2

I have setup Postfix but am having trouble with the setup.

Whenever I used to send emails to the server, it reject my mails saying 'Relaying Denied', so I changed the following in main.cf:

mynetworks = 0.0.0.0/0
mynetworks_style = subnet

I can now send email and it works, but MX tests say that it is an open relay (obviously unintended).

How can I resolve this? I obviously want anybody to be able to email my domain, but I'm unsure of the configuration.

I know I can change the mynetworks, but then doesn't this restrict who CAN email to the server?

  • Are you trying to relay mail through this server, or to deliver mail to this server? – nickgrim Aug 29 '12 at 13:22
  • Makes no difference with respect to this issue, since an open relay is an open relay. Email is not a trivial undertaking. – adaptr Aug 29 '12 at 13:54
4

mynetworks must only contain trusted users that can use the server to relay mails to other domains - otherwise, as you've found, it's an open relay. You might want to set it to 192.168.0.0/16, 10/8 or 172.16.0.0/12 if using RFC 1918 addresses on your internal network.

The settings that control whether people can send mail to your server include mydestination and virtual_mailbox_domains - read the docs here or here.

  • mydestination, relay_domains, and virtual_[alias|mailbox]_maps. NOT virtual_[alias|mailbox]_DOMAINS. – adaptr Aug 29 '12 at 13:49
4

The problem that opens you up is the

mynetworks = 0.0.0.0/0

Cause somewhere below you probably have it listed in

smtpd_recipient_restrictions = ... permit_mynetworks ...

If you need to be able to send email from any ip then you just look at enabled a user/password to send email which the common one is sasl

2

As documented at http://www.postfix.org/postconf.5.html#mynetworks :

mynetworks (default: see "postconf -d" output)
The list of "trusted" remote SMTP clients that have more privileges than "strangers".

In particular, "trusted" SMTP clients are allowed to relay mail through Postfix.
See the smtpd_recipient_restrictions parameter description in the postconf(5) manual.

0

use authentification only for yours ip: main.cf

smtpd_recipient_restrictions =
    permit_mynetworks
    reject_unauth_destination

use file to store your ip main.cf:

mynetworks = hash:/etc/postfix/network_table 

Use script to update your ip if change (run in cron)

#!/bin/bash
###
## sh /sx_sys/postfix_mynetwork_ip_checker.sh
LOGFILE="/var/log/smtp_relay.log"

curent_ip=$(dig @exemple.com exemple.com | awk '/^;; ANSWER SECTION:$/ { getline ; print $5 }')
#echo $curent_ip

saved_ip=$(</etc/postfix/network_table )
#echo $saved_ip
if [ "$curent_ip OK" != "$saved_ip" && -n "$curent_ip"]; then
echo "$curent_ip OK" > "/etc/postfix/network_table"
postmap /etc/postfix/network_table
echo "$(date) smtp allow for $curent_ip" >> $LOGFILE 2>&1
mail -s "smtp allow for $curent_ip $(date)" s2@myserv.exemple.com < /dev/null
fi
exit 0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.