0
Mam regułew smtpd_recipient_restrictions =
check_sender_accesshash:/etc/postfix/sender,
Która sprawdza domeny i nie pozwala na użycie jej w mailfrom bez autoryzacji.
Connected to mail.mojadomana.pl Escape character is '^]'. 220 mail.mojadomana.pl helo domena.pl 250 mail.mojadomana.pl mail from: <tomasz.nowak@mail.mojadomana.pl> 250 2.1.0 Ok rcpt to: <tomasz.nowak@mail.mojadomana.pl> 554 5.7.1 <tomasz.nowak@mail.mojadomana.pl>: Sender address rejected: Brak uwierzytelnienia poczty wychodzacej - RL
Problem w tym ze spamer w polu mail from podaje swój e-mail albo go niepoddaje ale w header from umieszcza
adres e-mail w mojej domenie i takie coś mój Postfixprzepuszcza.
I rzeczywiście sprawdziłem to i mój Postfix pozwala w headerwpisać from: uzytkownik@mojadomena.pl.
Connected to mail.mojadomana.pl Escape character is '^]'. 220 mail.mojadomana.pl helo domena.pl 250 mail.mojadomana.pl mail from: <0-l76.byovset@awemail.com> 250 2.1.0 Ok rcpt to: <tomasz.nowak@mail.mojadomana.pl> data from: tomasz.nowak@mail.mojadomana.pl
Wysyłając w taki sposób spam klient który odbiera pocztę widzi, że nadawcą jest użytkownik z moją domeną. Czy ktoś spotkał się z takim problem? Poniżej przykładowy spam i moja konfiguracja Postfix’a.
Return-Path: <0-l76.byovset@awemail.com> X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on mail.mojadomena.pl X-Spam-Level: X-Spam-Status: No, score=-100.0 required=7.0 tests=USER_IN_WHITELIST autolearn=ham version=3.2.5 X-Original-To:tomasz.nowak@mail.mojadomana.pl Delivered-To: tomasz.nowak@mail.mojadomana.pl Received: from localhost (mail.mojadomena.pl [127.0.0.1]) by mail.mojadomena.pl (Postfix) with ESMTP id 5DF855F896 for <tomasz.nowak@mail.mojadomana.pl>; Fri, 2 Sep 2011 16:53:59 +0200 (CEST) X-Virus-Scanned: amavisd-new at mail.mojadomena.pl Received: from mail.mojadomena.pl ([127.0.0.1]) by localhost (mail.mojadomena.pl [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 3aEHTQlOZeex for <tomasz.nowak@mail.mojadomana.pl>; Fri, 2 Sep 2011 16:53:59 +0200 (CEST) Received: from client135-147.cmk.ru (client135-147.cmk.ru [195.182.135.147]) by tomasz.nowak@mail.mojadomana.pl (Postfix) with ESMTP id 308F25F872 for <tomasz.nowak@mail.mojadomana.pl>; Fri, 2 Sep 2011 16:52:29 +0200 (CEST) Received: from 195.182.135.147(helo=mojadomena.pl) by mail.mojadomena.pl with esmtpa (Exim 4.69) (envelope-from ) id 1MMP6V-6185ea-9G for <tomasz.nowak@mail.mojadomana.pl>; Fri, 2 Sep 2011 17:54:23 +0300 From: <tomasz.nowak@mail.mojadomana.pl> To: <tomasz.nowak@mail.mojadomana.pl> Subject: Get a New Job Today Date: Fri, 2 Sep 2011 17:54:23 +0300 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: jsasl-98 Message-ID: <6831552417.67GD6RO9685888@dviuk.lizrbrmxxa.info> Are you finding it hard to get your career started? Our company is established insurance firm who needs a talented candidate to join our operations and administrative team as a Regional Assistant. This is a great opportunity for you to develop your skills and to grow within a well, respected company. The benefits include: - Basic salary of 3000 Euros plus special bonus system - 35 days paid off - Career development Our company is a world leader in providing insurance support to our partners. Our experienced HR representatives will listen carefully to your employment needs and then work diligently to match your skills and qualifications to the duties which will be assigned to you. Whether you're looking for temporary, temporary-to-permanent or permanent opportunities do not miss your chance and apply now. If you are interested, please reply to: Allison@newweb-career.com,Thank you!
Konfiguracja Postfix'a:
alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases anvil_rate_time_unit = 60s biff = no bounce_template_file = /etc/postfix/bounce.cf.pl broken_sasl_auth_clients = yes canonical_maps = hash:/etc/postfix/canonical command_directory = /usr/sbin config_directory = /etc/postfix content_filter = amavisfeed:[127.0.0.1]:10024 daemon_directory = /usr/libexec/postfix debug_peer_level = 2 defer_transports = disable_vrfy_command = yes header_checks = regexp:/etc/postfix/header_checks home_mailbox = Maildir/ html_directory = no inet_interfaces = all mail_name = Postfix mail_owner = postfix mailbox_command = /usr/bin/procmail mailbox_size_limit = 1024000000 mailbox_transport = mailq_path = /usr/bin/mailq.postfix manpage_directory = /usr/share/man masquerade_classes = envelope_sender, header_sender, header_recipient masquerade_domains = masquerade_exceptions = root message_size_limit = 204800000 myhostname = mail.mojadomena.pl mynetworks = 127.0.0.1 newaliases_path = /usr/bin/newaliases.postfix queue_directory = /var/spool/postfix readme_directory = /usr/share/doc/postfix-2.3.3/README_FILES relocated_maps = hash:/etc/postfix/relocated sample_directory = /usr/share/doc/postfix-2.3.3/samples sendmail_path = /usr/sbin/sendmail.postfix setgid_group = postdrop smtp_use_tls = yes smtpd_banner = $myhostname Postfix smtpd_client_connection_count_limit = 10 smtpd_client_connection_rate_limit = 50 smtpd_client_event_limit_exceptions = $mynetworks smtpd_client_message_rate_limit = 40 smtpd_client_recipient_rate_limit = 50 smtpd_client_restrictions = permit_sasl_authenticated, reject_rbl_client zen.spamhaus.org, reject_rbl_client cbl.abuseat.org, smtpd_error_sleep_time = 30 smtpd_hard_error_limit = 5 smtpd_helo_required = yes smtpd_helo_restrictions = reject_unauth_pipelining, reject_invalid_helo_hostname, permit smtpd_recipient_limit = 500 smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, check_sender_access hash:/etc/postfix/sender, reject_non_fqdn_recipient, reject_unknown_recipient_domain, reject_rbl_client zen.spamhaus.org, reject_rbl_client bl.spamcop.net, reject_rbl_client dul.dnsbl.sorbs.net, reject_rbl_client cbl.abuseat.org, reject_rbl_client dynamic.rbl.tld check_client_access hash:/etc/postfix/whitelist, smtpd_sasl_auth_enable = yes smtpd_sasl_local_domain = smtpd_sasl_security_options = noanonymous smtpd_sender_restrictions = permit_sasl_authenticated, reject_unknown_sender_domain, reject_non_fqdn_sender, reject_unknown_address, reject_sender_login_mismatch, permit smtpd_soft_error_limit = 3 smtpd_tls_CAfile = /etc/pki/dovecot/certs/posredninew.pem smtpd_tls_cert_file = /etc/pki/dovecot/certs/publicnew.pem smtpd_tls_key_file = /etc/pki/dovecot/certs/privatenew.pem smtpd_tls_loglevel = 1 smtpd_tls_received_header = yes smtpd_tls_session_cache_timeout = 3600s smtpd_use_tls = yes strict_rfc821_envelopes = yes tls_random_source = dev:/dev/urandom transport_maps = hash:/etc/postfix/transport unknown_address_reject_code = 550 unknown_hostname_reject_code = 550 unknown_local_recipient_reject_code = 550 virtual_alias_domains = mojadomena.pl
Macie jakieś sposoby aby zabezpieczyć się przed tym typem spamu?
