Dotaz: Postfix a Relay access denied

[Petr Ullmann]

Dobrý večer kolegové, už řeším snad poslední problém s postfixem. V rámci vnitřní sítě není problém posílat cokoli kamkoli. Ale pokud se připojím na svůj účet z vnější sítě, tak můžu odeslat mail jenom na adresy existující na serveru. Pokud má zprává jít někam jinam, tak dostanu chybu relay access denied. Prohlédnul jsem diskuze, co jsou na abíčku, ale bohužel bez úspěchu.

/etc/postfix/main.cf

inet_protocols = all
biff = no
mail_spool_directory = /var/mail
canonical_maps = hash:/etc/postfix/canonical
virtual_alias_domains = hash:/etc/postfix/virtual
relocated_maps = hash:/etc/postfix/relocated
transport_maps = hash:/etc/postfix/transport
sender_canonical_maps = hash:/etc/postfix/sender_canonical
masquerade_exceptions = root
masquerade_classes = envelope_sender, header_sender, header_recipient
myhostname = server.mojedomena.cz
delay_warning_time = 1h
message_strip_characters = \0
program_directory = /usr/lib/postfix
inet_interfaces = all
masquerade_domains = 
mydestination = $myhostname, localhost.$mydomain, localhost
myorigin = $mydomain
defer_transports = 
mynetworks_style = subnet
mynetworks = 127.0.0.0/8,192.168.1.0/24,192.168.2.0/24,192.168.3.0/24
disable_dns_lookups = no
relayhost = 
content_filter = 
mailbox_command = 
mailbox_transport = 
strict_8bitmime = no
disable_mime_output_conversion = no

maps_rbl_domains = bl.spamcop.net, dnsbl.njabl.org, sbl.spamhaus.org, dnsbl.ahbl.org

# broken_sasl_auth_clients = yes

smtpd_client_restrictions = permit_mynetworks,
			    reject_unknown_sender_domain,
			    reject_rhsbl_client blackhole.securityusage.com,
			    reject_rbl_client sbl-xbl.spamhaus.org,
			    reject_rbl_client relays.mail-abuse.org,
			    reject_rbl_client dialups.mail-abuse.org,
			    reject_rbl_client blackholes.mail-abuse.org,
			    reject_rbl_client blackholes.easynet.nl,
			    reject_rbl_client bl.spamcop.net,
			    reject_rbl_client dnsbl.njabl.org,
			    permit

# smtpd_sasl_auth_enable = yes
# smtpd_sasl_local_domain = $myhostname
# smtpd_sasl_security_options = noanonymous
# smtpd_sasl_application_name = smtpd

smtpd_helo_required = no
smtpd_helo_restrictions =
strict_rfc821_envelopes = no

smtpd_recipient_restrictions = permit_mynetworks,
			       reject_non_fqdn_recipient,
			       reject_unknown_recipient_domain,
			       check_recipient_access hash:/etc/postfix/access,
			       reject_unauth_destination,
			       permit

smtpd_use_tls = no
smtp_use_tls = no
#alias_maps = hash:/etc/aliases
mailbox_size_limit = 0
message_size_limit = 0

smtpd_sender_restrictions = permit_mynetworks,
			    reject_non_fqdn_sender,
			    reject_unknown_sender_domain,
			    check_sender_access hash:/etc/postfix/access,
			    permit

disable_vrfy_command = yes
content_filter = amavis:[127.0.0.1]:10024

Je mi jasné, že problém může být v mynetworks, ale i když z něj smažu všechny adresy, tak to stejně nefunguje. Stejně tak, i když dám u smtpd_client_restriction jenom permit. Výsledek je stejný i pokud SASL povolím.

/etc/postfix/master.cf

smtp      inet  n       -       n       -       -       smtpd
amavis    unix  -       -       n       -       5       smtp
  -o smtp_data_done_timeout=1200
  -o smtp_send_xforward_command=yes
  -o disable_dns_lookups=yes
  -o max_use=20
submission inet n      -       n       -       -       smtpd
     -o smtpd_etrn_restrictions=reject
     -o smtpd_client_restrictions=permit_sasl_authenticated,reject
#smtps    inet  n       -       n       -       -       smtpd -o smtpd_tls_wrappermode=yes
#  -o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes
#submission   inet    n       -       n       -       -       smtpd
#  -o smtpd_etrn_restrictions=reject
#  -o smtpd_enforce_tls=yes -o smtpd_sasl_auth_enable=yes
#628      inet  n       -       n       -       -       qmqpd

# nove!!!
# submission inet n	-	-	-	-	smtpd
#	-o smtpd_sasl_auth_enable=yes
#	-o virtual_mailbox_domains=
#	- content_filter=
 
pickup    fifo  n       -       n       60      1       pickup
cleanup   unix  n       -       n       -       0       cleanup
qmgr      fifo  n       -       n       300     1       qmgr
#qmgr     fifo  n       -       n       300     1       oqmgr
tlsmgr    unix  -       -       n       1000?   1       tlsmgr
rewrite   unix  -       -       n       -       -       trivial-rewrite
bounce    unix  -       -       n       -       0       bounce
defer     unix  -       -       n       -       0       bounce
trace     unix  -       -       n       -       0       bounce
verify    unix  -       -       n       -       1       verify
flush     unix  n       -       n       1000?   0       flush
proxymap  unix  -       -       n       -       -       proxymap
smtp      unix  -       -       n       -       -       smtp
# When relaying mail as backup MX, disable fallback_relay to avoid MX loops
relay     unix  -       -       n       -       -       smtp
	-o fallback_relay=
#       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
showq     unix  n       -       n       -       -       showq
error     unix  -       -       n       -       -       error
discard   unix  -       -       n       -       -       discard
local     unix  -       n       n       -       -       local
virtual   unix  -       n       n       -       -       virtual
lmtp      unix  -       -       n       -       -       lmtp
anvil     unix  -       -       n       -       1       anvil
127.0.0.1:10025 inet	n	-	n	-	-	smtpd
  -o content_filter=
  -o smtpd_delay_reject=no
  -o smtpd_client_restrictions=permit_mynetworks,reject
  -o smtpd_helo_restrictions=
  -o smtpd_sender_restrictions=
  -o smtpd_recipient_restrictions=permit_mynetworks,reject
  -o smtpd_data_restrictions=reject_unauth_pipelining
  -o smtpd_end_of_data_restrictions=
  -o smtpd_restriction_classes=
  -o mynetworks=127.0.0.0/8
  -o smtpd_error_sleep_time=0
  -o smtpd_soft_error_limit=1001
  -o smtpd_hard_error_limit=1000
  -o smtpd_client_connection_count_limit=0
  -o smtpd_client_connection_rate_limit=0
  -o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_address_mappings
  -o local_header_rewrite_clients=
  -o local_recipient_maps=
  -o relay_recipient_maps=
scache	  unix  -       -       n       -       1       scache

Nenapadá někoho něco? Předem díky za rady a případně připomínky ke konfiguraci..

Petr

Odpovědi

[oron]

"Je mi jasné, že problém může být v mynetworks, ale i když z něj smažu všechny adresy, tak to stejně nefunguje. Stejně tak, i když dám u smtpd_client_restriction jenom permit. Výsledek je stejný i pokud SASL povolím. "

myslim ze okrem povolenia smtpd_sasl_auth_enable, treba este min. nastavit:

 cat /usr/lib/sasl2/smtpd.conf
pwcheck_method: saslauthd
mech_list: PLAIN LOGIN

a mal by byt spusteny: saslauthd -a shadow