Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have setup Postfix but am having trouble with the setup.

Whenever I used to send emails to the server, it reject my mails saying 'Relaying Denied', so I changed the following in main.cf:

mynetworks = 0.0.0.0/0
mynetworks_style = subnet

I can now send email and it works, but MX tests say that it is an open relay (obviously unintended).

How can I resolve this? I obviously want anybody to be able to email my domain, but I'm unsure of the configuration.

I know I can change the mynetworks, but then doesn't this restrict who CAN email to the server?

share|improve this question
    
Are you trying to relay mail through this server, or to deliver mail to this server? –  nickgrim Aug 29 '12 at 13:22
    
Makes no difference with respect to this issue, since an open relay is an open relay. Email is not a trivial undertaking. –  adaptr Aug 29 '12 at 13:54

4 Answers 4

mynetworks must only contain trusted users that can use the server to relay mails to other domains - otherwise, as you've found, it's an open relay. You might want to set it to 192.168.0.0/16, 10/8 or 172.16.0.0/12 if using RFC 1918 addresses on your internal network.

The settings that control whether people can send mail to your server include mydestination and virtual_mailbox_domains - read the docs here or here.

share|improve this answer
    
mydestination, relay_domains, and virtual_[alias|mailbox]_maps. NOT virtual_[alias|mailbox]_DOMAINS. –  adaptr Aug 29 '12 at 13:49

The problem that opens you up is the

mynetworks = 0.0.0.0/0

Cause somewhere below you probably have it listed in

smtpd_recipient_restrictions = ... permit_mynetworks ...

If you need to be able to send email from any ip then you just look at enabled a user/password to send email which the common one is sasl

share|improve this answer

As documented at http://www.postfix.org/postconf.5.html#mynetworks :

mynetworks (default: see "postconf -d" output)
The list of "trusted" remote SMTP clients that have more privileges than "strangers".

In particular, "trusted" SMTP clients are allowed to relay mail through Postfix.
See the smtpd_recipient_restrictions parameter description in the postconf(5) manual.

share|improve this answer

use authentification only for yours ip: main.cf

smtpd_recipient_restrictions =
    permit_mynetworks
    reject_unauth_destination

use file to store your ip main.cf:

mynetworks = hash:/etc/postfix/network_table 

Use script to update your ip if change (run in cron)

#!/bin/bash
###
## sh /sx_sys/postfix_mynetwork_ip_checker.sh
LOGFILE="/var/log/smtp_relay.log"

curent_ip=$(dig @exemple.com exemple.com | awk '/^;; ANSWER SECTION:$/ { getline ; print $5 }')
#echo $curent_ip

saved_ip=$(</etc/postfix/network_table )
#echo $saved_ip
if [ "$curent_ip OK" != "$saved_ip" && -n "$curent_ip"]; then
echo "$curent_ip OK" > "/etc/postfix/network_table"
postmap /etc/postfix/network_table
echo "$(date) smtp allow for $curent_ip" >> $LOGFILE 2>&1
mail -s "smtp allow for $curent_ip $(date)" s2@myserv.exemple.com < /dev/null
fi
exit 0
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.