We have been struggling with our mail server for awhile. We finally have SpamAssassin working. But there is one thing that we can’t figure out — if our users use an e-mail client from a non-trusted network, the mail server doesn’t seem to check for SMTP authentication (even though all the documents say that it should). I have tried several suggestions from here and the Apple Developer site — all to no avail.

Our username database is LDAP and works fine with Squirrelmail and pop mail.

The problem in a nutshell:

inside to inside: works
inside to outside: works
outside to inside: works
outside to outside: does not work (rejected as relay when it should also check for smtp authentication)

So, I would greatly appreciated any input.

Here is the postfix configuration settings and some SMTP log entries that show the unsuccessful attempts. [Note: the first one "works" because I temporarily added my home IP network to my trusted networks.]

=========================

Operating System: OS X Server 10.3.7
======================================

Postfix mail_version: 2.0.10
==============================

Results from postconf -n:
========================

always_bcc =
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
debug_peer_level = 2
enable_server_options = yes
inet_interfaces = all
luser_relay =
mail_owner = postfix
mailbox_command = /usr/bin/procmail -a "$EXTENSION"
mailbox_transport = procmail
mailq_path = /usr/bin/mailq
manpage_directory = /usr/share/man
message_size_limit = 10240000
mydestination = $myhostname,localhost.$mydomain,our_real_host.org
mydomain_fallback = localhost
myhostname = mail.our_real_host.org
mynetworks = 127.0.0.1/32,172.16.128.3/32,10.61.0.0/16,69.abc.def.gef/26
mynetworks_style = host
newaliases_path = /usr/bin/newaliases
queue_directory = /private/var/spool/postfix
readme_directory = /usr/share/doc/postfix
relayhost =
sample_directory = /usr/share/doc/postfix/examples
sendmail_path = /usr/sbin/sendmail
setgid_group = postdrop
smtpd_client_restrictions = reject_rbl_client relays.ordb.org
smtpd_enforce_tls = no
smtpd_pw_server_security_options = cram-md5
smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination,permit
smtpd_sasl_auth_enable = yes
smtpd_tls_loglevel = 0
smtpd_use_pw_server = yes
smtpd_use_tls = no
unknown_local_recipient_reject_code = 450

======================================

SMTP log (/var/log/mail.log) entry when IP address is in my_networks:
====================================================================

Feb 9 15:39:48 mail postfix/smtpd[19325]: connect from 66.159.abc.def.adsl.snet.net[66.159.abc.def]
Feb 9 15:39:49 mail postfix/smtpd[19325]: 71B5E1F7AF7: client=66.159.abc.def.adsl.snet.net[66.159.abc.def]

Feb 9 15:39:58 mail postfix/qmgr[17418]: 3D6301F7B18: from=<chasshoo@our_real_host.org>, size=691, nrcpt=1 (queue

active)
Feb 9 15:40:00 mail postfix/smtp[19363]: 3D6301F7B18: to=<[email protected]>,

relay=snetmx3.prodigy.net[204.60.203.71], delay=2, status=sent (250 2.0.0 j19KdwQM008683 Message accepted for

delivery)

SMTP log entry when IP address is not in my_networks and client mail program has SMTP authentication off:
========================================================================================================

Feb 9 15:50:06 mail postfix/smtpd[19795]: 9F92E1F7DA0: reject: RCPT from

66.159.abc.def.adsl.snet.net[66.159.abc.def]: 554 <[email protected]>: Relay access denied;

from=<chasshoo@our_real_host.org> to=<[email protected]> proto=SMTP helo=<cs>

SMTP log entry when IP address is not in my_networks and client mail program has SMTP authentication on (log entry

seems the same):
==================================================================================================================

================

Feb 9 15:53:10 mail postfix/smtpd[19846]: 0D2EF1F7DE9: reject: RCPT from

66.159.abc.def.adsl.snet.net[66.159.abc.def]: 554 <[email protected]>: Relay access denied;

from=<chasshoo@our_real_host.org> to=<[email protected]> proto=SMTP helo=<cs>

=========

Thanks again,
Charlie