AFP548 Changing the world one server at a time.

Postfix rejecting relay for local users

Home › Forums › OS X Server and Client Discussion › Mail › Postfix rejecting relay for local users

Viewing 6 posts - 1 through 6 (of 6 total)
  • Author
    Posts
  • October 27, 2004 at 3:10 am #359691
    Bill Eccles
    Participant

    Gentleones,

    I’m having problems getting Postfix to work properly. It denies relay access for users who are remote and whose IP addresses aren’t predictable. Here’s what shows up in the logs:

    Oct 26 22:20:28 centipede postfix/smtpd[4874]: warning: aa.bb.cc.dd: hostname aa-bb-cc-dd.otherdomain.com verification failed: Host not found
Oct 26 22:20:28 centipede postfix/smtpd[4874]: connect from unknown[aa.bb.cc.dd]
Oct 26 22:20:29 centipede postfix/smtpd[4874]: 3819E18E653: client=unknown[aa.bb.cc.dd], sasl_method=PLAIN, sasl_username=bob
Oct 26 22:20:29 centipede postfix/smtpd[4874]: 3819E18E653: reject: RCPT from unknown[aa.bb.cc.dd]: 554 <bob@localdomain.net>: Relay access denied; from=<bob@localdomain.net> to=<bill@localdomain.net> proto=ESMTP helo=<[192.168.0.2]>
Oct 26 22:20:33 centipede postfix/smtpd[4874]: lost connection after RCPT from unknown[aa.bb.cc.dd]
Oct 26 22:20:33 centipede postfix/smtpd[4874]: disconnect from unknown[aa.bb.cc.dd]

    And here’s the output of postconf -n, which I believe summarizes what Server Admin configures:

    allow_untrusted_routing = no
always_bcc = 
command_directory = /usr/sbin
config_directory = /etc/postfix
content_filter = smtp-amavis:[127.0.0.1]:10024
daemon_directory = /usr/libexec/postfix
debug_peer_level = 2
enable_server_options = yes
inet_interfaces = all
luser_relay = 
mail_owner = postfix
mailbox_transport = cyrus
mailq_path = /usr/bin/mailq
manpage_directory = /usr/share/man
maps_rbl_domains = 
maps_rbl_reject_code = 571
message_size_limit = 10240000
mydestination = $myhostname,localhost.$mydomain,mylocalhostname.localdomain.net,localdomain.net,
mydomain_fallback = localhost
myhostname = mylocalhostname.localdomain.net
mynetworks = 127.0.0.0/8
mynetworks_style = host
newaliases_path = /usr/bin/newaliases
queue_directory = /private/var/spool/postfix
readme_directory = /usr/share/doc/postfix
relayhost = 
sample_directory = /usr/share/doc/postfix/examples
sendmail_path = /usr/sbin/sendmail
setgid_group = postdrop
smtpd_client_restrictions = permit_mynetworks,reject_rbl_client cbl.abuseat.org,reject_rbl_client relays.visi.com,reject_rhsbl_client relays.visi.com,reject_unauth_destination,reject_unauth_pipelining,reject_invalid_hostname,permit
smtpd_delay_reject = yes
smtpd_enforce_tls = no
smtpd_helo_required = yes
smtpd_pw_server_security_options = login,plain
smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination,permit
smtpd_sasl_auth_enable = yes
smtpd_sender_restrictions = reject_rbl_client cbl.abuseat.org,    reject_rbl_client relays.visi.com,    reject_rhsbl_client relays.visi.com,    reject_non_fqdn_sender,    reject_unauth_pipelining,    permit
smtpd_tls_cert_file = /etc/postfix/server.pem
smtpd_tls_loglevel = 0
smtpd_use_pw_server = yes
smtpd_use_tls = no
unknown_local_recipient_reject_code = 450

    I don’t particularly want to massage main.conf, so what setting do I have wrong in Server Admin? I can, by the way, login to the box as “bob,” which I presume is a test to see if I have actually got that much (authentication) working.

    And, by the way, it doesn’t work even when the hostname verifies.

    Any clues?

    Thanks,
    Bill

    October 27, 2004 at 10:08 am #359694
    Bill Eccles
    Participant

    Update: it now accepts relay access for recipients whose domains are on the machine–I forgot to include the domain in “Local host aliases.”

    But it still won’t do SMTP relay for recipients outside the domain.

    C’mon, folks, six reads and no clues yet? How unlike this community!

    🙂

    Bill

    October 27, 2004 at 11:34 am #359695
    Bill Eccles
    Participant

    I turned on eaxtra-heavy-duty logging (redwood-type, that is) for the problem connections. You can see that the user is authenticated successfully, but that the reject_unauth_destination restriction gets in the way of a successful. Here’s the result. (Domain names have been changed to protect the innocent… and not-so-innocent….)

    Thanks, y’all!
    Bill

    Oct 27 07:15:09 centipede postfix/smtpd[12854]: connect from machine.domain.net[192.168.1.2]
Oct 27 07:15:09 centipede postfix/smtpd[12854]: > machine.domain.net[192.168.1.2]: 220 centipede.drdomain.net ESMTP Postfix
Oct 27 07:15:09 centipede postfix/smtpd[12854]: watchdog_pat: 0x308458
Oct 27 07:15:09 centipede postfix/smtpd[12854]: < machine.domain.net[192.168.1.2]: EHLO [127.0.0.1]
Oct 27 07:15:09 centipede postfix/smtpd[12854]: > machine.domain.net[192.168.1.2]: 250-centipede.drdomain.net
Oct 27 07:15:09 centipede postfix/smtpd[12854]: > machine.domain.net[192.168.1.2]: 250-PIPELINING
Oct 27 07:15:09 centipede postfix/smtpd[12854]: > machine.domain.net[192.168.1.2]: 250-SIZE 10240000
Oct 27 07:15:09 centipede postfix/smtpd[12854]: > machine.domain.net[192.168.1.2]: 250-VRFY
Oct 27 07:15:09 centipede postfix/smtpd[12854]: > machine.domain.net[192.168.1.2]: 250-ETRN
Oct 27 07:15:09 centipede postfix/smtpd[12854]: > machine.domain.net[192.168.1.2]: 250-AUTH LOGIN PLAIN
Oct 27 07:15:09 centipede postfix/smtpd[12854]: match_hostname: machine.domain.net ~? 127.0.0.0/8
Oct 27 07:15:09 centipede postfix/smtpd[12854]: match_hostaddr: 192.168.1.2 ~? 127.0.0.0/8
Oct 27 07:15:09 centipede postfix/smtpd[12854]: match_list_match: machine.domain.net: no match
Oct 27 07:15:09 centipede postfix/smtpd[12854]: match_list_match: 192.168.1.2: no match
Oct 27 07:15:09 centipede postfix/smtpd[12854]: > machine.domain.net[192.168.1.2]: 250 8BITMIME
Oct 27 07:15:09 centipede postfix/smtpd[12854]: watchdog_pat: 0x308458
Oct 27 07:15:09 centipede postfix/smtpd[12854]: < machine.domain.net[192.168.1.2]: AUTH PLAIN dummyHashkakjakFA
Oct 27 07:15:09 centipede postfix/smtpd[12854]: > machine.domain.net[192.168.1.2]: 235 Authentication successful
Oct 27 07:15:09 centipede postfix/smtpd[12854]: watchdog_pat: 0x308458
Oct 27 07:15:10 centipede postfix/smtpd[12854]: < machine.domain.net[192.168.1.2]: MAIL FROM:<Bill@Domain.net>
Oct 27 07:15:10 centipede postfix/smtpd[12854]: extract_addr: input: <Bill@Domain.net>
Oct 27 07:15:10 centipede postfix/smtpd[12854]: extract_addr: result: Bill@Domain.net
Oct 27 07:15:10 centipede postfix/smtpd[12854]: fsspace: .: block size 4096, blocks free 1351002
Oct 27 07:15:10 centipede postfix/smtpd[12854]: smtpd_check_size: blocks 4096 avail 1351002 min_free 0 size 0
Oct 27 07:15:10 centipede postfix/smtpd[12854]: connect to subsystem public/cleanup
Oct 27 07:15:10 centipede postfix/smtpd[12854]: public/cleanup socket: wanted attribute: queue_id
Oct 27 07:15:10 centipede postfix/smtpd[12854]: input attribute name: queue_id
Oct 27 07:15:10 centipede postfix/smtpd[12854]: input attribute value: 12C1A18F0C3
Oct 27 07:15:10 centipede postfix/smtpd[12854]: public/cleanup socket: wanted attribute: (list terminator)
Oct 27 07:15:10 centipede postfix/smtpd[12854]: input attribute name: (end)
Oct 27 07:15:10 centipede postfix/smtpd[12854]: send attr flags = 2
Oct 27 07:15:10 centipede postfix/smtpd[12854]: 12C1A18F0C3: client=machine.domain.net[192.168.1.2], sasl_method=PLAIN, sasl_username=bill
Oct 27 07:15:10 centipede postfix/smtpd[12854]: > machine.domain.net[192.168.1.2]: 250 Ok
Oct 27 07:15:10 centipede postfix/smtpd[12854]: watchdog_pat: 0x308458
Oct 27 07:15:10 centipede postfix/smtpd[12854]: < machine.domain.net[192.168.1.2]: RCPT TO:<Bill.Eccles@ExternalDomain.com>
Oct 27 07:15:10 centipede postfix/smtpd[12854]: extract_addr: input: <Bill.Eccles@ExternalDomain.com>
Oct 27 07:15:10 centipede postfix/smtpd[12854]: extract_addr: result: Bill.Eccles@ExternalDomain.com
Oct 27 07:15:10 centipede postfix/smtpd[12854]: generic_checks: START
Oct 27 07:15:10 centipede postfix/smtpd[12854]: generic_checks: name=permit_mynetworks
Oct 27 07:15:10 centipede postfix/smtpd[12854]: permit_mynetworks: machine.domain.net 192.168.1.2
Oct 27 07:15:10 centipede postfix/smtpd[12854]: match_hostname: machine.domain.net ~? 127.0.0.0/8
Oct 27 07:15:10 centipede postfix/smtpd[12854]: match_hostaddr: 192.168.1.2 ~? 127.0.0.0/8
Oct 27 07:15:10 centipede postfix/smtpd[12854]: match_list_match: machine.domain.net: no match
Oct 27 07:15:10 centipede postfix/smtpd[12854]: match_list_match: 192.168.1.2: no match
Oct 27 07:15:10 centipede postfix/smtpd[12854]: generic_checks: name=permit_mynetworks status=0
Oct 27 07:15:10 centipede postfix/smtpd[12854]: generic_checks: name=reject_rbl_client
Oct 27 07:15:10 centipede postfix/smtpd[12854]: reject_rbl: Client host 192.168.1.2
Oct 27 07:15:10 centipede postfix/smtpd[12854]: dns_query: 2.1.168.192.cbl.abuseat.org (A): Host not found
Oct 27 07:15:10 centipede postfix/smtpd[12854]: ctable_locate: install entry key 2.1.168.192.cbl.abuseat.org
Oct 27 07:15:10 centipede postfix/smtpd[12854]: generic_checks: name=reject_rbl_client status=0
Oct 27 07:15:10 centipede postfix/smtpd[12854]: generic_checks: name=reject_rbl_client
Oct 27 07:15:10 centipede postfix/smtpd[12854]: reject_rbl: Client host 192.168.1.2
Oct 27 07:15:10 centipede postfix/smtpd[12854]: dns_query: 2.1.168.192.relays.visi.com (A): Host not found
Oct 27 07:15:10 centipede postfix/smtpd[12854]: ctable_locate: install entry key 2.1.168.192.relays.visi.com
Oct 27 07:15:10 centipede postfix/smtpd[12854]: generic_checks: name=reject_rbl_client status=0
Oct 27 07:15:10 centipede postfix/smtpd[12854]: generic_checks: name=reject_rhsbl_client
Oct 27 07:15:10 centipede postfix/smtpd[12854]: reject_rbl_domain: Client host machine.domain.net
Oct 27 07:15:10 centipede postfix/smtpd[12854]: dns_query: machine.domain.net.relays.visi.com (A): Host not found
Oct 27 07:15:10 centipede postfix/smtpd[12854]: ctable_locate: install entry key machine.domain.net.relays.visi.com
Oct 27 07:15:10 centipede postfix/smtpd[12854]: generic_checks: name=reject_rhsbl_client status=0
Oct 27 07:15:10 centipede postfix/smtpd[12854]: generic_checks: name=reject_unauth_destination
Oct 27 07:15:10 centipede postfix/smtpd[12854]: reject_unauth_destination: Bill.Eccles@ExternalDomain.com
Oct 27 07:15:10 centipede postfix/smtpd[12854]: permit_auth_destination: Bill.Eccles@ExternalDomain.com
Oct 27 07:15:10 centipede postfix/smtpd[12854]: connect to subsystem private/rewrite
Oct 27 07:15:10 centipede postfix/smtpd[12854]: send attr request = rewrite
Oct 27 07:15:10 centipede postfix/smtpd[12854]: send attr rule = canonicalize
Oct 27 07:15:10 centipede postfix/smtpd[12854]: send attr address = Bill.Eccles@ExternalDomain.com
Oct 27 07:15:10 centipede postfix/smtpd[12854]: private/rewrite socket: wanted attribute: address
Oct 27 07:15:10 centipede postfix/smtpd[12854]: input attribute name: address
Oct 27 07:15:10 centipede postfix/smtpd[12854]: input attribute value: Bill.Eccles@ExternalDomain.com
Oct 27 07:15:10 centipede postfix/smtpd[12854]: private/rewrite socket: wanted attribute: (list terminator)
Oct 27 07:15:10 centipede postfix/smtpd[12854]: input attribute name: (end)
Oct 27 07:15:10 centipede postfix/smtpd[12854]: rewrite_clnt: canonicalize: Bill.Eccles@ExternalDomain.com -> Bill.Eccles@ExternalDomain.com
Oct 27 07:15:10 centipede postfix/smtpd[12854]: send attr request = resolve
Oct 27 07:15:10 centipede postfix/smtpd[12854]: send attr address = Bill.Eccles@ExternalDomain.com
Oct 27 07:15:10 centipede postfix/smtpd[12854]: private/rewrite socket: wanted attribute: transport
Oct 27 07:15:10 centipede postfix/smtpd[12854]: input attribute name: transport
Oct 27 07:15:10 centipede postfix/smtpd[12854]: input attribute value: smtp
Oct 27 07:15:10 centipede postfix/smtpd[12854]: private/rewrite socket: wanted attribute: nexthop
Oct 27 07:15:10 centipede postfix/smtpd[12854]: input attribute name: nexthop
Oct 27 07:15:10 centipede postfix/smtpd[12854]: input attribute value: ExternalDomain.com
Oct 27 07:15:10 centipede postfix/smtpd[12854]: private/rewrite socket: wanted attribute: recipient
Oct 27 07:15:10 centipede postfix/smtpd[12854]: input attribute name: recipient
Oct 27 07:15:10 centipede postfix/smtpd[12854]: input attribute value: Bill.Eccles@ExternalDomain.com
Oct 27 07:15:10 centipede postfix/smtpd[12854]: private/rewrite socket: wanted attribute: flags
Oct 27 07:15:10 centipede postfix/smtpd[12854]: input attribute name: flags
Oct 27 07:15:10 centipede postfix/smtpd[12854]: input attribute value: 4096
Oct 27 07:15:10 centipede postfix/smtpd[12854]: private/rewrite socket: wanted attribute: (list terminator)
Oct 27 07:15:10 centipede postfix/smtpd[12854]: input attribute name: (end)
Oct 27 07:15:10 centipede postfix/smtpd[12854]: resolve_clnt_query: `Bill.Eccles@ExternalDomain.com' -> t=`smtp' h=`ExternalDomain.com' r=`Bill.Eccles@ExternalDomain.com'
Oct 27 07:15:10 centipede postfix/smtpd[12854]: ctable_locate: install entry key Bill.Eccles@ExternalDomain.com
Oct 27 07:15:10 centipede postfix/smtpd[12854]: 12C1A18F0C3: reject: RCPT from machine.domain.net[192.168.1.2]: 554 <Bill.Eccles@ExternalDomain.com>: Relay access denied; from=<Bill@Domain.net> to=<Bill.Eccles@ExternalDomain.com> proto=ESMTP helo=<[127.0.0.1]>
Oct 27 07:15:10 centipede postfix/smtpd[12854]: generic_checks: name=reject_unauth_destination status=2
Oct 27 07:15:10 centipede postfix/smtpd[12854]: > machine.domain.net[192.168.1.2]: 554 <Bill.Eccles@ExternalDomain.com>: Relay access denied
Oct 27 07:15:11 centipede postfix/smtpd[12854]: watchdog_pat: 0x308458
Oct 27 07:15:12 centipede postfix/smtpd[12854]: smtp_get: EOF
Oct 27 07:15:12 centipede postfix/smtpd[12854]: lost connection after RCPT from machine.domain.net[192.168.1.2]
Oct 27 07:15:12 centipede postfix/smtpd[12854]: disconnect from machine.domain.net[192.168.1.2]
    October 27, 2004 at 11:57 am #359698
    Bill Eccles
    Participant

    Solved!!

    OK, for those of you who are wondering, “Bill, how’d you do it without massaging the main.cf file by hand?”, here’s the answer.

    I didn’t.

    In fact, it turns out that I’d massaged my main.cf file by hand before per a configuration I found here at AFP548 (for something else), so I dropped my objection to massaging my file by hand. In fact, I went back and added “mynetworks,” too, because Apple doesn’t provide a good way of including “mynetworks” while allowing login from somewhere outside “mynetworks.”

    Now, on to the previous problem: All I needed to do was add the “permit_sasl_authenticated” to the front of the smptd_client_restrictions list and all is well.

    Thanks for playing!
    Bill

    (Joel, make sure these forums are getting Googled. This kind of little fix might be useful for someone else in the future.)

    The outcome:

    smtpd_client_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_rbl_client cbl.abuseat.org,reject_rbl_client relays.visi.com,reject_rhsbl_clie
nt relays.visi.com,reject_unauth_destination,reject_unauth_pipelining,reject_invalid_hostname,permit
    October 29, 2004 at 8:59 pm #359746
    Bill Eccles
    Participant

    Probably–I don’t know for sure.

    I imagine it might have been the AFP548 anti-spam measures, too, but I can’t seem to find that article right now.

    Anyway, problem solved, and I now have a better understanding of PostFix than I had before–and that’s a good thing!

    Thanks,
    Bill

    November 30, 2004 at 9:39 pm #360047
    Anonymous
    Guest

    Bill,

    How do I turn logging of
    “…verification failed: Host not found”
    off the console? Most of those failures are spammers, and I have this message logged into two other places already.

    I run OpenBSD3.4-Stable, Postfix2.1.5, SA3.0.1 & Amavisd (latest).

    Thanks,

    M.S>

  • Author
    Posts
Viewing 6 posts - 1 through 6 (of 6 total)
  • You must be logged in to reply to this topic.