OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: Capture outgoing mail
From: Bennett Todd (betrahul.net)
Date: Sun Sep 17 2000 - 15:14:28 CDT

2000-08-10-00:08:41 Nick Rout:
> I am not sure of the precise difference between
> "receive" and "forward".

Postfix is a Mail Transport Agent. It receives email messages and
disposes of them. Depending on the envelope recipient, and on how
postfix is configured, a given message will either be handed off to
a local delivery agent, or else fed into an appropriate transport.
By default messages whose envelope recipient has a string after the
"" [RHS for Right-Hand-Side] that matches one of the choices in
mydestination, and whose string before the "" [LHS] matches a name
found in /etc/aliases or /etc/passwd, will be locally delivered; if
the RHS is in mydestination but the LHS isn't known, the message
will bounce; if the RHS isn't in mydestination then the message will
be forwarded, via SMTP, to a server found by looking up the RHS in
DNS, with record type MX, or A if no MX is found.

"forwarded" email is simply email that has been received by postfix,
and, after it's received, is found to need remote delivery rather
than local delivery. It might be received via pipe to
/usr/{lib,sbin}/sendmail, it might be received via smtp, it makes no
difference.

> Also I have not been able to find anything in the
> postfix docs about always_bcc.

A quick grep over the docs installed by the postfix RPM that I use
turns it up in HISTORY, RELEASE_NOTES, conf/main.cf.default,
conf/sample-misc.cf, and the man pages cleanup(8), pickup(8), and
smtpd(8).

        rpm -qd postfix|xargs grep always_bcc

rpm makes my life easier:-).

> When I send a message to (say) postfix-userspostfix.org from my windows
> outlook client, it first goes to my postfix smtp server, which then
> communicates with the postfix server (or more accurately, the server pointed
> to by the postfix.org mx record), which then performs whatever further
> transfer or delivery is required.
>
> In this circumstance, does my postfix receive or forward the message?

It receives it, then decides to forward it.

> I thought "receive" implied a final destination?

I suppose it could, but it doesn't strike me that way; a daemon
receives a message or request, then decides how to deal with it.

> However my always_bcc seems to be bcc'ing mail in the
> circumstances I just described, ie when I would have described
> postfix's role as forwarding.

always_bcc sets aside a copy of every message that passes through
postfix in any direction. Each of the man pages that mentions
always_bcc describes it:

        Address to send a copy of each message that enters the
        system.

In the [common] case where you want to keep or scan a copy of all
traffic sent by or related to a specific person, you can pick that
traffic out of the torrent set aside by always_bcc by using procmail
or some other filter on the stream. A good filter [procmail is one]
will be very fast, that's part of the definition of "good" in that
application domain:-).

-Bennett

  • application/pgp-signature attachment: stored