Открыл недавно несколько возможностей в Постфиксе для отсеивания нежелательной почты на этапе HELO.
Теперь у меня сервер отсеивает от 90 до 98% почты
сразу. Антивирус (clamAV) и SA отдыхают. Коэффициент SA задрал до 7.3. Все равно до него мало что доходит.
Итак в main.cf стоит:
smtpd_recipient_restrictions =
permit_mynetworks,
reject_non_fqdn_recipient,
reject_unauth_destination,
check_helo_access hash:/etc/postfix/helo_checks,
check_helo_access pcre:/etc/postfix/helo_checks_pcre,
check_sender_access hash:/etc/postfix/sender_checks,
check_client_access hash:/etc/postfix/client_checks,
check_sender_mx_access cidr:/etc/postfix/mx_access,
check_recipient_mx_access cidr:/etc/postfix/mx_access,
reject_rbl_client relays.ordb.org,
reject_rbl_client sbl.spamhaus.org,
reject_unknown_sender_domain,
reject_unknown_recipient_domain#/etc/postfix/helo_checks:
# This file has to be "compiled" with "postmap"
# Reject anybody that HELO's as being in our own domain(s)
# (Note that if you followed the order suggested in the main.cf
# examples, above, that machines in mynetworks will be okay.)
<Мой домен> REJECT You are not in trala.la
# Somebody HELO'ing with our IP address?
<мой IP> REJECT You are not me
Это хорошо помогает против вирус и зомби.
#/etc/postfix/helo_checks.pcre:
#
# Note: You must have PCRE support support built in to Postfix at
# compile time to use this.
#
# No, you won't find this entry in my "smtpd_recipient_restrictions,"
# above. I'm not doing this check (at this time).
#
# If you want to be really picky about it: HELO'ing with an IP
# address is RFC-compliant - *if* it's enclosed in square-brackets
# ("[]"s). (One would think "reject_invalid_hostname" checks for
# this, but it does not.)
#
# Somebody HELO'ing with a non-RFC-compliant dotted-quad IP
# address? For shame! (I don't do this check, btw.)
#
# Initial expression
#/^[0-9]+(\.[0-9]+){3}$/ REJECT Invalid hostname (plain D)
# expression modified by Eugene 22.03.2005
/[^[] *[0-9]+((\.|-)[0-9]+){3}/ REJECT Invalid hostname (ipable)
#
/(modem|dia(l|lup)|dsl|p[cp]p|cable|catv|poo(l|les)|dhcp|client|customer|user|[0
-9]{4,})(-|\.|[0-9])/ REJECT Invalid hostname (client)
#
/[0-9]+-[0-9]+/ REJECT Invalid hostname (D-D)
О других файлах можно почитать в руководствах.
Если есть вопросы, спрашивайте :-)
Больше всего сработок дают эти два приведенных здесь файла.
