# Postfix Redirection of Spam?

## yottabit

Hi Everyone!

I have a bunch of rules running on my Postfix server for checking blacklists and the like, often rejecting huge amounts of spam.

Relevant Postfix config:

```
parent_domain_matches_subdomains = smtpd_access_maps

smtpd_helo_required = yes

disable_vrfy_command = yes

smtpd_recipient_restrictions =

        check_client_access hash:/etc/postfix/pop-before-smtp

        , permit_sasl_authenticated

        , check_helo_access hash:/etc/postfix/helo_checks

        , check_sender_access hash:/etc/postfix/sender_checks

        , check_client_access hash:/etc/postfix/client_checks

        , check_recipient_access hash:/etc/postfix/recipient_checks

        , permit_mynetworks

        , reject_non_fqdn_sender

        , reject_non_fqdn_recipient

        , reject_non_fqdn_hostname

        , reject_unknown_sender_domain

        , reject_invalid_hostname

        , reject_unknown_recipient_domain

        , reject_unauth_destination

        , reject_unauth_pipelining

#       , reject_unknown_client

        , reject_rbl_client bl.spamcop.net

        , reject_rbl_client cbl.abuseat.org

        , reject_rbl_client relays.ordb.org

        , reject_rbl_client opm.blitzed.org

        , reject_rbl_client list.dsbl.org

        , reject_rbl_client sbl-xbl.spamhaus.org

        , reject_rbl_client blackholes.easynet.nl

        , reject_rbl_client dynablock.njabl.org

        , reject_rhsbl_client blackhole.securitysage.com

        , reject_rhsbl_sender blackhole.securitysage.com

        , reject_rbl_client blackholes.mail-abuse.org

        , reject_rbl_client dialups.mail-abuse.org

        , reject_rbl_client dnsbl.sorbs.net

        , check_recipient_access hash:/etc/postfix/filtered_domains

        , permit

smtpd_data_restrictions =

            reject_unauth_pipelining,

            permit
```

Sometimes I have huge amounts of spam being rejected, as shown in this snippet:

```
Postfix log summaries for Sep 10

Grand Totals

------------

messages

    122   received

    128   delivered

      0   forwarded

      0   deferred

      2   bounced

    321   rejected (71%)

      6   reject warnings

      0   held

      0   discarded (0%)

  12420k  bytes received

  23188k  bytes delivered

     39   senders

     38   sending hosts/domains

     26   recipients

     17   recipient hosts/domains

smtpd

     579   connections

     199   hosts/domains

       4   avg. connect time (seconds)

  0:42:06  total connect time
```

I also have a SpamCop account and I send in all spam that gets through my Postfix filters. My question is this: how would I go about having Postfix accept the spam and redirect it automatically to a given e-mail address (like my SpamCop address in this case)?

Cheers,

J

----------

## bmichaelsen

How do you identify spam?

I would use a spamassasin/procmail combo to mark and deliver mails to do what you are up to do.

see:

http://gentoo-wiki.com/HOWTO_Email_System_for_the_Home_Network

http://gentoo-wiki.com/HOWTO_Email_System_for_the_Home_Network_Part_2

however, spamassassin eats lots of RAM ...

----------

## yottabit

I do use a post-processing spam-assassin filter, but I'm talking mainly for the rbl matching rules that occur way before spam-assassin...

----------

## bmichaelsen

ok, cant help you there. Your solution might be hidden somewhere in this document:

http://www.postfix.org/CONTENT_INSPECTION_README.html

----------

## yottabit

I was thinking there might be some sort of general Postfix option for a mailbox to which all rejected mail could be sent... I'll have to search through the mounds of Postfix documentation...

----------

## trossachs

yottabit, have can I get Postfix to generate weekly or daily logs the kind of which you have posted above?

----------

## yottabit

You'll want to check out the pflogsumm (postfix log summary) perl script:

http://jimsun.linxnet.com/postfix_contrib.html

----------

## trossachs

Thanks yottabit, but when I try and run a report:

```
pflogsumm.pl -d yesterday /var/log/maillog
```

The print out displays no mail delivered or received whatsoever. This is a little strange as I get around 7000 per day. I thought this was just something that could be ported to a Cron job or similar? Clearly something I am doing wrong here.

```
Grand Totals

------------

messages

      0   received

      0   delivered

      0   forwarded

      0   deferred

      0   bounced

      0   rejected (0%)

      0   reject warnings

      0   held

      0   discarded (0%)

      0   bytes received

      0   bytes delivered

      0   senders

      0   sending hosts/domains

      0   recipients

      0   recipient hosts/domains

Per-Hour Traffic Summary

    time          received  delivered   deferred    bounced     rejected

    --------------------------------------------------------------------

    0000-0100           0          0          0          0          0

    0100-0200           0          0          0          0          0

    0200-0300           0          0          0          0          0

    0300-0400           0          0          0          0          0

    0400-0500           0          0          0          0          0

    0500-0600           0          0          0          0          0

    0600-0700           0          0          0          0          0

    0700-0800           0          0          0          0          0

    0800-0900           0          0          0          0          0

    0900-1000           0          0          0          0          0

    1000-1100           0          0          0          0          0

    1100-1200           0          0          0          0          0

    1200-1300           0          0          0          0          0

    1300-1400           0          0          0          0          0

    1400-1500           0          0          0          0          0

    1500-1600           0          0          0          0          0

    1600-1700           0          0          0          0          0

    1700-1800           0          0          0          0          0

    1800-1900           0          0          0          0          0

    1900-2000           0          0          0          0          0

    2000-2100           0          0          0          0          0

    2100-2200           0          0          0          0          0

    2200-2300           0          0          0          0          0

    2300-2400           0          0          0          0          0
```

----------

## yottabit

Check your log rotation policies... you specified the "yesterday" option in pflogsumm.pl, so are you rotating maillog nightly to maillog.0 (or similar)?

I created a shell script in /etc/cron.daily/ that does this:

```
#/usr/bin/sh

#

/usr/local/bin/pflogsumm.pl -d yesterday -i --smtpd_stats --verbose_msg_detail /

var/log/messages.1 > /home/httpd/htdocs/pflogsumm/`date -d yesterday +%F`; chmod

 644 /home/httpd/htdocs/pflogsumm/*
```

With this I can check the log file daily via webpage. At the request of some of my users I have used a .htaccess file to password protect this directly to save from some bot scraping e-mail addresses out of it for spamming.

----------

## trossachs

I get the same result with the 'today' switch option enabled.

----------

## yottabit

Hrm, then I'm not sure what to tell you. I have my postfix log output going to /var/log/messages instead of /var/log/maillog. Are you sure you have it going to maillog?

----------

## trossachs

My log output for PF goes to /var/log/messages. Shouldn't this thing simply 'work out of the box?'Last edited by trossachs on Fri Mar 28, 2008 9:57 am; edited 1 time in total

----------

## cgill27

 *trossachs wrote:*   

> My log output for PF goes to /var/log/messages. Should this thing simply 'work out of the box?'

 

Postfix by default logs to /var/log/messages so run the script like below (using whatever switches you want ofcourse):

pflogsumm.pl --verbose_msg_detail /var/log/messages

You can also have it email the report to you via:

pflogsumm.pl --verbose_msg_detail /var/log/messages | mail -s "Email Report" user@domain.com

----------

## trossachs

Nice One. Thanks mate, have got the results I need now. How much mail does your server get hit with on a daily basis? 45k yesterday!

----------

