Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm setting up a new mail server for my company with Ubuntu Server 11.04 and postfix/dovecot. I'm new on this so I have some problems. I'm getting it works only for receving mails from any address outside the lan and I can send only for the same domain. If I try to send a new message with it to an outside address (eg gmail) I have Relay denied.

So, my server had 2 network interface, 1 for my lan (192.168.1.xxx) and one had a public static ip address. My domain, for testing pourpose, is enti.centropaghe.it and I create an MX record to mail.enti.centropaghe.it

My goal is to get a full functionaly imap/smtp/pop3 server, with autentication on both side and it can send email to all address:)

I post some of my configuration file so you can digg it:

/etc/postfix/main.cf

# See /usr/share/postfix/main.cf.dist for a commented, more complete version


# Debian specific:  Specifying a file name will cause the first
# line of that file to be used as the name.  The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname

smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

readme_directory = no

# TLS parameters
smtpd_use_tls=yes
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

mydomain = enti.centropaghe.it
myhostname = mail.enti.centropaghe.it
mydestination = $myhostname, localhost.$mydomain, $mydomain, localhost
relayhost = $mydomain
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 192.168.1.0/24
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = $mydomain
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
default_transport = error
relay_transport = error
mail_spool_directory = /var/mail/

/etc/resolv.conf

search enti.centropaghe.it
nameserver 192.168.1.221 #is my dns server on my lan

/etc/hosts

127.0.0.1       localhost.localdomain localhost
192.168.1.148   mail.enti.centropaghe.it darwin

dig enti.centropaghe.it mx

; <<>> DiG 9.7.3 <<>> enti.centropaghe.it mx
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 65356
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3

;; QUESTION SECTION:
;enti.centropaghe.it.           IN      MX

;; ANSWER SECTION:
enti.centropaghe.it.    8381    IN      MX      10 mail.enti.centropaghe.it.

;; AUTHORITY SECTION:
centropaghe.it.         71334   IN      NS      dns2.telemar.it.
centropaghe.it.         71334   IN      NS      dns.telemar.it.

;; ADDITIONAL SECTION:
mail.enti.centropaghe.it. 7333  IN      A       213.178.198.62
dns.telemar.it.         28595   IN      A       213.178.196.1
dns2.telemar.it.        20154   IN      A       213.178.195.254

;; Query time: 1 msec
;; SERVER: 192.168.1.221#53(192.168.1.221)
;; WHEN: Wed Feb 29 15:24:47 2012
;; MSG SIZE  rcvd: 151

dig enti.centropaghe.it any

; <<>> DiG 9.7.3 <<>> enti.centropaghe.it any
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58752
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 3

;; QUESTION SECTION:
;enti.centropaghe.it.           IN      ANY

;; ANSWER SECTION:
enti.centropaghe.it.    8342    IN      MX      10 mail.enti.centropaghe.it.
enti.centropaghe.it.    7266    IN      A       213.178.198.58

;; AUTHORITY SECTION:
centropaghe.it.         71295   IN      NS      dns2.telemar.it.
centropaghe.it.         71295   IN      NS      dns.telemar.it.

;; ADDITIONAL SECTION:
mail.enti.centropaghe.it. 7294  IN      A       213.178.198.62
dns.telemar.it.         28556   IN      A       213.178.196.1
dns2.telemar.it.        20115   IN      A       213.178.195.254

;; Query time: 0 msec
;; SERVER: 192.168.1.221#53(192.168.1.221)
;; WHEN: Wed Feb 29 15:25:27 2012
;; MSG SIZE  rcvd: 167

/var/log/mail.log

Feb 29 17:11:10 darwin postfix/smtpd[8207]: warning: 213.178.xxx.xxx: hostname ip.213.178.xxx.xxx.telemar.it verification failed: Name or service not known
Feb 29 17:11:10 darwin postfix/smtpd[8207]: connect from unknown[213.178.xxx.xxx]
Feb 29 17:11:10 darwin postfix/smtpd[8207]: NOQUEUE: reject: RCPT from unknown[213.178.xxx.xxx]: 554 5.7.1 <username@gmail.com>: Relay access denied; from=<otherusername@enti.centropaghe.it> to=<username@gmail.com> proto=ESMTP helo=<[192.168.1.138]>
Feb 29 17:11:13 darwin postfix/smtpd[8207]: disconnect from unknown[213.178.xxx.xxx]

postconf -n

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
config_directory = /etc/postfix
inet_interfaces = all
mail_spool_directory = /var/mail/
mailbox_size_limit = 0
mydestination = $myhostname, localhost.$mydomain, $mydomain, localhost
mydomain = enti.centropaghe.it
myhostname = mail.enti.centropaghe.it
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 192.168.1.0/24
myorigin = $mydomain
readme_directory = no
recipient_delimiter = +
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
smtpd_tls_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file = /etc/ssl/private/ssl-cert-snakeoil.key
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_use_tls = yes

I hope that's all. If you need something else, let me know.

Update

With last modifications, now using the internal ip address of the smtp I can send email to outside address. But doesn't work using mail.enti.centropaghe.it

share|improve this question
    
Please remove any and all of the above and replace it with the output of postconf -n and the logs from at least one complete message being handled by postfix, that shows the problem you are trying to solve. –  adaptr Feb 29 '12 at 15:14
1  
Why I have to remove? postconf -n is the output of main.cf so it's the same. –  Kreker Feb 29 '12 at 15:24
    
...no, of course it isn't. Where are the logs ? –  adaptr Feb 29 '12 at 15:26
    
added like you request. What's the differences between main.cf and postconf -n? –  Kreker Feb 29 '12 at 16:14
add comment

1 Answer

up vote 2 down vote accepted

From your main.cf:

default_transport (default: smtp) You used: *default_transport = error*

The default mail delivery transport and next-hop destination for destinations that do not match $mydestination, $inet_interfaces, $proxy_interfaces, $virtual_alias_domains, $virtual_mailbox_domains, or $relay_domains

Well, that does it. Remove this line. You want to use SMTP to send out email that isn't for your domain. Right now, you've forced yourself to only perform local delivery (any mail that is supposed to go anywhere outside of that machine will not be accepted). That's why you can receive mail, but nothing that isn't accepted by that host is forwarded.


relayhost (default: empty) You used: relayhost = $mydomain

The next-hop destination of non-local mail; overrides non-local domains in recipient addresses. This information is overruled with relay_transport...

This definitely affects things. Unless you have a different SMTP server listening on enti.centropaghe.it that you want all mail to go through, your mail is again going nowhere. You probably should remove this line.


relay_transport (default: relay) You used: *relay_transport = error*

The default mail delivery transport and next-hop destination for remote delivery to domains listed with $relay_domains. In order of decreasing precedence, the nexthop destination is taken from $relay_transport, $sender_dependent_relayhost_maps, $relayhost, or from the recipient domain

I see no $relay_domains, so I suggest removing this.

Update

Ah, horse of a different color. This line below says who is allowed to relay. Your error message is coming from a host beginning with 213.178. Since there is no entry for it and you have other form of authentication for relaying, it is denied. Perhaps you want to add an entry covering your assigned network range?

mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 192.168.1.0/24

Let me know how that works out for you.

share|improve this answer
2  
default_transport=error means that any outgoing mail will be rejected (5xx) and returned to sender. It's a bit more disastrous than "only allowing local delivery", which is really not the result this has. –  adaptr Feb 29 '12 at 15:19
    
@adaptr Oops, I see how I conveyed that the wrong way. I was thinking local as in machine, one machine for domain, only receipt there... fixing it so my wording isn't confusing. Thanks. –  Jeff Ferland Feb 29 '12 at 15:34
1  
@Kreker See update. Your log shows that you're connecting from a public IP in that case and that IP is not part of your configured hosts for relaying. –  Jeff Ferland Feb 29 '12 at 16:30
1  
@Kreker see postfix.org/SASL_README.html for a howto on setting up authentication in Postfix. –  Jeff Ferland Feb 29 '12 at 16:46
1  
You must allow any IP to connect because any IP could be sending mail that is destined to you. The check for whether relaying is allowed happens in the middle of the conversation and only if there is mail that is meant for somewhere else. If somebody authenticates they can use you to relay mail elsewhere regardless of where they came from. –  Jeff Ferland Mar 1 '12 at 13:44
show 11 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.