[SOLVED] postfix: Block certain SMTP clients

gdr · 08-28-2013, 03:58 AM

I've identified two hosts which regularly spam my users, yet come undetected by spam filters. They're ran by "newsletter" companies which have really good deliverability rate and thus use proper RDNS.

So I tried blocking them in smtp_header_checks like this:

Code:

/^Received: .*\.inis\.pl/                       REJECT Spamerzy wypierdalac!
/^Received: .*\.freshmail\.pl/                  REJECT Spamerzy wypierdalac!

But obviously this didn't work - the Received headers are created further in the pipeline.

How do I block certain remote hosts from connecting based on their RDNS, without resorting to iptables and IP-level blocks?

Berhanie · 08-28-2013, 05:12 AM

i think you meant to use header_checks, not smtp_header_checks, since the smtp_*_checks are done only for outgoing mail.

but, i would try do the filtering at connection time, with smtpd_client_restrictions, or based on MAIL FROM, with smtpd_sender_restrictions. i think that the MAIL FROM value gets copied into the Received header anyway.

gdr · 08-28-2013, 09:09 AM

The MAIL FROM command wouldn't do it, these operators send emails from many domains, but it's always the same set of mail servers with the same RDNS.

But thank you for header_checks! I have the gift of misunderstanding Postfix documentation every time I read it

gdr · 08-28-2013, 09:21 AM

I've found exactly what I needed - it's called check_client_access and works like this (borrowed from Nixcraft forums):

/etc/postfix/main.cf

Code:

smtpd_recipient_restrictions =
	permit_mynetworks
	permit_sasl_authenticated
	reject_unauth_destination
	etc....
	check_client_access regexp:/etc/postfix/blacklist_clients
	etc..
	permit

/etc/postfix/blacklist_clients

Code:

# IP
/^10\.10\.1\.2$/		REJECT UCE black-listed
# IP block
/^10\.10\.1/			REJECT UCE black-listed
# exact domain
/^example\.com$/		REJECT UCE black-listed
# everything in a domain
/example\.com$/			REJECT UCE black-listed
# specific hosts
/^uce-relay\.example\.com$/	REJECT UCE black-listed

Berhanie · 08-28-2013, 07:40 PM

good job. ignore my comment on MAIL FROM being copied to Received. that was nonsense.