0

I'm on Centos 6.5 with Postfix/Dovecot and some virtual domains.

Postfix works fine, but I've got a lot of messages like this "NOQUEUE: reject: RCPT from 1-160-127-12.dynamic.hinet.net[1.160.127.12]: 454 4.7.1 : Relay access denied; from= to= proto=SMTP" in my maillog.

I've tried to close port 25 with iptables, when I do so - I got no such messages, but my mail system starts work incorrectly and can't receive mail from other hosts.

Please help!

My postconf -n:

    alias_database = $alias_maps
    alias_maps = hash:/etc/postfix/aliases
    broken_sasl_auth_clients = yes
    command_directory = /usr/sbin
    config_directory = /etc/postfix
    daemon_directory = /usr/libexec/postfix
    data_directory = /var/lib/postfix
    debug_peer_level = 2
    html_directory = no
    inet_interfaces = all
    inet_protocols = ipv4
    mail_owner = postfix
    mailq_path = /usr/bin/mailq.postfix
    manpage_directory = /usr/share/man
    message_size_limit = 20971520
    mydestination = localhost.$mydomain, localhost
    newaliases_path = /usr/bin/newaliases.postfix
    queue_directory = /var/spool/postfix
    readme_directory = /usr/share/doc/postfix-2.6.6/README_FILES
    relay_domains = *
    sample_directory = /usr/share/doc/postfix-2.6.6/samples
    sendmail_path = /usr/sbin/sendmail.postfix
    setgid_group = postdrop
    smtp_tls_cert_file = /etc/pki/tls/certs/example.com.crt
    smtp_tls_key_file = /etc/pki/tls/private/example.com.key
    smtp_tls_loglevel = 1
    smtp_tls_session_cache_database = btree:/etc/postfix/smtp_tls_session_cache
    smtp_tls_session_cache_timeout = 3600s
    smtp_use_tls = yes
    smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
    smtpd_sasl_auth_enable = yes
    smtpd_sasl_local_domain = example.com
    smtpd_sasl_path = /var/run/dovecot/auth-client
    smtpd_sasl_security_options = noanonymous
    smtpd_sasl_tls_security_options = $smtpd_sasl_security_options
    smtpd_sasl_type = dovecot
    smtpd_tls_cert_file = /etc/pki/tls/certs/example.com.crt
    smtpd_tls_key_file = /etc/pki/tls/private/example.com.key
    smtpd_tls_loglevel = 1
    smtpd_tls_received_header = yes
    smtpd_tls_session_cache_database = btree:/etc/postfix/smtpd_tls_session_cache
    smtpd_tls_session_cache_timeout = 3600s
    smtpd_use_tls = yes
    soft_bounce = yes
    tls_random_source = dev:/dev/urandom
    unknown_local_recipient_reject_code = 550
    virtual_alias_maps = hash:/etc/postfix/vmail_aliases
    virtual_gid_maps = static:2222
    virtual_mailbox_base = /var/vmail
    virtual_mailbox_domains = hash:/etc/postfix/vmail_domains
    virtual_mailbox_maps = hash:/etc/postfix/vmail_mailbox
    virtual_minimum_uid = 2222
    virtual_transport = virtual
    virtual_uid_maps = static:2222

Please help! Will attach master.cf or anything other if needed.

  • What is the purpose of this SMTP server. Receiving mail for your domain? sending mail outbound to other domains for clients in your network? – dmansfield Jun 9 '14 at 21:47
  • In general: there are some websites on this server. Each has own virtual mailboxes. So the mission is to receive mail for all mailboxes on all domains of this server and to send emails from registered virtual mailboxes. – tester3 Jun 9 '14 at 22:42
1

relay_domains should be the names you receive mail for. The "outside world" will connect to your server (according to DNS MX records) and send mail for those domains. Bad people will try to connect the same way, but try to send email to random other domains, they will be rejected and you will see the log message you see above. It's perfectly normal.

However, I don't like that your relay_domains is set to '*'. This is bad, put it back to the default (or comment it out) which is $mydestination, and make sure "mydestination" is set properly.

To allow "your" clients to connect (to send outgoing mail to other people's domains), check the smtpd_recipient_restrictions (which looks ok above), which basically says, people on "your" network, or clients that have authenticated can send to any outside domain.

But I don't see "mynetworks" is set up at all, so unless your outgoing mail clients are authenticated they won't be able to send. You probably want to set up "mynetworks".

  • I understand about bad people, and I also see that my config blocks their tries. But I've got huge logs because of them. Can I disable logging of this situation? – tester3 Jun 10 '14 at 20:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.