/etc/postfix/main.cfalias_maps = hash:/etc/aliases
virtual_alias_maps = hash:/etc/aliases
smtpd_banner = mailalm.example.com JSC "NAT Kazakhstan"
# Disable unix notifications
biff = no
delay_warning_time = 12h
strict_rfc821_envelopes = yes
smtpd_helo_required = yes
smtpd_recipient_restrictions =
reject_unauth_pipelining
reject_non_fqdn_sender
reject_non_fqdn_recipient
reject_non_fqdn_helo_hostname
reject_invalid_helo_hostname
reject_unauth_destination
reject_multi_recipient_bounce
check_helo_access hash:/etc/postfix/checks/helo_checks
check_helo_access pcre:/etc/postfix/checks/helo_checks.pcre
check_sender_access hash:/etc/postfix/checks/sender_checks
check_recipient_access hash:/etc/postfix/checks/recipient_checks
# reject_unknown_helo_hostname
reject_unknown_client_hostname
check_client_access pcre:/etc/postfix/checks/client_check.pcre
reject_unknown_sender_domain
reject_unknown_address
check_policy_service unix:private/spf
reject_unlisted_recipient
# check_client_access hash:/etc/postfix/checks/client_check
reject_rbl_client pbl.spamhaus.org
reject_rbl_client zen.spamhaus.org
reject_rbl_client sbl.spamhaus.org
reject_rbl_client xbl.spamhaus.org
reject_rbl_client cbl.abuseat.org
reject_rbl_client bl.spamcop.net
reject_rbl_client dnsbl.sorbs.net
reject_rhsbl_client rhsbl.sorbs.net
check_policy_service inet:127.0.0.1:60000
myorigin = example.com
myhostname = mailalm.example.com
mydestination =
mynetworks =
virtual_mailbox_domains = example.com
virtual_mailbox_maps = proxy:ldap:ldapmap
virtual_transport = hash:/etc/postfix/virtual_transport
transport_maps = hash:/etc/postfix/virtual_transport
ldapmap_version = 3
ldapmap_domain = example.com
ldapmap_bind_dn = postfix@example.com
ldapmap_bind_pw = MegoPassword
ldapmap_search_base = dc=example, dc=com
ldapmap_server_host = dc05.example.com, dc06.example.com
ldapmap_server_port = 3268
ldapmap_query_filter = (&(proxyAddresses=smtp:%s)(|(&(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))(objectClass=group)))
ldapmap_result_filter = %s
ldapmap_result_attribute = mail
-------------------------------------------------------------------------------
/etc/postfix/master.cf
# Postfix master process configuration file. For details on the format
# of the file, see the master(5) manual page (command: "man 5 master").
#
# Do not forget to execute "postfix reload" after editing this file.
#
# ==========================================================================
# service type private unpriv chroot wakeup maxproc command + args
# (yes) (yes) (yes) (never) (100)
# ==========================================================================
spamf unix - n n - - pipe
user=spam argv=/home/spam/spamfilter.sh -f $(sender) -- $(recipient)
smtp inet n - - - - smtpd
-o content_filter=spamf
smtp unix - - - - - smtp
spf unix - n n - - spawn
user=nobody argv=/usr/bin/policyd-spf
pickup fifo n - - 60 1 pickup
cleanup unix n - - - 0 cleanup
qmgr fifo n - n 300 1 qmgr
rewrite unix - - - - - trivial-rewrite
bounce unix - - - - 0 bounce
defer unix - - - - 0 bounce
trace unix - - - - 0 bounce
verify unix - - - - 1 verify
flush unix n - - 1000? 0 flush
proxymap unix - - n - - proxymap
proxywrite unix - - n - - proxymap
relay unix - - - - - smtp
showq unix n - - - - showq
error unix - - - - - error
retry unix - - - - - error
discard unix - - - - - discard
virtual unix - n n - - virtual
anvil unix - - - - 1 anvil
--------------------------------------------------------------------------
/etc/postfix/checks/client_check
мои доверненные домены OK Trust to this domen
..
--------------------------------------------------------------------------
/etc/postfix/checks/client_check.pcre
/(modem|dia(l|lup)|dialin|dsl|p[cp]p|cable|catv|poo(l|les)|dhcp|client|customer|user|[0-9]{6,})(-|\.|[0-9])/ REJECT spamer hostname
/(\d{1,3}-\d{1,3}-\d{1,3}-\d{1,3})/ REJECT numeric hostname
--------------------------------------------------------------------------
/etc/postfix/checks/helo_checks
example.com REJECT You are not me 1
mail.example.com REJECT You are not me 2
mailalm.example.com REJECT You are not me 3
localhost REJECT You are not localhost 4
myip REJECT You are not me 5
secondmyip REJECT You are not me 6
..
--------------------------------------------------------------------------
/etc/postfix/checks/helo_checks.pcre
/\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}/ REJECT I don't like dynamic addressess
--------------------------------------------------------------------------
/etc/postfix/checks/sender_checks
example.com REJECT you are not @example.com .!.
subscribe.ru REJECT mail from subscribe.ru deny
humo.ru REJECT mail from humo.ru deny
wapstat.ru REJECT mail from wapstat.ru deny
odnoklassniki.ru REJECT mail from odnoklassniki.ru deny
amazon.com REJECT mail from amazon.com deny
undp.org REJECT mail from undp.org deny
vkontakte.ru REJECT mail from vkontakte.ru deny
imhonet.ru REJECT mail from imhonet.ru deny
mirtesen.ru REJECT mail from mirtesen.ru deny
corp.mail.ru REJECT mail from corp.mail.ru deny
khodorkovsky.ru REJECT mail from khodorkovsky.ru deny
monamour.ru REJECT mail from monamour.ru deny
cnews.ru REJECT mail from cnews.ru deny
pirivet.msk.ru REJECT mail from pirivet.msk.ru deny
rin.ru REJECT mail from rin.ru deny
mail.kz REJECT mail from mail.kz deny
supercom.kz REJECT mail from supercom.kz deny
rbc.ru REJECT mail from rbc.ru deny
intourservice.kz REJECT mail from intourservice.kz deny
ozon.ru REJECT mail from ozon.ru deny
ashleyllc.com REJECT mail from ashleyllc.com deny
yahoo.com REJECT mail from yahoo.com deny
knc.kz REJECT mail from knc.kz deny
ak-cent.kz REJECT mail from ak-cent.kz deny
proxad.net REJECT mail from proxad.net deny
facebookmail.com REJECT mail from facebookmail.com deny
euratechnews.de REJECT mail from euratechnews.de deny
--------------------------------------------------------------------------
/home/spam/spamfilter.sh
#!/bin/sh
INSPECT_DIR=/home/spam/mail
SENDMAIL="/usr/sbin/sendmail -i"
SPAMASSASSIN=/usr/bin/spamc
EX_TEMPFAIL=75
EX_UNAVAILABLE=69
cd $INSPECT_DIR || { echo $INSPECT_DIR does not exist; exit
$EX_TEMPFAIL; }
# Clean up when done or when aborting.
trap "rm -f in.$$; rm -f out.$$" 0 1 2 3 15
cat | $SPAMASSASSIN > out.$$ || { echo Message content rejected; exit
$EX_UNAVAILABLE; }
$SENDMAIL "$@" < out.$$
exit $?
--------------------------------------------------------------------------
/etc/spamassassin/local.cf
rewrite_header Subject *****SPAM*****
use_bayes 1
bayes_auto_learn 1
lock_method flock
bayes_min_spam_num 50
bayes_min_ham_num 50
bayes_ignore_header X-Spam-Flag
bayes_ignore_header X-Spam-Status
required_score 6
score HTTP_USERNAME_USED 7
score FAKE_HELO 7
score FORGED_RCVD 7
score UNWANTED_LANGUAGE_BODY 7
score MLM 5
score RCVD_NUMERIC_HELO 4
score MISSING_SUBJECT 3
score SPF_PASS -5
score RDNS_DYNAMIC 8
score MSGID_OUTLOOK_INVALID 5
body VIAGRA /viagra/i
body PENIS /penis/i
score VIAGRA 8
score PENIS 8
score DEAR_WINNER 8
ok_locales ru en
--------------------------------------------------------------------------
/etc/postgrey/whitelist_clients
# postgrey whitelist for mail client hostnames
# --------------------------------------------
# put this file in /etc/postgrey or specify its path
# with --whitelist-clients=xxx
# Debian-specific additions
# I *know* they run real mail queues, so greylisting only creates
# bigger load for them.
gmail.com
google.com
mail.ru
bk.ru
list.ru
rambler.ru
yandex.ru
yandex.net
--------------------------------------------------------------------------
/etc/postgrey/whitelist_recipients
# postgrey whitelist for mail recipients
# --------------------------------------
# put this file in /etc/postgrey or specify its path
# with --whitelist-recipients=xxx
postmaster@
abuse@
