Postfix

第一个是发垃圾邮件的，我很少看到这么执着的家伙：

Mar 5 20:34:12 tarsier postfix/smtpd[5567]: NOQUEUE: reject: RCPT from unknown[218.13.181.114]: 450 <server_9.netstar.com>: (此处略去为什么拒绝此邮件); from=falkon@163.com to=cnproj-cvs-request@lists.cn.freebsd.org proto=ESMTP helo=<server_9.netstar.com>

有完没完啊，哥们我都拒绝你一个多礼拜了，看不看RFC??

没啥技术含量，做个笔记而已。

相关日志如下：

Jan 11 22:19:02 tarsier postfix/postfix-script: stopping the Postfix mail system
Jan 11 22:19:02 tarsier postfix/master[92875]: terminating on signal 15
Jan 11 22:19:02 tarsier postfix/postfix-script: starting the Postfix mail system
Jan 11 22:19:02 tarsier postfix/master[70250]: daemon started – version 2.2.8, configuration /usr/local/etc/postfix

SPF并不总只是一种公德性的行为，有时它也会给你带来额外的好处，比如：

Dec 17 15:40:55 tarsier postfix/smtpd[63579]: NOQUEUE: reject: RCPT from unknown[60.177.46.2]: 550 support@geekcn.org: Sender address rejected: “geekcn.org [60.177.46.2] is not allowed to send mail for support@geekcn.org”; from=support@geekcn.org to=steve@geekcn.org proto=ESMTP helo=<geekcn.org>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

Return-Path: <zvbn00831@sohu.com>
Received-SPF: unknown (tarsier.geekcn.org: error in processing
	during lookup of domain of sohu.com: Invalid IPv4 address literal)
	client-ip=61.135.132.105; envelope-from=zvbn00831@sohu.com;
	helo=smtp128.sohu.com; problem=Invalid IPv4 address literal
	near ":" in "ip4:";
Received: from smtp128.sohu.com (unknown [61.135.132.105])
	by tarsier.geekcn.org (Postfix) with ESMTP id 7437CEB43CE
	for <delphij@delphij.net>; Sat,  3 Dec 2005 15:36:44 +0800 (CST)
Received: from shopguide.oicp.net (unknown [221.218.149.214])
	by smtp128.sohu.com (Postfix) with ESMTP
	id ADA3600FCF6; Sat,  3 Dec 2005 15:36:42 +0800 (CST)
From: =?gb2312?B?xOq117Tzt8XLzQ==?= <zvbn00831@sohu.com>
To: <delig?19@y??o?.c??.cn>, <de?lga?es1?3@ya?o?.c?m>,
	<delphij@delphij.net>, <delp?in?gu?n@ho?m?il.c?m>,
	<delphi?cl@oc?ouds?ft.c?m>, <deh?whu?w??@?o?.co?>,
	<del???iii@???.com>, <d??wy@ho????l.c??>, <dem????81@????.com>,
	<de????08@???.com>
Subject: =?gb2312?B?tefX08fZ0MLJz8rQo6GxyMnMs6G827jxtc00MCWjoTk51KrD4tTLt9GjoQ==?=
Date: Sat, 03 Dec 2005 15:36:38 +0800
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_NextPart_001_00D9_01C652C1.7622F956"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1478
X-MimeOLE: Produced By Microsoft MimeOLE 6.00.2800.1478
Message-Id: <20051203073642.ADA3600FCF6@smtp128.sohu.com>

看来，垃圾邮件的发送者已经被轰到别人那里了。但愿他们的人能够改良反垃圾技术。为了防止收集垃圾邮件地址，已经对这里除了发送者和我自己之外的地址进行了反收集处理。

离这个Q结束还有1个月，来总结一下：

工作：

• 基本完成了内部版本的FreeBSD 6.0-RELEASE，并已开始用于生产服务器
• 替换了公司的一组基于qmail的转发服务器，采用FreeBSD 6.0和postfix
• 实现了一个验证服务
• 设计并实现了一组全新的反垃圾策略，有效地将垃圾邮件的数量降低了若干量级，并且用户无不良反映(最开始出现过一次问题，但并不是策略本身的问题)
• 设计了一组新的用户行为分析系统，并实现了其初级部分。该系统将进一步提高邮件系统的可用性
• 追和扑灭了邮件系统中的一批中等和严重程度的隐患
• 1314同学撤退后客串跑了若干次机房扑火
• 赶猪，逮老鼠，上大包……(暗语，内部人员偷着乐就行了，不要泄露国家机密;)
  (不过李逵却说……算了还是不说了)

开源软件方面的掺和：

• 为FreeBSD 6.0-RELEASE的发布进行了一些工作，总体而言得到了认可
• 翻译完了FreeBSD Architecture Handbook的SMP章节

假定你使用的是FreeBSD

0. 在测试服务器上测试postfix配置文件，确认其能够与qmail提供同样的服务。
1. 执行svc -d /services/qmail-smtpd，停止进信。
2. 执行qmailctl flush，下发所有邮件，等待队列空。

感恩节那天，正式完全彻底地消灭了第一组公司的qmail服务器，并全线替换为FreeBSD 6.0+postfix。这是公司邮件服务的一大进步。

再也没有恶心的代码，拥堵的队列，缓冲区溢出、各式各样的hack、裹尸布一样的千层补丁，再也没有signal 11和大批大批的垃圾邮件了！！！

So someone has hacked 210.51.165.42, which apparantly is an open proxy that can lead to attacks. The box has tried to trick my mail server into trusting him and thus relay spams, but my postfix configurations has rejected all its requests. Considering to have pf configuration to avoid it…

Yes, finally postfix is supporting DSN. To quote Witese, this is the first postfix snapshot which provides “full support for RFC 3461..3464 Delivery Status Notifications”!

Today, Wietse Venema has announced postfix 2.2.0-RELEASE. To quote him:

The official Postfix 2.2 release adopts widely used third-party patches and a bunch of new functionality that was developed over the past year.Below is a summary of the changes. These and more are detailed in the RELEASE_NOTES document, which also describe the incompatible changes that you should be aware of BEFORE upgrading from Postfix
2.1 or earlier.

• TLS and IPv6 support are now built into Postfix, based on code
  from third-party patches.

• Extended query interface for LDAP, MySQL and PostgreSQL with free
  form SQL queries, and domain name filters to reduce unnecessary
  lookups.