3

In 2008 I set up a simple mail server (running ubuntu 8.04 LTS) to allow local automation controllers to send email alarms without limits. I used to use gmx, but found that if an account had a ton of alarms, which indicates a problem, that gmx would block it. I set up postfix and got it working. I then needed to be able to allow this type of controller to send alarms from remote sites. I set up firewall rules to my static IP address and all is well.

Now, I have installed a new server, running ubuntu 12.04, doing the exact same thing as before. Local controllers can connect to the server and send emails just fine. However, when the remote controllers try to connect, I see the following in /var/log/mail.log :

Aug 23 16:21:24 localhost postfix/smtpd[6709]: NOQUEUE: reject: RCPT from unknown[xx.xx.xx.xx]: 554 5.7.1 : Relay access denied; from= to= proto=ESMTP helo=

I found that editing a particular line in /etc/postfix/main.cf allows individual remote IP addresses to connect and send mail:

mynetworks = 127.0.0.0/8,10.102.0.0/16,xx.xx.xx.xx/32

where xx.xx.xx.xx is the static IP address of the remote location. I compared configuration files between the old server and the new server, and they're basically identical. Does anyone know how to get it to work like it did before?

  • Do you just list the static IP (xx.xx.xx.xx) for mynetworks, or is it xx.xx.xx.xx/32 (notice the /32)? – KJ-SRS Aug 24 '12 at 18:25
  • I do have the cidr notation for the extra network. when I xx'd it out I deleted the /32. – senorsmile Aug 24 '12 at 19:44
2

"Basically the same" is not the same as "the same." :)

You need to list the authorized IP addresses in mynetworks and tell Postfix to authorize them:

smtpd_recipient_restrictions =
        permit_mynetworks,
  • What I mean by basically the same is that there seem to be some default options that I had never touched in both versions that didn't appear in the other. So, while I didn't have to specify authorized remote public I.P. addresses in postfix on Ubuntu 8.04, I do now have to do that on 12.04? What if the remote client doesn't have a static Public I.P. address? – senorsmile Aug 24 '12 at 20:19
0

Check the virtual file for postfix.

/etc/postfix/virtual:
#            virtual-alias.domain     anything (right-hand content does not matter)
#            postmaster@virtual-alias.domain  postmaster
#            user1@virtual-alias.domain       address1
#            user2@virtual-alias.domain       address2, address3
#
#        The  virtual-alias.domain anything entry is required for a
#        virtual alias domain. Without this entry, mail is rejected
#        with  "relay  access  denied", or bounces with "mail loops
#        back to myself".
  • I added the file /etc/postfix/virtual. I tried setting it up with the line virtual-alias.domain anything, as well as with a specific hostname.mydomain.net, where that name actually resolves to something in our public DNS records. Same error each time. – senorsmile Aug 24 '12 at 20:00
0

So, to fix the problem, SASL had to be set up properly along with the certs. I followed this guide almost exactly and got everything working:

https://help.ubuntu.com/12.04/serverguide/postfix.html.

What threw me off is that I didn't need it on 8.04. Clearly a security upgrade in postfix.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.