Unterschiede
Hier werden die Unterschiede zwischen zwei Versionen angezeigt.
| Beide Seiten der vorigen Revision Vorhergehende Überarbeitung Nächste Überarbeitung | Vorhergehende Überarbeitung | ||
| centos:mail_c6:mta_10 [18.03.2014 13:08. ] – [SRS - Sender Rewriting Scheme] django | centos:mail_c6:mta_10 [22.07.2019 15:07. ] (aktuell) – Externe Bearbeitung 127.0.0.1 | ||
|---|---|---|---|
| Zeile 1: | Zeile 1: | ||
| ====== SPF - Sender Policy Framework ====== | ====== SPF - Sender Policy Framework ====== | ||
| {{: | {{: | ||
| - | Mit Hilfe von SPF((**S**ender **P**olicy **F**rameworks)) kann definiert werden, welche Mailserver für welche Domains eMails verschickt werden (können), oder nicht, oder anders ausgedrückt, | + | Mit Hilfe von SPF((**S**ender **P**olicy **F**rameworks)) kann definiert werden, welche Mailserver für welche Domains eMails verschickt werden (können), oder nicht, oder anders ausgedrückt, |
| Mit SPF soll hauptsächlich Absenderadressfälschungen verhindert werden, nicht jedoch direkt Spam zu bekämpfen. Dieses here Ziel wirft bei genauerer Betrachtung viele Fragen auf und erzeugt bei manchen Mailserver-Betreibern nicht gerade viel Begeisterungsstürme. Probleme tauchen mit unter bei Mailumleitungen, | Mit SPF soll hauptsächlich Absenderadressfälschungen verhindert werden, nicht jedoch direkt Spam zu bekämpfen. Dieses here Ziel wirft bei genauerer Betrachtung viele Fragen auf und erzeugt bei manchen Mailserver-Betreibern nicht gerade viel Begeisterungsstürme. Probleme tauchen mit unter bei Mailumleitungen, | ||
| Zeile 55: | Zeile 55: | ||
| * **include** Einbinden einer weiteren SPF-Abfrage. | * **include** Einbinden einer weiteren SPF-Abfrage. | ||
| - | In der Regel wird man bei der Definition folgenden Festlegung treffen: //**eMails werden normalerweise immer von den IP-Adressen des zuständigen Mailserver versandt, können aber auch von anderen Servern verschickt werden.**// Als SPF-Record ergibt das dann "// | + | In der Regel wird man bei der Definition folgenden Festlegung treffen: //**eMails werden normalerweise immer von den IP-Adressen des zuständigen Mailserver versandt, können aber auch von anderen Servern verschickt werden.**// Als SPF-Record ergibt das dann "// |
| | | ||
| Wir tragen also bei unserem zuständigen DNS entsprechend die richtigen Daten ein. | Wir tragen also bei unserem zuständigen DNS entsprechend die richtigen Daten ein. | ||
| - | | + | |
| Über die URL [[http:// | Über die URL [[http:// | ||
| ===== SPF-Bewertung bei der Mailannahme ===== | ===== SPF-Bewertung bei der Mailannahme ===== | ||
| - | Neben der Befragung von [[centos: | + | Neben der Befragung von [[centos: |
| - | ==== Installation ==== | + | <WRAP round tip> \\ Auf den ersten Blick erscheint der Postfix Poliyd-Daemon **pypolicyd-spf** |
| - | Das RPM-Paket aus dem EPEL-Repository | + | |
| - | # yum install pypolicyd-spf | + | |
| - | Was uns das Paket alles mitbringt, zeigt uns wie immer der Aufruf | + | Möchte man aber hingegen später **[[centos: |
| - | # rpm -qil pypolicyd-spf | + | |
| - | < | + | |
| - | Version | + | |
| - | Release | + | |
| - | Install Date: Sun 16 Mar 2014 10:33:12 AM CET Build Host: buildvm-05.phx2.fedoraproject.org | + | |
| - | Group : Unspecified | + | |
| - | Size : 102907 | + | |
| - | Signature | + | |
| - | Packager | + | |
| - | URL : https:// | + | |
| - | Summary | + | |
| - | Description : | + | |
| - | pypolicyd-spf is a Postfix policy engine for Sender Policy Framework (SPF) | + | |
| - | checking. It is implemented in pure Python and uses the python-spf (pyspf) | + | |
| - | module. | + | |
| - | This SPF policy server implementation provides flexible options for different | + | </WRAP> |
| - | receiver policies and sender whitelisting to enable it to support a very wide | + | |
| - | range of requirements. | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | </code> | + | |
| - | ==== Hinweise zur Konfiguration | + | ==== Installation |
| - | Hilfreiche Hinweise zur nötigen Konfiguration finden | + | Als laden wir uns das aktuelle RPM auf unseren Server. |
| - | # | + | # |
| - | < | + | |
| - | Python based policy daemon for Postfix SPF checking | + | |
| - | Tumgreyspf source | + | |
| - | | + | |
| - | < | + | |
| - | python-policyd-spf changes | + | |
| - | | + | |
| - | < | + | |
| - | Documentation inputs: | + | |
| - | | + | |
| - | < | + | |
| - | | + | |
| - | | + | |
| - | Licensed under the Apache License, Version | + | # wget http:// |
| - | you may not use this file except in compliance with the License. | + | |
| - | You may obtain a copy of the License at | + | |
| - | | + | Dann installieren wir das Paket. |
| + | # yum localinstall smf-spf-2.0.4-1.el6.x86_64.rpm | ||
| - | | + | Altenativ können wir das Paket natürlich auch direkt von [[http:// |
| - | | + | # yum localinstall http:// |
| - | | + | |
| - | See the License for the specific language governing permissions and | + | |
| - | | + | |
| - | ================= | + | Ein Update des Paketes geht entsprechend der Installation. |
| + | # yum localupdate http:// | ||
| - | This is python-policyd-spf, an external policy checker for the postfix mail | + | Was uns das Paket alles mitbringt, zeigt uns wie immer der Aufruf von **rpm -qil <paketname>** |
| - | server. | + | # rpm -qil smf-spf |
| - | be rejected by your server. | + | < |
| - | + | Version | |
| - | To install from the tar.gz (if this software has been packaged for your | + | Release |
| - | distribution, | + | Install Date: Tue 01 Apr 2014 10:41:43 PM CEST Build Host: vml010039.intra.nausch.org |
| - | using your normal distribution packaging tools): | + | Group : System Environment/Daemons |
| - | + | Size : | |
| - | 1. Extract the package from the tarball (tar -xvvzf ...) | + | Signature |
| - | 2. Enter the package directory (cd ...) | + | Packager |
| - | 3. python setup.py build | + | URL : http://smfs.sourceforge.net/smf-spf.html |
| - | 4. As root python setup.py install | + | Summary |
| - | + | Description : | |
| - | It requires Python (python2.6, python2.7, or python3.2+), | + | smf-spf is a lightweight, |
| - | (python-spf) library version 2.0 or higher, and (for Python versions before | + | Sender Policy Framework technology |
| - | python3.3, the ipaddr module - for python3.3 and later the built-in ipaddress | + | checks |
| - | module is used). | + | domain that it is coming from. It' |
| - | be downloaded from: | + | spf-milter, and milter-spiff milters. |
| - | + | /etc/mail/smfs | |
| - | http:// | + | /etc/mail/smfs/smf-spf.conf |
| - | + | /etc/rc.d/init.d/smf-spf | |
| - | If ipaddr not available through your packaging system, it can be downloaded | + | /usr/sbin/smf-spf |
| - | from: | + | /usr/share/ |
| - | + | /usr/share/doc/smf-spf-2.0.4/COPYING | |
| - | http:// | + | /usr/share/ |
| - | + | /usr/share/doc/smf-spf-2.0.4/README.md | |
| - | To use the optional RFC 5451 Authentication-Results header, the authres module | + | /var/run/smfs |
| - | is also needed. | + | /var/run/smfs/smf-spf.sock |
| - | + | ||
| - | https:// | + | |
| - | + | ||
| - | Nothing is configured by default, so this will not interact with Postfix until | + | |
| - | it has been set up. | + | |
| - | + | ||
| - | See man 1 policyd-spf for information on setting up and using this policy | + | |
| - | server. | + | |
| - | + | ||
| - | See man 5 policyd-spf.conf for configuration file information. | + | |
| - | </code> | + | |
| - | + | ||
| - | === policyd-spf === | + | |
| - | # man policyd-spf | + | |
| - | < | + | |
| - | + | ||
| - | NAME | + | |
| - | | + | |
| - | + | ||
| - | VERSION | + | |
| - | | + | |
| - | + | ||
| - | USAGE | + | |
| - | NOTE: Depending on the packaging and distribution, | + | |
| - | + | ||
| - | $ policyd-spf (Start using installed config file) | + | |
| - | + | ||
| - | $ policyd-spf -h (Display usage message) | + | |
| - | + | ||
| - | $ policyd-spf / | + | |
| - | + | ||
| - | | + | |
| - | age (policyd-spf.conf.commented) and in policyd-spf.conf(5). | + | |
| - | an uncommented configuration file in / | + | |
| - | + | ||
| - | | + | |
| - | SPF checks is supported. | + | |
| - | | + | |
| - | + | ||
| - | OTHER DOCUMENTATION | + | |
| - | This documentation assumes you have read Postfix’s README_FILES/ | + | |
| - | | + | |
| - | + | ||
| - | See man 5 policyd-spf.conf for configuration file information. | + | |
| - | + | ||
| - | man 5 policyd-spf.peruser provides documentation on setting up and using different configura- | + | |
| - | tion options on a per user (mail reciepient) basis. | + | |
| - | + | ||
| - | SYNOPSIS | + | |
| - | | + | |
| - | pure Python and uses the pyspf module. | + | |
| - | | + | |
| - | + | ||
| - | DESCRIPTION | + | |
| - | | + | |
| - | + | ||
| - | Each time a Postfix SMTP server process is started it connects to the policy service socket | + | |
| - | and Postfix runs one instance of this Python script. | + | |
| - | cess terminates after 100 seconds of idle time, or after serving 100 clients. | + | |
| - | of starting this Python script is smoothed over time | + | |
| - | + | ||
| - | The default policy_time_limit is 1000 seconds. | + | |
| - | tions to complete. | + | |
| - | | + | |
| - | + | ||
| - | | + | |
| - | | + | |
| - | | + | |
| - | otherwise permitted. | + | |
| - | will have the SPF Received header prepended. | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | | + | |
| - | check actions are to reject mail with other than Pass/None. HELO records are much simpler | + | |
| - | than Mail From records and rejecting based on HELO checking does not present a false positive | + | |
| - | | + | |
| - | | + | |
| - | LOGGING | + | |
| - | | + | |
| - | " | + | |
| - | a value of "0", only test results (SPF hits/ | + | |
| - | Postfix and logged as a warning by Postfix also. For logging by this policy server, look for | + | |
| - | " | + | |
| - | + | ||
| - | TESTING THE POLICY DAEMON | + | |
| - | | + | |
| - | + | ||
| - | To test the policy daemon by hand, execute: | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | Each query is a bunch of attributes. | + | |
| - | of all the attributes shown below: | + | |
| - | + | ||
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | The policy daemon will answer in the same style, with an attribute list followed by a empty | + | |
| - | line: | + | |
| - | + | ||
| - | | + | |
| - | | + | |
| - | + | ||
| - | POSTFIX INTEGRATION | + | |
| - | 1. Add the following to /etc/ | + | |
| - | + | ||
| - | | + | |
| - | | + | |
| - | + | ||
| - | NOTE: Check the path to both the installed Python interpreter and | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | user nobody, create a dedicated user for this policy server and use | + | |
| - | that instead. | + | |
| - | + | ||
| - | 2. Configure the Postfix policy service in / | + | |
| - | + | ||
| - | | + | |
| - | ... | + | |
| - | | + | |
| - | | + | |
| - | ... | + | |
| - | | + | |
| - | + | ||
| - | NOTE: | + | |
| - | else your system can become an open relay. | + | |
| - | + | ||
| - | 3. Reload Postfix. | + | |
| - | + | ||
| - | SEE ALSO | + | |
| - | | + | |
| - | AUTHORS | + | |
| - | This version of python-policyd-spf was written by Copyright © 2007-2012 Scott Kitterman | + | |
| - | <scott@kitterman.com>. It is derived from Tumgreyspf, written by Sean Reifschneider, | + | |
| - | tummy.com, ltd < | + | |
| - | < | + | |
| - | + | ||
| - | This man-page was created by Scott Kitterman < | + | |
| - | + | ||
| - | 2012-03-17 | + | |
| - | </code> | + | |
| - | + | ||
| - | === policyd-spf.conf === | + | |
| - | # man 5 policyd-spf.conf | + | |
| - | < | + | |
| - | + | ||
| - | NAME | + | |
| - | | + | |
| - | + | ||
| - | VERSION | + | |
| - | | + | |
| - | + | ||
| - | USAGE | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | OTHER DOCUMENTATION | + | |
| - | This documentation assumes you have read Postfix’s README_FILES/ | + | |
| - | | + | |
| - | + | ||
| - | man 1 policyd-spf provides general operation documentation for this package. | + | |
| - | + | ||
| - | man 5 policyd-spf.peruser provides documentation on setting up and using different configura- | + | |
| - | tion options on a per user (mail reciepient) basis. | + | |
| - | + | ||
| - | SYNOPSIS | + | |
| - | | + | |
| - | | + | |
| - | can be changed by changing the installed configuration files or through giving a path to an | + | |
| - | | + | |
| - | + | ||
| - | DESCRIPTION | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | | + | |
| - | and the sample configuration file show the format to use. These options can be adjusted on a | + | |
| - | per user (mail recipient) basis. | + | |
| - | | + | |
| - | + | ||
| - | OPTIONS | + | |
| - | LOGGING | + | |
| - | " | + | |
| - | + | ||
| - | The default, 1, logs no debugging messages, just basic SPF results and errors generated | + | |
| - | | + | |
| - | not cause an error, but will not log any additional information). | + | |
| - | + | ||
| - | debug level 2 adds a log message if no client address (IP address from which the connection | + | |
| - | was made), Mail From addresss, or HELO/EHLO name is received by the policy server, and logs | + | |
| - | SPF results for each Mail From and HELO check. | + | |
| - | + | ||
| - | debug level 3 generates a log message each time the policy server starts and each time it | + | |
| - | | + | |
| - | the message. | + | |
| - | | + | |
| - | + | ||
| - | debug level 4 logs the complete data set received by Postfix via the policy interface and | + | |
| - | when the end of the entry is read. | + | |
| - | + | ||
| - | debug level 5 is used to debug config file processing and can only be set in code and not via | + | |
| - | the config file. | + | |
| - | + | ||
| - | If debug level is 0, then the policy server logs errors only. | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | TEST OPERATION | + | |
| - | The policy server can operate in a test only mode. This allows you to see the potential | + | |
| - | | + | |
| - | | + | |
| - | enable | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | HELO/EHLO CHECKING | + | |
| - | HELO check rejection policy options are: | + | |
| - | + | ||
| - | | + | |
| - | | + | |
| - | there are no standard e-mail use cases where a HELO check should not Pass if there is an SPF | + | |
| - | | + | |
| - | this option is not fully RFC 4408 compliant since the SPF check for the Mail From identity is | + | |
| - | | + | |
| - | the SMTP dialogue and there is no practical reason to waste resources on Mail From checks if | + | |
| - | the HELO check will already cause the message to be rejected. These deviations should not | + | |
| - | cause interoperability problems when used for HELO. | + | |
| - | + | ||
| - | | + | |
| - | | + | |
| - | SMTP dialogue | + | |
| - | HELO check will already cause the message to be rejected. | + | |
| - | + | ||
| - | | + | |
| - | since the Mail From identity is mandatory, but HELO/EHLO is known first in the SMTP dialogue | + | |
| - | and there is no practical reason to waste resources on Mail From checks if the HELO check | + | |
| - | will already cause the message to be rejected. | + | |
| - | + | ||
| - | Null - Only reject HELO Fail for Null sender (SPF Classic). | + | |
| - | | + | |
| - | least this option (SPF_Not_Pass or Fail) are preferred) is highly recommended. | + | |
| - | + | ||
| - | False - Never reject on HELO, append header only. This is useful for post-SMTP spam filters | + | |
| - | such as SpamAssassin. | + | |
| - | + | ||
| - | | + | |
| - | twice (once for HELO checks and once for Mail From) with two different configuration files. | + | |
| - | This approach is useful to get both the HELO and Mail From headers prepended to a message. | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | HELO/EHLO PASS RESTRICTION | + | |
| - | HELO Pass Restriction allows integration with other Postfix access controls by provding a | + | |
| - | user supplied name of a postfix access restriction to be applied to a message when the HELO | + | |
| - | | + | |
| - | fix SMTP server access table access(5) and explained in the Postfix RESTRICTION CLASS README. | + | |
| - | The README.per_user_whitelisting file provided with this distribution provides examples. | + | |
| - | Note: A helo pass restriction will be the returned result even if the mail from result would | + | |
| - | cause the message to be rejected. | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | | + | |
| - | Mail From CHECKING | + | |
| - | Mail From rejection policy options are: | + | |
| - | + | ||
| - | | + | |
| - | since the mail with an SPF Neutral result is treated differently than mail with no SPF record | + | |
| - | and Softfail results are not supposed to cause mail rejection. | + | |
| - | not recommended. Use per-domain if needed (per-domain usage described below). | + | |
| - | + | ||
| - | | + | |
| - | | + | |
| - | this option is not recommended. Use per-domain if needed (per-domain usage described below). | + | |
| - | + | ||
| - | Fail (default) - Reject on Mail From Fail. | + | |
| - | + | ||
| - | False - Never reject on Mail From, append header only. This is useful for post-SMTP spam | + | |
| - | | + | |
| - | + | ||
| - | | + | |
| - | the policy server twice (once for HELO checks and once for Mail From) with two different con- | + | |
| - | | + | |
| - | prepended to a message. | + | |
| - | ing has a lower false positive risk than Mail From checking), but this approach would not be | + | |
| - | fully RFC 4408 compliant since the Mail From identity is mandatory. | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | Mail From PASS RESTRICTION | + | |
| - | Mail From Pass Restriction allows integration with other Postfix access contlols by provding | + | |
| - | a user supplied name of a postfix access restriction to be applied to a message when the HELO | + | |
| - | | + | |
| - | fix SMTP server access table access(5) and explained in the Postfix RESTRICTION CLASS README. | + | |
| - | Note: A mail from pass restriction will be the returned result even if the helo result would | + | |
| - | cause the message to be rejected. | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | Limit Rejections To Domains That Send No Mail | + | |
| - | | + | |
| - | cause mail to be rejected if the HELO/Mail From record is " | + | |
| - | ful for rejecting mail in situations where the tolerance for rejecting wanted mail is very | + | |
| - | low. It operates on both HELO and Mail From identities if set. | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | Domain Specific Receiver Policy | + | |
| - | Using this option, a list of domains can be defined for special processing when messages do | + | |
| - | not Pass SPF. This can be useful for commonly spoofed domains that are not yet publishing | + | |
| - | SPF records with -all. Specifically, | + | |
| - | fail result, it will be rejected (as if it had a Fail result). | + | |
| - | by RFC 4408, but if needed, it is better to do it on a per-domain basis rather than globally. | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | Permanent Error Processing | + | |
| - | | + | |
| - | + | ||
| - | True - Reject the message if the SPF result (for HELO or Mail From) is PermError. | + | |
| - | | + | |
| - | have a problem with their SPF record. | + | |
| - | + | ||
| - | False - Treat PermError the same as no SPF record at all. This is consistet with the pre-RFC | + | |
| - | usage (the pre-RFC name for this error was " | + | |
| - | + | ||
| - | This is a global option that affects both HELO and Mail From scopes when checks for that | + | |
| - | scope are enabled. The only per scope setting that can over-ride this is | + | |
| - | | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | Temporary Error Processing | + | |
| - | | + | |
| - | + | ||
| - | | + | |
| - | traditional usage and has proven useful in reducing acceptance of unwanted messages. | + | |
| - | times spam senders do not retry. | + | |
| - | has made it onto a DNS RBL and can then be rejected. | + | |
| - | | + | |
| - | in the sense that they require operator intervention to correct. | + | |
| - | + | ||
| - | This is a global option that affects both HELO and Mail From scopes when checks for that | + | |
| - | scope are enabled. The only per scope setting that can over-ride this is | + | |
| - | | + | |
| - | + | ||
| - | | + | |
| - | false positive risk. | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | Prospective SPF Check | + | |
| - | | + | |
| - | This is useful for outbound MTAs to avoid sending mail that would Fail SPF checks when | + | |
| - | | + | |
| - | Mail From checking. SPF Received headers are not added when this option is used. | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | LOCAL SPF BYPASS LIST | + | |
| - | Do not check SPF for localhost addresses - add to skip addresses to skip SPF for internal | + | |
| - | | + | |
| - | be used, to allow mail from local clients submitting mail to an MTA also acting as a Mail | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | SPF IP WHITELIST | + | |
| - | A comma separated CIDR Notation list of IP addresses to skip SPF checks for. Use this list | + | |
| - | to whitelist trusted relays (such as a secondary MX and trusted forwarders). | + | |
| - | | + | |
| - | Note the lack of spaces in the list. | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | SPF DOMAIN WHITELIST | + | |
| - | | + | |
| - | Use this to list trusted forwarders by domain name. Client IP addresses are tested against | + | |
| - | SPF records published by the listed domains. | + | |
| - | plex outbound infrastructures and SPF records. | + | |
| - | | + | |
| - | This is a trace header only. This option does nothing if the domain does not have an SPF | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | | + | |
| - | PTR DOMAIN WHITELIST | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | done using the same rules as the SPF PTR mechanism as described in RFC 4408. List the parent | + | |
| - | | + | |
| - | An x-header is prepended indicating the IP was whitelisted against SPF checks. | + | |
| - | trace header only. This option does nothing if the host does not have a PTR record record. | + | |
| - | In this case use the SPF IP Whitelist described above. Note the lack of spaces in the list. | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | RESULTS HEADER | + | |
| - | The standard method for documenting SPF results in a message (for consumption by downstream | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | If there is a requirement to prepend both Received-SPF and Authentication- Results headers, | + | |
| - | then it must be done by processing the message with more than one instance of the policy | + | |
| - | | + | |
| - | + | ||
| - | | + | |
| - | | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | SPF | + | |
| - | + | ||
| - | Authentications Results Authentication Identifier | + | |
| - | Every Authentication-Results header field has an authentication identifier field (’Auth- | + | |
| - | | + | |
| - | and RFC 5451 paragraph | + | |
| - | Header_Type ’AR’ is used. | + | |
| - | + | ||
| - | The authentication identifier field provides a unique identifier that refers to the authenti- | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | SEE ALSO | + | |
| - | man 1 policyd-spf, | + | |
| - | RFC 5451 | + | |
| - | + | ||
| - | AUTHORS | + | |
| - | This version of pypolicyd-spf was written by Copyright © 2007-2012, Scott Kitterman | + | |
| - | < | + | |
| - | | + | |
| - | < | + | |
| - | + | ||
| - | This man-page was created by Scott Kitterman < | + | |
| - | + | ||
| - | 2012-03-17 | + | |
| - | </code> | + | |
| - | + | ||
| - | === policyd-spf.peruser === | + | |
| - | # man 5 policyd-spf.peruser | + | |
| - | < | + | |
| - | + | ||
| - | NAME | + | |
| - | | + | |
| - | + | ||
| - | VERSION | + | |
| - | 1.0 | + | |
| - | + | ||
| - | USAGE | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | OTHER DOCUMENTATION | + | |
| - | This documentation assumes you have read Postfix’s README_FILES/ SMTPD_POLICY_README and are | + | |
| - | | + | |
| - | + | ||
| - | man 1 policyd-spf provides general operation documentation for this package. | + | |
| - | + | ||
| - | See man 5 policyd-spf.conf for configuration file information. | + | |
| - | + | ||
| - | SYNOPSIS | + | |
| - | | + | |
| - | | + | |
| - | can be changed by changing the installed configuration files or through giving a path to an | + | |
| - | | + | |
| - | + | ||
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | DESCRIPTION | + | |
| - | Use of per-user configuration is defined in the application configuration file with the set- | + | |
| - | ting " | + | |
| - | | + | |
| - | email address of a recipient of the message. | + | |
| - | + | ||
| - | All options available at the application level (See man 5 policyd-spf.conf) can be adjusted | + | |
| - | on a per-user basis. | + | |
| - | | + | |
| - | not yet known for smtpd_client_restrictions, | + | |
| - | | + | |
| - | | + | |
| - | only to a single recipient. | + | |
| - | is not available, warnings will be logged and the per-user information will be ignored. | + | |
| - | + | ||
| - | In addition to specifying individual users, regular expression matching is also available, | + | |
| - | but may have performance implications since the entire user table has to be traversed for | + | |
| - | each message recipient. | + | |
| - | + | ||
| - | OPTIONS | + | |
| - | Text Per-User Configuration File | + | |
| - | The text file option is useful for testing and when only a small number of users require per- | + | |
| - | user configurations. | + | |
| - | + | ||
| - | " | + | |
| - | + | ||
| - | Lines beginning with "#" | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | The configuration of the file is a comma separated combination of user and configuration | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | It is not necessary to specify all configuration parameters for each user, only those that | + | |
| - | are different than the overall configuration need to be specified. | + | |
| - | + | ||
| - | If the specified per user configuration file is missing, an error is logged and the global | + | |
| - | | + | |
| - | + | ||
| - | SEE ALSO | + | |
| - | man 1 policyd-spf, | + | |
| - | + | ||
| - | AUTHORS | + | |
| - | This version of pypolicyd-spf was written by Copyright © 2007-2011, Scott Kitterman | + | |
| - | < | + | |
| - | | + | |
| - | + | ||
| - | This man-page was created by Scott Kitterman < | + | |
| - | + | ||
| - | 2012-03-17 | + | |
| </ | </ | ||
| ==== Konfiguration ==== | ==== Konfiguration ==== | ||
| - | Im RPM-Paket wird zwar eine Konfigurationsdatei schon an die richtige Stelle | + | Die Konfiguration des **smf-spf**-Daemons gestaltet sich vergleichsweise einfach und erfolgt lediglich mit Hilfe Der Datei //**/etc/mail/smfs/smf-spf.conf**// |
| - | Wir kopieren uns also daher diese Musterdatei an die richtige Stelle im Verzeichnis //**/etc/**//. | + | Mit unserem Editor der Wahl, z.B. **vim** bearbeiten wir diese Konfigurationsdatei. |
| - | # | + | # |
| - | Anschließende bearbeiten wir diese Datei mit unserem Editor der Wahl. Als wichtigen ersten Schrittsetzen wir die Option | + | <file bash /etc/mail/smfs/smf-spf.conf># /etc/mail/smfs/smf-spf.conf |
| - | # vim /etc/python-policyd-spf/policyd-spf.conf | + | # |
| - | <file bash / | + | # smf-spf configuration file v2.0.2 (it's read at start) |
| - | # 5 includes all debug messages. | + | # |
| - | # Django : 2014-03-16 | + | |
| - | # default: debugLevel = 1 | + | |
| - | debugLevel = 1debugLevel = 5 | + | |
| - | # If set to 0, no messages are rejected | + | # Whitelist |
| - | # | + | # |
| - | # Django : 2014-03-16 | + | # The syntax is an IP address followed by a slash |
| - | # default: defaultSeedOnly = 1 | + | # and a CIDR netmask (if the netmask is omitted, /32 is assumed) |
| - | defaultSeedOnly = 0 | + | # |
| + | WhitelistIP 127.0.0.0/8 | ||
| + | WhitelistIP 10.0.0.0/ | ||
| + | # Django : 2014-02-26 | ||
| + | # nicht benutzte (private) Netzbereiche entfernt | ||
| + | # WhitelistIP 172.16.0.0/12 | ||
| + | # WhitelistIP 192.168.0.0/ | ||
| - | # HELO check rejection policy. Options are: | + | # Whitelist by a sender PTR record |
| - | # HELO_reject = SPF_Not_Pass | + | # |
| - | # | + | # Performs a case insensitive substring match |
| - | # | + | # |
| - | # | + | #WhitelistPTR .friendlydomain.tld |
| - | # | + | #WhitelistPTR friendlyhost.friendlydomain.tld |
| - | # | + | |
| - | HELO_reject = SPF_Not_Pass | + | |
| - | # HELO pass restriction policy. | + | # Whitelist by an envelope sender e-Mail address |
| - | # HELO_pass_restriction = helo_passed_spf | + | # |
| - | # the HELO checking result is Pass. The given restriction must be an | + | # Performs |
| - | # | + | # |
| - | #HELO_pass_restriction | + | # |
| + | # | ||
| + | #WhitelistFrom friend@friendlydomain.tld | ||
| - | # Mail From rejection policy. | + | # Whitelist by an envelope recipient e-Mail address |
| - | # | + | # |
| - | # | + | # Performs a case insensitive substring match |
| - | # | + | # |
| - | # | + | #WhitelistTo postmaster@ |
| - | # | + | #WhitelistTo @yourspamloverdomain.tld |
| - | Mail_From_reject = Fail | + | # |
| - | # | + | # Refuse e-Mail messages at SPF Fail results (RFC-4408) |
| - | # | + | # |
| - | # | + | # Default: on |
| + | # | ||
| + | # | ||
| + | #RefuseFail off | ||
| - | # Mail From pass restriction policy. | ||
| - | # Mail_From_pass_restriction = mfrom_passed_spf - Apply the given | ||
| - | # restriction when the Mail From checking result is Pass. The given | ||
| - | # restriction must be an action as defined for a Postfix SMTP server | ||
| - | # access table access(5). | ||
| - | # | ||
| - | # | + | # Subject tagging of e-Mail messages at SPF SoftFail |
| - | # | + | # and Fail (if RefuseFail set to off) results |
| - | # | + | # |
| - | # | + | # Default: on |
| - | # | + | # |
| + | # | ||
| - | # | + | # Subject tagging string |
| - | # | + | # |
| - | # | + | # Default: [SPF:fail] |
| - | PermError_reject = False | + | # |
| + | #Tag [SPF: | ||
| - | # | + | # Build a standard Received-SPF: header |
| - | # | + | # |
| - | # | + | # Default: on |
| - | TempError_Defer = False | + | # |
| + | # | ||
| - | # | + | # Quarantine of e-Mail messages at SPF SoftFail |
| - | # | + | # and Fail (if RefuseFail set to off) results |
| - | # | + | # |
| + | # Default: off | ||
| + | # | ||
| + | # | ||
| - | # Do not check SPF for localhost addresses - add to skip addresses to | + | # Quarantine mailbox |
| - | # skip SPF for internal networks if desired. Defaults are standard IPv4 and | + | # |
| - | # IPv6 localhost addresses. | + | # Default: postmaster |
| - | # Django : 2014-03-16 | + | # |
| - | # default: skip_addresses = 127.0.0.0/ | + | #QuarantineBox postmaster |
| - | skip_addresses = 127.0.0.1/ | + | # |
| - | # | + | # In-memory cache engine TTL settings |
| - | # | + | # |
| - | # | + | # The time is given in seconds, except if a unit is given: |
| + | # m for minutes, h for hours, and d for days | ||
| + | # Specify zero to disable caching | ||
| + | # | ||
| + | # Default: 1h | ||
| + | # | ||
| + | #TTL 1h | ||
| - | # | + | # Run as a selected user (smf-spf must be started |
| - | # their SPF check should be whitelisted from SPF. | + | # |
| - | # | + | # Default: smfs |
| - | # | + | # |
| + | #User smfs | ||
| - | # Domain_Whitelist_PTR: | + | # Socket used to communicate with Sendmail daemon |
| - | # on PTR match. | + | # |
| - | # Example (default is no PTR whitelist) | + | # Default: unix:/ |
| - | # Domain_Whitelist_PTR = yahoo.com | + | # |
| + | #Socket unix:/ | ||
| + | # Django : 2014-03-25 | ||
| + | Socket inet: | ||
| - | # Type of header to insert to document SPF result. Can be RFC 4408 | + | # Facility for logging via Syslog daemon |
| - | # Received-SPF (SPF) or RFC 5451 Authentication Results (AR). It cannot be | + | # |
| - | # both. | + | # Default: mail |
| - | # Examples: (default is Received-SPF): | + | # |
| - | # Header_Type = AR | + | #Syslog mail # |
| - | # Header_Type = SPF | + | |
| - | # Every Authentication-Results header field has an authentication identifier | ||
| - | # field (' | ||
| - | # name. See policyd-spf.conf.5 and RFC 5451 paragraph 2.3 for details. | ||
| - | # Default is None. Authserv-Id must be provided if Header_Type ' | ||
| - | # Authserv_Id = mx.example.com | ||
| </ | </ | ||
| - | In der Konfigurationsdatei **master.cf** unseres Postfix-Mailserver tragen wir nun nachfolgende Zeilen ein. | + | In der Konfigurationsdatei **main.cf** unseres Postfix-Mailserver tragen wir nun noch am Ende nachfolgende Zeilen ein. |
| - | # | + | # |
| - | <file bash / | + | <file bash / |
| # Django : 2014-03-16 | # Django : 2014-03-16 | ||
| - | # SPF-Check | + | # SPF-Check |
| - | policy | + | smtpd_milters |
| - | user=nobody argv=/ | + | |
| - | # | + | |
| ... | ... | ||
| </ | </ | ||
| - | In der Konfigurationsdatei **main.cf** unseres Postfix-Mailserver ergänzen | + | ==== Programmstart ==== |
| - | # | + | === erster manueller Start === |
| + | Nun können | ||
| + | # | ||
| - | <file bash / | + | Starting smf-spf: |
| - | # Django : 2014-03-16 | + | |
| - | # SPF Check | + | |
| - | check_policy_service unix:private/ | + | |
| - | # policy_time_limit = 3600, | + | |
| - | ... | + | In der Prozessliste finden wir nun unseren Prozess smf-spf, der mit den Rechten des Users smf läuft: |
| - | </ | + | # ps auxw | grep smf-spf |
| - | Anschließend starten wir unseren Postfix-Mailserver einmal durch, damit unsere Konfigurationsänderungen aktiv werden. | + | smfs |
| - | ==== Tests und Logging ==== | + | Mittels lsof können |
| - | Zum Testen schicken | + | # |
| - | # | + | |
| - | < | + | COMMAND |
| - | Mar 16 12:17:01 vml000080 policyd-spf[12354]: | + | smf-spf 28462 smfs 4u IPv4 2597844 |
| - | Mar 16 12:17:01 vml000080 policyd-spf[12354]: | + | |
| - | Mar 16 12:17:01 vml000080 policyd-spf[12354]: | + | |
| - | Mar 16 12:17:01 vml000080 policyd-spf[12354]: | + | |
| - | Mar 16 12:17:01 vml000080 policyd-spf[12354]: | + | |
| - | Mar 16 12:17:01 vml000080 policyd-spf[12354]: | + | |
| - | Mar 16 12:17:01 vml000080 policyd-spf[12354]: | + | |
| - | Mar 16 12:17:01 vml000080 policyd-spf[12354]: | + | |
| - | Mar 16 12:17:01 vml000080 policyd-spf[12354]: | + | |
| - | Mar 16 12:17:01 vml000080 policyd-spf[12354]: | + | |
| - | Mar 16 12:17:01 vml000080 policyd-spf[12354]: | + | |
| - | Mar 16 12:17:01 vml000080 policyd-spf[12354]: | + | |
| - | Mar 16 12:17:01 vml000080 policyd-spf[12354]: | + | |
| - | Mar 16 12:17:01 vml000080 policyd-spf[12354]: | + | |
| - | Mar 16 12:17:01 vml000080 policyd-spf[12354]: | + | |
| - | Mar 16 12:17:01 vml000080 policyd-spf[12354]: | + | |
| - | Mar 16 12:17:01 vml000080 policyd-spf[12354]: | + | |
| - | Mar 16 12:17:01 vml000080 policyd-spf[12354]: | + | |
| - | Mar 16 12:17:01 vml000080 policyd-spf[12354]: | + | |
| - | Mar 16 12:17:01 vml000080 policyd-spf[12354]: | + | |
| - | Mar 16 12:17:01 vml000080 policyd-spf[12354]: | + | |
| - | Mar 16 12:17:01 vml000080 policyd-spf[12354]: | + | |
| - | Mar 16 12:17:01 vml000080 policyd-spf[12354]: | + | |
| - | Mar 16 12:17:01 vml000080 policyd-spf[12354]: | + | |
| - | Mar 16 12:17:01 vml000080 policyd-spf[12354]: | + | |
| - | Mar 16 12:17:01 vml000080 policyd-spf[12354]: | + | |
| - | Mar 16 12:17:01 vml000080 policyd-spf[12354]: | + | |
| - | Mar 16 12:17:01 vml000080 policyd-spf[12354]: Cached data for this instance: [] | + | |
| - | Mar 16 12:17:01 vml000080 policyd-spf[12354]: | + | |
| - | Mar 16 12:17:01 vml000080 policyd-spf[12354]: | + | |
| - | Mar 16 12:17:01 vml000080 policyd-spf[12354]: | + | |
| - | Mar 16 12:17:01 vml000080 policyd-spf[12354]: | + | |
| - | Mar 16 12:17:01 vml000080 policyd-spf[12354]: | + | |
| - | </ | + | |
| - | Im Mailheader der empfangenen eMail findet sich dann auch ein entsprechender Eintrag: | + | === automatisches Starten des Dienste beim Systemstart |
| - | Received-SPF: | + | Damit der smf-spf-Daemon automatisch bei jedem Systemstart startet, denn ohne laufenden **smf-spf-daemon** verweigert nun unser **postfix** die Annahme der Nachrichten, |
| + | # chkconfig smf-spf on | ||
| - | Bei einem produktiven System | + | Die Überprüfungung ob der Dienst (Daemon) smf-spfwirklich bei jedem Systemstart automatisch mit gestartet |
| - | < | + | # chkconfig |
| - | Mar 16 13:19:05 vml000080 policyd-spf[14906]: spfcheck: pyspf result: " | + | |
| - | Mar 16 13:19:05 vml000080 policyd-spf[14906]: None; identity=helo; | + | |
| - | Mar 16 13:19:05 vml000080 policyd-spf[14906]: spfcheck: pyspf result: " | + | |
| - | Mar 16 13:19:05 vml000080 policyd-spf[14906]: | + | |
| - | Mar 16 13:19:05 vml000080 policyd-spf[14906]: | + | |
| - | </ | + | |
| - | ===== SRS - Sender Rewriting Scheme ===== | + | smf-spf 0: |
| - | Zu Beginn dieses Artikels wurde bereits darauf hingewiesen, | + | |
| - | Das nachfolgende Schaubild verdeutlicht, | + | Wichtig sind jeweils |
| - | <uml w=900> | + | Anschließend starten wir unseren Postfix-Mailserver einmal durch, damit unsere zuvor eingetragene Konfigurationsänderung aktiv werden kann. |
| + | # service postfix condrestart | ||
| - | title Mailversand einer eMail bei Weiterleitung (alias)\n | + | Shutting down postfix: |
| - | skin BlueModern | + | |
| - | participant "\n Mail-Server mx1.example.org \n 88.217.127.21 \n" as links | + | |
| - | participant "\n Mail-Server mx01.nausch.org \n 217.91.103.190 \n" as mitte | + | |
| - | participant "\n Mail-Server mx1.piratenpartei-bayern.de \n 88.198.212.215 \n" as rechts | + | |
| - | participant "\n DNS-Server von \n nausch.org \n" as DNS | + | |
| - | links -> mitte : connect | + | ==== Tests und Logging ==== |
| - | note left : \n eMail: \ From: n3rd@example.org \n To: pirat_django@piraten-it.guru \n Date: Tue, 18 Mar 2014 11:23:38 +0100 Subject: Termin \n \n Ahoi, \n kann leider nicht kommen! \n \n cul8r \n n3rd \n | + | Zum Testen schicken wir uns von einem fremden Mailserver aus, der einen gültigen |
| - | links <-- mitte : . 220 mx01.nausch.org ESMTP Postfix | + | # less / |
| - | links -> mitte : HELO mx1.example.org | + | |
| - | links <-- mitte : . 250 mx01.nausch.org | + | |
| - | links -> mitte : MAIL FROM:< | + | |
| - | mitte -> DNS : host -t TXT example.org | + | |
| - | note right : \n Abfrage des \n SPF-Records \n von example.org \n | + | |
| - | mitte <-- DNS : example.org descriptive text " | + | |
| - | note left : \n Nur der Mailserver | + | |
| - | links <-- mitte : . 250 2.1.0 Ok | + | |
| - | links -> mitte : RCPT TO:< | + | |
| - | links <-- mitte : . 250 2.1.0 Ok | + | |
| - | links -> mitte : Übermittlung der Nachricht | + | |
| - | links <-- mitte : 250 2.0.0 Ok: queued as 5957581 | + | |
| - | note left : \n Beenden der Verbindung \n | + | |
| - | mitte -> rechts | + | |
| - | note left : \n eMail: \ From: n3rd@example.org \n To: pirat_django@piraten-it.guru \n Date: Tue, 18 Mar 2014 11:23:38 +0100 Subject: Termin \n \n Ahoi, \n kann leider nicht kommen! \n \n cul8r \n n3rd \n | + | |
| - | mitte <-- rechts | + | |
| - | mitte -> rechts | + | |
| - | mitte <-- rechts : . 250 mx1.piratenpartei-bayern.de | + | |
| - | mitte -> rechts : MAIL FROM:< | + | |
| - | rechts -> DNS : host -t TXT example.org | + | |
| - | note right : \n Abfrage des \n SPF-Records \n von example.org \n | + | |
| - | rechts | + | |
| - | note left : \n Nur der Mailserver mit der \n IP 88.217.217.21 ist berechtigt \n eMails der Mail-Domain \n example.org zu versenden! \n Die IP-Adresse 217.91.103.190 ist als Versender nicht berechtigt! \n | + | |
| - | mitte <-- rechts : . | + | |
| - | note left : \n Beenden der Verbindung \n | + | |
| - | links <-- mitte | + | Damit nicht bei jeder Anfrage, der SPF-Record beim DNS abgerufen werden muss, cacht der Daemon auch entsprechend |
| - | note right : \n Bounce | + | Mar 26 14:40:18 vml000080 smf-spf[26416]: |
| - | </uml> | + | |
| - | Da in dem fiktiven | + | Natürlich wird ein Fehler beim Überprüfen des SPF-records auch im maillog vermerkt. |
| + | Dec 15 14:39:49 vml000080 smf-spf[1501]: | ||
| - | Damit die Nachricht nun beim eigentlichen Zielsystem ankommt, müssen wir dafür Sorge tragen, dass das relayende System, also unser Mailserver, beim **MAIL FROM** im **Envelope** unsere Domain als Absender setzt. Dann kann das eigentliche Zielsystem, unsere eMail annehmen, da wir für unseren | + | Im Mailheader der empfangenen eMail findet sich dann auch die entsprechenden Einträge: |
| + | Authentication-Results: | ||
| + | |||
| + | ===== SRS - Sender Rewriting Scheme ===== | ||
| + | Zu Beginn dieses Artikels wurde bereits darauf hingewiesen, dass mit unter Probleme bei Mailumleitungen und/oder WebFormularen auftauchen können. Mit **SRS**((**S**ender **R**ewriting **S**cheme)) | ||
| - | Und an dieser Stelle setzt nun Sender Rewriting Scheme (kurz **SRS**) an! Wird eine eMail weitergeleitet, | + | ====== Links ====== |
| - | | + | |
| - | Sollte die eMail zu uns zurück-bouncen, | + | |
| + | | ||
| + | | ||
| - | ==== Installation ==== | ||
| - | FIXME //... coming soon...// FIXME | ||
django