1 # POSTLICYD configuration
3 # Postlicyd configuration contains:
4 # - a set of filter definition
5 # - the entry point in the filters for each smtp states
7 # The configuration format use 2 types of data:
8 # Token: [[:alpha:]]([[:alnum:]_]*)
9 # String: string format is a bit more complex. It can be one of the two following
11 # - C-like strings "[^\n\r]*". In this kind of string, the \ character is used to
12 # escape any character \c = c (\n = n, \\ = \, ...). This format allow non-ascii
13 # strings and string concatenation " abcd " "ef" = " abcd ef".
14 # - ASCII-only strings can be written without double-quotes. They can be splitted
15 # into several lines using shell-like escaping of EOL. A string begins and ends on
16 # on a non-blank character. This king of string can not contain semi-colons.
18 # The following format are equivalent:
22 # (2) "this is a string"
27 # Most of the configuration use a format:
30 # When not in a string, spaces and line breaks are ignored. You can use comments
31 # everywhere out of a string. It starts with a '#' character and ends at the end of the
32 # line. Comments are strictly equivalents to white spaces.
36 # A definition of a filter contains:
37 # - the name of the filter. This name MUST be uniq (non-uniq names can lead to undefined
40 # - a list of type-specific parameters
41 # - a list of hooks (on_hookname)
44 # A filter look likes that:
48 # param1 = parameter value 1;
56 # A filter can returns different values. Each return value is given a name. The
57 # configuration associates an action to run to a return value name.
59 # The action can be either a postfix access(5) value or a filter name. Postfix access
60 # parameters must be prefixed by 'postfix:'.
63 # on_match = postfix:REJECT Blacklisted;
66 # Current defined filter types are:
67 # - iplist: match the client_address against one or more blacklist files from a rbl
69 # - file: (no)?lock:weight:filename
70 # declare a file to load. If lock is given, the klist is locked into the
71 # RAM. The weight is a number giving the weight of this blaclist file in the
73 # - rbldns: (no)?lock:weight:filename
74 # this is an alias for file.
75 # - dns: weight:hostname
76 # use a rbl via DNS resolution with the given weight. If a DNS lookup error occurs
77 # the IP is considered as beeing "not found".
78 # - soft_threshold: score (default: 1)
79 # minimum score to match the soft_match return value
80 # - hard_threshold: score (default: 1)
81 # minimum score to match the hard_match return value
83 # The score of a query is the sum of the weight of the blacklist it matched.
84 # - If the IP can not be parsed, returns error
85 # - If no rbl was available (no file and all dns down), returns error.
86 # - If the score is strictly greater >= than hard_threshold, returns hard_match
87 # - If the score is strictly greater >= than soft_threshold, returns soft_match
88 # - Else, returns fail
91 spamhaus_and_abuseat {
95 file = lock:10:/var/spool/postlicyd/rbl.spamhaus.org;
96 file = lock:1:/var/spool/postlicyd/cbl.abuseat.org;
101 on_soft_match = greylist;
102 on_hard_match = postfix:REJECT optional text;
103 on_fail = postfix:OK;
104 on_error = postfix:DUNNO;
108 # - strlist: match strings from the query against a list of list.
110 # - file: (no)?lock:(partial-)?(pre|suf)fix:weight:filename
111 # declare a file to load. If lock is given, the list is locked into the
112 # RAM. Prefix/Suffix is a parameter to tell the matcher which is the most
113 # efficient storage order. The strings are internally stored into a trie that
114 # allow high compression if a lot of prefix are shared by several strings. If
115 # you choose "prefix", string are stored in the natural order in memory and
116 # prefix compression is performed. If you choose "suffix", strings are stored
117 # in reverse order in memory and suffix compression is performed. If you add "partial-"
118 # to the match order, the entry will match if the file contains a prefix (resp. suffix)
119 # of the string. The weight is a number giving the weight of this list in the string score.
121 # * a file that contains ".polytechnique.org" in "partial-suffix" mode will match
122 # all subdomains of "polytechnique.org".
123 # * a file that contains "postmaster@" in "partial-prefix" mode will match all
125 # * a file open without "partial-" modifier match exact strings.
126 # - rbldns: (no)?lock:weight:filename
127 # declare a rbldns zone file to load. This is exactly the same as file excepted that it wraps
128 # parsing of hostname to split them into 2 categories:
129 # * names beginning with '*' are sorted as 'domains' and are matched as suffix
130 # * names starting with an alphanumirical character are sorted as 'hostnames' and are
131 # process via exact matching.
132 # - dns: weight:hostname
133 # use a rhbl via DNS resolution with the given weight. If a DNS lookup error occurs
134 # the hostname is considered as beeing "not found". This can only be used with "hostnames"
136 # - soft_threshold: score (default: 1)
137 # minimum score to match the soft_match return value
138 # - hard_threshold: score (default: 1)
139 # minimum score to match the hard_match return value
140 # - fields: field_name(,field_name)*
141 # list of field the match the string against.
142 # currently only email OR hostname fields are supported. You MUST choose only
143 # one of these types per strlist, and be carefull that the field you requested
144 # are available in the protocol state you want to use this filter for.
145 # * hostname fields: helo_name, client_name, reverse_client_name, sender_domain,
147 # * email fields: sender, recipient
148 # No space is allowed in this parameter.
150 # The score of a query is the sum of the weight of the list it matched.
151 # - If no rhbl was available (no file and all dns down), returns error.
152 # - If the score is strictly greater >= than hard_threshold, returns hard_match
153 # - If the score is strictly greater >= than soft_threshold, returns soft_match
154 # - Else, returns fail
156 # - to match helo_name, you must be on HELO state or later
157 # (stmpd_helo_restrictions)
158 # - to match sender, you must be on MAIL state or later
159 # (smtpd_sender_restrictions)
160 # - to match recipient, you must on RCPT state (stmpd_recipient_restrictions)
161 # - client_name and reverse_client_name are always available
163 # Whitelist some clients
168 file = lock:1:suffix:/var/spool/postlicyd/client_whitelist;
169 rbldns = lock:1:/va/spool/postlicyd/abuse.rfc-ignorant.org;
170 fields = client_name,sender_domain,helo_name;
173 on_hard_match = postfix:OK;
174 on_fail = spamhaus_and_abuseat;
178 # - greylist: greylister
180 # - path: /my/path/ (required)
181 # path where to store the greylist database
182 # - prefix: name (default: "")
183 # prefix to the name of the greylist database
184 # - lookup_by_host: boolean (default: false)
185 # perform lookup per host instead of domain.
186 # - delay: number (default: 300)
187 # number of seconds the client must wait before retrial.
188 # - retry_window: (default: 2 * 24 * 3600)
189 # number of seconds we wait for a retry.
190 # - client_awl: number (default: 5)
191 # number of successful greylisting before the client get whitelisted (0 means,
192 # no-auto-whitelist).
193 # - max_age: number (default: 30 * 3600)
194 # lifetime of a greylist/whitelist session: ie, if a client does ne reappear during
195 # max_age seconds, the entries associated to this client are invalidated.
197 # - if the client is whitelisted, returns whitelist
198 # - if the client is greylisted, returns greylist
199 # - if a error occured (not currently possible), returns error
201 # this filter is a recipient filter and works in RCPT state only
202 # (smtpd_recipient_restrictions).
204 # Perform greylisting
209 path = /var/spool/postlicyd/;
213 on_greylist = postfix:DEFER_IF_PERMIT optional text;
214 on_whitelist = postfix:OK;
218 # - match: direct matching against the query fields
220 # - match_all: boolean
221 # if true, the filter won't match until all conditions
222 # are verified. If false, the filter match on the first
223 # verified condition.
224 # - condition: field_name OP (value)
225 # * the field_name is one of the field name of the query
226 # emitted by postfix. This list with description of each
227 # field is available at:
228 # http://www.postfix.org/SMTPD_POLICY_README.html
229 # postlicyd also support fields sender_domain and recipient_domain
230 # * OP is an operator. Available operators are:
231 # == field_name is strictly equal to value
232 # =i field_name is case insensitively equal to value
233 # != field_name is not equal to value
234 # !i field_name is not case insensitively equal to value
235 # >= field_name contains value
236 # >i field_name contains case insensitively value
237 # <= field_name is contained by value
238 # <i field_name is contained case insensitively by value
239 # #= field_name is empty or not set
240 # #i field_name is not empty
242 # - if the conditions are verified (according to match_all strategy), return match
243 # - if the conditions are not verified, return fail
245 # match one of the condition: "stress mode activated", "client_name contains debian.org" or
246 # "recipient is empty"
252 condition = stress == yes;
253 condition = client_name >= debian.org;
254 condition = recipient #=;
257 on_match = postfix:OK;
264 # Access policy daemon can be used at several protocol states. For each of this states,
265 # you can define a different entry point in the filtering tree. This entry points have
266 # the following format:
268 # state = filter_name;
270 # The filter_name MUST be one of the filter you previously defined.
272 # The available states are:
273 # - client_filter: called on CONNECT state (smtpd_client_restrictions)
274 # - helo_filter (or ehlo_filter): called on HELO/EHLO command (smtpd_helo_restrictions)
275 # - sender_filter: called on the MAIL FROM command (stmpd_sender_restrictions)
276 # - recipient_filter: called on the RCPT TO command (smtpd_recipient_restrictions)
277 # - data_filter: called on the DATA command (smtpd_data_restrictions)
278 # - end_of_data_filter: called on the END-OF-DATA command
279 # (smtpd_end_of_data_restrictions)
280 # - etrn_filter: called on the ETRN command (stmpd_etrn_restrictions)
281 # - verify_filter: called on the VRFY command (no postfix hook ?)
283 recipient_filter = client_whitelist;
288 # Port to which the server is bound. The default is 10000. If the port is specified as
289 # a command line parameter, the value specified on command line overides this value.
291 # You must RESTART the server to change the port (reload does not affect the port).
295 # vim:set syntax=conf: