************ ppoossttffwwdd qquuiicckkssttaarrtt gguuiiddee ************

To use postfwd you have to perform the following steps:

   1. _G_e_t_ _p_o_s_t_f_w_d_ _o_r_ _p_o_s_t_f_w_d_2
   2. _C_r_e_a_t_e_ _y_o_u_r_ _o_w_n_ _p_o_s_t_f_w_d_ _r_u_l_e_s_e_t
   3. _O_p_t_i_o_n_a_l_:_ _C_r_e_a_t_e_ _a_ _d_e_d_i_c_a_t_e_d_ _u_s_e_r_/_g_r_o_u_p_ _f_o_r_ _p_o_s_t_f_w_d
   4. _L_a_u_n_c_h_ _p_o_s_t_f_w_d
   5. _T_e_l_l_ _p_o_s_t_f_i_x_ _t_o_ _u_s_e_ _p_o_s_t_f_w_d
   6. _F_i_n_i_s_h_e_d_!_ _H_o_w_ _t_o_ _g_o_ _o_n_?

   1. GGeett ppoossttffwwdd oorr ppoossttffwwdd22
      You may skip this step, if your operating system distribution contains a
      version of postfwd, but it is recommended to use a recent version from
      _p_o_s_t_f_w_d_._o_r_g. It is also recommended to use recent versions of the perl
      modules Net::DNS and Net::Server (see _r_e_q_u_i_r_e_d_ _p_e_r_l_ _m_o_d_u_l_e_s for more
      information).


      CCrreeaattee yyoouurr oowwnn ppoossttffwwdd rruulleesseett
      postfwd is not a dedicated antispam tool (although it may be used as
      such). Instead of that it is basically a restriction language for postfix
      which allows to place complex policy expressions into a simple ruleset.
      For reasonable operation you have to create your own ruleset, like:
      	# reject @domain.local if request comes from outside 10.0.0.0/8 network
      	id=RULE-01 ;  sender_domain=domain.local ;  client_address=!!(10.0.0.0/
      8) ;  action=REJECT not allowed

      	# reject if sender equals recipient
      	id=RULE-02 ;  sender==$$recipient ;  action=REJECT not allowed

      	# check some rbls and reject, if listed on >= 2 of them
      	id=RULE-03 ;  rbl=zen.spamhaus.org,bl.spamcop.net,ix.dnsbl.manitu.net ;
      rblcount>=2 ;  action=REJECT not allowed
   2. Now save these rules to a file (e.g. /etc/postfwd.cf). Please note that
      these are just very basic examples. Please read the _d_o_c_u_m_e_n_t_a_t_i_o_n for
      more information on postfwd's capabilities. To check your ruleset you
      should use the "-C" command line option. This displays postfwd's view of
      your ruleset, like:
      	# postfwd -f /etc/postfwd.cf -C
      	  Rule   0: id->"RULE-01"; action->"REJECT not allowed"; sender_domain-
      >"=;domain.local"; client_address->"=;!!(10.0.0.0/8)"
      	  Rule   1: id->"RULE-02"; action->"REJECT not allowed"; sender-
      >"==;$$recipient"
      	  Rule   2: id->"RULE-03"; action->"REJECT not allowed"; rblcount->"2";
      rbl->"=;zen.spamhaus.org, =;bl.spamcop.net, =;ix.dnsbl.manitu.net"
   3. If you just want to see that anything works a single rule like
      "id=DEFAULT; action=dunno" is fine, too.


      OOppttiioonnaall:: CCrreeaattee aa ddeeddiiccaatteedd uusseerr//ggrroouupp ffoorr ppoossttffwwdd
      By default postfwd will try to use user 'nobody' and group 'nobody'. So
      it should be safe to skip this step in most environments. If you run a
      system that is exposed to dangerous networks and feel paranoid you may
      want to create a dedicated user and group for the postfwd process. On
      unix systems enter:
      	# groupadd postfwd
      	# useradd -g postfwd -d /var/empty -s /bin/false -c "postfwd daemon
      user" postfwd
      	# passwd -l postfwd
   4.
      LLaauunncchh ppoossttffwwdd
      Start postfwd with your ruleset. Leave out the --user and --group
      options, if you have skipped step 3 and want to run postfwd as nobody/
      nobody.
      	# postfwd --daemon -f /etc/postfwd.cf -u postfwd -g postfwd
   5. Now watch your logs (default facility: mail) for lines like:
      	Jun  8 12:14:33 jupiter postfwd[20270]: postfwd 1.11 starting
      	Jun  8 12:14:33 jupiter postfwd[20271]: Process Backgrounded
      	Jun  8 12:14:33 jupiter postfwd[20271]: 2009/06/08-12:14:33 postfwd
      (type Net::Server::Multiplex) starting! pid(20271)
      	Jun  8 12:14:33 jupiter postfwd[20271]: Binding to TCP port 10040 on
      host 127.0.0.1
      	Jun  8 12:14:33 jupiter postfwd[20271]: Setting gid to "1003 1003"
      	Jun  8 12:14:33 jupiter postfwd[20271]: Setting uid to "1010"
      	Jun  8 12:14:33 jupiter postfwd[20271]: postfwd 1.11 ready for input
   6. To control further daemon operations the commands `postfwd --kill` and
      `postfwd --reload` may be used. Please see `postfwd -h` and the
      _d_o_c_u_m_e_n_t_a_t_i_o_n for more information.


      TTeellll ppoossttffiixx ttoo uussee ppoossttffwwdd
      Open your main.cf (usually located at /etc/postfix) and find or add a
      line starting with:
      	smtpd_recipient_restrictions = ...
   7. To place the postfwd check here, modify this as follows:
      	# note the leading whitespaces from the 2nd line!
      	smtpd_recipient_restrictions = permit_mynetworks,	# recommended
      		...,						# optional
      		reject_unauth_destination,			# recommended
      		check_policy_service inet:127.0.0.1:10040,	# **postfwd integration**
      		...						# optional
   8. Please note that for some checks (like the 'size' attribute) postfwd has
      to be integrated at another level of the smtp transaction
      (smtpd_end_of_data_restrictions). More information on that can be found
      in the _p_o_s_t_f_i_x_ _d_o_c_u_m_e_n_t_a_t_i_o_n.


      FFiinniisshheedd!! HHooww ttoo ggoo oonn??
      A good point to start is postfwd's manual. You should be able to view it
      using the `postfwd -m` command or visit the _d_o_c_u_m_e_n_t_a_t_i_o_n_ _p_a_g_e. There are
      also some configuration examples on the _w_e_b_p_a_g_e. Another very useful
      source of information is the _P_o_s_t_f_i_x_ _S_M_T_P_ _A_c_c_e_s_s_ _P_o_l_i_c_y_ _D_e_l_e_g_a_t_i_o_n
      documentation.
