diff --git a/group_vars/all/main.yml b/group_vars/all/main.yml index fc93350..5395a20 100644 --- a/group_vars/all/main.yml +++ b/group_vars/all/main.yml @@ -2991,6 +2991,14 @@ copy_plain_files_postfwd: src_path: mailserver/etc/postfix/postfwd.bl-recipient-exeeds-msg-size-20mb dest_path: /etc/postfix/postfwd.bl-recipient-exeeds-msg-size-20mb + - name: postfwd.high-rate-number-messages + src_path: mailserver/etc/postfix/postfwd.high-rate-number-messages + dest_path: /etc/postfix/postfwd.high-rate-number-messages + + - name: postfwd.high-rate-number-recipients + src_path: mailserver/etc/postfix/postfwd.high-rate-number-recipients + dest_path: /etc/postfix/postfwd.high-rate-number-recipients + - name: postfwd.wl-hosts src_path: mailserver/etc/postfix/postfwd.wl-hosts dest_path: /etc/postfix/postfwd.wl-hosts diff --git a/roles/common/files/mail.cadus/etc/postfix/postfwd.high-rate-number-messages b/roles/common/files/mail.cadus/etc/postfix/postfwd.high-rate-number-messages new file mode 100644 index 0000000..0a8aec8 --- /dev/null +++ b/roles/common/files/mail.cadus/etc/postfix/postfwd.high-rate-number-messages @@ -0,0 +1,19 @@ +# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] *** + +# --- +# SASL Users are allowed to send up to 500 messages per hour +# +# This file is called with '=='. This means perl regexp is NOT possible +# +# +# example: +# +# # give sasl usernames here +# # +# ckubu@oopen.de +# +# --- + +# give sasl usernames here +application@cadus.org + diff --git a/roles/common/files/mail.cadus/etc/postfix/postfwd.wl-hosts b/roles/common/files/mail.cadus/etc/postfix/postfwd.wl-hosts deleted file mode 100644 index c425a4e..0000000 --- a/roles/common/files/mail.cadus/etc/postfix/postfwd.wl-hosts +++ /dev/null @@ -1,22 +0,0 @@ -# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] *** - -# --- -# Trusted hosts whitelisted by postfwd -# -# This file is called with '=~'. This means perl regexp is possible -# -# -# To increase performance use ^ and/or $ in regular expressions -# -# Example: -# -# # all hosts of domain 'oopen.de' -# \.oopen\.de$ -# -# # host a.mx.oopen.de -# ^a\.mx\.oopen\.de$ -# -# --- - -# give truested hostnames here - diff --git a/roles/common/files/mailserver/etc/postfix/postfwd.cf b/roles/common/files/mailserver/etc/postfix/postfwd.cf index 80cec69..7dc03fe 100644 --- a/roles/common/files/mailserver/etc/postfix/postfwd.cf +++ b/roles/common/files/mailserver/etc/postfix/postfwd.cf @@ -172,12 +172,26 @@ id=BLOCK_MSG_RCPT recipient_count=90 action=REJECT Too many recipients, please reduce to less than 90 or consider using a mailing list. Error: BLOCK_MSG_RCPT +# Higher rate limit for users in exception list +id=RATE_MSG_EXCEPTION + &&INCOMING + &&SASL_AUTH + sasl_username==file:/etc/postfix/postfwd.high-rate-number-messages + action=rate($$sasl_username/500/3600/450 4.7.1 Number messages per hour exceeded. Error:RATE_MSG_EXCEPTION) + # Block users sending more than 50 messages/hour id=RATE_MSG &&INCOMING &&SASL_AUTH action=rate($$sasl_username/50/3600/450 4.7.1 Number messages per hour exceeded. Error:RATE_MSG) +# Higher recipient rate limit for specific users from file +id=RATE_RCPT_HIGH + &&INCOMING + &&SASL_AUTH + sasl_username==file:/etc/postfix/postfwd.rate-msg-exceptions + action=rcpt($$sasl_username/1000/3600/450 4.7.1 Number recipients per hour exceeded. Error:RATE_RCPT_HIGH) + # Block users sending more than 250 recipients total/hour id=RATE_RCPT &&INCOMING diff --git a/roles/common/files/mailserver/etc/postfix/postfwd.high-rate-number-messages b/roles/common/files/mailserver/etc/postfix/postfwd.high-rate-number-messages new file mode 100644 index 0000000..73814fa --- /dev/null +++ b/roles/common/files/mailserver/etc/postfix/postfwd.high-rate-number-messages @@ -0,0 +1,18 @@ +# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] *** + +# --- +# SASL Users are allowed to send up to 500 messages per hour +# +# This file is called with '=='. This means perl regexp is NOT possible +# +# +# example: +# +# # give sasl usernames here +# # +# ckubu@oopen.de +# +# --- + +# give sasl usernames here + diff --git a/roles/common/files/mailserver/etc/postfix/postfwd.high-rate-number-recipients b/roles/common/files/mailserver/etc/postfix/postfwd.high-rate-number-recipients new file mode 100644 index 0000000..c9bf5cb --- /dev/null +++ b/roles/common/files/mailserver/etc/postfix/postfwd.high-rate-number-recipients @@ -0,0 +1,17 @@ +# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] *** + +# --- +# SASL Users are allowed to send up to 1000 recipients per hour +# +# This file is called with '=='. This means perl regexp is NOT possible +# +# example: +# +# # give sasl usernames here +# # +# ckubu@oopen.de +# +# --- + +# give sasl usernames here + diff --git a/roles/common/files/mailserver/etc/postfix/postfwd.wl-hosts b/roles/common/files/mailserver/etc/postfix/postfwd.wl-hosts index e4b3a28..c425a4e 100644 --- a/roles/common/files/mailserver/etc/postfix/postfwd.wl-hosts +++ b/roles/common/files/mailserver/etc/postfix/postfwd.wl-hosts @@ -20,9 +20,3 @@ # give truested hostnames here -# host b.mx.oopen.de -^b\.mx\.oopen\.de$ - -# host d.mx.oopen.de -^d\.mx\.oopen\.de$ -