From bbdc193f05cb2f1624d6c7bbffd27f8060de35c8 Mon Sep 17 00:00:00 2001 From: Micah Date: Tue, 12 Jul 2016 11:20:58 -0400 Subject: Block ip-based helo at MTA (#8139). Numeric helo is a very strong indicator of spam. When this is blocked, a very significant amount of spam stops. Change-Id: Ieb340190faf37638950d1aa60b52268659e0b7f6 --- puppet/modules/site_postfix/files/checks/helo_access.pcre | 2 ++ puppet/modules/site_postfix/manifests/mx/checks.pp | 7 +++++++ puppet/modules/site_postfix/manifests/mx/smtpd_checks.pp | 2 +- 3 files changed, 10 insertions(+), 1 deletion(-) create mode 100644 puppet/modules/site_postfix/files/checks/helo_access.pcre diff --git a/puppet/modules/site_postfix/files/checks/helo_access.pcre b/puppet/modules/site_postfix/files/checks/helo_access.pcre new file mode 100644 index 00000000..4ebd42e6 --- /dev/null +++ b/puppet/modules/site_postfix/files/checks/helo_access.pcre @@ -0,0 +1,2 @@ +!/[[:alpha:]]/ REJECT Numeric HELO is a sign of spam, please contact us if this is in error + diff --git a/puppet/modules/site_postfix/manifests/mx/checks.pp b/puppet/modules/site_postfix/manifests/mx/checks.pp index f406ad34..9678c205 100644 --- a/puppet/modules/site_postfix/manifests/mx/checks.pp +++ b/puppet/modules/site_postfix/manifests/mx/checks.pp @@ -1,3 +1,4 @@ +# management of specific MTA checks class site_postfix::mx::checks { file { @@ -13,6 +14,12 @@ class site_postfix::mx::checks { mode => '0644', owner => root, group => root; + + '/etc/postfix/checks/helo_checks.pcre': + source => 'puppet:///modules/site_postfix/checks/helo_access.pcre', + mode => '0644', + owner => root, + group => root; } exec { diff --git a/puppet/modules/site_postfix/manifests/mx/smtpd_checks.pp b/puppet/modules/site_postfix/manifests/mx/smtpd_checks.pp index 291d7ee4..162e6d86 100644 --- a/puppet/modules/site_postfix/manifests/mx/smtpd_checks.pp +++ b/puppet/modules/site_postfix/manifests/mx/smtpd_checks.pp @@ -28,7 +28,7 @@ class site_postfix::mx::smtpd_checks { 'smtps_relay_restrictions': value => 'permit_mynetworks, permit_tls_clientcerts, defer_unauth_destination'; 'smtps_helo_restrictions': - value => 'permit_mynetworks, check_helo_access hash:$checks_dir/helo_checks, permit'; + value => 'permit_mynetworks, check_helo_access hash:$checks_dir/helo_checks, check_helo_access pcre:$checks_dir/helo_checks.pcre, permit'; 'smtpd_sender_restrictions': value => 'permit_mynetworks, reject_non_fqdn_sender, reject_unknown_sender_domain, permit'; } -- cgit v1.2.3