github-com-docker-mailserver/docker-mailserver
1
0
Fork 0
mirror of https://github.com/docker-mailserver/docker-mailserver.git synced 2024-01-19 02:48:50 +00:00
Code Issues Projects Releases Wiki Activity

fix: adjust DNSBL return code interpretation (#2890)

Browse source
This commit is contained in:
Georg Lauterbach 2022-11-07 09:28:47 +01:00 committed by GitHub
parent 3b884dbd47
commit 0ef8d5ae2b
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
4 changed files with 10 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
target/postfix/main.cf
View file

@ -48,17 +48,18 @@ smtpd_helo_required = yes
smtpd_delay_reject = yes smtpd_delay_reject = yes
smtpd_helo_restrictions = permit_mynetworks, reject_invalid_helo_hostname, permit smtpd_helo_restrictions = permit_mynetworks, reject_invalid_helo_hostname, permit
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination, check_policy_service unix:private/policyd-spf, reject_unauth_pipelining, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, reject_unknown_recipient_domain, reject_rbl_client zen.spamhaus.org smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination, check_policy_service unix:private/policyd-spf, reject_unauth_pipelining, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, reject_unknown_recipient_domain, reject_rbl_client zen.spamhaus.org=127.0.0.[2..11]
smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, reject_unauth_pipelining smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, reject_unauth_pipelining
smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unknown_sender_domain, reject_unknown_client_hostname smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unknown_sender_domain, reject_unknown_client_hostname
disable_vrfy_command = yes disable_vrfy_command = yes
# Postscreen settings to drop zombies/open relays/spam early # Postscreen settings to drop zombies/open relays/spam early
postscreen_dnsbl_action = enforce postscreen_dnsbl_action = enforce
postscreen_dnsbl_sites = zen.spamhaus.org*3 postscreen_dnsbl_sites =
bl.mailspike.net zen.spamhaus.org=127.0.0.[2..11]*3
bl.mailspike.net=127.0.0.[2;14;13;12;11;10]
b.barracudacentral.org*2 b.barracudacentral.org*2
bl.spameatingmonkey.net bl.spameatingmonkey.net=127.0.0.2
dnsbl.sorbs.net dnsbl.sorbs.net
psbl.surriel.com psbl.surriel.com
list.dnswl.org=127.0.[0..255].0*-2 list.dnswl.org=127.0.[0..255].0*-2

6
target/scripts/startup/setup-stack.sh
View file

@ -398,8 +398,8 @@ function _setup_postgrey
{ {
_log 'debug' 'Configuring Postgrey' _log 'debug' 'Configuring Postgrey'
sed -i -E \ sedfile -i -E \
's|, reject_rbl_client zen.spamhaus.org$|, reject_rbl_client zen.spamhaus.org, check_policy_service inet:127.0.0.1:10023|' \ 's|(^smtpd_recipient_restrictions =.*)|\1, check_policy_service inet:127.0.0.1:10023|' \
/etc/postfix/main.cf /etc/postfix/main.cf
sed -i -e \ sed -i -e \
@ -1078,7 +1078,7 @@ function _setup_dnsbl_disable
_log 'debug' 'Disabling postfix DNS block list (zen.spamhaus.org)' _log 'debug' 'Disabling postfix DNS block list (zen.spamhaus.org)'
sedfile -i \ sedfile -i \
'/^smtpd_recipient_restrictions = / s/, reject_rbl_client zen.spamhaus.org//' \ '/^smtpd_recipient_restrictions = / s/, reject_rbl_client zen.spamhaus.org=127.0.0.\[2..11\]//' \
/etc/postfix/main.cf /etc/postfix/main.cf
_log 'debug' 'Disabling postscreen DNS block lists' _log 'debug' 'Disabling postscreen DNS block lists'

2
test/mail_dnsbl.bats
View file

@ -36,7 +36,7 @@ function setup_file() {
@test "checking enabled postscreen DNS block lists --> postscreen_dnsbl_sites" { @test "checking enabled postscreen DNS block lists --> postscreen_dnsbl_sites" {
run docker exec "${CONTAINER}" postconf postscreen_dnsbl_sites run docker exec "${CONTAINER}" postconf postscreen_dnsbl_sites
assert_output 'postscreen_dnsbl_sites = zen.spamhaus.org*3 bl.mailspike.net b.barracudacentral.org*2 bl.spameatingmonkey.net dnsbl.sorbs.net psbl.surriel.com list.dnswl.org=127.0.[0..255].0*-2 list.dnswl.org=127.0.[0..255].1*-3 list.dnswl.org=127.0.[0..255].[2..3]*-4' assert_output 'postscreen_dnsbl_sites = zen.spamhaus.org=127.0.0.[2..11]*3 bl.mailspike.net=127.0.0.[2;14;13;12;11;10] b.barracudacentral.org*2 bl.spameatingmonkey.net=127.0.0.2 dnsbl.sorbs.net psbl.surriel.com list.dnswl.org=127.0.[0..255].0*-2 list.dnswl.org=127.0.[0..255].1*-3 list.dnswl.org=127.0.[0..255].[2..3]*-4'
} }
# ENABLE_DNSBL=0 # ENABLE_DNSBL=0

2
test/mail_with_postgrey.bats
View file

@ -25,7 +25,7 @@ function teardown_file() {
} }
@test "checking postgrey: /etc/postfix/main.cf correctly edited" { @test "checking postgrey: /etc/postfix/main.cf correctly edited" {
run docker exec mail_with_postgrey /bin/bash -c "grep 'zen.spamhaus.org, check_policy_service inet:127.0.0.1:10023' /etc/postfix/main.cf | wc -l" run docker exec mail_with_postgrey /bin/bash -c "grep -F 'zen.spamhaus.org=127.0.0.[2..11], check_policy_service inet:127.0.0.1:10023' /etc/postfix/main.cf | wc -l"
assert_success assert_success
assert_output 1 assert_output 1
} }