OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Chip Olson (ceoshore.net)
Date: Wed Feb 06 2002 - 13:16:38 CST

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    Hi;

    I have Postfix set up with procmail as a local delivery agent, with
    postmaster etc. aliases pointing to root and a root alias pointing to
    me. Mail to regular users works fine, but mail to root was seeming to
    fall into a black hole, until I found it in /var/spool/mail/nobody.
    According to the log, Postfix received the mesage just fine and passed
    it off to procmail, still as user root. What horribly obvious thing am
    I missing? An exerpt from my maillog file follows, along with my main.cf
    and aliases files.

    Excerpt from log file:

    Feb 6 14:59:57 sherlock postfix/smtpd[17577]: connect from poseidon.shore.net[207.244.124.88]
    Feb 6 14:59:57 sherlock postfix/smtpd[17577]: D7BA15C004: client=poseidon.shore.net[207.244.124.88]
    Feb 6 14:59:57 sherlock postfix/cleanup[17578]: D7BA15C004: message-id=<20020206135941.K21993shore.net>
    Feb 6 14:59:58 sherlock postfix/qmgr[13274]: D7BA15C004: from=<ceoprimushost.com>, size=1049, nrcpt=1 (queue active)
    Feb 6 14:59:58 sherlock postfix/local[17579]: warning: dict_nis_init: NIS domain name not set - NIS lookups disabled
    Feb 6 14:59:58 sherlock postfix/local[17579]: D7BA15C004: to=<rootthsi.org>, relay=local, delay=1, status=sent ("|/usr/bin/procmail")
    Feb 6 14:59:58 sherlock postfix/smtpd[17577]: disconnect from poseidon.shore.net[207.244.124.88]

    /etc/postfix/main.cf:

    # Global Postfix configuration file. This file lists only a subset
    # of all 100+ parameters. See the sample-xxx.cf files for a full list.
    #
    # The general format is lines with parameter = value pairs. Lines
    # that begin with whitespace continue the previous line. A value can
    # contain references to other $names or ${name}s.
    #
    # NOTE - CHANGE NO MORE THAN 2-3 PARAMETERS AT A TIME, AND TEST IF
    # POSTFIX STILL WORKS AFTER EVERY CHANGE.

    # SOFT BOUNCE
    #
    # The soft_bounce parameter provides a limited safety net for
    # testing. When soft_bounce is enabled, mail will remain queued that
    # would otherwise bounce. This parameter disables locally-generated
    # bounces, and prevents the SMTP server from rejecting mail permanently
    # (by changing 5xx replies into 4xx replies). However, soft_bounce
    # is no cure for address rewriting mistakes or mail routing mistakes.
    #
    #soft_bounce = no

    # LOCAL PATHNAME INFORMATION
    #
    # The queue_directory specifies the location of the Postfix queue.
    # This is also the root directory of Postfix daemons that run chrooted.
    # See the files in examples/chroot-setup for setting up Postfix chroot
    # environments on different UNIX systems.
    #
    queue_directory = /var/spool/postfix

    # The command_directory parameter specifies the location of all
    # postXXX commands. The default value is $program_directory.
    #
    command_directory = /usr/sbin

    # The daemon_directory parameter specifies the location of all Postfix
    # daemon programs (i.e. programs listed in the master.cf file). The
    # default value is $program_directory. This directory must be owned
    # by root.
    #
    daemon_directory = /usr/libexec/postfix

    # QUEUE AND PROCESS OWNERSHIP
    #
    # The mail_owner parameter specifies the owner of the Postfix queue
    # and of most Postfix daemon processes. Specify the name of a user
    # account THAT DOES NOT SHARE ITS USER OR GROUP ID WITH OTHER ACCOUNTS
    # AND THAT OWNS NO OTHER FILES OR PROCESSES ON THE SYSTEM. In
    # particular, don't specify nobody or daemon. PLEASE USE A DEDICATED
    # USER.
    #
    mail_owner = postfix

    # The default_privs parameter specifies the default rights used by
    # the local delivery agent for delivery to external file or command.
    # These rights are used in the absence of a recipient user context.
    # DO NOT SPECIFY A PRIVILEGED USER OR THE POSTFIX OWNER.
    #
    #default_privs = nobody

    # INTERNET HOST AND DOMAIN NAMES
    #
    # The myhostname parameter specifies the internet hostname of this
    # mail system. The default is to use the fully-qualified domain name
    # from gethostname(). $myhostname is used as a default value for many
    # other configuration parameters.
    #
    myhostname = sherlock.thsi.org
    #myhostname = virtual.domain.name

    # The mydomain parameter specifies the local internet domain name.
    # The default is to use $myhostname minus the first component.
    # $mydomain is used as a default value for many other configuration
    # parameters.
    #
    mydomain = thsi.org

    # SENDING MAIL
    #
    # The myorigin parameter specifies the domain that locally-posted
    # mail appears to come from. The default is to append $myhostname,
    # which is fine for small sites. If you run a domain with multiple
    # machines, you should (1) change this to $mydomain and (2) set up
    # a domain-wide alias database that aliases each user to
    # userthat.users.mailhost.
    #
    #myorigin = $myhostname
    myorigin = $mydomain

    # RECEIVING MAIL

    # The inet_interfaces parameter specifies the network interface
    # addresses that this mail system receives mail on. By default,
    # the software claims all active interfaces on the machine. The
    # parameter also controls delivery of mail to user[ip.address].
    #
    #inet_interfaces = all
    #inet_interfaces = $myhostname
    inet_interfaces = $myhostname, localhost

    # The mydestination parameter specifies the list of domains that this
    # machine considers itself the final destination for. That includes
    # Sendmail-style virtual domains hosted on this machine.
    #
    # Do not include Postfix-style virtual domains - those domains are
    # specified elsewhere (see sample-virtual.cf, and sample-transport.cf).
    #
    # The default is $myhostname + localhost.$mydomain. On a mail domain
    # gateway, you should also include $mydomain. Do not specify the
    # names of domains that this machine is backup MX host for. Specify
    # those names via the relay_domains or permit_mx_backup settings for
    # the SMTP server (see sample-smtpd.cf).
    #
    # The local machine is always the final destination for mail addressed
    # to user[the.net.work.address] of an interface that the mail system
    # receives mail on (see the inet_interfaces parameter).
    #
    # Specify a list of host or domain names, /file/name or type:table
    # patterns, separated by commas and/or whitespace. A /file/name
    # pattern is replaced by its contents; a type:table is matched when
    # a name matches a lookup key. Continue long lines by starting the
    # next line with whitespace.
    #
    #mydestination = $myhostname, localhost.$mydomain
    mydestination = $myhostname, localhost.$mydomain, $mydomain
    #mydestination = $myhostname, localhost.$mydomain, $mydomain,
    # mail.$mydomain, www.$mydomain, ftp.$mydomain

    # TRUST AND RELAY CONTROL

    # The mynetworks parameter specifies the list of "trusted" SMTP
    # clients that have more privileges than "strangers".
    #
    # In particular, "trusted" SMTP clients are allowed to relay mail
    # through Postfix. See the smtpd_recipient_restrictions parameter
    # in file sample-smtpd.cf.
    #
    # You can specify the list of "trusted" network addresses by hand
    # or you can let Postfix do it for you (which is the default).
    #
    # By default (mynetworks_style = subnet), Postfix "trusts" SMTP
    # clients in the same IP subnetworks as the local machine.
    # On Linux, this does works correctly only with interfaces specified
    # with the "ifconfig" command.
    #
    # Specify "mynetworks_style = class" when Postfix should "trust" SMTP
    # clients in the same IP class A/B/C networks as the local machine.
    # Don't do this with a dialup site - it would cause Postfix to "trust"
    # your entire provider's network. Instead, specify an explicit
    # mynetworks list by hand, as described below.
    #
    # Specify "mynetworks_style = host" when Postfix should "trust"
    # only the local machine.
    #
    #mynetworks_style = class
    mynetworks_style = subnet
    #mynetworks_style = host

    # Alternatively, you can specify the mynetworks list by hand, in
    # which case Postfix ignores the mynetworks_style setting.
    #
    # Specify an explicit list of network/netmask patterns, where the
    # mask specifies the number of bits in the network part of a host
    # address.
    #
    # You can also specify the absolute pathname of a pattern file instead
    # of listing the patterns here. Specify type:table for table-based lookups
    # (the value on the table right-hand side is not used).
    #
    #mynetworks = 168.100.189.0/28, 127.0.0.0/8
    #mynetworks = $config_directory/mynetworks
    #mynetworks = hash:/etc/postfix/network_table

    # The relay_domains parameter restricts what clients this mail system
    # will relay mail from, or what destinations this system will relay
    # mail to. See the smtpd_recipient_restrictions restriction in the
    # file sample-smtpd.cf for detailed information.
    #
    # By default, Postfix relays mail
    # - from "trusted" clients whose IP address matches $mynetworks,
    # - from "trusted" clients matching $relay_domains or subdomains thereof,
    # - from untrusted clients to destinations that match $relay_domains
    # or subdomains thereof, except addresses with sender-specified routing.
    # The default relay_domains value is $mydestination.
    #
    # In addition to the above, the Postfix SMTP server by default accepts mail
    # that Postfix is final destination for:
    # - destinations that match $inet_interfaces,
    # - destinations that match $mydestination
    # - destinations that match $virtual_maps.
    # These destinations do not need to be listed in $relay_domains.
    #
    # Specify a list of hosts or domains, /file/name patterns or type:name
    # lookup tables, separated by commas and/or whitespace. Continue
    # long lines by starting the next line with whitespace. A file name
    # is replaced by its contents; a type:name table is matched when a
    # (parent) domain appears as lookup key.
    #
    # NOTE: Postfix will not automatically forward mail for domains that
    # list this system as their primary or backup MX host. See the
    # permit_mx_backup restriction in the file sample-smtpd.cf.
    #
    #relay_domains = $mydestination

    # INTERNET OR INTRANET

    # The relayhost parameter specifies the default host to send mail to
    # when no entry is matched in the optional transport(5) table. When
    # no relayhost is given, mail is routed directly to the destination.
    #
    # On an intranet, specify the organizational domain name. If your
    # internal DNS uses no MX records, specify the name of the intranet
    # gateway host instead.
    #
    # In the case of SMTP, specify a domain, host, host:port, [host]:port,
    # [address] or [address]:port; the form [host] turns off MX lookups.
    #
    # If you're connected via UUCP, see also the default_transport parameter.
    #
    #relayhost = $mydomain
    #relayhost = gateway.my.domain
    #relayhost = uucphost
    #relayhost = [an.ip.add.ress]

    # REJECTING UNKNOWN LOCAL USERS
    #
    # The local_recipient_maps parameter specifies optional lookup tables
    # with all users that are local with respect to $mydestination and
    # $inet_interfaces. If this parameter is defined, then the SMTP server
    # will reject mail for unknown local users.
    #
    # If you use the default Postfix local delivery agent for local
    # delivery, uncomment the definition below.
    #
    # Beware: if the Postfix SMTP server runs chrooted, you may have to
    # copy the passwd (not shadow) database into the jail. This is
    # system dependent.
    #
    #local_recipient_maps = $alias_maps unix:passwd.byname

    # INPUT RATE CONTROL
    #
    # The in_flow_delay configuration parameter implements mail input
    # flow control. This feature is turned on by default, although it
    # still needs further development (it's disabled on SCO UNIX due
    # to an SCO bug).
    #
    # A Postfix process will pause for $in_flow_delay seconds before
    # accepting a new message, when the message arrival rate exceeds the
    # message delivery rate. With the default 50 SMTP server process
    # limit, this limits the mail inflow to 50 messages a second more
    # than the number of messages delivered per second.
    #
    # Specify 0 to disable the feature. Valid delays are 0..10.
    #
    #in_flow_delay = 1s

    # ADDRESS REWRITING
    #
    # Insert text from sample-rewrite.cf if you need to do address
    # masquerading.
    #
    # Insert text from sample-canonical.cf if you need to do address
    # rewriting, or if you need username->Firstname.Lastname mapping.

    # ADDRESS REDIRECTION (VIRTUAL DOMAIN)
    #
    # Insert text from sample-virtual.cf if you need virtual domain support.

    # "USER HAS MOVED" BOUNCE MESSAGES
    #
    # Insert text from sample-relocated.cf if you need "user has moved"
    # style bounce messages. Alternatively, you can bounce recipients
    # with an SMTP server access table. See sample-smtpd.cf.

    # TRANSPORT MAP
    #
    # Insert text from sample-transport.cf if you need explicit routing.

    # ALIAS DATABASE
    #
    # The alias_maps parameter specifies the list of alias databases used
    # by the local delivery agent. The default list is system dependent.
    # On systems with NIS, the default is to search the local alias
    # database, then the NIS alias database. See aliases(5) for syntax
    # details.
    #
    # If you change the alias database, run "postalias /etc/aliases" (or
    # wherever your system stores the mail alias file), or simply run
    # "newaliases" to build the necessary DBM or DB file.
    #
    # It will take a minute or so before changes become visible. Use
    # "postfix reload" to eliminate the delay.
    #
    #alias_maps = dbm:/etc/aliases
    #alias_maps = hash:/etc/aliases
    #alias_maps = hash:/etc/aliases, nis:mail.aliases
    #alias_maps = netinfo:/aliases

    # The alias_database parameter specifies the alias database(s) that
    # are built with "newaliases" or "sendmail -bi". This is a separate
    # configuration parameter, because alias_maps (see above) may specify
    # tables that are not necessarily all under control by Postfix.
    #
    #alias_database = dbm:/etc/aliases
    #alias_database = dbm:/etc/mail/aliases
    #alias_database = hash:/etc/aliases
    #alias_database = hash:/etc/aliases, hash:/opt/majordomo/aliases

    # ADDRESS EXTENSIONS (e.g., user+foo)
    #
    # The recipient_delimiter parameter specifies the separator between
    # user names and address extensions (user+foo). See canonical(5),
    # local(8), relocated(5) and virtual(5) for the effects this has on
    # aliases, canonical, virtual, relocated and .forward file lookups.
    # Basically, the software tries user+foo and .forward+foo before
    # trying user and .forward.
    #
    #recipient_delimiter = +

    # DELIVERY TO MAILBOX
    #
    # The home_mailbox parameter specifies the optional pathname of a
    # mailbox file relative to a user's home directory. The default
    # mailbox file is /var/spool/mail/user or /var/mail/user. Specify
    # "Maildir/" for qmail-style delivery (the / is required).
    #
    #home_mailbox = Mailbox
    #home_mailbox = Maildir/
     
    # The mail_spool_directory parameter specifies the directory where
    # UNIX-style mailboxes are kept. The default setting depends on the
    # system type.
    #
    #mail_spool_directory = /var/mail
    #mail_spool_directory = /var/spool/mail

    # The mailbox_command parameter specifies the optional external
    # command to use instead of mailbox delivery. The command is run as
    # the recipient with proper HOME, SHELL and LOGNAME environment settings.
    # Exception: delivery for root is done as $default_user.
    #
    # Other environment variables of interest: USER (recipient username),
    # EXTENSION (address extension), DOMAIN (domain part of address),
    # and LOCAL (the address localpart).
    #
    # Unlike other Postfix configuration parameters, the mailbox_command
    # parameter is not subjected to $parameter substitutions. This is to
    # make it easier to specify shell syntax (see example below).
    #
    # Avoid shell meta characters because they will force Postfix to run
    # an expensive shell process. Procmail alone is expensive enough.
    #
    # IF YOU USE THIS TO DELIVER MAIL SYSTEM-WIDE, YOU MUST SET UP AN
    # ALIAS THAT FORWARDS MAIL FOR ROOT TO A REAL USER.
    #
    mailbox_command = /usr/bin/procmail
    #mailbox_command = /some/where/procmail -a "$EXTENSION"

    # The mailbox_transport specifies the optional transport in master.cf
    # to use after processing aliases and .forward files. This parameter
    # has precedence over the mailbox_command, fallback_transport and
    # luser_relay parameters.
    #
    # Specify a string of the form transport:nexthop, where transport is
    # the name of a mail delivery transport defined in master.cf. The
    # :nexthop part is optional. For more details see the sample transport
    # configuration file.
    #
    #mailbox_transport = lmtp:unix:/file/name
    #mailbox_transport = cyrus

    # The fallback_transport specifies the optional transport in master.cf
    # to use for recipients that are not found in the UNIX passwd database.
    # This parameter has precedence over the luser_relay parameter.
    #
    # Specify a string of the form transport:nexthop, where transport is
    # the name of a mail delivery transport defined in master.cf. The
    # :nexthop part is optional. For more details see the sample transport
    # configuration file.
    #
    #fallback_transport = lmtp:unix:/file/name
    #fallback_transport = cyrus
    #fallback_transport =

    # The luser_relay parameter specifies an optional destination address
    # for unknown recipients. By default, mail for unknown local recipients
    # is bounced.
    #
    # The following expansions are done on luser_relay: $user (recipient
    # username), $shell (recipient shell), $home (recipient home directory),
    # $recipient (full recipient address), $extension (recipient address
    # extension), $domain (recipient domain), $local (entire recipient
    # localpart), $recipient_delimiter. Specify ${name?value} or
    # ${name:value} to expand value only when $name does (does not) exist.
    #
    # luser_relay works only for the default Postfix local delivery agent.
    #
    #luser_relay = $userother.host
    #luser_relay = $localother.host
    #luser_relay = admin+$local
      
    # JUNK MAIL CONTROLS
    #
    # The controls listed here are only a very small subset. See the file
    # sample-smtpd.cf for an elaborate list of anti-UCE controls.

    # The header_checks parameter specifies an optional table with patterns
    # that each logical message header is matched against, including
    # headers that span multiple physical lines. Patterns are matched
    # in the specified order, and the search stops upon the first match.
    # When a pattern matches, what happens next depends on the associated
    # action that is specified in the right-hand side of the table:
    #
    # REJECT the entire message is rejected.
    # REJECT text.... The text is sent to the originator.
    # IGNORE the header line is silently discarded.
    # WARN the header is logged (not rejected) with a warning message.
    #
    # These patterns do not apply to MIME headers in the message body.
    #
    # See also the body_checks example in the sample-filter.cf file.
    #
    #header_checks = regexp:/etc/postfix/header_checks

    # FAST ETRN SERVICE
    #
    # Postfix maintains per-destination logfiles with information about
    # deferred mail, so that mail can be flushed quickly with the SMTP
    # "ETRN domain.name" command, or by executing "sendmail -qRdomain.name".
    #
    # By default, Postfix maintains deferred mail logfile information
    # only for destinations that Postfix is willing to relay to (as
    # specified in the relay_domains parameter). For other destinations,
    # Postfix attempts to deliver ALL queued mail after receiving the
    # SMTP "ETRN domain.name" command, or after execution of "sendmail
    # -qRdomain.name". This can be slow when a lot of mail is queued.
    #
    # The fast_flush_domains parameter controls what destinations are
    # eligible for this "fast ETRN/sendmail -qR" service.
    #
    #fast_flush_domains = $relay_domains
    #fast_flush_domains =

    # SHOW SOFTWARE VERSION OR NOT
    #
    # The smtpd_banner parameter specifies the text that follows the 220
    # code in the SMTP server's greeting banner. Some people like to see
    # the mail version advertised. By default, Postfix shows no version.
    #
    # You MUST specify $myhostname at the start of the text. That is an
    # RFC requirement. Postfix itself does not care.
    #
    smtpd_banner = $myhostname ESMTP $mail_name
    #smtpd_banner = $myhostname ESMTP $mail_name ($mail_version)

    # PARALLEL DELIVERY TO THE SAME DESTINATION
    #
    # How many parallel deliveries to the same user or domain? With local
    # delivery, it does not make sense to do massively parallel delivery
    # to the same user, because mailbox updates must happen sequentially,
    # and expensive pipelines in .forward files can cause disasters when
    # too many are run at the same time. With SMTP deliveries, 10
    # simultaneous connections to the same domain could be sufficient to
    # raise eyebrows.
    #
    # Each message delivery transport has its XXX_destination_concurrency_limit
    # parameter. The default is $default_destination_concurrency_limit for
    # most delivery transports. For the local delivery agent the default is 2.

    #local_destination_concurrency_limit = 2
    #default_destination_concurrency_limit = 10

    # DEBUGGING CONTROL
    #
    # The debug_peer_level parameter specifies the increment in verbose
    # logging level when an SMTP client or server host name or address
    # matches a pattern in the debug_peer_list parameter.
    #
    debug_peer_level = 2

    # The debug_peer_list parameter specifies an optional list of domain
    # or network patterns, /file/name patterns or type:name tables. When
    # an SMTP client or server host name or address matches a pattern,
    # increase the verbose logging level by the amount specified in the
    # debug_peer_level parameter.
    #
    #debug_peer_list = 127.0.0.1
    #debug_peer_list = some.domain

    # The debugger_command specifies the external command that is executed
    # when a Postfix daemon program is run with the -D option.
    #
    # Use "command .. & sleep 5" so that the debugger can attach before
    # the process marches on. If you use an X-based debugger, be sure to
    # set up your XAUTHORITY environment variable before starting Postfix.
    #
    debugger_command =
             PATH=/usr/bin:/usr/X11R6/bin
             xxgdb $daemon_directory/$process_name $process_id & sleep 5

    # INSTALL-TIME CONFIGURATION INFORMATION
    #
    # The following parameters are used when installing a new Postfix version.
    #
    # sendmail_path: The full pathname of the Postfix sendmail command.
    # This is the Sendmail-compatible mail posting interface.
    #
    sendmail_path = /usr/sbin/sendmail

    # newaliases_path: The full pathname of the Postfix newaliases command.
    # This is the Sendmail-compatible command to build alias databases.
    #
    newaliases_path = /usr/bin/newaliases

    # mailq_path: The full pathname of the Postfix mailq command. This
    # is the Sendmail-compatible mail queue listing command.
    #
    mailq_path = /usr/bin/mailq

    # setgid_group: The group for mail submission and queue management
    # commands. This must be a group name with a numerical group ID that
    # is not shared with other accounts, not even with the Postfix account.
    #
    setgid_group = postdrop

    # manpage_directory: The location of the Postfix on-line manual pages.
    #
    manpage_directory = /usr/local/man

    # sample_directory: The location of the Postfix sample configuration files.
    #
    sample_directory = /etc/postfix

    # readme_directory: The location of the Postfix README files.
    #
    readme_directory = /usr/share/postfic

    /etc/postfix/aliases:

    #
    # Sample aliases file. Install in the location as specified by the
    # output from the command "postconf alias_maps". Typical path names
    # are /etc/aliases or /etc/mail/aliases.
    #
    # >>>>>>>>>> The program "newaliases" must be run after
    # >> NOTE >> this file is updated for any changes to
    # >>>>>>>>>> show through to Postfix.
    #

    # Basic system aliases -- these MUST be present
    MAILER-DAEMON: postmaster
    postmaster: root

    # General redirections for pseudo accounts
    bin: root
    daemon: root
    named: root
    nobody: root
    uucp: root
    www: root
    ftp-bugs: root
    postfix: root

    # Put your local aliases here.

    # Well-known aliases
    manager: root
    dumper: root
    operator: root
    abuse: postmaster

    # trap decode to catch security attacks
    decode: root

    # Person who should get root's mail
    root: ceo

    -- 
    -Chip Olson. | ceo at shore dot net
    "Here comes the sun, doo-doo-doo-doo,
    Here comes the sun, I say, It's all right..."
                                                  -George Harrison 1943-2001.
    

    - To unsubscribe, send mail to majordomopostfix.org with content (not subject): unsubscribe postfix-users