3

I'm trying to use postfix + policyd2 to limit amount of outgoing emails. But when implementing policyd2 policies i get Access denied - no mater what i do i get denied.

  • Postfix version 2.11.4
  • PolicyD2 (cluebringer) version 2.0.14-1

Error box from email client:

An error occurred while sending mail. The mail server responded: 4.7.1 <[email protected]>: Recipient address rejected: Access denied. Please check the message recipient [email protected] and try again.

When i turn off policyd2 in postfix /etc/postfix/main.cf everything works:

smtpd_end_of_data_restrictions=check_policy_service inet:127.0.0.1:10031
smtpd_recipient_restrictions=check_policy_service inet:127.0.0.1:10031, 

If i turn it back on, this is what i get /var/log/maillog:

postfix/smtpd[3228]: >>> START Helo command RESTRICTIONS <<<
postfix/smtpd[3228]: generic_checks: name=reject_invalid_helo_hostname                   
postfix/smtpd[3228]: reject_invalid_hostaddr: [192.168.0.10]
postfix/smtpd[3228]: generic_checks: name=reject_invalid_helo_hostname status=0
postfix/smtpd[3228]: >>> END Helo command RESTRICTIONS <<<
postfix/smtpd[3228]: >>> START Recipient address RESTRICTIONS <<<
postfix/smtpd[3228]: generic_checks: name=check_policy_service
postfix/smtpd[3228]: trying... [127.0.0.1]
postfix/smtpd[3228]: auto_clnt_open: connected to 127.0.0.1:10031
postfix/smtpd[3228]: send attr request = smtpd_access_policy
postfix/smtpd[3228]: send attr protocol_state = RCPT
postfix/smtpd[3228]: send attr protocol_name = ESMTP
postfix/smtpd[3228]: send attr client_address = 88.88.88.88
postfix/smtpd[3228]: send attr client_name = example.pl
postfix/smtpd[3228]: send attr reverse_client_name = example.pl
postfix/smtpd[3228]: send attr helo_name = [192.168.0.10]
postfix/smtpd[3228]: send attr sender = [email protected]
postfix/smtpd[3228]: send attr recipient = [email protected]
postfix/smtpd[3228]: send attr recipient_count = 0
postfix/smtpd[3228]: send attr queue_id = 
postfix/smtpd[3228]: send attr instance = c9c.5584b989.ab0c0.0
postfix/smtpd[3228]: send attr size = 368
postfix/smtpd[3228]: send attr etrn_domain = 
postfix/smtpd[3228]: send attr stress = 
postfix/smtpd[3228]: send attr sasl_method = PLAIN
postfix/smtpd[3228]: send attr sasl_username = [email protected]
postfix/smtpd[3228]: send attr sasl_sender = 
postfix/smtpd[3228]: send attr ccert_subject = 
postfix/smtpd[3228]: send attr ccert_issuer = 
postfix/smtpd[3228]: send attr ccert_fingerprint = 
postfix/smtpd[3228]: send attr ccert_pubkey_fingerprint = 
postfix/smtpd[3228]: send attr encryption_protocol = TLSv1
postfix/smtpd[3228]: send attr encryption_cipher = ECDHE-RSA-AES256-SHA
postfix/smtpd[3228]: send attr encryption_keysize = 256
postfix/smtpd[3228]: 127.0.0.1:10031: wanted attribute: action
postfix/smtpd[3228]: input attribute name: action
postfix/smtpd[3228]: input attribute value: DEFER
postfix/smtpd[3228]: 127.0.0.1:10031: wanted attribute: (list terminator)
postfix/smtpd[3228]: input attribute name: (end)
postfix/smtpd[3228]: check_table_result: inet:127.0.0.1:10031 DEFER policy query
postfix/smtpd[3228]: NOQUEUE: reject: RCPT from example.pl[88.88.88.88]: 450 4.7.1 <[email protected]>: Recipient address rejected: Access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.0.10]>
postfix/smtpd[3228]: generic_checks: name=check_policy_service status=2
postfix/smtpd[3228]: >>> END Recipient address RESTRICTIONS <<<
postfix/smtpd[3228]: > example.pl[88.88.88.88]: 450 4.7.1 <[email protected]>: Recipient address rejected: Access denied
postfix/smtpd[3228]: watchdog_pat: 0x83b23a8

Policy example.

Create policy:

INSERT INTO policies VALUES (1, 'In Out', 10, 'In Out Policy', 0);
INSERT INTO policy_members VALUES (1, 1, 'any', 'any', '' ,0);

Add quotas - actions:

INSERT INTO quotas (PolicyID,Name,Track,Period,Verdict,Data) VALUES (1,'Sender:user@domain', 'Sender:user@domain', 60, 'DEFER', 'Deferring: To many messages from sender in last 60s.');
INSERT INTO quotas (PolicyID,Name,Track,Period,Verdict,Data) VALUES (1,'Recipient:@domain', 'Recipient:@domain', 60, 'REJECT', 'Quota limit reached.');

Add quota limits:

INSERT INTO quotas_limits (QuotasID, Type, CounterLimit) VALUES (1,'MessageCount', 12);
INSERT INTO quotas_limits (QuotasID, Type, CounterLimit) VALUES (2,'MessageCount', 20);

Can't use web gui (no PHP) - so I'm not sure if it is correct. Was searching and trying different policy examples but the error remains exactly the same.

0

1 Answer 1

3

Permissions on policyd2 sqlite3 database file were wrong.

PolicyD2 has capability to run daemon as specific user, in my case:

/etc/policyd.conf
# User to run this daemon as
user=policyd
group=policyd

Permissions on the database were root:root.

-rw-r--r-- root root policyd2.db

After changing to policyd:policyd i could send emails.

-rw-r--r-- policyd policyd policyd2.db

Now Acces denied error make sense.

3
  • Thanks for the solution :). Can you elaborate this answer like (1) how you track down the problems until you can pinpoint it to sqlite problem (2) Can you share the policyd log stating that sqlite permission was wrong (3) Can you share how the permission of sqlite db before and after fixing?
    – masegaloeh
    Jun 22, 2015 at 23:49
  • 1) I went to bed, to reset myself again, i knew that policyd2 check_policy_service was the problem. I was editing policyd2.db from root account, (because policyd account does not have a shell), removed policyd2.db couple times while creating policies and forgot to change permissions. When i woke up i realized that it might be the problem. Because policyd has its own user:group permissions. 2) Never looked into policyd2.log was focused on maillog. Right now i can't see anything that would point into wrong permissions on policyd2.db.
    – Abc Xyz
    Jun 23, 2015 at 8:49
  • +1 Great explanation. Thanks for sharing the solution with us :)
    – masegaloeh
    Jun 23, 2015 at 9:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .