bmatthewshea/- postfix-geoip.pl

## - postfix-geoip.pl
#!/usr/bin/perl
# Brady Shea Feb 25 2019
# starting point:
# http://web.archive.org/web/20151128083440/https://www.kutukupret.com/2011/05/29/postfix-geoip-based-rejections/
use strict;
use warnings;
use Sys::Syslog qw(:DEFAULT setlogsock);
use Geo::IP;
use Regexp::Common;

#my $gi = Geo::IP->new(GEOIP_INDEX_CACHE);  #should probably use this one? works. New spawns after 3600s, though.
my $gi           = Geo::IP->new(GEOIP_STANDARD);
my $country_code = "";
my $client       = "";

# Country codes to reject
my @geo_map = (
    'BR' ,
    'PW' ,
    'NL' ,
    'JP' ,
    'UA' ,
    'LR' ,
    'KR' ,
    'RO' ,
    'IN' ,
    'CN' ,
    'HK' ,
    'TW' ,
    'RU'
);

#
# Initalize and open syslog.
#
openlog('postfix/geoip','pid','mail');

#
# Autoflush standard output.
#
select STDOUT; $|++;

while (<>) {
  if ($_ =~ /\w\s\w/)  # if two words..
  {
    chomp;

    $_ =~ s/^\S+\s*//; #Remove "get " (first word)
    $client    = $_;

    #check tld sent first to avoid geoip call if possible (example mailer.domain.ru = .ru/RU)
    $country_code = uc tld_check($client);
    if ( grep /$country_code/, @geo_map )
    {
      reject_country();
      $country_code="";  # remove
      next;
    }
    #geoip tests
    if ( $client =~ m/$RE{net}{IPv4}/ ){
      $country_code = $gi->country_code_by_addr($client); # is IP - normally NOT sent by POSTFIX "check_client_access tcp:" - sends 'unknown'
    } else {
      $country_code = $gi->country_code_by_name($client); # is DNS name
    }

    if (defined $country_code)
    {
      if ( grep /$country_code/, @geo_map )
        {
           reject_country();
           } else {
           approve_country();
           }
        } else {
          unknown_country();
        }
        next;
  }
  #incomplete lookup (was the "get sub.domain.tld" missing the 'get'? The string is always 2 parts.
  lookup_error();
}

# SUBS

#quick check on TLD to see if it matches our banned tlds. This should avoid calling GEOIP too much
sub tld_check {
  my @pieces = split /\./,$_;
  my $tld   = $pieces[-1];
  chomp($tld);
  return $tld;
}
sub reject_country {
  print "200 REJECT no connections accepted from country code $country_code\n";
  syslog("info","Client: %s REJECTED because of country code match %s", $client, $country_code);
  return
}
sub approve_country {
  print "200 DUNNO passed geoip check\n";
  syslog("info","Client: %s PASSED geoip from country code: %s", $client, $country_code);
  return
}
sub unknown_country {
  print "200 DUNNO geoip country not found\n";
  syslog("info","Client: %s PASSED geoip - no country found", $client);
  return
}
# This next one should probably be switched to REJECT if I start seeing many of them.
# POSTFIX should ALWAYS send a two part string.
sub lookup_error {
  print "200 DUNNO geoip skipped\n";
  syslog("info","Incomplete DATA received from MTA to do a geoip check");
  return;
}

## README-postfix-geoip.md

      
    Raw
  

              README-postfix-geoip.md
            
          
    Installation:
The starting point for this script was from here:


http://web.archive.org/web/20151128083440/https://www.kutukupret.com/2011/05/29/postfix-geoip-based-rejections/
You need:

Linux machine with-
Perl
Perl Geo::IP module
and of course "Postfix" (MTA)


You will need to add the script above somewhere on your system. /etc/postfix/scripts/postfix-geoip.pl would probably be a good place. It doesn't really matter where it is placed, though. Keep in mind the permissions & owner will need to be correct no matter where you put it.
Once placed, make sure it's owned by root and can be run by the "nobody" user. (It should be owned by root to avoid postfix warnings):
sudo chown root: /etc/postfix/scripts /etc/postfix/scripts/postfix-geoip.pl
sudo chmod 755 /etc/postfix/scripts/postfix-geoip.pl


Once the script is owned correctly and executable on the Postfix system, you will need to edit the Postfix configuration.
Edit sudo nano /etc/postfix/main.cf and find smtpd_client_restrictions = and add a 'check_client_access' directive under it (just make sure it has a comma on end and is above the final 'permit') Leave any other directives you may see (the dots '...') in place.:
smtpd_client_restrictions =
...
check_client_access tcp:[127.0.0.1]:2528,
...
permit

Example:


NOTE: It may be a better idea to place this under smtpd_helo_restrictions since this is the very first check. If it's a bad IP, it should go no further. Less system resources would be used to check and 'block' a connected IP under HELO hypothetically. I used smtpd_client_restrictions for my own reasons. Either area should work. I haven't tested it under helo restrictions, though.


Next, edit the /etc/postfix/master.cf file and put this bit at the very bottom of this file:

127.0.0.1:2528 inet  n       n       n       -       0      spawn
         user=nobody argv=/etc/postfix/scripts/postfix-geoip.pl


Next install GeoIP system wide. Debian/Ubuntu apt example:
sudo apt update -y && sudo apt install libgeo-ip-perl

OR: If using cpan to install the module:
sudo cpan install Geo::IP


Configuration is complete. Restart Postfix:
sudo systemctl restart postfix
Test / check mail.log / etc.
	#!/usr/bin/perl
	# Brady Shea Feb 25 2019
	# starting point:
	# http://web.archive.org/web/20151128083440/https://www.kutukupret.com/2011/05/29/postfix-geoip-based-rejections/
	use strict;
	use warnings;
	use Sys::Syslog qw(:DEFAULT setlogsock);
	use Geo::IP;
	use Regexp::Common;

	#my $gi = Geo::IP->new(GEOIP_INDEX_CACHE); #should probably use this one? works. New spawns after 3600s, though.
	my $gi = Geo::IP->new(GEOIP_STANDARD);
	my $country_code = "";
	my $client = "";

	# Country codes to reject
	my @geo_map = (
	'BR' ,
	'PW' ,
	'NL' ,
	'JP' ,
	'UA' ,
	'LR' ,
	'KR' ,
	'RO' ,
	'IN' ,
	'CN' ,
	'HK' ,
	'TW' ,
	'RU'
	);

	#
	# Initalize and open syslog.
	#
	openlog('postfix/geoip','pid','mail');

	#
	# Autoflush standard output.
	#
	select STDOUT; $\|++;

	while (<>) {
	if ($_ =~ /\w\s\w/) # if two words..
	{
	chomp;

	$_ =~ s/^\S+\s*//; #Remove "get " (first word)
	$client = $_;

	#check tld sent first to avoid geoip call if possible (example mailer.domain.ru = .ru/RU)
	$country_code = uc tld_check($client);
	if ( grep /$country_code/, @geo_map )
	{
	reject_country();
	$country_code=""; # remove
	next;
	}
	#geoip tests
	if ( $client =~ m/$RE{net}{IPv4}/ ){
	$country_code = $gi->country_code_by_addr($client); # is IP - normally NOT sent by POSTFIX "check_client_access tcp:" - sends 'unknown'
	} else {
	$country_code = $gi->country_code_by_name($client); # is DNS name
	}

	if (defined $country_code)
	{
	if ( grep /$country_code/, @geo_map )
	{
	reject_country();
	} else {
	approve_country();
	}
	} else {
	unknown_country();
	}
	next;
	}
	#incomplete lookup (was the "get sub.domain.tld" missing the 'get'? The string is always 2 parts.
	lookup_error();
	}

	# SUBS

	#quick check on TLD to see if it matches our banned tlds. This should avoid calling GEOIP too much
	sub tld_check {
	my @pieces = split /\./,$_;
	my $tld = $pieces[-1];
	chomp($tld);
	return $tld;
	}
	sub reject_country {
	print "200 REJECT no connections accepted from country code $country_code\n";
	syslog("info","Client: %s REJECTED because of country code match %s", $client, $country_code);
	return
	}
	sub approve_country {
	print "200 DUNNO passed geoip check\n";
	syslog("info","Client: %s PASSED geoip from country code: %s", $client, $country_code);
	return
	}
	sub unknown_country {
	print "200 DUNNO geoip country not found\n";
	syslog("info","Client: %s PASSED geoip - no country found", $client);
	return
	}
	# This next one should probably be switched to REJECT if I start seeing many of them.
	# POSTFIX should ALWAYS send a two part string.
	sub lookup_error {
	print "200 DUNNO geoip skipped\n";
	syslog("info","Incomplete DATA received from MTA to do a geoip check");
	return;
	}