OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: selective greylisting?

From: Robert Felber (r.felberek-muc.de)
Date: Thu Nov 02 2006 - 02:14:00 CST


On Thu, Nov 02, 2006 at 08:59:27AM +0100, Robert Felber wrote:
> > $MAXDNSBLMSG = 'check_greylist';
> ^^^^^^^^^^^^^^^^
>
> This should probably be
> $MAXDNSBLMSG = 'check_greylist ';
>
> Policyd-weight returns then the string
> "check_greylist ; check http://rbls.org/?q=$ip"
>
> Usually it returns
> "550 Your MTA is listed in too many DNSBLs; check http://rbls.org/?q=$ip"
>
> I am not certain how postfix treats garbage in case of restriction classes.

Ok, postfix fails to accept such return message:

Nov 2 09:07:35 fpsvr1z150 postfix/smtpd[7961]: warning: access table inet:127.0.0.1:12525 has entry with lookup table: greylist ; MTA helo: foo.domain.de, MTA hostname: p54994f8b.dip.t-dialin.net[84.153.79.139] (helo/hostname mismatch)
Nov 2 09:07:35 fpsvr1z150 postfix/smtpd[7961]: warning: do not specify lookup tables inside SMTPD access maps
Nov 2 09:07:35 fpsvr1z150 postfix/smtpd[7961]: warning: define a restriction class and specify its name instead.

(postconf -n smtpd_restriction_classes
 smtpd_restriction_classes =
    has_our_domain_as_sender
    permit_valid_relayer
    check_helo
    check_backscatter
    check_policyd_weight
    greylist
)

I'll see whether I can design it such, that restriction classes may be defined
and if so, that no explanatory garbage is being appended.

--
    Robert Felber (PGP: 896CF30B)
    Munich, Germany