SPF導入-Postfix

1.事前準備

以前に途中で設定を投げ出していたので古いモジュールを削除
# cd pypolicyd-spf-1.2
# python setup.py install --record remove.txt
# cat remove.txt |xargs rm -vrf

removed `/usr/lib/python2.6/site-packages/policydspfsupp.py'
removed `/usr/lib/python2.6/site-packages/policydspfuser.py'
removed `/usr/lib/python2.6/site-packages/policydspfsupp.pyc'
removed `/usr/lib/python2.6/site-packages/policydspfuser.pyc'
removed `/usr/bin/policyd-spf'
removed `/usr/share/man/man1/policyd-spf.1'
removed `/usr/share/man/man5/policyd-spf.conf.5'
removed `/etc/python-policyd-spf/policyd-spf.conf'
removed `/usr/share/man/man5/policyd-spf.peruser.5'
removed `/usr/lib/python2.6/site-packages/pypolicyd_spf-1.2-py2.6.egg-info'

2.設定

ダウンロード

• pydns-2.3.6.tar
• pypolicyd-spf-1.3.2.tar.gz
• pyspf-2.0.12.tar.gz

インストール

• pydns
  # tar xvf pydns-2.3.6.tar
# cd pydns-2.3.6
# python setup.py install
• pypolicyd-spf
  # tar zxvf pypolicyd-spf-1.3.2.tar.gz
# cd pypolicyd-spf-1.3.2
# python setup.py install
• pyspf-2.0.12
  # tar zxvf pyspf-2.0.12.tar.gz
# cd pyspf-2.0.12
# python setup.py install

モジュールの動作確認

# python /usr/bin/policyd-spf /etc/python-policyd-spf/policyd-spf.conf
//何も表示されなければOK

設定変更

• confファイルをコメント付きファイルに変更
  # mv /etc/python-policyd-spf/policyd-spf.conf /etc/python-policyd-spf/policyd-spf.conf.org
# cp pypolicyd-spf-1.3.2/policyd-spf.conf.commented /etc/python-policyd-spf/policyd-spf.conf
• SPF判定のみをヘッダに追加するように変更(rejectなし)
  # vi /etc/python-policyd-spf/policyd-spf.conf

#HELO_reject = SPF_Not_Pass //comment
HELO_reject = False //add
#Mail_From_reject = Fail //comment
Mail_From_reject = False //add

Postfix設定

• master.cf
  # vi /etc/postfix/master.cf //最終行に以下を追加

#spf //comment
policyd-spf unix  -      n       n       -       0       spawn
  user=nobody argv=/usr/bin/python /usr/bin/policyd-spf /etc/python-policyd-spf/policyd-spf.conf

• mail.cf
  # vi /etc/postfix/main.cf //check_policy_service以降を追加する

#smtpd_recipient_restrictions = permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination
smtpd_recipient_restrictions = permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination,check_policy_service unix:private/policyd-spf

• 再起動
  # service postfix restart

3.動作確認

• gmailから@mylines.org宛に送ってみる

Received-Spf：Pass (sender SPF authorized) identity=mailfrom; client-ip=209.85.220.48; helo=mail-pa0-f48.google.com; envelope-from=test@gmail.com; receiver=Mail@mylines.org 

• 送信元を詐称して@mylnies.org宛に送ってみる

Received-Spf：Softfail (domain owner discourages use of this host) identity=mailfrom; client-ip=112.78.117.190; helo=sv9.star-plus.netowl.jp; envelope-from=test@gmail.com; receiver=Mail@mylines.org 

参考

https://blog.apar.jp/linux/766/
http://news.mynavi.jp/news/2013/03/28/125/