1

I'm using Postfix (2.3.3) on CentOS (5.7). Right now, my server seems to be acting like an open relay. If I specify a login, it works fine, both unsecured and with TLS (however TLS nags me about the invalid certificate, but I guess I just have to get a certificate). That's what I want, if a client doesn't support TLS, then fallback to unsecured.

However, it seems that if I don't provide any login, it still sends email.

This is my main.cf configuration file:

command_directory = /usr/sbin
daemon_directory = /usr/libexec/postfix

myhostname = mail.valdron.ca
mydomain = valdron.ca
myorigin = $mydomain
mydestination = $myhostname, $mydomain

unknown_local_recipient_reject_code = 550

mynetworks = 127.0.0.0/8

alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases

debug_peer_level = 2

debugger_command =
         PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
         xxgdb $daemon_directory/$process_name $process_id & sleep 5

sendmail_path = /usr/sbin/sendmail.postfix
newaliases_path = /usr/bin/newaliases.postfix
mailq_path = /usr/bin/mailq.postfix

setgid_group = postdrop
html_directory = no
manpage_directory = /usr/share/man
sample_directory = /usr/share/doc/postfix-2.3.3/samples
readme_directory = /usr/share/doc/postfix-2.3.3/README_FILES

virtual_alias_maps = hash:/etc/postfix/virtual
sender_bcc_maps = hash:/etc/postfix/bcc
mailbox_command = /usr/bin/procmail-wrapper -o -a $DOMAIN -d $LOGNAME
home_mailbox = Maildir/

smtpd_sasl_auth_enable = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
broken_sasl_auth_clients = yes

smtpd_tls_key_file = /etc/pki/tls/private/mail.valdron.ca.key
smtpd_tls_cert_file = /etc/pki/tls/certs/mail.valdron.ca.cert
smtpd_tls_loglevel = 1
smtpd_tls_session_cache_timeout = 3600s
smtpd_tls_session_cache_database = btree:/var/spool/postfix/smtpd_tls_cache
tls_random_source = dev:/dev/urandom
mailbox_size_limit = 0
notify_classes = bounce, delay, resource
smtpd_recipient_restrictions = reject_unauth_destination permit_sasl_authenticated permit_mynetworks check_relay_domains
smtpd_tls_security_level = may

Also, non-related to the first question, iPhone users get the following error (translated from French): "The recipient was rejected by the server because the relay is not allowed". I don't have an iPhone to test. Is it possible that the ISP blocks port 25 mail servers, as so many ISP do?

Improve this question
7
  • Are you sending the "test" email from the same machine? Localhost = "mynetworks" which will eval to PERMIT
    – Tim
    Jan 18, 2012 at 20:58
  • 2
    Clients (iPhone) should not be submitting e-mail to the server on port 25. Port 25 is for server to server communication only. Clients should submit on port 587 (the MSA port).
    – Chris S
    Jan 18, 2012 at 21:11
  • @Tim I'm using a remote machine
    – jValdron
    Jan 19, 2012 at 0:02
  • @ChrisS Should I not allow port 25 connections then?
    – jValdron
    Jan 19, 2012 at 0:02
  • @jValdron If you're going to receive e-mail from other servers then you'll need 25 open. If you're only sending e-mail then yeah, you wouldn't need port 25.
    – Chris S
    Jan 19, 2012 at 1:15

2 Answers 2

Reset to default
1

Try changing the smtpd_recipient_restrictions line to this:

smtpd_recipient_restrictions = reject_unauth_destination, permit_sasl_authenticated, permit_mynetworks, check_relay_domains

I've tried to lookup the syntax but I always use , between values unless I place the values on separate lines (in which case the following parameters have to start with a whitespace) like:

smtpd_recipient_restrictions = reject_unauth_destination
                               permit_sasl_authenticated
                               permit_mynetworks
                               check_relay_domains

Edit 1
A good tool to remotely test if a server is really an open relay is benefical to use, just to avoid mistakes or "false positives". This one tests a dozen or so various ways to relay, and will report to you if any of them works. Just type your IP adress in the box and click "Test":
http://www.mailradar.com/openrelay/

Improve this answer
6
  • Ummm, nope, still sends without authentication
    – jValdron
    Jan 19, 2012 at 0:03
  • I see above that you try from a remote machine, but exactly how/what do you test to see that it still relays? And what is in your $relay_domains configuration (or in the /etc/postfix/relay_domains file if the variable points to that one)?
    – Mattias Ahnberg
    Jan 19, 2012 at 0:15
  • I tried from a remote computer to mail.valdron.ca and it does NOT relay for me. The only reason I can think it relays for you is if you test from an approved computer OR use the domain name the server is supposed to manage.
    – Mattias Ahnberg
    Jan 19, 2012 at 0:16
  • Basically, I'm testing from home. The server is in co-location about 15 km from here. And the relay_domains file doesn't seem to exists. And the file variable is not set in my main.cf, odd.
    – jValdron
    Jan 19, 2012 at 0:52
  • I should specify that my knowledge of mail servers is somewhat limited ;)
    – jValdron
    Jan 19, 2012 at 0:53
0

For the 2nd question, you can verify if the port is open by using nmap to scan the host, or simply telnet hostname 25.

If the telnet responds with something to the tune of 220 mailserver_name ESMTP, then the port is open.

Improve this answer
1
  • Yep, already tried telnet-ing, worked fine
    – jValdron
    Jan 19, 2012 at 0:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .