Was lehnt ihr ab beim Einliefern von Mails?

[Winfried Neessen]

Hi Daniel,

Am 11.03.2016 um 02:57 schrieb Daniel <daniel at ist-immer-online.de>:

> Was lehnt ihr ab beim Einliefern von Mails direkt ab im Postfix?
> 

Bei uns siehts so aus:

## Restrictions
strict_rfc821_envelopes = yes
smtpd_helo_required = yes
smtpd_sender_login_maps = proxy:pgsql:${config_directory}/sql_config/pgsql_virtual_sender_login_maps.cf
smtpd_recipient_restrictions =
        check_recipient_access hash:${config_directory}/access_lists/perdomain_blacklist
        reject_non_fqdn_recipient
        reject_non_fqdn_sender
        reject_unknown_sender_domain
        reject_unknown_recipient_domain
        permit_mynetworks
        reject_sender_login_mismatch
        permit_sasl_authenticated
        reject_unauth_destination
        reject_unauth_pipelining
        check_client_access hash:${config_directory}/access_lists/policyd_weight/client_whitelist
        check_sender_access hash:${config_directory}/access_lists/policyd_weight/sender_whitelist
        check_recipient_access hash:${config_directory}/access_lists/policyd_weight/rcpt_whitelist
        check_policy_service inet:127.0.0.1:12525
        check_recipient_access hash:${config_directory}/access_lists/rfc2142
        reject_invalid_hostname
        check_helo_access hash:${config_directory}/access_lists/helo_access
        check_client_access hash:${config_directory}/access_lists/client_access
        check_sender_access hash:${config_directory}/access_lists/sender_access
        check_recipient_access hash:${config_directory}/access_lists/recipient_access
        check_client_access hash:${config_directory}/access_lists/rbl_client_exceptions
        reject_rbl_client bl.spamcop.net
        reject_rbl_client zen.spamhaus.org
        reject_rbl_client dnsbl.sorbs.net
        reject_rbl_client ix.dnsbl.manitu.net
        reject_rbl_client b.barracudacentral.org
        reject_spf_invalid_sender
        permit
smtpd_data_restrictions =
        reject_multi_recipient_bounce

Dazu kommen dann noch ein paar header_checks. Wir haben mit der Config eigentlich
eine sehr geringe False-Positives Zahl.


Winni
-------------- nächster Teil --------------
Ein Dateianhang mit Binärdaten wurde abgetrennt...
Dateiname   : signature.asc
Dateityp    : application/pgp-signature
Dateigröße  : 801 bytes
Beschreibung: Message signed with OpenPGP using GPGMail
URL         : <https://listi.jpberlin.de/pipermail/postfixbuch-users/attachments/20160311/5765553e/attachment.asc>