1
  • I have an Ubuntu 14.04 server at mydomain.com with a bunch of users with @domain in login, like us.er@mydomain.com.
  • Each of them has an "pseudo" account us.er-mydomain.com with the same uid, passwd and shadow entries.
  • Each of them has an entry in /etc/postfix/virtual: us.er@mydomain.com us.er-mydomain.com.

(These users are migrated from Virtualmin on CentOS).

My server rejects mail with an error:

Dec  6 10:27:31 mydomain postfix/smtpd[8176]: NOQUEUE: reject: RCPT from lalala.asdfasdf.com[220.232.206.13]: 554 5.7.1 <us.er@mydomain.com>:
 Relay access denied; from=<asdfasdf@asdfasdf.com> to=<us.er@mydomain.com> proto=ESMTP helo=<lalala@asdfasdf.com>

though it DOES have a us.er@mydomain.com account.

I don't have myhostname or mydomain set. If I set them to my server domain, postmap starts rejecting mail with unknown user: "us.er" message.

What is the best way to fix SMTP receiving? Is there anything very wrong with this setup?

Imap and pop3 work more or less. Configuration dumps are below.

hostname

some-isp-vps

hostname -f

mydomain.com 

postconf -n

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
allow_percent_hack = no
broken_sasl_auth_clients = yes
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/lib/postfix
data_directory = /var/lib/postfix
debug_peer_level = 2
debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5
home_mailbox = Maildir/
html_directory = no
inet_interfaces = all
inet_protocols = all
mail_owner = postfix
mailbox_size_limit = 0
mailq_path = /usr/bin/mailq
manpage_directory = /usr/share/man
message_size_limit = 30485760
milter_default_action = accept
milter_protocol = 2
mydestination = $myhostname, localhost.$mydomain, localhost, vp1.mydomain.com
mynetworks = 192.241.228.147,127.0.0.1
newaliases_path = /usr/bin/newaliases
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-2.6.6/README_FILES
sample_directory = /usr/share/doc/postfix-2.6.6/samples
sender_bcc_maps = hash:/etc/postfix/bcc
sendmail_path = /usr/sbin/sendmail
setgid_group = postdrop
smtp_tls_note_starttls_offer = yes
smtp_tls_security_level = may
smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,permit_auth_destination,reject_unauth_destination
smtpd_relay_restrictions = permit_mynetworks,permit_sasl_authenticated,permit_auth_destination,reject_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_local_domain =
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_tls_auth_only = no
smtpd_tls_cert_file = /etc/ssl/certs/ssl.cert
smtpd_tls_key_file = /etc/ssl/certs/ssl.key
smtpd_tls_loglevel = 1
smtpd_tls_mandatory_ciphers = high
smtpd_tls_received_header = yes
smtpd_tls_security_level = may
tls_random_source = dev:/dev/urandom
unknown_local_recipient_reject_code = 550
virtual_alias_maps = hash:/etc/postfix/virtual

postconf -M

smtp       inet  n       -       n       -       -       smtpd -o smtpd_sasl_auth_enable=yes
smtps      inet  n       -       n       -       -       smtpd -o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes -o smtpd_client_restrictions=permit_sasl_authenticated,reject -o milter_macro_daemon_name=ORIGINATING
pickup     fifo  n       -       n       60      1       pickup
cleanup    unix  n       -       n       -       0       cleanup
qmgr       fifo  n       -       n       300     1       qmgr
tlsmgr     unix  -       -       n       1000?   1       tlsmgr
rewrite    unix  -       -       n       -       -       trivial-rewrite
bounce     unix  -       -       n       -       0       bounce
defer      unix  -       -       n       -       0       bounce
trace      unix  -       -       n       -       0       bounce
verify     unix  -       -       n       -       1       verify
flush      unix  n       -       n       1000?   0       flush
proxymap   unix  -       -       n       -       -       proxymap
proxywrite unix  -       -       n       -       1       proxymap
smtp       unix  -       -       n       -       -       smtp
relay      unix  -       -       n       -       -       smtp -o smtp_fallback_relay=
showq      unix  n       -       n       -       -       showq
error      unix  -       -       n       -       -       error
retry      unix  -       -       n       -       -       error
discard    unix  -       -       n       -       -       discard
local      unix  -       n       n       -       -       local
virtual    unix  -       n       n       -       -       virtual
lmtp       unix  -       -       n       -       -       lmtp
anvil      unix  -       -       n       -       1       anvil
scache     unix  -       -       n       -       1       scache
submission inet  n       -       n       -       -       smtpd -o smtpd_sasl_auth_enable=yes
  • 1
    Postfix can't help you. Authentication is passed to SASL server. You can set MUA to authentication with us.er-mydomain.com. – Reinaldo Gil Dec 6 '14 at 21:39
  • 2
    Postfix refused relay to mydomain.com because isn't listed as local or virtual domain. The first step is define the domain class (postfix.org/ADDRESS_CLASS_README.html). myhostname is the machine name. mydestination is a list with domains hosted and users listed on passwd. – Reinaldo Gil Dec 6 '14 at 21:49
  • Thanks a lot! That's already a good answer, can you please post it? MUA authorization works, what doesn't is receiving mail from other hosts. – Victor Sergienko Dec 6 '14 at 21:50
3

Postfix refused relay to mydomain.com because isn't listed as local or virtual domain. The first step is define the domain class (postfix.org/ADDRESS_CLASS_README.html). myhostname is the machine name. mydestination is a list with domains hosted and users listed on passwd.

  • Making it a virtual domain actually helped! Thanks a lot! For future readers: in /etc/postfix/virtual I added virtual_alias_domains = mydomain.com and ran postmap /etc/postfix/virtual ; service postfix restart. – Victor Sergienko Dec 12 '14 at 12:44
2

Your postfix smtpd process is complaining with a:

<us.er@mydomain.com>: Relay access denied

because:

  1. mydomain.com is not configured/recognized as a local final destination;

and

  1. postfix is not configured to relay messages to an external mydomain.com domain;

So, being unable to deliver both localy (as for point 1) and remotely (as for point 2), it gives out the "Relay access denied" error you're facing with.

Based on your configuration, your problem is point 1: you want your postfix to be the final destination for mydomain.com domain, but postfix... still don't know this. You have two way to solve this:

  • A) mydestination directive: "...The list of domains that are delivered via the $local_transport mail delivery transport....". Unfortunatly, your configuration set it with:

    mydestination = $myhostname, localhost.$mydomain, localhost, vp1.mydomain.com

without including $mydomain alone;

  • B) virtual_mailbox_domains directive: "...Postfix is final destination for the specified list of domains; mail is delivered via the $virtual_transport mail delivery transport....". (BTW: your config contains a virtual_alias_maps directive that is surely related to virtual domain hosting, but probably you haven't initially properly configured the referenced /etc/postfix/virtual file)

A very important note: you've to carefully choose if including your hosted domain in "mydestination" or "virtual_mailbox_domain" as it can have serious security implications, in terms of the unix-accounts you might be forced to create locally on your machine. In your message you wrote:

"...Each of them has an "pseudo" account us.er-mydomain.com with the same uid, passwd and shadow entries...."

so your clearly referenced /etc/passwd and /etc/shadow. Hence they are REAL accounts!

In general, if you choose the "mydestination" route, you're mostly forced to have REAL accounts associated to each of the mailboxes you're hosting. This could not be a serious problem in case you're hosting only your very own single domain.

On the contrary, it can quickly became a nightmare when you're hosting SEVERAL domains. In this case, you're probably offering your users only the e-mail service and... setting a real unix account for each of them is definitly too-much.

That's why since Postfix 2.0 the virtual_mailbox_domains have been added.

In the end: you have already solved your problem, adding your domain to the virtual domain list. This is OK. But this setup does not need real-unix-accounts to be defined.

A very clear example I suggest you to check is this: Postfix virtual MAILBOX example: separate domains, non-UNIX accounts

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.