-----BEGIN PGP SIGNATURE-----
iQEzBAEBCAAdFiEE7sBxPmxNSLEwQp4k5k1h0mWW9oAFAmJac94ACgkQ5k1h0mWW
9oAAVQgAloimpD4P23zT4yQRkNBLmTK25Y2hqqECK2+3+nPkZmJBC6QSMDsVS1tX
WUWsiM8vGZdgkgMuQiGTDLGRjkgSeOApsEr7ug+RQuJmv9LoJKZbsLcIV4R/fHow
O79e2EvPIkMbpqQU1K+2IMPc7JhyPM4yhAJMtqlsXUCD3bMsTFHBhZVFNuxNx+hV
hht9XRgReOULN4sP0SjcSZAWRHWTDLZi5EDSJr6yGrRYudMIlIHQBbDwsrLelGf0
b/jNNWDCoibY6ASxew29lXx9PmrxeZ5cgRxKvppCaERsr/k2uEUkVwfCaUTDrbkQ
i7uS1LyidMtDwxljrHY7tj+T8sfFaw==
=9TSp
-----END PGP SIGNATURE-----
> 15. apr. 2022 kl. 23:20 skrev alejandro@rogue-research.com:
>
> Since I am using 2 hosts (1 antispamer, 1 smtp server) on the same LAN, I thought `rdr-to` would not work as stated on: <https://www.openbsd.org/faq/pf/rdr.html>, under the section "Redirection and Reflection" which is why I used `divert-to`. But neither work, thus, I am left with no ideas as of how to forward the emails from the antispam machine to the email server.
As Stuart already mentioned, spamd is really designed to be run on either the mail server itself or the gateway for the network the SMTP service runs in.
That said, I actually have running a setup conceptually like what you sketch here, where the purpose is to pool resources to do greylisting, greytrapping and content filtering for several domains that have their own «real» mail servers.
The way this works is, for the domains we serve, the machines running spamd are the MXes published to the world. Anything that gets past spamd is sent on to a local mail service on the host running spamd (exim in this case, for inertia reasons) which does content filtering on inbound and delivers to the hosts specified for each domain (which again could be anything that speaks SMTP). It is of course not necessary to do the content filtering on the same host that runs spamd, but you do need an SMTP service that delivers whatever gets past spamd to somewhere with a real mail service.
>
> What's different from all the docs and examples I've found is that I'm trying to use two hosts, and everything I've seen seems to assume spamd and the smtp server are on the same host. If `rdr-to` is not the way to go, how must I overcome this challenge?
Again, the more common way to set up is to either do the spamd things on the OpenBSD firewall/gateway, which then lets SMTP traffic that gets past greylisting etc to a real SMTP service or set up spamd on the mail server itself.
The way forward in your case is likely something like the filter-and-forward setup I described earlier.
All the best,
Peter
—
Peter N. M. Hansteen, member of the first RFC 1149 implementation team
http://bsdly.blogspot.com/ http://www.bsdly.net/ http://www.nuug.no/
"Remember to set the evil bit on all malicious network traffic"
delilah spamd[29949]: 85.152.224.147: disconnected after 42673 seconds.
No comments:
Post a Comment