iptables rule to block all outgoing mail sent via perl (or other) scripts

[StéphanS]

Mail should always be sent via qmail or Postfix.
In order to be able to track any spammers and to use Parallels Premium Outgoing Antispam.

I have created the following iptable rules to enforce this for Postfix:

iptables -A OUTPUT -d 127.0.0.1 -p tcp -m tcp --dport 25 -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 25 -m owner --gid-owner postfix -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 25 -m owner --gid-owner mailman -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 25 -m owner --uid-owner root -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 25 -j REJECT --reject-with icmp-port-unreachable

Would it be possible for the Plesk Firewall Module to have such a rule so we can better control the mailflow?


Thanks!

 

[FernandoI]

Mail should always be sent via qmail or Postfix.
In order to be able to track any spammers and to use Parallels Premium Outgoing Antispam.

I have created the following iptable rules to enforce this for Postfix:




Would it be possible for the Plesk Firewall Module to have such a rule so we can better control the mailflow?


Thanks!

Hello! My server was compromised with a ugly Perl script and spammed out tons of mails.
This IPTABLES rules come great for stopping them, have you tested them in qmail ?

Thanks for sharing.

Greetings!

 

[StéphanS]

Hello! My server was compromised with a ugly Perl script and spammed out tons of mails.
This IPTABLES rules come great for stopping them, have you tested them in qmail ?

Thanks for sharing.

Greetings!

For qmail it should be:

iptables -A OUTPUT -d 127.0.0.1 -p tcp -m tcp --dport 25 -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 25 -m owner --gid-owner qmail -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 25 -m owner --gid-owner mailman -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 25 -m owner --uid-owner root -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 25 -j REJECT --reject-with icmp-port-unreachable

I have not tested this though, so let me know if it worked for you!

 

[JuanCar]

Hi, a good idea
I've a question about these rules, could add a LOG, something like

-j LOG --log-prefix "Alert QMAIL-REJECTED"

in last rule for example?

Oh, and another question, does it work with qmail?

Thanks

 

[StéphanS]

Hi, a good idea
I've a question about these rules, could add a LOG, something like

-j LOG --log-prefix "Alert QMAIL-REJECTED"

in last rule for example?

If you have a LOG chain then this should work as intended.
Please refer to http://www.thegeekstuff.com/2012/08/iptables-log-packets/

Oh, and another question, does it work with qmail?

For qmail it should be:

iptables -A OUTPUT -d 127.0.0.1 -p tcp -m tcp --dport 25 -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 25 -m owner --gid-owner qmail -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 25 -m owner --gid-owner mailman -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 25 -m owner --uid-owner root -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 25 -j REJECT --reject-with icmp-port-unreachable

I have not tested this though, so let me know if it worked for you!

 

[omidkosari]

Thanks . I think these rules should enabled by default . I know here is linux thread but any equivalent rules for Windows ?