0

I am using iRedMail 0.8.6 for a e-mail implementation. Now the following problem came up:

It is not possible to send a mail through telnet from an existing mail account whithout being logged in. But if there is an alias (used as a forward address) without an existing mail account, it is possible to send a mail from this alisas through telnet without being logged in.

Now my question is, if it is possible to prevent this behaving through config. Or do I have to create disabled mail-accounts for each alias which is used to relay to another address.

Here's my config:

queue_directory = /var/spool/postfix

smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no

append_dot_mydomain = no
readme_directory = no

# TLS parameters
smtpd_tls_cert_file = /etc/ssl/certs/mail.pem
smtpd_tls_key_file = /etc/ssl/private/mail.key
smtpd_use_tls=yes
smtp_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

myhostname = foo.bar.de
alias_maps = hash:/etc/postfix/aliases
alias_database = hash:/etc/postfix/aliases
myorigin = foo.bar.de
mydestination = $myhostname, localhost, localhost.localdomain, localhost.$myhostname
relayhost = 
mynetworks = 127.0.0.0/8
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = 111.22.3.44
#inet_protocols = all
inet_protocols = ipv4
virtual_alias_domains = 
allow_percent_hack = no
swap_bangpath = no
mydomain = foo.de
mynetworks_style = host
smtpd_data_restrictions = reject_unauth_pipelining
smtpd_reject_unlisted_recipient = yes
smtpd_reject_unlisted_sender = yes
smtp_tls_security_level = may
smtp_tls_CAfile = $smtpd_tls_CAfile
smtpd_sender_restrictions = permit_mynetworks, reject_sender_login_mismatch, permit_sasl_authenticated
delay_warning_time = 0h
maximal_queue_lifetime = 4h
bounce_queue_lifetime = 4h
proxy_read_maps = $canonical_maps $lmtp_generic_maps $local_recipient_maps $mydestination $mynetworks $recipient_bcc_maps $recipient_canonical_maps $relay_domains $relay_recipient_maps $relocated_maps $sender_bcc_maps $sender_canonical_maps $smtp_generic_maps $smtpd_sender_login_maps $transport_maps $virtual_alias_domains $virtual_alias_maps $virtual_mailbox_domains $virtual_mailbox_maps $smtpd_sender_restrictions
smtp_data_init_timeout = 240s
smtp_data_xfer_timeout = 600s
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, check_helo_access pcre:/etc/postfix/helo_access.pcre
queue_run_delay = 300s
minimal_backoff_time = 300s
maximal_backoff_time = 4000s
enable_original_recipient = no
disable_vrfy_command = yes
home_mailbox = Maildir/
allow_min_user = no
message_size_limit = 52428800
virtual_minimum_uid = 2000
virtual_uid_maps = static:2000
virtual_gid_maps = static:2000
virtual_mailbox_base = /var/vmail
transport_maps = proxy:mysql:/etc/postfix/mysql/transport_maps_user.cf, proxy:mysql:/etc/postfix/mysql/transport_maps_domain.cf
virtual_mailbox_domains = proxy:mysql:/etc/postfix/mysql/virtual_mailbox_domains.cf
virtual_mailbox_maps = proxy:mysql:/etc/postfix/mysql/virtual_mailbox_maps.cf
virtual_alias_maps = proxy:mysql:/etc/postfix/mysql/virtual_alias_maps.cf, proxy:mysql:/etc/postfix/mysql/domain_alias_maps.cf, proxy:mysql:/etc/postfix/mysql/catchall_maps.cf, proxy:mysql:/etc/postfix/mysql/domain_alias_catchall_maps.cf
sender_bcc_maps = proxy:mysql:/etc/postfix/mysql/sender_bcc_maps_user.cf, proxy:mysql:/etc/postfix/mysql/sender_bcc_maps_domain.cf
recipient_bcc_maps = proxy:mysql:/etc/postfix/mysql/recipient_bcc_maps_user.cf, proxy:mysql:/etc/postfix/mysql/recipient_bcc_maps_domain.cf
relay_domains = $mydestination, proxy:mysql:/etc/postfix/mysql/relay_domains.cf
smtpd_sender_login_maps = proxy:mysql:/etc/postfix/mysql/sender_login_maps.cf
smtpd_sasl_auth_enable = yes
smtpd_sasl_local_domain = 
broken_sasl_auth_clients = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_authenticated_header = no
smtpd_recipient_restrictions = reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_non_fqdn_sender, reject_non_fqdn_recipient, reject_unlisted_recipient, check_policy_service inet:127.0.0.1:7777, check_policy_service inet:127.0.0.1:10031, permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_end_of_data_restrictions = check_policy_service inet:127.0.0.1:10031
smtpd_tls_security_level = may
smtpd_tls_loglevel = 1
smtpd_tls_CAfile = /etc/ssl/StartCom/sub.class1.server.ca.pem
tls_random_source = dev:/dev/urandom
mailbox_command = /usr/lib/dovecot/deliver
virtual_transport = dovecot
dovecot_destination_recipient_limit = 1
smtpd_sasl_type = dovecot
smtpd_sasl_path = dovecot-auth
content_filter = smtp-amavis:[127.0.0.1]:10024
smtp-amavis_destination_recipient_limit = 1
master_service_disable = 
smtpd_relay_restrictions = reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_non_fqdn_sender, reject_non_fqdn_recipient, reject_unlisted_recipient, check_policy_service inet:127.0.0.1:7777, check_policy_service inet:127.0.0.1:10031, permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination

Update

The telnet command I used are:

[email protected]:~# telnet foo.bar.de 25
Trying 111.111.111.111...
Connected to foo.bar.de.
Escape character is '^]'.
220 foo.bar.de ESMTP Postfix (Ubuntu)
> HELO foo.com
250 foo-bar.de
> mail from: foo-bar.de
250 2.1.0 Ok
> rcpt to: [email protected]  #//(same domain as the server)
250 2.1.5 Ok
> data
354 End data with <CR><LF>.<CR><LF>
> subject: test
> test
> .
250 2.0.0 Ok: queued as 4E19C4823FE
> quit
Connection closed by foreign host.

I just realized it only works, when the reciever has the same domain than the postfix server

1 Answer 1

1

Could you please show us the telnet commands used to produce this issue? so that we can reproduce it and fix it.

By the way, iRedMail team offers very active support on the online support forum: http://www.iredmail.org/forum/ it's better to ask for support in the forum.

2
  • I updated my question. I use btw iRedMail 0.8.6 And thank you for you answer aswell. May 2, 2016 at 23:29
  • 1
    You can fix this issue by enabling iRedAPD plugin "reject_sender_login_mismatch", it will check whether sender domain is hosted on localhost, if yes, it will reject email if it's not SASL authenticated. Maybe the iRedAPD release shipped in iRedMail-0.8.6 doesn't have plugin "reject_sender_login_mismatch", you can upgrade iRedAPD first, latest version is iRedAPD-1.8.0. Upgrade tutorials are available here: iredmail.org/docs/iredapd.releases.html By the way, Postfix parameter "smtpd_sender_login_maps" is applied to email sent by authenticated user, so it doesn't work in this case. May 3, 2016 at 5:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .