MAKING MY POSTFIX CONFIG RACIST Yesterday I described blocking "Aleksandr" spam in Postfix, something that's apparantly becomming a rite of passage among internet 'postmasters'. Of course while doing lots of log reading for the sake of that, I found myself wading through the constant stream of IP-address-rich spammers trying to brute force the log-in so that they could use it as a relay (also a small few trying to break into POP/IMAP so they could read my emails, but those are vastly outnumbered by the SMTP attacks). I'm not afraid of them succeeding, and there's no issue from server load, but I don't really want to oblige them either. It occoured to me that they pretty much all come from overseas IP addresses, and yet I've never even been overseas so I'm definately only going to connect to it from an Australian IP address, so why not just block all non-Australian IP addresses from doing SASL authentication? This is something that I've never been brave enough to do on SSH connections because I'm not on a fixed IP myself so one day if it goes wrong or there's an error in the geo-IP database, I'll get locked out. But with email it's much less scary - even if I don't have time to mess with the server configuration when it goes wrong, I can just switch to using my ISP's SMTP server instead anyway. Yet the trouble is that I've been using port 25 for sending mail from remote clients, and of course that's also where the SMTP server listens for incoming mail to local mailboxes, which I definately want to accept from IP addresses outside Australia. So I can't simply filter port 25 with the firewall, and as such I spent quite a while looking through the Postfix docs expecting to find a way to restrict which IP addresses it offers SASL to. I was rather disappointed to find out that there was nothing of the sort. But the next day I went back and discovered that I was on the wrong track entirely. There's actually a standard "submission" port (587) designated especially for connections from clients looking to relay their mail into the wider universe. There's also some suggestion that my configuration using port 25 for this was wrong from the outset, although things like Sylpheed defaulting to port 25 suggest that it must be a very common mistake if it is one. This is configured by disabling SASL globally in /etc/postfix/main.cf with "smtpd_sasl_auth_enable = no", then enabling the submission port in /etc/postfix/master.cf with the "-o smtpd_sasl_auth_enable = yes" parameter. Now port 25 still accepts connections from any other servers for receiving incoming mail, but won't accept authentication, which is required for mail relay. Mail relay is only accepted on port 587. Port 587 was blocked before by the firewall (Firehol), so now I've enabled it only for networks on a list of Australian IP ranges. This is fetched automatically and converted as described in the Firehol docs: http://firehol.org/guides/ipset/ So I set a cron job to autmatically fetch and update the Australian IP set (which I called australian_nets) from the web, then used this line to allow the submission port in firehol.conf: server submission accept src ipset:australian_nets I'm using this as my source of IP ranges: https://www.ipdeny.com/ipblocks/ But of course it's tricky to test because I don't have access to a computer that's outside of Australia besides this VPS itself. Many websites offering nmap functionality don't test the submission port, but I eventually found https://nmap.online/, Testing geo restriction by running "nmap -F [IP address]" and comparing with https://nmap.online/ (basic functions work without Javascript): the web Nmap doesn't show the "submission" port open, but the local one does. Yay! Sure enough, now there are no more "SASL LOGIN authentication failed" messages in /var/log/mail.log, yet mail is delivered successfully from my clients after changing the port setting from 25 to 587. Interestingly some of the spammers trying to get into port 25 did keep banging their head against the wall. By the next day there were over 4700 records of attempted AUTH log-ins there, even though they were just getting the "authorisation not available" error back. http://firehol.org/guides/ipset/ http://firehol.org/firehol-manual/firehol-services/#service-submission http://www.postfix.org/postconf.5.html#smtpd_sasl_auth_enable https://serverfault.com/a/706280 https://www.ipdeny.com/ipblocks/ https://nmap.online/ - The Free Thinker PS: This is my first attempt at converting some of my personal server-configuration notes into other-human-readable format, I'm not sure how well it worked, but somehow it still took me over half an hour!