last night we figured out someone sending too many emails to our mailing servers, so this is the tool for handling those email flooding attacks.
fixrate applies sending rate limit per users, so you don't have to limit entire domain. from now on fixrate protects mail.snix.ir service.
fixrate is written in golang, for compiling this code you should have golang
installed.
if not, use apt to install it apt install golang
, after that clone this repository by using either git.snix.ir or github.com
# git clone https://git.snix.ir/fixrate-go.git
# git clone https://github.com/Sina-Ghaderi/fixrate-go.git
# cd fixrate-go && go build
# ./fixrate-go
expected 'daemon' or 'users' commands
usage of fixrate postfix module snix.ir LLC:
./fixrate commands... [ OPTIONS ] ...
commands:
daemon starting fixrate daemon, should be used by systemd
--config pass a file to read configuration from. default: ./fixrate.conf
users add or modify users and attributes in database
--config pass a file to read configuration from. default: ./fixrate.conf
--username a username to add/modify in database. default is sina@snix.ir
--counter time interval (seconds) between user counter reset. default is 120
--userrate how many e-mails user should be able to send. default is 10
example:
---- adding name@domain.com ---- 100 e-mail per 10 minutes:
./fixrate users --username name@domain.com -- userrate 100 --counter 600
Copyright (c) 2021 git.snix.ir, All rights reserved.
Developed BY sina@snix.ir --> Sina Ghaderi
This work is licensed under the terms of the MIT license.
you may want to create a systemd file for runing this as a linux service (systemctl start
... and enable
etc...)
fixrate-go supports unix socket and tcp network listeners, in order to reduce kernel opened connections its recommended to use unix socket if you can host fixrate on postfix server
default configuration file of fixrate is ./fixrate.conf
, you may want to specify another file path by using --config
flag
edit postfix mail agent config file under /etc/postfix/main.cf
(debian based systems)
if planning to use unix file you should note that for some reasons postfix root directory is under /var/spool/postfix
so you need to create fixrate-go socket file under this directory, otherwise you may facing with warning: connect to <socket> no such a file or directory
warning in mail.log
file
## if using unix socket -->
# echo "smtpd_sender_restrictions = reject_unknown_sender_domain, check_policy_service unix:/fix/fixrate.sock" >> /etc/postfix/main.cf
# mkdir /var/spool/postfix/fix
# service postfix restart
## if useing tcp connection -->
# echo "smtpd_sender_restrictions = reject_unknown_sender_domain, check_policy_service inet:127.0.0.1:9984" >> /etc/postfix/main.cf
# service postfix restart
just use default config file in this package fixrate.conf
and change it as you need.
you should set MYSQL user/pass/database/address parameters in order to connect to sql server.
if choosing to use unix or inet remember to set corresponding parameters followd by listener_type =
literal.
default fixrate config file fixrate.conf
## Mysql(or mariaDB) database to use
sql_database = postfix
## sql connection port number
sql_tcpport = 3306
## sql username to connect database
sql_username = postfix
## sql password to connect database
sql_password = Pass1234
## sql server address 127.0.0.1 ....
sql_address = 127.0.0.1
## Default rate limit plan for users that not exists in database yet.
## first parameter is number of emails and the next one is time interval (Seconds) between user counter reset
## following parameters determine that users only can send 10 e-mails per 120 seconds
## note that if you change specific user by fixrate users command, this not effect that user anymore.
default_ratelimit = 10 120
## fixrate listening mode can be only unix or inet, if you want to connect this service over TCP protocol
## should use inet, for using unix socket files should unix be used.
listener_type = unix
## config for unix listener type, ignored if use inet
## socket file should be under /var/spool/postfix/
## REMEMBER to mkdir directory /var/spool/postfix/fix/ first
socket_path = /var/spool/postfix/fix/fixrate.sock
## socket file should be read and writable by both fixrate and postfix services.
socket_perm = 666
## config for inet listener type ignored if use unix
listen_addr = 127.0.0.1:9984
an smart ass user, limited as below
you are welcome to e-mail me, suggestions, bug reporting or anything else, ... use sina@snix.ir
Copyright (c) 2021 git.snix.ir, All rights reserved.
Developed BY sina@snix.ir --> Sina Ghaderi
This work is licensed under the terms of the MIT license.