OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: postfix and local users and myorigin

From: Aaron P. Martinez (mlproficuous.com)
Date: Fri Apr 09 2004 - 21:53:06 CDT


On Fri, 2004-04-09 at 20:55, WSUV testaccount wrote:
> date: April 09 2004
> keywords: .forward myorigin local users "myorigin causes local users to be
> forwarded"
>
>
> postfix mail_version = 2.0.19
>
>
> From what I can tell, Postfix is supposed to act (and empirically does)
> like the following...but it seems illogical and at odds with what
> administrators would normally want... am I wrong?
>
> I have a central email server, 'mail.test.edu', which receives all
> incoming email to our domain "test.edu" and distributes email to students
> on another email server 'student.test.edu' via entries in mail.test.edu's
> aliases file.
>
> postfix uses $myorigin=test.edu on student.test.edu so when users on
> student.test.edu send email, it is sent looking as if it was sent from
> test.domain rather then student.test.edu. Which is what you'd want,
> because recipients then see only one common domain return address.
>
> Seems to me, a completely standard scenario.
>
> I would then expect (but I'd be wrong) that if I was sending email on
> student.test.edu to 'joe' that it would be delivered directly to the local
> 'joe' account without leaving the system, and if joe was not local, it
> would then expand to joetest.edu
>
> However Postfix will use the 'myorigin' parameter to expand user email
> names that are not fully qualified to be:
> user$mydomain, in my case, usertest.edu
>
> This sends email that is meant for local users back to the central server,
> which then sends it right back to student.test.edu because of the alias
> file redirection.
>
> This has 2 undesireable effects:
> 1. processing that could be done locally, is instead done remotely, adding
> to the burden of the central server.
>
> 2. .forward files in student.test.edu email accounts must make sure that
> they put in entries that use fully qualifed email addresses as in:
> joeremoteaddress.com, \joestudent.test.edu
>
> using an entry in a .forward file like:
> joeremoteaddress.com, \joe
> will cause an email loop to occur as the email message that should be
> stored locally is instead sent back to the central server which sends it
> back to student.test.edu to be forwarded again via the .forward file,
> which postfix will detect as a loop.
>
> 3. Software that sets .forward files on the behalf of a user (like the IMP
> web email forward module, and the unix vacation app) use a simple name
> so I'd have to modify the source.
>
> If I were to set 'myorigin=student.test.edu' then users are delivered
> locally and .forward expands without problems, but then all email lists
> the sender as if they came from 'student.test.edu' rather the 'test.edu'
>
> According to the Postfix FAQ, I'd have to create a virtual lookup table
> for all the local users. This means administering another table of users
> along with the aliases file on the central server.
>
> Postfix is such a clean, flexible system, I find it hard to believe this
> behavior cannot be taylored to:
> send non-qualified email addresses to the local system and if not a local
> account expand to the fully qualified name
> label all email as if coming from a central email server
>
> Any comments? Thanks

Looks like it's doing what you're telling it to do to me.
>
> postconf -n on student.test.edu is:
>
> alias_database = hash:/etc/postfix/aliases
> alias_maps = hash:/etc/postfix/aliases
> bounce_size_limit = 50000
> command_directory = /usr/sbin
> config_directory = /etc/postfix
> daemon_directory = /usr/libexec/postfix
> debug_peer_level = 2
> mail_owner = postfix
> mailbox_command = /usr/bin/procmail -a "$EXTENSION"
> mailq_path = /usr/bin/mailq
> manpage_directory = /usr/share/man
> message_size_limit = 5120000
> mydestination = student, student.test.edu, localhost, localhost.test.edu
mydestination = $myhostname, localhost.$mydomain, $mydomain
> mydomain = test.edu
> myhostname = student.test.edu
> myorigin = test.edu
> newaliases_path = /usr/bin/newaliases
> queue_directory = /var/spool/postfix
> readme_directory = /usr/share/doc/postfix-1.1.11/README_FILES
> sample_directory = /usr/share/doc/postfix-1.1.11/samples
> sendmail_path = /usr/sbin/sendmail
> setgid_group = postdrop
>
>

Aaron