | ||
| - | |||
| - | This man-page was created by Scott Kitterman < | ||
| - | |||
| - | 2012-03-17 | ||
| - | </ | ||
| - | |||
| - | === policyd-spf.peruser === | ||
| - | # man 5 policyd-spf.peruser | ||
| - | < | ||
| - | |||
| - | NAME | ||
| - | | ||
| - | |||
| - | VERSION | ||
| - | 1.0 | ||
| - | |||
| - | USAGE | ||
| - | | ||
| - | | ||
| - | |||
| - | OTHER DOCUMENTATION | ||
| - | This documentation assumes you have read Postfix’s README_FILES/ | ||
| - | | ||
| - | |||
| - | man 1 policyd-spf provides general operation documentation for this package. | ||
| - | |||
| - | See man 5 policyd-spf.conf for configuration file information. | ||
| - | |||
| - | SYNOPSIS | ||
| - | | ||
| - | | ||
| - | can be changed by changing the installed configuration files or through giving a path to an | ||
| - | | ||
| - | |||
| - | | ||
| - | | ||
| - | | ||
| - | | ||
| - | |||
| - | DESCRIPTION | ||
| - | Use of per-user configuration is defined in the application configuration file with the set- | ||
| - | ting " | ||
| - | | ||
| - | email address of a recipient of the message. | ||
| - | |||
| - | All options available at the application level (See man 5 policyd-spf.conf) can be adjusted | ||
| - | on a per-user basis. | ||
| - | | ||
| - | not yet known for smtpd_client_restrictions, | ||
| - | | ||
| - | | ||
| - | only to a single recipient. | ||
| - | is not available, warnings will be logged and the per-user information will be ignored. | ||
| - | |||
| - | In addition to specifying individual users, regular expression matching is also available, | ||
| - | but may have performance implications since the entire user table has to be traversed for | ||
| - | each message recipient. | ||
| - | |||
| - | OPTIONS | ||
| - | Text Per-User Configuration File | ||
| - | The text file option is useful for testing and when only a small number of users require per- | ||
| - | user configurations. | ||
| - | |||
| - | " | ||
| - | |||
| - | Lines beginning with "#" | ||
| - | | ||
| - | | ||
| - | |||
| - | The configuration of the file is a comma separated combination of user and configuration | ||
| - | | ||
| - | | ||
| - | | ||
| - | | ||
| - | | ||
| - | | ||
| - | | ||
| - | |||
| - | It is not necessary to specify all configuration parameters for each user, only those that | ||
| - | are different than the overall configuration need to be specified. | ||
| - | |||
| - | If the specified per user configuration file is missing, an error is logged and the global | ||
| - | | ||
| - | |||
| - | SEE ALSO | ||
| - | man 1 policyd-spf, | ||
| - | |||
| - | AUTHORS | ||
| - | This version of pypolicyd-spf was written by Copyright © 2007-2011, Scott Kitterman | ||
| - | < | ||
| - | | ||
| - | |||
| - | This man-page was created by Scott Kitterman < | ||
| - | |||
| - | 2012-03-17 | ||
| - | </ | ||
| - | |||
| - | ==== Konfiguration ==== | ||
| - | Im RPM-Paket wird zwar eine Konfigurationsdatei schon an die richtige Stelle // | ||
| - | |||
| - | Wir kopieren uns also daher diese Musterdatei an die richtige Stelle im Verzeichnis // | ||
| - | # cp / | ||
| - | |||
| - | Anschließende bearbeiten wir diese Datei mit unserem Editor der Wahl. | ||
| - | # vim / | ||
| - | <file bash / | ||
| - | # 5 includes all debug messages. | ||
| - | debugLevel = 1 | ||
| - | |||
| - | # If set to 0, no messages are rejected by SPF. This allows you to see the | ||
| - | # potential impact of SPF checking in your mail logs without rejecting mail. | ||
| - | defaultSeedOnly = 1 | ||
| - | |||
| - | # HELO check rejection policy. Options are: | ||
| - | # HELO_reject = SPF_Not_Pass (default) - Reject if result not Pass/ | ||
| - | # HELO_reject = Softfail - Reject if result Softfail and Fail | ||
| - | # HELO_reject = Fail - Reject on HELO Fail | ||
| - | # HELO_reject = Null - Only reject HELO Fail for Null sender (SPF Classic) | ||
| - | # HELO_reject = False - Never reject/ | ||
| - | # HELO_reject = No_Check - Never check HELO. | ||
| - | HELO_reject = SPF_Not_Pass | ||
| - | |||
| - | # HELO pass restriction policy. | ||
| - | # HELO_pass_restriction = helo_passed_spf - Apply the given restriction when | ||
| - | # the HELO checking result is Pass. The given restriction must be an | ||
| - | # action as defined for a Postfix SMTP server access table access(5). | ||
| - | # | ||
| - | |||
| - | # Mail From rejection policy. | ||
| - | # Mail_From_reject = SPF_Not_Pass - Reject if result not Pass/ | ||
| - | # Mail_From_reject = Softfail - Reject if result Softfail and Fail | ||
| - | # Mail_From_reject = Fail - Reject on Mail From Fail (default) | ||
| - | # Mail_From_reject = False - Never reject/ | ||
| - | # Mail_From_reject = No_Check - Never check Mail From/Return Path. | ||
| - | Mail_From_reject = Fail | ||
| - | |||
| - | # Reject only from domains that send no mail. Options are: | ||
| - | # No_Mail = False - Normal SPF record processing (default) | ||
| - | # No_Mail = True - Only reject for " | ||
| - | |||
| - | # Mail From pass restriction policy. | ||
| - | # Mail_From_pass_restriction = mfrom_passed_spf - Apply the given | ||
| - | # restriction when the Mail From checking result is Pass. The given | ||
| - | # restriction must be an action as defined for a Postfix SMTP server | ||
| - | # access table access(5). | ||
| - | # | ||
| - | |||
| - | # Reject mail for Netural/ | ||
| - | # Recevier policy option to reject mail from certain domains when SPF is not | ||
| - | # Pass/None even if their SPF record does not produce a Fail result. | ||
| - | # Option does not change the effect of PermError_reject or TempError_Defer | ||
| - | # Reject_Not_Pass_Domains = aol.com, | ||
| - | |||
| - | # Policy for rejecting due to SPF PermError. | ||
| - | # PermError_reject = True | ||
| - | # PermError_reject = False | ||
| - | PermError_reject = False | ||
| - | |||
| - | # Policy for deferring messages due to SPF TempError. | ||
| - | # TempError_Defer = True | ||
| - | # TempError_Defer = False | ||
| - | TempError_Defer = False | ||
| - | |||
| - | # Prospective SPF checking - Check to see if mail sent from the defined IP | ||
| - | # address would pass. | ||
| - | # Prospective = 192.168.0.4 | ||
| - | |||
| - | # Do not check SPF for localhost addresses - add to skip addresses to | ||
| - | # skip SPF for internal networks if desired. Defaults are standard IPv4 and | ||
| - | # IPv6 localhost addresses. | ||
| - | skip_addresses = 127.0.0.0/ | ||
| - | |||
| - | # Whitelist: CIDR Notation list of IP addresses not to check SPF for. | ||
| - | # Example (default is no whitelist): | ||
| - | # Whitelist = 192.168.0.0/ | ||
| - | |||
| - | # Domain_Whitelist: | ||
| - | # their SPF check should be whitelisted from SPF. | ||
| - | # Example (default is no domain whitelist): | ||
| - | # Domain_Whitelist = pobox.com, | ||
| - | |||
| - | # Domain_Whitelist_PTR: | ||
| - | # on PTR match. | ||
| - | # Example (default is no PTR whitelist) | ||
| - | # Domain_Whitelist_PTR = yahoo.com | ||
| - | |||
| - | # Type of header to insert to document SPF result. Can be RFC 4408 | ||
| - | # Received-SPF (SPF) or RFC 5451 Authentication Results (AR). It cannot be | ||
| - | # both. | ||
| - | # Examples: (default is Received-SPF): | ||
| - | # Header_Type = AR | ||
| - | # Header_Type = SPF | ||
| - | |||
| - | # Every Authentication-Results header field has an authentication identifier | ||
| - | # field (' | ||
| - | # name. See policyd-spf.conf.5 and RFC 5451 paragraph 2.3 for details. | ||
| - | # Default is None. Authserv-Id must be provided if Header_Type ' | ||
| - | # Authserv_Id = mx.example.com | ||
| - | </ | ||
django