History of postmax
This installation guide is intended to walk you through completely setting up a postfix smtp mail server with the maximum spam and anti-virus protection available from the open-source community. This technique is similar to that provided ((Mac OS X Server Mail)) with IP and DNS protection. It is an amalgamation of several online tutorials available throughout the net and from the software vendors, but all in one neat and tidy place. Our sincere thanks to all who contributed such wonderful software to make this world a better place.
!1. Software Install
{code source="bash"}yum install postfix spamassassin amavisd-new clamav
chkconfig postfix on
chkconfig clamd on
chkconfig freshclam on
chkconfig amavisd on
{/code}
For RedHat / CentOS, you might need to get the RPM's from [http://dag.wieers.com/rpm/FAQ.php#B|DAG]
!2. Anti-Virus Configuration
Tweak __/etc/amavisd.conf__ with your host information, and uncomment the clamd scanner
{code source="txt"}['ClamAV-clamd',
\&ask_daemon, ["CONTSCAN {}\n", "127.0.0.1:3310"],
qr/\bOK$/, qr/\bFOUND$/,
qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],{/code}
You might need to change the socket listed with "127.0.0.1:3310" as listed above. SpamAssassin settings are made in this file. Also, make sure __$inet_socket_port = 10024;__ See [http://www200.pair.com/mecham/spam/amavisd-settings.html|detailed explanation of amavisd.conf] for more information.
{code souce="bash"}/etc/init.d/clamd start
service amavisd start
service clamd start
# If you are behind a proxy, you need adjust /etc/freshclam.conf
freshclam
service freshclam start{/code}
postconf -e 'content_filter = amavis:[127.0.0.1]:10024'
postconf -e 'receive_override_options = no_address_mappings'
Append these lines to __/etc/postfix/master.cf__
{code source="text"}amavis unix - - - - 2 smtp
-o smtp_data_done_timeout=1200
-o smtp_send_xforward_command=yes
-o disable_dns_lookups=yes
127.0.0.1:10025 inet n - - - - smtpd
-o content_filter=
-o local_recipient_maps=
-o relay_recipient_maps=
-o smtpd_restriction_classes=
-o smtpd_client_restrictions=
-o smtpd_helo_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,reject
-o mynetworks=127.0.0.0/8
-o strict_rfc821_envelopes=yes
-o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
-o smtpd_bind_address=127.0.0.1{/code}
Restart postfix
If you run a server for a significant number of users, you will want to run several virus scans at once. Change the 2 in two places: "- - - - 2" as above in master.cf, and "$max_servers = 2;" in amavisd.conf. These numbers should always match.
!3. Test Setup
Use telnet to see if the appropriate ports are open:
telnet yourhost.com 25
telnet localhost 3310
telnet localhost 10025
telnet localhost 10024
!4. IP Address Spam Prevention
!!__[http://tqmcube.com/rbldnsd.php|RBLDNSD]__
This is a local DNS server database that performs local (e.g. FAST) DNS lookups against a list of dynamic and blacklisted IP's. Successful local lookup means it's on the blacklist and will be rejected.
#Install the rbldns RPM (available in Fedora Extras, or [http://www.corpit.ru/mjt/rbldnsd.html|source])
#Edit your __named.conf__ and add:{code source="txt"}
zone "clients.blocked.rbl" IN {
type forward;
forward first;
forwarders { 127.0.0.1 port 530; };
};
zone "hosts.blocked.rbl" IN {
type forward;
forward first;
forwarders { 127.0.0.1 port 530; };
};{/code}
#Edit __/etc/sysconfig/rbldnsd__ and add the following lines:{code source="txt"}RBLDNSD="dsbl -r/var/lib/rbldnsd -b 127.0.0.1/530 \
clients.blocked.rbl:ip4set:clients,dynamic \
hosts.blocked.rbl:dnset:hosts \
"{code}
#Get the [http://tqmcube.com/files/dnsbl_lists.tar.bz2|latest RBLDNS databases] and move database files to /var/lib/rbldnsd
# Gentlepeople, start your daemons: "service restart named; service restart rbldnsd;" Test with telnet localhost 53; and telnet locahost 530;
# Preform a test lookup:{code source="text"}
$dig @localhost 223.61.83.162.clients.blocked.rbl -t txt
;; ANSWER SECTION:
223.61.83.162.clients.blocked.rbl. 2048 IN TXT "DNSBL. 162.83.61.223 is a known spam source. Mail from 162.83.61.223 is NOT accepted on this server!"
{/code}
# Update the following line of your __/etc/postfix/main.cf__{code source="txt"}
smtpd_recipient_restrictions = permit_mynetworks,reject_unauth_destination,reject_rbl_client clients.blocked.rbl,reject_rhsbl_client hosts.blocked.rbl,reject_rhsbl_sender hosts.blocked.rbl{/code}
!![http://wiki.apache.org/spamassassin/DnsBlocklists|Spamassassin DNS Blocklists]
__En-masse IP Block__ Here is a tutorial for [http://www.fadden.com/techmisc/asian-spam.htm|Blocking E-mail from China and Korea] using Postfix and the [http://okean.com/asianspamblocks.html|Okean CIDR Blocks]
!5. DNS Spam Prevention
There are two main options DomainKeys, and SenderID.
DomainKeys were invented by Yahoo, SenderID was invented by Microsoft. These are arguably competing techniques, however, implementing both seems to have no ill-effect. Given SenderID was invented by Microsoft, you can be assured Outlook Server SMTP gateways employ SenderID, and are unlikely to support DomainKeys any time soon. In early 2005 when these proposals came out simultaneously, they were seen as competing techniques. As time has passed, they are now seen as more complementary, and typically both are implemented.
!!DomainKeys Identified Mail
[http://www.dkim.org/|Domain Keys Identified Mail] is the newest open-standard e-mail authentication specification. To use DomainKeys, typically a filter or "plugin" is needed for your SMTP gateway. There is a [http://dkimproxy.sourceforge.net/|postfix filter] that is fairly easy to install and configure. Several perl modules need to be installed:
!!!DKIMproxy
#Install necessary perl modules (make sure you have openssl-devel installed):{code source="bash"}cpan -i Crypt::OpenSSL::RSA Mail::Address MIME::Base64 Net::DNS Net::Server Test::More Mail::DKIM Error{/code}
#[http://dkimproxy.sourceforge.net/|download source], extract tarball, cd into directory, and compile source with __./configure --prefix=/usr/local/dkimproxy ; make install__
# For outbound mail signing, you will need a public/private key combo. {code source="txt"}
openssl genrsa -out private_domainkey.key 1024
openssl rsa -in private.key -pubout -out public_domainkey.key{/code}
#Tweak __sample-dkim-init-script.sh__ and copy to /etc/init.d/dkim - Either make a dkimproxy user or change DKIMPROXYUSER and DKIMPROXYGROUP to postfix. The following are line changes made, adjust to your liking...{code source="bash"}
*snip*
DKIMPROXYUSER=postfix
DKIMPROXYGROUP=postfix
*snip*
DKIMPROXY_IN_CFG="/etc/dkimproxy_in.conf"
DKIMPROXY_OUT_CFG="/etc/dkimproxy_out.conf"
{/code}
#Customize the default in confiugration __cp /usr/local/dkimproxy/etc/dkimproxy_in.conf.example /etc/dkimproxy_in.conf__ and modify /etc/dkimproxy_in.conf{code source="bash"}
# specify what address/port DKIMproxy should listen on
listen 127.0.0.1:10026
# specify what address/port DKIMproxy forwards mail to
relay 127.0.0.1:10027
{/code}
#Customize the default out confiugration __cp /usr/local/dkimproxy/etc/dkimproxy_out.conf.example /etc/dkimproxy_out.conf__ and modify /etc/dkimproxy_out.conf{code source="bash"}
# specify what address/port DKIMproxy should listen on
listen 127.0.0.1:10028
# specify what address/port DKIMproxy forwards mail to
relay 127.0.0.1:10029
# specify what domains DKIMproxy can sign for (comma-separated, no spaces)
domain yourdomain.com
# specify what signatures to add
signature dkim(c=relaxed)
signature domainkeys(c=nofws)
# specify location of the private key
keyfile /etc/pki/domainkeys/private.key
# specify the selector (i.e. the name of the key record put in DNS)
selector selector1
{/code}
#start dkim with __service dkim start__. Test ports are up and running with telnet localhost 10026 and telnet localhost 10028
#Add inbound dkim postfix configuration to __/etc/postfix/master.cf__{code source="txt"}#
# The main SMTP server. It receives incoming mail from the network
# and passes it to the content filter on localhost port 10026.
#
smtp inet n - n - - smtpd
-o smtpd_proxy_filter=127.0.0.1:10026
-o smtpd_client_connection_count_limit=10
#
# After-filter SMTP server. Receive mail from the DKIM verifying proxy on
# localhost port 10027.
#
127.0.0.1:10027 inet n - n - - smtpd
-o smtpd_authorized_xforward_hosts=127.0.0.0/8
-o smtpd_client_restrictions=
-o smtpd_helo_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,reject
-o smtpd_data_restrictions=
-o mynetworks=127.0.0.0/8
-o receive_override_options=no_unknown_recipient_checks{/code}
#Add outbound filter to sign outgoing messages in postfix configuration __/etc/postfix/master.cf__{code souce="txt"}
#
# modify the default submission service to specify a content filter
# and restrict it to local clients and SASL authenticated clients only
#
submission inet n - n - - smtpd
-o smtpd_etrn_restrictions=reject
-o smtpd_sasl_auth_enable=yes
-o content_filter=dksign:[127.0.0.1]:10028
-o receive_override_options=no_address_mappings
-o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject
#
# specify the location of the DKIM signing proxy
# Note: the smtp_discard_ehlo_keywords option requires a recent version of
# Postfix. Leave it off if your version does not support it.
#
dksign unix - - n - 10 smtp
-o smtp_send_xforward_command=yes
-o smtp_discard_ehlo_keywords=8bitmime,starttls
#
# service for accepting messages FROM the DKIM signing proxy
#
127.0.0.1:10029 inet n - n - 10 smtpd
-o content_filter=
-o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
-o smtpd_helo_restrictions=
-o smtpd_client_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,reject
-o mynetworks=127.0.0.0/8
-o smtpd_authorized_xforward_hosts=127.0.0.0/8{/code}
!!SenderID (and SPF)
SenderID merged with a smaller group called Sender Policy Framework (SPF). SPF is a very simple mechanism for specifying which servers are valid for sending your email and is much simpler to implement than DomainKeys. Microsoft holds several patents in relation to the SenderID framework, however it released those patents in the "public domain" this past october. Beyond the typical cynicism of Microsoft's ulterior motives, SPF has a significant [http://www.advogato.org/article/816.html|amount of technical criticism]. Regardless, [http://itmanagement.earthweb.com/columns/executive_tech/article.php/3604761|many major ISP's are using SPF] to filter mail, including AOL (and RoadRunner) which has in some reports exclusively implemented SPF to some degree. (Spamassassin reports SOFT_FAIL reports from bogus .rr.com emails.)
!!!Spamassassin SPF Support
#Install SPF perl module{code source="txt"}cpan -i Mail::SPF::Query{/code}
!!!SPF Outbound support
The quickest way to get the DNS entries up and running is to [http://www.openspf.org/FAQ/Manage_my_own|follow the wizard].
!6. Spamassassin Advanced Tools
!![http://razor.sourceforge.net/|Razor]
#Get the [http://razor.sourceforge.net/|latest SDK source] and install {code source="bash"}wget http://unc.dl.sourceforge.net/sourceforge/razor/razor-agents-sdk-2.07.tar.gz
tar xvzf razor-agents-sdk-2.07.tar.gz
cd razor-agents-sdk-2.07
perl Makefile.PL && make && make install # Or, if not root: perl Makefile.PL PREFIX=$HOME && make && make install{/code}
# Get the [http://razor.sourceforge.net/|latest agents source] and register agents{code source="bash"}wget http://unc.dl.sourceforge.net/sourceforge/razor/razor-agents-2.84.tar.gz
tar xvzf razor-agents-2.84.tar.gz
cd razor-agents-2.84
perl Makefile.PL PREFIX=$HOME && make && make install # Or, if installing system-wide as root: perl Makefile.PL && make && make install
razor-admin -create
razor-admin -discover
razor-admin -register{/code}
!Troubleshooting
*Be sure to watch your logs, such as: tail -f /var/log/maillog
*Config tinkering can lead to one of the services being down..
*On SLES 10, it seems clamd can take up to 10 minutes to begin accepting connections. Reason currenly unknown. Please chime in if you have any ideas.
*Check your open ports with __netstat -lp__ and you should see somthing like:{code source="txt}# netstat -lp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 localhost:10024 *:* LISTEN 2011/amavisd (maste
tcp 0 0 localhost:10025 *:* LISTEN 19755/master
tcp 0 0 localhost:10026 *:* LISTEN 19221/perl
tcp 0 0 localhost:10027 *:* LISTEN 19755/master
tcp 0 0 localhost:10028 *:* LISTEN 19229/perl
tcp 0 0 localhost:10029 *:* LISTEN 19755/master
tcp 0 0 localhost:dyna-access *:* LISTEN 1803/clamd
tcp 0 0 localhost:domain *:* LISTEN 1875/named
tcp 0 0 *:smtp *:* LISTEN 19755/master
tcp 0 0 *:domain *:* LISTEN 1875/named
tcp 0 0 *:ssh *:* LISTEN 2064/sshd
tcp 0 0 *:smtp *:* LISTEN 19755/master
*snip*{/code}
* Error like : {code source="text"}child process [20099]: Error closing main::stdin: Bad file descriptor at /usr/sbin/amavisd line 1872, <GEN8> line 74.\n{/code} Net: :Server 0.91 (or later) introduced a change which makes it incompatible with amavisd-new-2.3.3 (or earlier). Either [http://www.ijs.si/software/amavisd/#download|upgrade amavis] or downgrade your perl Net: :Server
!References and Other tutorails
[http://wiki.apache.org/spamassassin/SingleUserUnixInstall]
[http://devnull.com/kyler/dspam.20040512.html]
[http://howtoforge.com/virtual-users-domains-postfix-courier-mysql-squirrelmail-mandriva2008.1-p3]
!1. Software Install
{code source="bash"}yum install postfix spamassassin amavisd-new clamav
chkconfig postfix on
chkconfig clamd on
chkconfig freshclam on
chkconfig amavisd on
{/code}
For RedHat / CentOS, you might need to get the RPM's from [http://dag.wieers.com/rpm/FAQ.php#B|DAG]
!2. Anti-Virus Configuration
Tweak __/etc/amavisd.conf__ with your host information, and uncomment the clamd scanner
{code source="txt"}['ClamAV-clamd',
\&ask_daemon, ["CONTSCAN {}\n", "127.0.0.1:3310"],
qr/\bOK$/, qr/\bFOUND$/,
qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],{/code}
You might need to change the socket listed with "127.0.0.1:3310" as listed above. SpamAssassin settings are made in this file. Also, make sure __$inet_socket_port = 10024;__ See [http://www200.pair.com/mecham/spam/amavisd-settings.html|detailed explanation of amavisd.conf] for more information.
{code souce="bash"}/etc/init.d/clamd start
service amavisd start
service clamd start
# If you are behind a proxy, you need adjust /etc/freshclam.conf
freshclam
service freshclam start{/code}
postconf -e 'content_filter = amavis:[127.0.0.1]:10024'
postconf -e 'receive_override_options = no_address_mappings'
Append these lines to __/etc/postfix/master.cf__
{code source="text"}amavis unix - - - - 2 smtp
-o smtp_data_done_timeout=1200
-o smtp_send_xforward_command=yes
-o disable_dns_lookups=yes
127.0.0.1:10025 inet n - - - - smtpd
-o content_filter=
-o local_recipient_maps=
-o relay_recipient_maps=
-o smtpd_restriction_classes=
-o smtpd_client_restrictions=
-o smtpd_helo_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,reject
-o mynetworks=127.0.0.0/8
-o strict_rfc821_envelopes=yes
-o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
-o smtpd_bind_address=127.0.0.1{/code}
Restart postfix
If you run a server for a significant number of users, you will want to run several virus scans at once. Change the 2 in two places: "- - - - 2" as above in master.cf, and "$max_servers = 2;" in amavisd.conf. These numbers should always match.
!3. Test Setup
Use telnet to see if the appropriate ports are open:
telnet yourhost.com 25
telnet localhost 3310
telnet localhost 10025
telnet localhost 10024
!4. IP Address Spam Prevention
!!__[http://tqmcube.com/rbldnsd.php|RBLDNSD]__
This is a local DNS server database that performs local (e.g. FAST) DNS lookups against a list of dynamic and blacklisted IP's. Successful local lookup means it's on the blacklist and will be rejected.
#Install the rbldns RPM (available in Fedora Extras, or [http://www.corpit.ru/mjt/rbldnsd.html|source])
#Edit your __named.conf__ and add:{code source="txt"}
zone "clients.blocked.rbl" IN {
type forward;
forward first;
forwarders { 127.0.0.1 port 530; };
};
zone "hosts.blocked.rbl" IN {
type forward;
forward first;
forwarders { 127.0.0.1 port 530; };
};{/code}
#Edit __/etc/sysconfig/rbldnsd__ and add the following lines:{code source="txt"}RBLDNSD="dsbl -r/var/lib/rbldnsd -b 127.0.0.1/530 \
clients.blocked.rbl:ip4set:clients,dynamic \
hosts.blocked.rbl:dnset:hosts \
"{code}
#Get the [http://tqmcube.com/files/dnsbl_lists.tar.bz2|latest RBLDNS databases] and move database files to /var/lib/rbldnsd
# Gentlepeople, start your daemons: "service restart named; service restart rbldnsd;" Test with telnet localhost 53; and telnet locahost 530;
# Preform a test lookup:{code source="text"}
$dig @localhost 223.61.83.162.clients.blocked.rbl -t txt
;; ANSWER SECTION:
223.61.83.162.clients.blocked.rbl. 2048 IN TXT "DNSBL. 162.83.61.223 is a known spam source. Mail from 162.83.61.223 is NOT accepted on this server!"
{/code}
# Update the following line of your __/etc/postfix/main.cf__{code source="txt"}
smtpd_recipient_restrictions = permit_mynetworks,reject_unauth_destination,reject_rbl_client clients.blocked.rbl,reject_rhsbl_client hosts.blocked.rbl,reject_rhsbl_sender hosts.blocked.rbl{/code}
!![http://wiki.apache.org/spamassassin/DnsBlocklists|Spamassassin DNS Blocklists]
__En-masse IP Block__ Here is a tutorial for [http://www.fadden.com/techmisc/asian-spam.htm|Blocking E-mail from China and Korea] using Postfix and the [http://okean.com/asianspamblocks.html|Okean CIDR Blocks]
!5. DNS Spam Prevention
There are two main options DomainKeys, and SenderID.
DomainKeys were invented by Yahoo, SenderID was invented by Microsoft. These are arguably competing techniques, however, implementing both seems to have no ill-effect. Given SenderID was invented by Microsoft, you can be assured Outlook Server SMTP gateways employ SenderID, and are unlikely to support DomainKeys any time soon. In early 2005 when these proposals came out simultaneously, they were seen as competing techniques. As time has passed, they are now seen as more complementary, and typically both are implemented.
!!DomainKeys Identified Mail
[http://www.dkim.org/|Domain Keys Identified Mail] is the newest open-standard e-mail authentication specification. To use DomainKeys, typically a filter or "plugin" is needed for your SMTP gateway. There is a [http://dkimproxy.sourceforge.net/|postfix filter] that is fairly easy to install and configure. Several perl modules need to be installed:
!!!DKIMproxy
#Install necessary perl modules (make sure you have openssl-devel installed):{code source="bash"}cpan -i Crypt::OpenSSL::RSA Mail::Address MIME::Base64 Net::DNS Net::Server Test::More Mail::DKIM Error{/code}
#[http://dkimproxy.sourceforge.net/|download source], extract tarball, cd into directory, and compile source with __./configure --prefix=/usr/local/dkimproxy ; make install__
# For outbound mail signing, you will need a public/private key combo. {code source="txt"}
openssl genrsa -out private_domainkey.key 1024
openssl rsa -in private.key -pubout -out public_domainkey.key{/code}
#Tweak __sample-dkim-init-script.sh__ and copy to /etc/init.d/dkim - Either make a dkimproxy user or change DKIMPROXYUSER and DKIMPROXYGROUP to postfix. The following are line changes made, adjust to your liking...{code source="bash"}
*snip*
DKIMPROXYUSER=postfix
DKIMPROXYGROUP=postfix
*snip*
DKIMPROXY_IN_CFG="/etc/dkimproxy_in.conf"
DKIMPROXY_OUT_CFG="/etc/dkimproxy_out.conf"
{/code}
#Customize the default in confiugration __cp /usr/local/dkimproxy/etc/dkimproxy_in.conf.example /etc/dkimproxy_in.conf__ and modify /etc/dkimproxy_in.conf{code source="bash"}
# specify what address/port DKIMproxy should listen on
listen 127.0.0.1:10026
# specify what address/port DKIMproxy forwards mail to
relay 127.0.0.1:10027
{/code}
#Customize the default out confiugration __cp /usr/local/dkimproxy/etc/dkimproxy_out.conf.example /etc/dkimproxy_out.conf__ and modify /etc/dkimproxy_out.conf{code source="bash"}
# specify what address/port DKIMproxy should listen on
listen 127.0.0.1:10028
# specify what address/port DKIMproxy forwards mail to
relay 127.0.0.1:10029
# specify what domains DKIMproxy can sign for (comma-separated, no spaces)
domain yourdomain.com
# specify what signatures to add
signature dkim(c=relaxed)
signature domainkeys(c=nofws)
# specify location of the private key
keyfile /etc/pki/domainkeys/private.key
# specify the selector (i.e. the name of the key record put in DNS)
selector selector1
{/code}
#start dkim with __service dkim start__. Test ports are up and running with telnet localhost 10026 and telnet localhost 10028
#Add inbound dkim postfix configuration to __/etc/postfix/master.cf__{code source="txt"}#
# The main SMTP server. It receives incoming mail from the network
# and passes it to the content filter on localhost port 10026.
#
smtp inet n - n - - smtpd
-o smtpd_proxy_filter=127.0.0.1:10026
-o smtpd_client_connection_count_limit=10
#
# After-filter SMTP server. Receive mail from the DKIM verifying proxy on
# localhost port 10027.
#
127.0.0.1:10027 inet n - n - - smtpd
-o smtpd_authorized_xforward_hosts=127.0.0.0/8
-o smtpd_client_restrictions=
-o smtpd_helo_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,reject
-o smtpd_data_restrictions=
-o mynetworks=127.0.0.0/8
-o receive_override_options=no_unknown_recipient_checks{/code}
#Add outbound filter to sign outgoing messages in postfix configuration __/etc/postfix/master.cf__{code souce="txt"}
#
# modify the default submission service to specify a content filter
# and restrict it to local clients and SASL authenticated clients only
#
submission inet n - n - - smtpd
-o smtpd_etrn_restrictions=reject
-o smtpd_sasl_auth_enable=yes
-o content_filter=dksign:[127.0.0.1]:10028
-o receive_override_options=no_address_mappings
-o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject
#
# specify the location of the DKIM signing proxy
# Note: the smtp_discard_ehlo_keywords option requires a recent version of
# Postfix. Leave it off if your version does not support it.
#
dksign unix - - n - 10 smtp
-o smtp_send_xforward_command=yes
-o smtp_discard_ehlo_keywords=8bitmime,starttls
#
# service for accepting messages FROM the DKIM signing proxy
#
127.0.0.1:10029 inet n - n - 10 smtpd
-o content_filter=
-o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
-o smtpd_helo_restrictions=
-o smtpd_client_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,reject
-o mynetworks=127.0.0.0/8
-o smtpd_authorized_xforward_hosts=127.0.0.0/8{/code}
!!SenderID (and SPF)
SenderID merged with a smaller group called Sender Policy Framework (SPF). SPF is a very simple mechanism for specifying which servers are valid for sending your email and is much simpler to implement than DomainKeys. Microsoft holds several patents in relation to the SenderID framework, however it released those patents in the "public domain" this past october. Beyond the typical cynicism of Microsoft's ulterior motives, SPF has a significant [http://www.advogato.org/article/816.html|amount of technical criticism]. Regardless, [http://itmanagement.earthweb.com/columns/executive_tech/article.php/3604761|many major ISP's are using SPF] to filter mail, including AOL (and RoadRunner) which has in some reports exclusively implemented SPF to some degree. (Spamassassin reports SOFT_FAIL reports from bogus .rr.com emails.)
!!!Spamassassin SPF Support
#Install SPF perl module{code source="txt"}cpan -i Mail::SPF::Query{/code}
!!!SPF Outbound support
The quickest way to get the DNS entries up and running is to [http://www.openspf.org/FAQ/Manage_my_own|follow the wizard].
!6. Spamassassin Advanced Tools
!![http://razor.sourceforge.net/|Razor]
#Get the [http://razor.sourceforge.net/|latest SDK source] and install {code source="bash"}wget http://unc.dl.sourceforge.net/sourceforge/razor/razor-agents-sdk-2.07.tar.gz
tar xvzf razor-agents-sdk-2.07.tar.gz
cd razor-agents-sdk-2.07
perl Makefile.PL && make && make install # Or, if not root: perl Makefile.PL PREFIX=$HOME && make && make install{/code}
# Get the [http://razor.sourceforge.net/|latest agents source] and register agents{code source="bash"}wget http://unc.dl.sourceforge.net/sourceforge/razor/razor-agents-2.84.tar.gz
tar xvzf razor-agents-2.84.tar.gz
cd razor-agents-2.84
perl Makefile.PL PREFIX=$HOME && make && make install # Or, if installing system-wide as root: perl Makefile.PL && make && make install
razor-admin -create
razor-admin -discover
razor-admin -register{/code}
!Troubleshooting
*Be sure to watch your logs, such as: tail -f /var/log/maillog
*Config tinkering can lead to one of the services being down..
*On SLES 10, it seems clamd can take up to 10 minutes to begin accepting connections. Reason currenly unknown. Please chime in if you have any ideas.
*Check your open ports with __netstat -lp__ and you should see somthing like:{code source="txt}# netstat -lp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 localhost:10024 *:* LISTEN 2011/amavisd (maste
tcp 0 0 localhost:10025 *:* LISTEN 19755/master
tcp 0 0 localhost:10026 *:* LISTEN 19221/perl
tcp 0 0 localhost:10027 *:* LISTEN 19755/master
tcp 0 0 localhost:10028 *:* LISTEN 19229/perl
tcp 0 0 localhost:10029 *:* LISTEN 19755/master
tcp 0 0 localhost:dyna-access *:* LISTEN 1803/clamd
tcp 0 0 localhost:domain *:* LISTEN 1875/named
tcp 0 0 *:smtp *:* LISTEN 19755/master
tcp 0 0 *:domain *:* LISTEN 1875/named
tcp 0 0 *:ssh *:* LISTEN 2064/sshd
tcp 0 0 *:smtp *:* LISTEN 19755/master
*snip*{/code}
* Error like : {code source="text"}child process [20099]: Error closing main::stdin: Bad file descriptor at /usr/sbin/amavisd line 1872, <GEN8> line 74.\n{/code} Net: :Server 0.91 (or later) introduced a change which makes it incompatible with amavisd-new-2.3.3 (or earlier). Either [http://www.ijs.si/software/amavisd/#download|upgrade amavis] or downgrade your perl Net: :Server
!References and Other tutorails
[http://wiki.apache.org/spamassassin/SingleUserUnixInstall]
[http://devnull.com/kyler/dspam.20040512.html]
[http://howtoforge.com/virtual-users-domains-postfix-courier-mysql-squirrelmail-mandriva2008.1-p3]