From ed1ff6fa01bf110fc338b7116fdf577aa88a8d46 Mon Sep 17 00:00:00 2001 From: Micah Date: Tue, 27 Oct 2015 15:27:24 -0400 Subject: Add initial rate-limiting for outgoing SMTP, using postfwd (#5972) Change-Id: I6a6e68908b71d7499eb3ef3c7f0173b3d5b7baa2 --- puppet/modules/postfwd/files/postfwd_default | 19 ++++++++++ puppet/modules/postfwd/manifests/init.pp | 49 +++++++++++++++++++++++++ puppet/modules/postfwd/templates/postfwd.cf.erb | 31 ++++++++++++++++ 3 files changed, 99 insertions(+) create mode 100644 puppet/modules/postfwd/files/postfwd_default create mode 100644 puppet/modules/postfwd/manifests/init.pp create mode 100644 puppet/modules/postfwd/templates/postfwd.cf.erb (limited to 'puppet/modules/postfwd') diff --git a/puppet/modules/postfwd/files/postfwd_default b/puppet/modules/postfwd/files/postfwd_default new file mode 100644 index 00000000..79d0e3de --- /dev/null +++ b/puppet/modules/postfwd/files/postfwd_default @@ -0,0 +1,19 @@ +### This file managed by Puppet +# Global options for postfwd(8). + +# Set to '1' to enable startup (daemon mode) +STARTUP=1 + +# Config file +CONF=/etc/postfix/postfwd.cf +# IP where listen to +INET=127.0.0.1 +# Port where listen to +PORT=10040 +# run as user postfwd +RUNAS="postfw" +# Arguments passed on start (--daemon implied) +# RISEUP disable summary and cache-no-size +#ARGS="--summary=600 --cache=600 --cache-rdomain-only --cache-no-size" +ARGS="--cache=600 --cache-rdomain-only --no-rulestats" + diff --git a/puppet/modules/postfwd/manifests/init.pp b/puppet/modules/postfwd/manifests/init.pp new file mode 100644 index 00000000..b00bb071 --- /dev/null +++ b/puppet/modules/postfwd/manifests/init.pp @@ -0,0 +1,49 @@ +# This class provides rate-limiting for outgoing SMTP, using postfwd +# it is configured with some limits that seem reasonable for a generic +# use-case. Each of the following applies to sasl_authenticated users: +# +# . 150 recipients at a time +# . no more than 50 messages in 60 minutes +# . no more than 250 recipients in 60 minutes. +# +# This class could be easily extended to add overrides to these rules, +# maximum sizes per client, or additional rules +class postfwd { + + ensure_packages(['libnet-server-perl', 'libnet-dns-perl', 'postfwd']) + + file { + '/etc/default/postfwd': + source => 'puppet:///modules/postfwd/postfwd', + mode => '0644', + owner => root, + group => root, + require => Package['postfwd']; + + '/etc/postfix/postfwd.cf': + content => template('postfwd/postfwd.cf.erb'), + mode => '0644', + owner => root, + group => root, + require => File['/etc/postfix']; + } + + exec { + '/etc/init.d/postfwd reload': + refreshonly => true, + subscribe => [ File['/etc/postfix/postfwd.cf'], + File['/etc/default/postfwd'] ]; + } + + service { + 'postfwd': + ensure => running, + name => postfwd, + pattern => '/usr/sbin/postfwd', + enable => true, + hasrestart => true, + hasstatus => false, + require => [ File['/etc/default/postfwd'], + File['/etc/postfix/postfwd.cf']]; + } +} diff --git a/puppet/modules/postfwd/templates/postfwd.cf.erb b/puppet/modules/postfwd/templates/postfwd.cf.erb new file mode 100644 index 00000000..6460994a --- /dev/null +++ b/puppet/modules/postfwd/templates/postfwd.cf.erb @@ -0,0 +1,31 @@ +### This file managed by Puppet +# Before deploying a rule +# 1. test with an additional "sender==test@domain.org;" in the rule so it +# only applies to your test account +# 2. then when ready to test for all users, use WARN and watch the logs +# for a few days and make sure it working the way you like +# 3. Then when ready to deploy for real set a proper error code + +## Overrides - make like the following example +# id=exampleuser; sasl_username==exampleuser; action=dunno + +## Rules that apply to all senders +# Recipient Per Message Limit +# We only receive mail via smtp from sasl authenticated users +# directly. We want to limit to a lower amount to prevent phished accounts +# spamming +id=RCPTSENDER; recipient_count=150; action=REJECT Too many recipients, please try again. Contact http://<%= @domain %>/tickets/new if this is in error. ERROR:RCPTSENDER + +# Message Rate Limit +# This limits sasl authenticated users to no more than 50/60mins +# NOTE: sasl_username needs to be set to something or this check will fail +id=MSGRATE ; sasl_username=!!(^$); action==rate($$sasl_username/100/3600/450 4.7.1 exceeded message rate. Contact Contact http://<%= @domain %>/tickets/new if this is in error. ERROR:MSGRATE) + +# Total Recipient Rate Limit +# This adds up the recipients for all the sasl authenticated users messages +# and can't exceed more than 250/60min +# NOTE: sasl_username needs to be set to something or this check will fail +id=RCPTRATE ; sasl_username=!!(^$); action==rcpt($$sasl_username/500/3600/450 4.7.1 exceeded message rate. Contact http://<%= @domain %>/tickets/new if this is in error. ERROR:RCPTRATE) + +# Size per client Limit +id=SENDSIZE ; state==END_OF_DATA ; client_address==!!(10.0.1.0/24); action==size($$client_address/314572800/3600/450 4.7.1 Sorry you have sent too much data. Contact http://<%= @domain %>/tickets/new if this is in error. ERROR:SENDSIZE) -- cgit v1.2.3 From ea5b55fb9a4f831c586ba773205d3238e5213260 Mon Sep 17 00:00:00 2001 From: Micah Date: Mon, 2 Nov 2015 18:45:13 -0500 Subject: fix postfwd dependency requirement Change-Id: Ied475dd1d555a2388034012f5a799a202dcc6ee7 --- puppet/modules/postfwd/manifests/init.pp | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) (limited to 'puppet/modules/postfwd') diff --git a/puppet/modules/postfwd/manifests/init.pp b/puppet/modules/postfwd/manifests/init.pp index b00bb071..1ebc1d53 100644 --- a/puppet/modules/postfwd/manifests/init.pp +++ b/puppet/modules/postfwd/manifests/init.pp @@ -14,7 +14,7 @@ class postfwd { file { '/etc/default/postfwd': - source => 'puppet:///modules/postfwd/postfwd', + source => 'puppet:///modules/postfwd/postfwd_default', mode => '0644', owner => root, group => root, @@ -25,14 +25,7 @@ class postfwd { mode => '0644', owner => root, group => root, - require => File['/etc/postfix']; - } - - exec { - '/etc/init.d/postfwd reload': - refreshonly => true, - subscribe => [ File['/etc/postfix/postfwd.cf'], - File['/etc/default/postfwd'] ]; + require => Package['postfix']; } service { -- cgit v1.2.3 From 7d0b6b25e49a1ccb70c4f502f7dfc58878b900cc Mon Sep 17 00:00:00 2001 From: Micah Date: Mon, 2 Nov 2015 21:02:03 -0500 Subject: remove unused postfwd rule Change-Id: I8756c5c3212a3d7e3c44414fdf6bfff5cd29d70f --- puppet/modules/postfwd/templates/postfwd.cf.erb | 3 --- 1 file changed, 3 deletions(-) (limited to 'puppet/modules/postfwd') diff --git a/puppet/modules/postfwd/templates/postfwd.cf.erb b/puppet/modules/postfwd/templates/postfwd.cf.erb index 6460994a..1c45dd03 100644 --- a/puppet/modules/postfwd/templates/postfwd.cf.erb +++ b/puppet/modules/postfwd/templates/postfwd.cf.erb @@ -26,6 +26,3 @@ id=MSGRATE ; sasl_username=!!(^$); action==rate($$sasl_username/100/3600/450 4.7 # and can't exceed more than 250/60min # NOTE: sasl_username needs to be set to something or this check will fail id=RCPTRATE ; sasl_username=!!(^$); action==rcpt($$sasl_username/500/3600/450 4.7.1 exceeded message rate. Contact http://<%= @domain %>/tickets/new if this is in error. ERROR:RCPTRATE) - -# Size per client Limit -id=SENDSIZE ; state==END_OF_DATA ; client_address==!!(10.0.1.0/24); action==size($$client_address/314572800/3600/450 4.7.1 Sorry you have sent too much data. Contact http://<%= @domain %>/tickets/new if this is in error. ERROR:SENDSIZE) -- cgit v1.2.3