My personal notes on all things technical and factual....

Clayton's Tech Bits

Search this site:

Custom Search

Sat, 06 Sep 2008

/Admin/email/postfix: Impeding Spammers: Cap the SMTP E-mail Send Rate

One name: postfix-policyd[1]. Awesome. And I am only using just one of its features to-date.

I am not sure what the performance hit will be, because policyd is quite data intensive, and therefore is in fairly constant communication with MySQL. But this is an unavoidable nature of the beast.

The feature I am using is "Sender-based Throttling", wherein I can restrict *anyone* (not just my own users) who connects to my SMTP server to sending no more then a specified number of messages into my server over a specified period of time (message rate - say max 10 msgs/hr, for instance) addressed to no more then a specific number of addressees per period (say max 100 addressees per hour, for instance). The same feature is also supposed to restrict message size, and bandwidth used (ie. MB per hour, for instance, per user) but I have not yet gotten this working.

One caveat: webmail clients running on the same server do not use SMTP to send mail, they just use sendmail. So this method of restriction does not apply to webmail users (who are a *much* smaller spam problem...)

One gotcha, that wasted several of my hours: I finally figured out that when I used StartTLS / SASL to send a message through SMTP, it was not being counted. This was caused by an order-of-parameters problem in /etc/postfix/main.cf. The postfix website[2] says main.cf should be configured as follows:


 5 /etc/postfix/main.cf:
 6     smtpd_recipient_restrictions =
 7         ... 
 8         reject_unauth_destination 
 9         check_policy_service unix:private/policy

which implied that check_policy_service should be the last item on the list. My current smtpd_recipient_restrictions list looks like this:


smtpd_recipient_restrictions = 
   check_policy_service inet:127.0.0.1:10031
   permit_sasl_authenticated
   reject_unauth_destination
   reject_unlisted_recipient

My problem was that before, permit_sasl_authenticated was at the top of the list, which meant that SASL authenticated e-mails were immediately accepted and NEVER PASSED to policyd. Move permit_sasl_authenticated below the check_policy_service and policyd gets to make its decision first.

[1] http://www.policyd.org/
[2] http://www.postfix.org/SMTPD_POLICY_README.html

posted at: 02:08 | path: /Admin/email/postfix | permanent link to this entry

Home

Contact

Resumé / C.V.

Links

Categories:

Archives:

Subscribe XML RSS Feed

Sat, 06 Sep 2008