POSTGREYREPORT(8)

📦 version 1.37, in opensuse-leap 16.0

💅 POSTGREYREPORT(8) — like, the whole manual, but make it make sense

okay bestie, so this is POSTGREYREPORT(8), a page from the User Contributed Perl Documentation section of the manual. Yes, Perl. Yes, user contributed. We love a community moment 🫶

✨ NAME ✨

postgreyreport — the Fatal report for the Postfix Greylisting Policy Server. it's giving "snitch, but for mail" 💅

🌸 SYNOPSIS 🌸

postgreyreport [options...]

and here's the full menu, no skips, no crumbs:

 -h, --help                   display this help and exit
     --version                display version and exit

     --user=USER              run as USER (default: postgrey)
     --dbdir=PATH             find db files in PATH (default: /var/lib/postgrey)
     --delay=N                report triplets that did not try again after N seconds (default: 300)
     --greylist-text=TXT      text to match on for greylist maillog lines

     --skip_pool              Skip report for 'subscriber pools' ( last 2 octets of IP found in PTR name )
     --skip_dnsbl=RBL         RBL server to query and skip reporting for any listed hosts (SLOW!!)
     --skip_clients=FILE      PTR or IP or REGEXP of clients to skip in report
     --match_clients=FILE     *ONLY* report if fatal *AND* PTR/IP of client matches

     --show_tries             display the number of attempts failed triplets made in first column
     --show_time              show entry time in maillog (single line only)
     --tab                    use tabs as separators for easy cut(1)ting

     --nosingle_line          display sender/recipients grouped by ptr - ip
     --separate_by_subnet=TXT display TXT for every new /24 (ex: "=================\n" )
     --separate_by_ip=TXT     display TXT for every new IP  (ex: "\n")
     --check_sender=LIST      one or more of: mx,mx/24,a,a/24
                              does DNS/A lookups for sender @domain and compares sending IP
                              if match displays "MX" "A" or "MX/24" or "A/24" depending on LIST

🎀 the fine print (read it, i'm begging)

note that --(skip|match)_clients can be specified multiple times and there are no default files. fr fr, none.

same rules apply as postgrey's --whitelist-clients, so go read the postgrey doc for more info, iykyk.

--skip_dnsbl can also be specified multiple times — stack those DNSBL servers like it's a fit check 🔥

💜 DESCRIPTION 💜

so postgreyreport opens postgrey.db as read-only (respectful queen, she only looks 👀), reads a maillog via STDIN, extracts the triplets for any Greylisted lines, and looks them up in postgrey.db.

then: if the difference in first and last time seen is less than --delay=N, the triplet is considered fatal and displayed to STDOUT.

the report sorts by client IP address. periodt.

⭐ Note:

unless you're using --lookup_by_subnet or excluding all known MTA pools, you will likely get false fatal reports for "BigISPs". 😭 and not the cute kind of false.

here's the vibe: a message that was tried from every IP in an SMTP pool before making it through will show up in the report for all of the attempted source IPs. so it looks guilty 30 times when it's really just one message doing cardio. main character energy from the spam, honestly.

🦋 USAGE 🦋

bestie, it is best to run postgreyreport against a maillog that's at least several hours old (yesterdays??). you be the judge on how old is acceptable, i'm not your manager 💅

if you run the report against a live maillog you are not giving legit MTA's enough time to try again, and you will have lots of inaccurate information. we don't want that. we want accurate information. slay.

  • Ex usage:
      zcat /var/log/maillog.0.gz | ./postgreyreport [options] > postgreyreport.log

or

      zcat /var/log/maillog.0.gz | \
      ./postgreyreport --nosingle_line --check_sender=mx,a \
      --separate_by_subnet=":==================\n"
      # 94 "=" total, some were omitted for clarity
  • Ex Output: ( POD wrapping will mess this up, view source ) — not me warning you, the original warned you, and honestly respect 🫡
 :============================================================================================
 unknown                 4.29.43.31
                    marissa_mcclendonuu@abit.com.tw                      user1@recipient1.com
                            jake_meyerdt@ali.com.tw                      user2@recipient1.com
                        jenny_banks_sh@translate.ru                      user1@recipient2.com
                              rvazquezpo@ali.com.tw                      user3@recipient1.com
                                 aep@notimexico.com                      user2@recipient1.com
                    brittneystanley_ei@cetra.org.tw                      user2@recipient1.com
                            brendasheehan_cw@lib.ru                      user2@recipient1.com
 :============================================================================================
 lsanca1-ar5-127-189.biz.dsl.gtei.net      4.33.127.189
    A      fokkensr@lsanca1-ar5-127-189.biz.dsl.gtei.net                 user2@recipient1.com

                       cyxlfrfwciercu@publicist.com                      user3@recipient4.com
 :============================================================================================
 smtpout.mac.com       17.250.248.83
                             do_not_reply@apple.com                      user4@recipient5.com

 smtpout.mac.com       17.250.248.88
   MX                             legituser@mac.com                      user6@recipient7.com
 :============================================================================================

(that A and MX sitting there in the left column? that's --check_sender doing its little lookup flex ✨)

👑 HISTORY 👑

💀 1.14.3 — 20100321

some additions, from Leonard den Ottolander <leonard.den.ottolander.nl>

  • New option: --tab — Use tabs as separator in single line mode
  • New option: --show_time — Show entry time in maillog in single line mode

🍓 1.14.2 — 20040715

  • BUGFIX: (automatic) lookup-by-subnet support was broken, fixed.
  • BUGFIX: corrected a few spelling errors
  • new Option: --skip_pool — Skip report for 'subscriber pools'

🧚 1.14.1 — 20040712

  • Changed --return-string to --greylist-text to match postgrey
  • new Option: --skip_clients=FILE
  • new Option: --match_clients=FILE
  • new Option: --skip_dnsbl=RBL.DNS.NAME
  • all 3 of the new options can be specified multiple times.
  • Updated do_*_subsititions again to match postgrey

🔥 1.11.1 — 20040701

  • missing keys from DB are considered fatal triplets and included in report
  • Changed --delay testing from "greater than" to "greater than or equal to"
  • Fixed --help and --man switches
  • Removed setuid Notice

🌈 1.6.4 — 20040618

  • Initial Public Version (postgrey/contrib)

🎀 AUTHOR 🎀

Tom Baker <tbaker@bakerfl.org> — thank you for your service king 🫶

and that's the whole page bestie, no notes left behind 💖

little sign-off for the footer girlies: this page ships with perl v5.42.0, dated 2024-02-29, and it lives at POSTGREYREPORT(8). iconic. obsessed. 🌸✨

📦 where this page comes from