Hi,

I propose to set up a basic antispam / antivirus check on the mailing list server. The administration of mailing lists became a burden due to spams and virus.

I propose several steps: * first blocking mails from invalid domains and virus. This take very little server resource, but should remove a big part of unwanted trafic. * if this is not enough, then setting a specific antispam with Spamassassin for blocking most unwanted mails. This will also require more server resources.

Here below are the rules I propose to implement for the first step. These are the rules I use myself for the last 2 years.

======================== /etc/postfix/main.cf:

smtpd_helo_required = yes disable_vrfy_command = yes

unknown_address_reject_code = 554 unknown_client_reject_code = 554 unknown_hostname_reject_code = 554

# Default: not needed smtpd_recipient_restrictions = reject_invalid_hostname, reject_non_fqdn_hostname, reject_non_fqdn_sender, reject_non_fqdn_recipient, reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_unauth_pipelining, permit_mynetworks, reject_unauth_destination, reject_rbl_client relays.ordb.org, reject_rbl_client opm.blitzed.org, reject_rbl_client list.dsbl.org, reject_rbl_client sbl.spamhaus.org, reject_rbl_client cbl.abuseat.org, reject_rbl_client dul.dnsbl.sorbs.net, reject_rbl_client blackholes.easynet.nl, reject_rbl_client proxies.blackholes.wirehub.net, reject_rbl_client bl.spamcop.net, reject_rbl_client dnsbl.njabl.org, permit

smtpd_client_restrictions = permit_mynetworks, reject_unknown_client, reject_unknown_sender_domain, reject_non_fqdn_sender, reject_invalid_hostname, reject_non_fqdn_hostname, reject_non_fqdn_recipient, reject_unknown_recipient_domain, reject_unauth_pipelining, reject_unauth_destination, reject_rbl_client relays.ordb.org, reject_rbl_client opm.blitzed.org, reject_rbl_client list.dsbl.org, reject_rbl_client sbl.spamhaus.org, reject_rbl_client cbl.abuseat.org, reject_rbl_client dul.dnsbl.sorbs.net, reject_rbl_client blackholes.easynet.nl, reject_rbl_client proxies.blackholes.wirehub.net, reject_rbl_client bl.spamcop.net, reject_rbl_client dnsbl.njabl.org, permit

smtpd_helo_restrictions = permit_mynetworks, reject_invalid_hostname, reject_unknown_hostname, reject_non_fqdn_hostname

smtpd_sender_restrictions = reject_unknown_sender_domain, reject_non_fqdn_sender, reject_invalid_hostname, reject_non_fqdn_hostname, reject_non_fqdn_recipient, reject_unknown_recipient_domain, reject_unauth_pipelining, permit_mynetworks, reject_unauth_destination, reject_rbl_client relays.ordb.org, reject_rbl_client opm.blitzed.org, reject_rbl_client list.dsbl.org, reject_rbl_client sbl.spamhaus.org, reject_rbl_client cbl.abuseat.org, reject_rbl_client dul.dnsbl.sorbs.net, reject_rbl_client blackholes.easynet.nl, reject_rbl_client proxies.blackholes.wirehub.net, reject_rbl_client bl.spamcop.net, reject_rbl_client dnsbl.njabl.org, permit

header_checks = regexp:/etc/postfix/header_checks mime_header_checks = regexp:/etc/postfix/mime_header_checks

========== /etc/postfix/mime_header_checks:

/.*name=".*.(exe|pif|zip|scr|com|dat|vbs)"/ REJECT

========== /etc/postfix/header_checks: (new rules could be added as needed)

/Subject:.*Hydrocodone.*/ REJECT /Subject:.*Valium.*/ REJECT /Subject:.*Vicodin.*/ REJECT /Subject:.*Pharmacy.*/ REJECT /Subject:.*Xanax.*/ REJECT /Subject:.*Rolex.*/ REJECT /Subject:.*VIAGRA.*/ REJECT /Subject:.*Network Critical Update.*/ REJECT

Regards, Yann