iT邦幫忙

0

linux milter-greylist 如何設定白名單帳號

  • 分享至 

  • xImage

我想要的不是這樣的作法

針對寄件者白名單

acl whitelist addr 192.168.3.0/24

是要針對收信者作白名單

因為有業務反應說設了milter-greylist,信都收的很慢,他們沒法子等,要立刻收到,他不管垃圾信

有沒有辦法設定比如有sales這用戶

設定sales@123.com.tw 這帳號

不要delay信件的作法?

自己曾用 milter-greylist 的經驗,
是在 1.6 版之時:
在 /etc/mail/greylist.conf 裡,
預設全部是以 greylist 來處理,
只有是 addr, rcpt, domain, from 開頭的,
(那時還沒有 acl, list 等語法)
才以白名單處理。

在討論的過程中,
才知道已進化到 4.2.6/4.3.8 版,
語法的進化改變,
使得調整的彈性又更大。
圖片
  直播研討會
圖片
{{ item.channelVendor }} {{ item.webinarstarted }} |
{{ formatDate(item.duration) }}
直播中

1 個回答

12
逮丸逮丸
iT邦大師 1 級 ‧ 2010-08-09 16:33:54
最佳解答
<pre class="c" name="code">acl greylist rcpt sales@123.com.tw
看更多先前的回應...收起先前的回應...

您好,好像沒有用耶,我看log還是說請我等30分鍾

<pre class="c" name="code">#
# Simple greylisting config file using the new features
# See greylist2.conf for a more detailed list of available options
#
# $Id: greylist.conf,v 1.37.2.2 2006/09/27 20:03:24 manu Exp $
#

pidfile "/var/run/milter-greylist.pid"
socket "/var/milter-greylist/milter-greylist.sock"
dumpfile "/var/milter-greylist/greylist.db"
user "smmsp"

# Be verbose (or use -v flag)
#verbose

# Do not tell spammer how long they have to wait
quiet

# MX peering
#peer 192.0.2.17
#peer 192.0.2.18

[code]# Your own network, which should not suffer greylisting
list "my network" addr { 127.0.0.1/8 10.0.0.0/8 192.0.1.0/24 }

This is a list of broken MTAs that break with greylisting. Derived from

http://cvs.puremagic.com/viewcvs/greylisting/schema/whitelist_ip.txt?rev=1.16

list "broken mta" addr { \
12.5.136.141/32 \ # Southwest Airlines (unique sender)
12.5.136.142/32 \ # Southwest Airlines
12.5.136.143/32 \ # Southwest Airlines
12.5.136.144/32 \ # Southwest Airlines
12.107.209.244/32 \ # kernel.org (unique sender)
12.107.209.250/32 \ # sourceware.org (unique sender)
63.82.37.110/32 \ # SLmail
63.169.44.143/32 \ # Southwest Airlines
63.169.44.144/32 \ # Southwest Airlines
64.7.153.18/32 \ # sentex.ca (common pool)
64.12.136.0/24 \ # AOL (common pool)
64.12.137.0/24 \ # AOL
64.12.138.0/24 \ # AOL
[code]

<pre class="c" name="code">64.124.204.39      \ # moveon.org (unique sender)
	64.125.132.254/32  \ # collab.net (unique sender)
	66.94.237.16/28    \ # Yahoo Groups servers (common pool)
	66.94.237.32/28    \ # Yahoo Groups servers (common pool)
	66.94.237.48/30    \ # Yahoo Groups servers (common pool)
	66.100.210.82/32   \ # Groupwise?
	66.135.192.0/19    \ # Ebay
	66.162.216.166/32  \ # Groupwise?
	66.206.22.82/32    \ # Plexor
	66.206.22.83/32    \ # Plexor
	66.206.22.84/32    \ # Plexor
	66.206.22.85/32    \ # Plexor
	66.218.66.0/23     \ # Yahoo Groups servers (common pool)
	66.218.67.0/23     \ # Yahoo Groups servers (common pool)
	66.218.68.0/23     \ # Yahoo Groups servers (common pool)
	66.218.69.0/23     \ # Yahoo Groups servers (common pool)
	66.27.51.218/32    \ # ljbtc.com (Groupwise)
<pre class="c" name="code">152.163.225.0/24   \ # AOL
	194.245.101.88/32  \ # Joker.com
	195.235.39.19/32   \ # Tid InfoMail Exchanger v2.20
	195.238.2.0/24     \ # skynet.be (wierd retry pattern, common pool)
	195.238.3.0/24     \ # skynet.be
	195.46.220.208/32  \ # mgn.net
	195.46.220.209/32  \ # mgn.net
	195.46.220.210/32  \ # mgn.net
	195.46.220.211/32  \ # mgn.net
	195.46.220.221/32  \ # mgn.net
	195.46.220.222/32  \ # mgn.net
	195.238.2.0/24     \ # skynet.be (wierd retry pattern)
	195.238.3.0/24     \ # skynet.be
	204.107.120.10/32  \ # Ameritrade (no retry)
<pre class="c" name="code">	205.188.0.0/16     \ # AOL
	205.206.231.0/24   \ # SecurityFocus.com (unique sender)
	207.115.63.0/24    \ # Prodigy - retries continually
	207.171.168.0/24   \ # Amazon.com
	207.171.180.0/24   \ # Amazon.com
	207.171.187.0/24   \ # Amazon.com
	207.171.188.0/24   \ # Amazon.com
	207.171.190.0/24   \ # Amazon.com
	209.132.176.174/32 \ # sourceware.org mailing lists (unique sender)
	211.29.132.0/24    \ # optusnet.com.au (wierd retry pattern)
	213.136.52.31/32   \ # Mysql.com (unique sender)
	216.33.244.0/24    \ # Ebay
	217.158.50.178/32  \ # AXKit mailing list (unique sender)
	210.242.46.180/32  \ # hinet spam
}
<pre class="c" name="code"># List of users that want greylisting
#list "grey users" rcpt {  \
#	user1@example.com \
#	user2@example.com \
#	user3@example.com \
#}

# Give this a try if you enabled DNSRBL
#dnsrbl "SORBS DUN" dnsbl.sorbs.net 127.0.0.10

# And here is the access list
acl whitelist list "my network"
acl whitelist list "broken mta"
#acl greylist list "grey users" dnsrbl "SORBS DUN" delay 24h autowhite 3d
acl greylist default delay 30m autowhite 3d
acl whitelist default
acl whitelist addr 192.168.1.0/24
acl greylist rcpt sales@123.com.tw

以上是我的/etc/mail/greylist.conf
設定還麻煩您多幫忙了

我重啟milter-greylist
有看到ignored acl entry after acl default rule at line 107
看起來是說有設定忽略,這樣算成功嗎?

我還看到有人教我說用這樣
acl whitelist from sales@123.com.tw
可是好像沒有用

可能要:
把這兩行:
acl greylist default delay 30m autowhite 3d
acl whitelist default
移到最底下,
且 acl whitelist default 應拿掉,
或該行前面加 #。
所有新增的規則應在:
acl greylist default delay 30m autowhite 3d
之前。

因為公司有用郵件守門員進來的信都要透過210.242.46.192
所以我參考了您給的網站
作成以下

<pre class="c" name="code"># And here is the access list
acl whitelist list "my network"
acl whitelist list "broken mta"
#acl greylist list "grey users" dnsrbl "SORBS DUN" delay 24h autowhite 3d
acl whitelist addr 210.242.46.192 rcpt sales@123.com.tw
acl whitelist rcpt sales@123.com.tw
acl greylist default delay 30m autowhite 3d
acl whitelist default

這樣就可以了

您好我有試著加在
acl greylist default delay 30m autowhite 3d之前
但是也沒用
不知是不是因為
acl whitelist default沒拿掉的關係
這行有沒有拿掉有何差別呢?

您好我測試解果,似乎要寫為
acl whitelist rcpt sales@123.com.tw
才是正確的寫法

acl whitelist default這行我查了,是預設所有的都要delay
雖然使用上沒問題,但還是先註解掉了

<pre class="c" name="code">acl whitelist list "my network"
acl whitelist list "broken mta"
#acl greylist list "grey users" dnsrbl "SORBS DUN" delay 24h autowhite 3d
acl whitelist rcpt sales@123.com.tw
acl greylist default delay 30m autowhite 3d
#acl whitelist default
#acl whitelist addr 192.168.1.0/24

不過還是感謝您的指點,才讓我有個方向讚

仔細看一下 README 的說明:

<pre class="c" name="code">acl greylist rcpt /.*@example\.net/
acl whitelist default

這是前面都指定一些條件要 greylist,
最後一行說 未符合以上條件者,都以 白名單 處理。

而您的情況是:

<pre class="c" name="code">…
acl whitelist rcpt sales@123.com.tw
acl greylist default delay 30m autowhite 3d
acl whitelist default

前面列了一堆 要當白名單的條件,
所以最後一行應是上述的第三行:
「不符合上述條件的話,都以灰名單處理,
處理的方式是 延30分鐘,通過的話成3天的自動白名單」。
所以第4行的 acl whitelist default 是不需要的。

我要發表回答

立即登入回答