Rate limiting Postfix senders with smtpd parameters or Postfwd
Contain a hacked mail account before it floods the world.
- Answers
- How do you rate limit outgoing mail per user in Postfix?
- Topics
- cloud · cyber-security · howto · linux · networking · server
- Full article on willem.com
- https://willem.com/en/2019-09-10_fighting-backscatter-spam-at-server-level/
Summary
Use Postfix parameters like smtpd_client_message_rate_limit, smtpd_client_connection_rate_limit and smtpd_client_recipient_rate_limit, or a Postfix firewall like Postfwd. Rate limits cap the damage when a user's password is sniffed or a customer's computer catches a virus.
Full text
Abuse rarely starts with the server itself: it starts when a legitimate user's computer gets a virus or their password gets sniffed, for example over insecure wifi without TLS/SSL encryption. With individual authentication required for every user, the mail logs show exactly which account is causing the problem, and the server never acts as an open relay. Rate limiting adds a ceiling on top of that. Postfix offers per client configuration parameters such as smtpd_client_message_rate_limit, smtpd_client_connection_rate_limit and smtpd_client_recipient_rate_limit, and a policy firewall like Postfwd can enforce more elaborate rules. A compromised account can then still send some spam, but not enough to flood the world or to get the server blacklisted before you spot the problem in the logs.