Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to configure a secondary postfix to enable SMTP AUTH against my main postfix server (postfix + ldap auth + cyrus)

I've follow http://www.postfix.org/SASL_README.html#client_sasl adding:

smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous 
relayhost = [192.168.66.98]

the config files of secondary postfix are:

# postconf -n
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
debug_peer_level = 2
html_directory = no
inet_interfaces = localhost, 192.168.66.85
inet_protocols = all
local_recipient_maps =
mail_owner = postfix
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
mydestination = $myhostname, localhost.$mydomain, localhost
mydomain = ddol-test.com
mynetworks = 192.168.66.0/24, 127.0.0.0/8
myorigin = $myhostname
newaliases_path = /usr/bin/newaliases.postfix
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-2.6.6/README_FILES
relay_domains = $mydestination
relayhost = [192.168.66.98]
sample_directory = /usr/share/doc/postfix-2.6.6/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
transport_maps =
unknown_local_recipient_reject_code = 550

# cat /etc/postfix/sasl_passwd
[192.168.66.98]         666mgimeno@pre.ddol.es:1234

When I send a mail, it is correctly redirected to .66.98 but it do not auth on it and the behaviour of the email is like it for a non authenticated user.

This is my main postfix configuration:

cat main.cf

...
...
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes

smtpd_sasl_authenticated_header = yes
smtpd_sasl_path = smtpd

smtpd_helo_restrictions =
        permit_mynetworks,
        permit_sasl_authenticated,
        reject_non_fqdn_helo_hostname,
        reject_invalid_helo_hostname,
        permit

smtpd_sender_restrictions =
        reject_authenticated_sender_login_mismatch,
        permit

smtpd_recipient_restrictions =
        reject_unauth_pipelining,
        reject_non_fqdn_sender,
        reject_non_fqdn_recipient,
        check_policy_service inet:127.0.0.1:10031,
        permit_mynetworks,
        permit_sasl_authenticated,
        reject_unauth_destination,
        reject_unverified_recipient,
        check_policy_service inet:127.0.0.1:10045,
        reject_rbl_client bl.spamcop.net,
        reject_rbl_client psbl.surriel.com,
        reject_rbl_client sbl.spamhaus.org,
        reject_rbl_client xbl.spamhaus.org,
        reject_rbl_client zen.spamhaus.org,
        reject_rbl_client combined.rbl.msrbl.net,
        reject_rbl_client relays.ordb.org,
        reject_rbl_client list.dsbl.org,
        reject_rbl_client sbl-xbl.spamhaus.org,
        reject_rbl_client dnsbl.njabl.org,
        permit

header_checks = pcre:/etc/postfix/header_checks

smtpd_end_of_data_restrictions =
        check_policy_service inet:127.0.0.1:10031

soft_bounce = no

smtpd_helo_required = yes

smtpd_delay_reject = yes
disable_vrfy_command = yes

smtpd_sender_login_maps = ldap:/etc/postfix/sender_maps

amavisd-new_destination_concurrency_limit = 20

virtual_alias_maps = ldap:/etc/postfix/mailRedirect ldap:/etc/postfix/virtual ldap:/etc/postfix/catch-all

smtpd_sasl_local_domain =

smtp_tls_security_level = may
smtpd_tls_security_level = may
smtpd_tls_auth_only = no
smtp_tls_note_starttls_offer = yes
smtpd_tls_key_file = /etc/ssl/private/smtpd.key
smtpd_tls_cert_file = /etc/ssl/certs/smtpd.crt
smtpd_tls_CAfile = /etc/ssl/certs/cacert.pem
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom

message_size_limit=15728640

Right now, any mail sended from secondary postfix, is relayed to main postfix but it pass all the checks as it was for a non authenticated user, but I don't want that. I would like that the behaviour of the email was the same as an authenticated user and stops in "permit_sasl_authenticated" in smtpd_recipient_restrictions.

I don't know if I explain myself clear, anyway, do not hesitate to ask me for more information.

Thanks & Regards.

share|improve this question
    
If your secondary postfix server is on 192.168.66.0/24 network, this will happen as permit_mynetworks is before permit_sasl_authenticated in your smtpd_recipient_restrictions –  topdog Jul 24 '12 at 15:22
    
in my main config the variable is mynetworks = 127.0.0.0/8, so it never will match –  magiza83 Jul 24 '12 at 15:30
    
if I add the rule "reject_unauthenticated_sender_login_mismatch" i will only allow auth users to send through my main server, and this is the error I get when I try to send someting: "Jul 24 17:24:30 mail postfix/smtpd[8294]: NOQUEUE: reject: RCPT from unknown[192.168.66.85]: 553 5.7.1 <666mgimeno@pre.ddol.es>: Sender address rejected: not logged in; from=<666mgimeno@pre.ddol.es> to=<yeah@mola.com> proto=ESMTP helo=<mx-test.ddol-test.com>" As you can see, secondary postfix is not sending as an auth user. And I don't know how to configure it. –  magiza83 Jul 24 '12 at 15:31
    
if I delete the rule "reject_unauthenticated_sender_login_mismatch" the error is: "Jul 24 17:41:45 mail postfix/smtpd[8451]: NOQUEUE: reject: RCPT from unknown[192.168.66.85]: 554 5.7.1 <mgimeno@yeah.com>: Relay access denied; from=<666mgimeno@pre.ddol.es> to=<mgimeno@yeah.com> proto=ESMTP helo=<mx-test.ddol-test.com>" due to "reject_unauth_destination" rule –  magiza83 Jul 24 '12 at 15:46
add comment

1 Answer 1

up vote 1 down vote accepted

Your problem is here:

smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
relayhost = [192.168.66.98]

Note that you've used 'smtpd' rather than 'smtp'. This means you're setting up sasl for the listening deamon, not the sending agent.

Here's what I use in mine:

# use authentication
relayhost = [mail.messagingengine.com]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/saslpass
smtp_sasl_security_options = noanonymous

And it's working fine.

Oh - and the content of saslpass is:

mail.messagingengine.com myuser@my.domain:mypass

Note the colon and the space. I'm guessing you'll need to do the IP address there instead, or put an entry in /etc/hosts and use a name. The @my.domain is because messagingengine uses fully qualified email addresses for login. You probably just need a username.

share|improve this answer
    
thanks, you are totally right. and now it's working perfectly. –  magiza83 Jul 25 '12 at 7:51
    
you're welcome. I took the 'cyrus' tag off, since it's not really cyrus related at all. –  Bron Gondwana Jul 25 '12 at 11:45
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.