Implementation of Postgrey ( Greylisting ) and integration with Zimbra

Implementation of Postgrey ( Greylisting ) and integration with Zimbra

Tested on zimbra 6.x and zimbra 7.x Test Client - mail.heromotocorp.biz and mail.orientbell.com

Referances

http://efensys.blogspot.in/2011/11/zimbra-postgrey-integration.html

https://wiki.zimbra.com/wiki/Improving_Anti-spam_system#Postgrey

Installation and Configurations

get the rpmforge.repo in yum.repos.d ( if not there already )

yum install postgrey --nogpgcheck

Change the /etc/init.d/postgrey

from

OPTIONS="--unix=$SOCKET"

to

#OPTIONS="--unix=$SOCKET"
OPTIONS="--pidfile=/var/run/postgrey.pid --inet=10023 --delay=60 --max-age=10 --auto-whitelist-clients=10"

Start postgrey

/etc/init.d/postgrey 

Check postgrey

ps -ef | grep postgrey

Make it start at next boot time

chkconfig postgrey on 

Integration at Zimbra

su - zimbra
vim /opt/zimbra/conf/postfix_recipient_restrictions.cf
 # add below line above any lines starting with %%
 check_policy_service inet:127.0.0.1:10023

...then restart (as the user zimbra) Postfix (which will re-create /opt/zimbra/postfix/main.cf)

postfix reload

Check the Zimbra logs for postgrey

Apr 14 19:51:07 mail postgrey[10561]: action=greylist, reason=early-retry (5s missing), client_name=mail.tetrain.com, client_address=64.79.219.156,  sender=hmccinfo@heromotocorp.com, recipient=umiya@heromotocorp.biz

Toubleshooting

In Case of Orient bell the postgrey integration was not reflecting as it was not there in main.cf after postfix reload .

so the parameter was introduces manually . We fist pick the line containing the parameter "smtpd_recipient_restrictions" and then mofidied it to suite with "check_policy_service inet:127.0.0.1:10023" , as shown below .

postconf -e smtpd_recipient_restrictions="check_recipient_access hash:/opt/zimbra/postfix/conf/protected_recipients, reject_non_fqdn_recipient, permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination, check_client_access hash:/opt/zimbra/conf/postfix_rbl_override, reject_unlisted_recipient, reject_invalid_hostname, reject_unknown_sender_domain, reject_rbl_client cbl.abuseat.org, reject_rbl_client bl.spamcop.net, reject_rbl_client sbl.spamhaus.org, reject_rbl_client b.barracuracentral.org, reject_rbl_client dul.dnsbl.sorbs.net, check_policy_service inet:127.0.0.1:10023, permit"

zmlocalconfig  -e postfix_smtpd_recipient_restrictions="check_recipient_access hash:/opt/zimbra/postfix/conf/protected_recipients, reject_non_fqdn_recipient, permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination, check_client_access hash:/opt/zimbra/conf/postfix_rbl_override, reject_unlisted_recipient, reject_invalid_hostname, reject_unknown_sender_domain, reject_rbl_client cbl.abuseat.org, reject_rbl_client bl.spamcop.net, reject_rbl_client sbl.spamhaus.org, reject_rbl_client b.barracuracentral.org, reject_rbl_client dul.dnsbl.sorbs.net, check_policy_service inet:127.0.0.1:10023, permit"

Reports for postgrey

cat /var/log/maillog | postgreyreport \
--nosingle_line --check_sender=mx,a --show_tries \
--separate_by_subnet=":===================================================================================="

Implementation on Zimbra 8.5 above

Implement postgrey package in the same way for zimbra 7.x or 6.x as mentioned above .

For integration it with Zimbra 8.x above , please follow

First check the mta restrictions as user zimbra:

$ zmprov gcf zimbraMtaRestriction

In my case I get:

zimbraMtaRestriction: reject_invalid_hostname
zimbraMtaRestriction: reject_non_fqdn_sender
zimbraMtaRestriction: reject_rbl_client ix.dnsbl.manitu.net

It should look like

zimbraMtaRestriction: reject_invalid_hostname
zimbraMtaRestriction: reject_non_fqdn_sender
zimbraMtaRestriction: check_policy_service inet:127.0.0.1:10023
zimbraMtaRestriction: reject_rbl_client ix.dnsbl.manitu.net

To get these setting please do

$ zmprov mcf zimbraMtaRestriction "reject_invalid_hostname" zimbraMtaRestriction "reject_non_fqdn_sender" zimbraMtaRestriction "check_policy_service inet:127.0.0.1:10023" zimbraMtaRestriction "reject_rbl_client ix.dnsbl.manitu.net"

Also we have to do entry in /opt/zimbra/conf/zmconfigd/smtpd_recipient_restrictions.cf as

# add below line above any lines starting with %%
%%contains VAR:zimbraMtaRestriction check_policy_service inet:127.0.0.1:10023%%

Then Restart MTA

$ zmmtactl restart

Check the logs for postgrey in maillog and zimbra.log

For rest of the SPAM Tuning please visit https://wiki.zimbra.com/wiki/Anti-spam_Strategies and follow DCC , Kevin McGrail's rules etc