Jan Stary wrote:
> On Apr 29 16:29:45, Miroslav Lachman wrote:
>
>>Marian Cerny wrote:
>>
>>
>>>On 2008-04-29 15:38 +0200, Ciernik Tomas wrote:
>>>
>>>>Pri pouziti reject_non_fqdn_helo_hostname treba byt opatrny - napriklad taky
>>>>MS Outlook pouzije ako helo len nazov pocitaca, nie jeho domenu, takze na
>>>>zaklade tohto pravidla sa s nim postfix odmietne bavit.
>>>
>>>Pre uzivatelov tam mam permit_sasl_authenticated, takze to by nemuselo
>>>vadit, ze odmieta len nazov pocitaca. Ja osobne to
>>>reject_non_fqdn_helo_hostname ale nepouzivam. Myslim, ze som to tam
>>>nedal preto, ze to podla RFC helo nemusi byt FQDN, aj ked to si niesom
>>>isty... zaoberal som sa tym uz davno.
>>
>>Presne tak, pri pouziti permit_sasl_authenticated to uzivatele pusti, at
>>ma HELO jakekoliv, tudiz to zadnym Outlookum problemy nezpusobi.
>>Co jsem se dival po netu,
>
>
> (ehm)
>
>
>>tak prave RFC to FQDN vyzaduje.
>
>
> Nevyzaduje:
>
> These commands are used to identify the SMTP client to the
> SMTP server. The argument field contains the fully-qualified
> domain name of the SMTP client if one is available. In
> situations in which the SMTP client system does not have a
> meaningful domain name (e.g., when its address is dynamically
> allocated and no reverse mapping record is available), the
> client SHOULD send an address literal (see section 4.1.3),
> optionally followed by information that will help to identify
> the client system.
>
>
>>Alespon dle
>>citaci z nekolika webu (to konkretni RFC jsem ted neprohledaval, lenost
>>je hrozna)
>>"...parametr za HELO/EHLO bylo plně přeložitelné hostname (FQDN). Tuto
>>podmínku v SMTP protokolu popisuje RFC dokument 1123 sekce 5.2.5, RFC
>>821 sekce 4.1.1 a dále ještě RFC 2821."
>
>
> http://www.ietf.org/rfc/rfc2821.txt
>
> obsoletes RFC 821, RFC 974, and updates RFC 1123
> (replaces the mail transport materials of RFC 1123).
Dobra, vyklad at si udela kazdy po svem, pro me je dulezity funkcni
vysledek :)
rfc2821
2.3.5 Domain
The domain name, as described in this document and in [22], is the
entire, fully-qualified name (often referred to as an "FQDN"). A
domain name that is not in FQDN form is no more than a local alias.
Local aliases MUST NOT appear in any SMTP transaction.
3.2 Client Initiation
In the EHLO command the host sending the command identifies itself;
the command may be interpreted as saying "Hello, I am <domain>" (and,
in the case of EHLO, "and I support service extension requests").
4.1.1.1 Extended HELLO (EHLO) or HELLO (HELO)
Syntax:
ehlo = "EHLO" SP Domain CRLF
helo = "HELO" SP Domain CRLF
4.1.3 Address Literals
To bypass this barrier a special literal form
of the address is allowed as an alternative to a domain name. For
IPv4 addresses, this form uses four small decimal integers separated
by dots and enclosed by brackets such as [123.255.37.2], which
indicates an (IPv4) Internet Address in sequence-of-octets form.
Pokud k tomu pridam i popis z manualu Postfixu:
reject_non_fqdn_helo_hostname
Reject the request when the HELO or EHLO hostname is not in
fully-qualified domain form, as required by the RFC.
reject_non_fqdn_sender
Reject the request when the MAIL FROM address is not in
fully-qualified domain form, as required by the RFC.
reject_non_fqdn_recipient
Reject the request when the RCPT TO address is not in
fully-qualified domain form, as required by the RFC.
Tak si troufnu klidne na tom "tvrdosijne trvat" a toho, kdo to
neposkytne, odmitnout. Ostatne na netu jsou i daleko prisnejsi
mailservery, co vyzaduji pro EHLO / HELO hostname i existujici A / PTR
zaznamy a kdo vi co vsechno.
>>Greylisted: 0
>>RBL blocked: 0
>>bad HELO blocked: 4740
>>user unknown: 7118
>>SPAM clean: 695
>>SPAM spammy: 380
>>SPAM quarantine: 0
>>SPAM blocked: 2609
>>delivered (local): 1794
>>queued (to remote): 1377
>>pop3ssl login: 1271
>>pop3 login: 2500
>>imapssl login: 186
>>imap login: 191
>
>
> Takove logy bych chtel; co je vyrabi?
Takovou statistiku vyrabim ja, pomerne jednoduchym awk scriptem, mozna
jsem ho tu uz i pred casem pastoval.
----------------------------
#!/bin/sh
awk -- '
{
if (/NOQUEUE: reject:.+Greylisted for/) { greylisted++ }
if (/NOQUEUE: reject:.+blocked using/) { blocked++ }
if (/Helo command rejected:/) { badhelo++ }
if (/rejected: User unknown/) { unknown++ }
if (/Passed CLEAN/) { clean++ }
if (/Passed SPAMMY/) { spammy++ }
if (/Blocked SPAM.+quarantine: /) { spamquarantine++ }
if (/Blocked SPAM/ && !/quarantine: /) { blockspam++ }
if (/delivered to maildir/) { delivered++ }
if (/status=sent .+ Ok: queued/) { queued++ }
if (/pop3d-ssl: LOGIN/) { pop3ssl++ }
if (/pop3d: LOGIN/) { pop3++ }
if (/imapd-ssl: LOGIN/) { imapssl++ }
if (/imapd: LOGIN/) { imap++ }
} END {
printf("%-20s\t %i\n", "Greylisted:", greylisted)
printf("%-20s\t %i\n", "RBL blocked:", blocked)
printf("%-20s\t %i\n", "bad HELO blocked:", badhelo)
printf("%-20s\t %i\n", "user unknown:", unknown)
printf("%-20s\t %i\n", "SPAM clean:", clean)
printf("%-20s\t %i\n", "SPAM spammy:", spammy)
printf("%-20s\t %i\n", "SPAM quarantine:", spamquarantine)
printf("%-20s\t %i\n", "SPAM blocked:", blockspam)
printf("%-20s\t %i\n", "delivered (local):", delivered)
printf("%-20s\t %i\n", "queued (to remote):", queued)
printf("%-20s\t %i\n", "pop3ssl login:", pop3ssl)
printf("%-20s\t %i\n", "pop3 login:", pop3)
printf("%-20s\t %i\n", "imapssl login:", imapssl)
printf("%-20s\t %i\n", "imap login:", imap)
}' /var/log/maillog
----------------------------
Neni to nic super, asi to neni ani moc presne, ale je to jednoduche a
rychle. (a ani by to nemuselo byt zabaleno jako *.sh script, ale to uz
je holt muj zvyk)
Mirek
--
FreeBSD mailing list (users-l@freebsd.cz)
http://www.freebsd.cz/listserv/listinfo/users-l
