block your own domain in postfix sending mails via telnet HELO

Question

On my postfix/courier debian 9 server I can send mails via telnet with the result

 250 2.1.0 Ok

Now I try to block users from sending mails via telnet HELO comand using my own domain without authentification.

I added this in my postfix main.cf:

smtpd_helo_restrictions =
    permit_sasl_authenticated,
    permit_mynetworks,
    check_helo_access hash:/etc/postfix/check_helo_access,
    ...

This is my file /etc/postfix/check_helo_access:

/mydomain\.de$/                 550 Forged HELO/EHLO command

Now this kind of works, but when I try to send email via telnet it is blocked, but I get the error:

451 4.3.5 <mydomain.de>: Helo command rejected: Server configuration error

I also tried settin just this in /etc/postfix/check_helo_access:

mydomain.de REJECT

resulting in the same errormessage. The same error, if I set the option in smtpd_recipient_restrictions instead of smtpd_helo_restrictions.

How do I configure this right, so I get a sound error message in telnet? Or is this the correct way and the error message is just misleading?

Answer 1

You are mixing two different Postfix lookup table types:

• hash

  An indexed file type based on hashing. This is available only on systems with support for Berkeley DB databases. Public database files are created with the postmap(1) or postalias(1) command, and private databases are maintained by Postfix daemons. The database name as used in hash:table is the database file name without the .db suffix.

• pcre (read-only)

  A lookup table based on Perl Compatible Regular Expressions. The file format is described in pcre_table(5). The lookup table name as used in pcre:table is the name of the regular expression file.

• If you wish to use

  /example\.com$/   550   Forged HELO/EHLO command
  

  you need

  check_helo_access pcre:/etc/postfix/check_helo_access
  

  and have the Postfix built with PCRE support. In Debian 9, you'd need the postfix-pcre.

• With

  check_helo_access hash:/etc/postfix/check_helo_access
  

  you must use the format

  example.com   550   Forged HELO/EHLO command
  

  and remember to perform postmap /etc/postfix/check_helo_access after modifications.

As an additional hint, you could fire all HELO, sender and recipient restrictions after the full HELO, MAIL FROM & RCPT TO sequence by putting them all into smtpd_recipient_restrictions. This way you won't lose information on who was trying to send mail to whom, as you would if you reject the mail right after the HELO. This just makes the debugging and the forensics a lot easier.