Имеется почтовик Exchange 2003. Spam одолел. Встала задача по настройке шлюза хоть как-то режущего spam. Взор пал на Postgrey + Postfix. Настроил вроде правильно, шлюзом доволен, спам уменьшился в разы. Но появилась не большая проблемка, появились нормальные адреса, которые тоже не пропускаются. Вот ошибки с логов:
один домен
Код: Выделить всё
Apr 29 11:36:13 MailGateway postfix/smtpd[3190]: connect from mail2.samara.ххх.ru[83.242.х.х]
Apr 29 11:36:13 MailGateway postfix/smtpd[3190]: E3C76FF8CB: client=mail2.samara.ххх.ru[83.242.х.х]
Apr 29 11:36:13 MailGateway postfix/smtpd[3190]: warning: Recipient address rate limit exceeded: 2 from mail2.samara.ххх.ru[83.242.х.х] for service smtp
Apr 29 11:36:13 MailGateway postfix/smtpd[3190]: too many errors after RCPT from mail2.samara.ххх.ru[83.242.х.х]
Apr 29 11:36:13 MailGateway postfix/smtpd[3190]: disconnect from mail2.samara.ххх.ru[83.242.х.х]второй домен
Код: Выделить всё
Apr 27 11:00:41 MailGateway postfix/smtpd[707]: connect from relay1.ххх.ru[195.239.х.х]
Apr 27 11:00:41 MailGateway postfix/smtpd[707]: E29CF100280: client=relay1.ххх.ru[195.239.х.х]
Apr 27 11:00:41 MailGateway postfix/smtpd[707]: warning: Recipient address rate limit exceeded: 2 from relay1.ххх.ru[195.239.х.х] for service smtp
Apr 27 11:00:41 MailGateway postfix/smtpd[707]: too many errors after RCPT from relay1.ххх.ru[195.239.х.х]
Apr 27 11:00:41 MailGateway postfix/smtpd[707]: disconnect from relay1.ххх.ru[195.239.х.х]Попытался сам решить не получилось .
Увеличивал в Postfix количество соединений не помогло
Код: Выделить всё
smtpd_recipient_limit = 500В концовке решил эти IP и DNS имена в белый список внести.
Вроде настроил, но тоже не помогло. Добавил два файла WhiteDNS и WhiteIP в один вношу домены, в другой IP адреса.
И так настройки моего postfix
Main.cf
Код: Выделить всё
# See /usr/share/postfix/main.cf.dist for a commented, more complete version
# Debian specific: Specifying a file name will cause the first
# line of that file to be used as the name. The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no
# appending .domain is the MUA's job.
append_dot_mydomain = no
# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h
readme_directory = no
# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.
myhostname = mailgateway
mydomain = xxx-xxx.ru
local_recipient_maps =
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = antispam.xxx-x.ru, antispam, localhost.localdomain, localhost, xxx-x.ru, x-xxx.ru
relay_domains = xxx-x.ru, xxx-x.ru
relayhost =
mynetworks = 127.0.0.0/8, 192.168.0.102 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
# Postgrey Antispam
smtpd_recipient_restrictions = permit_mynetworks,
permit_sasl_authenticated,
reject_unauth_destination,
check_sender_access = hash:/etc/postfix/WhiteDNS,
check_policy_service inet:127.0.0.1:10023
transport_maps = hash:/etc/postfix/transport
virtual_transport = hash:/etc/postfix/transport
bounce_queue_lifetime = 1d
maximal_queue_lifetime = 1d
minimal_backoff_time = 180s
maximal_backoff_time = 12h
strict_rfc821_envelopes = yes
disable_vrfy_command = yes
smtpd_delay_reject = yes
smtpd_helo_required = yes
anvil_rate_time_unit = 60s
smtp_always_send_ehlo = yes
smtpd_hard_error_limit = 1
smtpd_recipient_limit = 500
smtpd_sasl_security_options = noanonymous
anvil_rate_time_unit = 60s
smtpd_client_connection_count_limit = 5
smtpd_client_connection_rate_limit = 6
smtpd_client_message_rate_limit = 6
smtpd_client_recipient_rate_limit = 1
smtpd_client_recipient_rate_limit = 1
smtpd_client_restrictions =
reject_unauth_pipelining,
permit_sasl_authenticated,
permit_mynetworks,
check_helo_access regexp:/etc/postfix/helo,
reject_unknown_client_hostname,
check_client_access regexp:/etc/postfix/dul_checks,
permit
smtpd_helo_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
reject_unknown_client,
# проверяем IP на присутствие в спам-листах
# reject_rbl_client cbl.abuseat.org,
# reject_rbl_client sbl-xbl.spamhaus.org,
# reject_rbl_client sbl.spamhaus.org,
# reject_rbl_client dnsbl.njabl.org,
check_helo_access regexp:/etc/postfix/helo,
reject_invalid_helo_hostname,
reject_non_fqdn_helo_hostname,
reject_unknown_helo_hostname,
check_sender_access hash:/etc/postfix/access,
check_recipient_access hash:/etc/postfix/recipients,
permit
smtpd_sender_restrictions =
permit_mynetworks,
permit_auth_destination,
check_sender_access hash:/etc/postfix/WhiteDNS,
check_client_access cidr:/etc/postfix/WhiteIP,
# check_sender_access hash:/etc/postfix/WhiteDNS,
reject_invalid_hostname,
reject_non_fqdn_hostname,
reject_non_fqdn_sender,
reject_non_fqdn_recipient,
reject_unknown_client,
reject_unknown_sender_domain,
reject_unknown_hostname,
reject_unknown_recipient_domain,
reject_unverified_recipient,
reject_unauth_destination,
reject_unauth_pipelining,
permit_sasl_authenticated,
permit
smtpd_recipient_restrictions =
reject_unauth_pipelining,
permit_mynetworks,
permit_sasl_authenticated,
reject_unauth_destination,
reject_invalid_hostname,
reject_non_fqdn_recipient,
reject_unknown_recipient_domain,
permit
# Debag
debug_peer_level = 2
debug_peer_list = 83.242.x.xФайл WhitDNS и WhiteIP
Содержат записи вида:
WhitDNS
Код: Выделить всё
sbrf-xxx.ru OK
mail2.xxx.ru OK
xxx.xxx.ru OKWhiteIP
Код: Выделить всё
xxx.xxx.xxx.xxx OKВключил Debag debug_peer_list = 83.242.x.x Вот что он говорит.
Код: Выделить всё
Apr 29 10:53:40 MailGateway postfix/smtpd[3151]: warning: restriction `debug_peer_level' after `permit' is ignoredПомогите пожалуйста разобрать!!!
