Discussion:
helo restrictions
(too old to reply)
Paul Bruce
20 years ago
Permalink
Hi,

I just wanted to clarify one thing about how the smtpd_helo_restrictions
worked.

The front line for me against spam is encapsulated in the following
settings - this works fairly well....

smtpd_client_restrictions = check_client_access hash:/etc/postfix/access,
reject_rbl_client relays.ordb.org
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks, check_helo_access
hash:/etc/postfix/helo_access, reject_unknown_hostname
smtpd_delay_reject = yes
unknown_virtual_alias_reject_code = 550
disable_vrfy_command = yes

However, some badly configured real smtp servers around the place have been
caught out - this is no real issue for me, because I simply tell them (in
the nicest possible way) that the people setting up their mail servers must
be a bunch of mugs because even my home mail sitting on my kitchen bench
gets through this maze.

One of these mugs needed an explanation and I happily went about explaning
what my mail server does at the frontline to prevent spaming. Tonight I've
been doing some more confiuration and more testing (uno.. the "one more
compile" type of thing) However during my testing I came out with an amazing
realisation - what I thought was happening was not happening.

This is what I thought was happening

1) My server requires HELO, were the remote machine kindly sends it name
2) my server already knows the IP address of the remote machine talking to
it
3) My server resolves the name given to it in the HELO request at step 1
4) if the resolved IP does not equal the known ip in step 2, then the helo
fails and transmission does not continue.

Sweet, That seemed like a really sensible and fail safe setup.

But I discovered (through testing - or insufficient reading, or more
possibly insufficient intelligence) that the real case is

1) My server requires HELO,
2) my server already knows the IP address of the remote machine talking to
it
3) My server resolves the name given to it in the HELO request at step 1
4) My server doesn't give two hoots whether the IPs equal, just so long as
the helo resolves to an ip, it is happy.

That seems a little silly to me, and all my helo reading doesn't seem to
help me.

I'm missing something here and if someone could point me in the right
direction I'd be greatly appreciative.

Thanks

Paul
Alex van den Bogaerdt
20 years ago
Permalink
Post by Paul Bruce
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks, check_helo_access
hash:/etc/postfix/helo_access, reject_unknown_hostname
However, some badly configured real smtp servers around the place have been
caught out - this is no real issue for me, because I simply tell them (in
the nicest possible way) that the people setting up their mail servers must
be a bunch of mugs because even my home mail sitting on my kitchen bench
gets through this maze.
So, why the "permit_mynetworks" ? :)
Post by Paul Bruce
This is what I thought was happening
[snip: checking address(HELO string) == address(client)]
Post by Paul Bruce
Sweet, That seemed like a really sensible and fail safe setup.
But I discovered (through testing - or insufficient reading, or more
possibly insufficient intelligence) that the real case is
[snip: checking RFC2821 validity]
Post by Paul Bruce
I'm missing something here and if someone could point me in the right
direction I'd be greatly appreciative.
See RFC2821. You want precisely the one and only thing that RFC2821
sais not to do (MUST NOT).

HTH
Alex
--
I ask you to respect any "Reply-To" and "Mail-Follow-Up" headers. If
you reply to me off-list, you'd better tell me you're doing so. If
you don't, and if I reply to the list, that's your problem, not mine.
Paul Bruce
20 years ago
Permalink
Thanks Alex,

Spent the last hour or so reading RFC2821.

I couldn't see how the RFC stated that what I suggest below is "MUST NOT"

Paul





-----Original Message-----
From: owner-postfix-***@postfix.org
[mailto:owner-postfix-***@postfix.org]On Behalf Of Alex van den
Bogaerdt
Sent: Monday, 6 December 2004 11:15 PM
To: postfix-***@postfix.org
Subject: Re: helo restrictions
Post by Paul Bruce
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks, check_helo_access
hash:/etc/postfix/helo_access, reject_unknown_hostname
However, some badly configured real smtp servers around the place have
been
Post by Paul Bruce
caught out - this is no real issue for me, because I simply tell them (in
the nicest possible way) that the people setting up their mail servers
must
Post by Paul Bruce
be a bunch of mugs because even my home mail sitting on my kitchen bench
gets through this maze.
So, why the "permit_mynetworks" ? :)
Post by Paul Bruce
This is what I thought was happening
[snip: checking address(HELO string) == address(client)]
Post by Paul Bruce
Sweet, That seemed like a really sensible and fail safe setup.
But I discovered (through testing - or insufficient reading, or more
possibly insufficient intelligence) that the real case is
[snip: checking RFC2821 validity]
Post by Paul Bruce
I'm missing something here and if someone could point me in the right
direction I'd be greatly appreciative.
See RFC2821. You want precisely the one and only thing that RFC2821
sais not to do (MUST NOT).

HTH
Alex
--
I ask you to respect any "Reply-To" and "Mail-Follow-Up" headers. If
you reply to me off-list, you'd better tell me you're doing so. If
you don't, and if I reply to the list, that's your problem, not mine.
Alex van den Bogaerdt
20 years ago
Permalink
Post by Paul Bruce
Thanks Alex,
Spent the last hour or so reading RFC2821.
I couldn't see how the RFC stated that what I suggest below is "MUST NOT"
An SMTP server MAY verify that the domain name parameter in the EHLO
command actually corresponds to the IP address of the client.
However, the server MUST NOT refuse to accept a message for this
reason if the verification fails: the information about verification
failure is for logging and tracing only.

Unless explicitly mentioned, RFC2821 talks about EHLO where it means
HELO or EHLO.

HTH
Alex

Continue reading on narkive:
Loading...