Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am trying to configure Postfix so that it would accept mail from authenticated clients outside $mynetworks.

When I try to send a test email from my iPhone, which is configured to use port 25, SSL and password authentication, the mail gets rejected by Postfix. I get the following in /var/log/mail.info:

Oct 25 17:41:35 mailhost postfix/smtpd[6136]: warning: 212.183.x.x: hostname host212-183-x-x.uk.access.vodafone.net verification failed: Name or service not known

Oct 25 17:41:35 mailhost postfix/smtpd[6136]: connect from unknown[212.183.x.x]

Oct 25 17:41:39 mailhost postfix/smtpd[6136]: NOQUEUE: reject: RCPT from unknown[212.183.x.x]: 554 5.7.1 : Client host rejected: Access denied; from=<aix@x.com> to=<aix@x.com> proto=ESMTP helo=<[10.25.x.x]>

Oct 25 17:41:39 mailhost postfix/smtpd[6136]: disconnect from unknown[212.183.x.x]

Here are all my main.cf settings that have to do with SASL/TLS:

smtpd_tls_cert_file = /etc/ssl/certs/ssl-mail.pem
smtpd_tls_key_file = /etc/ssl/private/ssl-mail.key
smtpd_use_tls = yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_sasl_auth_enable = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/dovecot-auth
smtpd_sasl_authenticated_header = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = $myhostname
broken_sasl_auth_clients = yes
smtpd_recipient_restrictions = reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_unauth_pipelining, permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtp_use_tls = yes
smtpd_tls_received_header = yes
smtpd_tls_mandatory_protocols = SSLv3, TLSv1
smtpd_tls_mandatory_ciphers = medium
smtpd_tls_auth_only = yes
tls_random_source = dev:/dev/urandom

How do I establish that the session is indeed authenticated?

How do I go about troubleshooting this further?

share|improve this question

3 Answers 3

up vote 2 down vote accepted

After much experimentation it turned out I had to add permit_sasl_authenticated to smtpd_client_restrictions (not to be confused with smtpd_recipient_restrictions).

This has fixed it.

share|improve this answer
    
Your post said that it had permit_sasl_authenticated for smtpd_recipient_restrictions –  becomingwisest Oct 25 '11 at 19:02
    
@ChristopherEvans: It did. What wasn't configured correctly was smtpd_CLIENT_restrictions (caps used for emphasis). –  NPE Oct 25 '11 at 19:07

Test from a system with telnet/openssl http://www.postfix.org/SASL_README.html#server_test I don't know if the iPhone supports starttls, so you may want to test against 465 and 587 for ssl support. I think also you have it setup to only accept authentication if ssl is used.

share|improve this answer

The parameters you are specifying on the line:

smtpd_recipient_restrictions = reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_unauth_pipelining, permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination

Are the likely culprit.

More on how to configure postfix relaying and access control can be found in the documentation.

Looks like you'll want to start by adding *.vodafone.net domain to the list of allowed domains for relaying.

share|improve this answer
    
Definitively not! You will not allow the Vodafone domain(s) to be allowed for relaying. Never ever. Always use SASL but don't trust servers based on names. –  mailq Oct 25 '11 at 20:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.