Hellos!
I was wondering, what exactly is the advantage of the newly introduced “milter-greylist” in terms of limiting the number of messages sent by a specific IP address, as opposed to using these Postfix directives which I’ve done so far?
smtpd_client_connection_rate_limit = 15
smtpd_client_message_rate_limit = 25
smtpd_client_recipient_rate_limit = 50
Howdy,
One of the issues is that Postfix views emails arriving externally, such as from Outlook and Thunderbird, as different from those arriving internally – such as those arriving via a PHP app using the mail() function.
The mail() function sends email using the /usr/sbin/sendmail command.
Email coming into the Postfix queue using the sendmail command bypasses all those smtpd checks, which allows abuse coming from web apps and users logged into the server.
That’s the big benefit. If it weren’t for that, I suspect Virtualmin wouldn’t have included support for milter-greylist at first, and instead would have begun by making use of some of the other Postfix options such as the ones you mentioned.
That said, milter-greylist does allow for more fine-grained message control, on a per-user and per-domain basis.
-Eric
Very good points Eric, thanks! I’ll give the milter a try on my main Virtualmin too.
Yes, thank you. Very useful.
An additional thought. What would be the best way to be informed when the milter limit hits? I.e. when a mail user or website tries to send more mails than allowed?
I suppose it would be useful to know, to either investigate if an email account or website was compromised, or to be made aware that too strict limits have been configured globally or for specific domains/users.
Oh, also: Eric, you wrote the milter offers limiting on a per-user basis. In Virtualmin, I can find only per-domain limits (in addition to the global one) though.
Howdy,
Yeah, there may be some room for improvement here!
At the moment, you’d either have to notice the extra email in the queue, or setup a cron job to grep the mail logs for a rate limiting error.
Webmin can generate an email notification when the queue reaches a certain size. That can be done in Webmin -> Others -> System and Server Status, and in there, you can setup a Mail queue size monitor.
The milter itself is very flexible regarding it’s limits… it looks like Jamie just started with per-domain limits though.
You could certainly manually add a per-user limit into the config, but I’ll add it to my notes to talk to Jamie about whether Virtualmin might support that in the GUI in the future.
-Eric
Thanks for your thoughts Eric! 
Thing is, when I configure a limit like say “100 mails per hour max”, the mail queue is probably not going to reflect an abuse. The mail queue will only grows to a size that can be caught by the Webmin monitor, i.e. let large enough quickly enough, and stay large, when there’s a huge backlog of to-be-processed messages, or when Postfix gets slowed down by recipient mail servers. When a spammer gets stopped right away after 100 mails though, that probably won’t happen.
So the idea sounds good indeed to (of course one could that manually, but…) to add a function like you suggested, that greps the mail logs for rate limiting errors and puts warnings out to the admin.