Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have the feeling the answer to this may be obvious but my head is pickled with this. setting up a mail thing on ubuntu 13.04 with postfix,iredmail,mysql and that. Getting this in the logs when I try to send mail

Aug 29 22:40:29 core-01-mail postfix/smtpd[10120]: NOQUEUE: reject: RCPT from AAAAAAAAA.com[199.9.9.9]: 554 5.7.1 : Relay access denied; from= to= proto=ESMTP helo=<[192.168.4.15]>

Here's my telnet sequence

    telnet myserver 25
    Trying myserver...
    Connected to myserver.net
    Escape character is '^]'.
    220 ************************************
    ehlo blah
    250-core-01-mail.myserver.net
    250-PIPELINING
    250-SIZE 15728640
    250-ETRN
    250-XXXXXXXA
    250-AUTH PLAIN LOGIN
    250-AUTH=PLAIN LOGIN
    250-ENHANCEDSTATUSCODES
    250-8BITMIME
    250 DSN
    auth login
    334 VXNlcm5hbWU6
    dGVzdEBqYXlmaXR6c2ltbW9ASDFb20=
    334 UGFzc3dvcmQ6
    dGVzdDE=
    235 2.7.0 Authentication successful
    mail from:<test@mydomain.com>
    250 2.1.0 Ok
    rcpt to:<AAAAAAAAA@gmail.com>
    554 5.7.1 <AAAAAAAA@gmail.com>: Relay access denied[/code]

Everything is fine up until I put the recipient in, I also get a similar error with the mail client. (I can send fine to other domains on the same server though)

As I understand it, it's the smptd recipient restrictions that control who can send out, but I don't see anything wrong with this.

    smtpd_recipient_restrictions = reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_non_fqdn_sender, reject_non_fqdn_recipient, reject_unlisted_recipient, check_policy_service inet:127.0.0.1:7777, check_policy_service inet:127.0.0.1:10031, permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination

Does anyone have any other suggestions?

/edit, here's the complete main.cf

  # See /usr/share/postfix/main.cf.dist for a commented, more complete version
  smtpd_banner = $myhostname ESMTP $mail_name
  biff = no
  # appending .domain is the MUA's job.
  append_dot_mydomain = no
  # Uncomment the next line to generate "delayed mail" warnings
  #delay_warning_time = 4h
  myhostname = core-01-mail.mydomain.net
  alias_maps = hash:/etc/postfix/aliases
  alias_database = hash:/etc/postfix/aliases
  mydestination =  $myhostname, localhost, localhost.localdomain, localhost.$myhostname
  relayhost =
  mynetworks = 127.0.0.0/8
  mailbox_command = /usr/lib/dovecot/deliver
  mailbox_size_limit = 0
  recipient_delimiter = +
  inet_interfaces = all
  # debug_peer_list = all
  ######trying to get send-proxy working
  postscreen_upstream_proxy_protocol = haproxy
  #######
  inet_protocols = ipv4
  virtual_alias_domains =
  myorigin = core-01-mail.mydomain.net
  allow_percent_hack = no
  swap_bangpath = no
  mydomain = mydomain.net
  mynetworks_style = host
  smtpd_data_restrictions = reject_unauth_pipelining
  smtpd_reject_unlisted_recipient = yes
  smtpd_reject_unlisted_sender = yes
  smtpd_sender_restrictions = permit_mynetworks, reject_sender_login_mismatch, permit_sasl_authenticated
  delay_warning_time = 0h
  maximal_queue_lifetime = 4h
  bounce_queue_lifetime = 4h
  proxy_read_maps = $canonical_maps $lmtp_generic_maps $local_recipient_maps $mydestination $mynetworks $recipient_bcc_maps $recipient_canonical_maps $relay_domains $relay_recipient_maps $relocated_maps $sender_bcc_maps $sender_canonical_maps $smtp_generic_maps $smtpd_sender_login_maps $transport_maps $virtual_alias_domains $virtual_alias_maps $virtual_mailbox_domains $virtual_mailbox_maps $smtpd_sender_restrictions
  smtp_data_init_timeout = 240s
  smtp_data_xfer_timeout = 600s
  smtpd_helo_required = yes
  smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, check_helo_access pcre:/etc/postfix/helo_access.pcre
  queue_run_delay = 300s
  minimal_backoff_time = 300s
  maximal_backoff_time = 4000s
  enable_original_recipient = no
  disable_vrfy_command = yes
  home_mailbox = Maildir/
  allow_min_user = no
  message_size_limit = 15728640
  virtual_minimum_uid = 2000
  virtual_uid_maps = static:2000
  virtual_gid_maps = static:2000
  virtual_mailbox_base = /data/vmail
  transport_maps = proxy:mysql:/etc/postfix/mysql/transport_maps_user.cf, proxy:mysql:/etc/postfix/mysql/transport_maps_domain.cf
  virtual_mailbox_domains = proxy:mysql:/etc/postfix/mysql/virtual_mailbox_domains.cf
  virtual_mailbox_maps = proxy:mysql:/etc/postfix/mysql/virtual_mailbox_maps.cf
  virtual_alias_maps = proxy:mysql:/etc/postfix/mysql/virtual_alias_maps.cf, proxy:mysql:/etc/postfix/mysql/domain_alias_maps.cf, proxy:mysql:/etc/postfix/mysql/catchall_maps.cf, proxy:mysql:/etc/postfix/mysql/domain_alias_catchall_maps.cf
  sender_bcc_maps = proxy:mysql:/etc/postfix/mysql/sender_bcc_maps_user.cf, proxy:mysql:/etc/postfix/mysql/sender_bcc_maps_domain.cf
  recipient_bcc_maps = proxy:mysql:/etc/postfix/mysql/recipient_bcc_maps_user.cf, proxy:mysql:/etc/postfix/mysql/recipient_bcc_maps_domain.cf
  relay_domains = $mydestination, proxy:mysql:/etc/postfix/mysql/relay_domains.cf
  smtpd_sender_login_maps = proxy:mysql:/etc/postfix/mysql/sender_login_maps.cf
  smtpd_sasl_auth_enable = yes
  smtpd_sasl_local_domain =
  broken_sasl_auth_clients = yes
  smtpd_sasl_security_options = noanonymous
  smtpd_sasl_authenticated_header = no

  smtpd_recipient_restrictions = reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_non_fqdn_sender, reject_non_fqdn_recipient, reject_unlisted_recipient, check_policy_service inet:127.0.0.1:7777, check_policy_service inet:127.0.0.1:10031, permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
  smtpd_end_of_data_restrictions = check_policy_service inet:127.0.0.1:10031
  smtpd_tls_security_level = may
  smtpd_tls_loglevel = 0
  smtpd_tls_key_file = /etc/ssl/wildcard.mydomain.net/wildcard.mydomain.net.key
  smtpd_tls_cert_file = /etc/ssl/wildcard.mydomain.net/wildcard.mydomain.net.crt
  smtpd_tls_CAfile = /etc/ssl/wildcard.mydomain.net/intermediate-ca.crt
  tls_random_source = dev:/dev/urandom
  virtual_transport = dovecot
  dovecot_destination_recipient_limit = 1
  smtpd_sasl_type = dovecot
  smtpd_sasl_path = ./dovecot-auth
  content_filter = smtp-amavis:[127.0.0.1]:10024
  smtp-amavis_destination_recipient_limit = 1

/edit/edit Hello future peeps, I figured it out (well not me, but this person, bbs.archlinux.org/viewtopic.php?id=158020)

i built this server with postfix 2.9 and had to upgrade to 2.10, so I had to change smtpd_recipient_restrictions = blah blah to smtpd_relay_restrictions = blah blah ffs would it have killed them to include backwards compatibility or at least a "this command is depreceated" warning in the logs?

share|improve this question
    
Could you please provide complete main.cf configuration file? Do you use relaying via another SMTP server with relayhost directive? DO you try to connect from IP 192.168.4.15? Is the server IP 199.9.9.9? –  dsmsk80 Aug 30 '13 at 7:19
    
added main.cf, it just relays straight out, thanks for looking –  vmos Aug 30 '13 at 8:24
    
When you solve your own problem, you should post it as an Answer below, not in the Question. –  Michael Hampton Aug 31 '13 at 16:26
add comment

1 Answer

Try the following one

smtpd_recipient_restrictions = 
 permit_mynetworks, 
 permit_sasl_authenticated,
 reject_unauth_destination,
 reject_unknown_sender_domain, 
 reject_unknown_recipient_domain, 
 reject_non_fqdn_sender, 
 reject_non_fqdn_recipient, 
 reject_unlisted_recipient, 
 check_policy_service inet:127.0.0.1:7777, 
 check_policy_service inet:127.0.0.1:10031

It's a good practice to avoid authenticated users such verification

share|improve this answer
    
Still getting the same error I'm afraid. Also, I've just realised that this "helo=<[192.168.4.15]>" is my local LAN IP. Could that be part of the issue? Then again, maybe not as it does work to stuff on the same server –  vmos Aug 30 '13 at 10:13
    
figured it out. i built this server wit postfix 2.9 and had to upgrade to 2.10, so I had to change smtpd_recipient_restrictions = blah blah to smtpd_relay_restrictions = blah blah ffs with thanks to bbs.archlinux.org/viewtopic.php?id=158020 –  vmos Aug 30 '13 at 17:05
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.