OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: 2-server setup for MTA + Content Filtering?

From: William Kimball, Jr. (popauth3teamdelsol.com)
Date: Wed Jun 09 2004 - 00:43:46 CDT


: What gets logged for the from-outside looping mail? If you remove the
: content_filter directive, does the mail still loop? Can you (as Rob
: Foehl suggested) fall back to a configuration that works without
: looping, but does *not* send to the filter, then work toward getting
: the filter back into the circuit?

If we really want to push forward with the configuration that I abandoned in favor of trying to find more appropriate
documentation, then we can. But, if there is a possibility of taking a fresh approach to this problem with such
documentation, then I'm in favor of leaving this configuration in yesterday's backup.

On the other hand, I'm insanely curious where this might go, so here are the log entries that I'm able to dig up (as is
customary, I have substituted the e-mail addresses and the IP; 123.123.123.123 represents the external IP of this
machine):

Jun 8 00:39:47 mail postfix/smtpd[7866]: connect from web14304.mail.yahoo.com[216.136.173.80]
Jun 8 00:39:48 mail postfix/smtpd[7866]: A90AEC89AD: client=web14304.mail.yahoo.com[216.136.173.80]
Jun 8 00:39:48 mail postfix/smtpd[7866]: A90AEC89AD: filter: RCPT from web14304.mail.yahoo.com[216.136.173.80]:
<valid-usermy-domain.tld>: Recipient address triggers FILTER amavisd:; from=<valid-useryahoo.com>
to=<valid-usermy-domain.tld> proto=SMTP helo=<web14304.mail.yahoo.com>
Jun 8 00:39:48 mail postfix/cleanup[7867]: A90AEC89AD: message-id=<20040608063939.29190.qmailweb14304.mail.yahoo.com>
Jun 8 00:39:48 mail postfix/qmgr[7706]: A90AEC89AD: from=<valid-useryahoo.com>, size=798, nrcpt=1 (queue active)
Jun 8 00:39:49 mail postfix/smtpd[7866]: disconnect from web14304.mail.yahoo.com[216.136.173.80]
Jun 8 00:39:49 mail postfix/smtpd[7866]: connect from mail.my-domain.tld[123.123.123.123]
Jun 8 00:39:49 mail postfix/smtp[7868]: warning: host mail.my-domain.tld[123.123.123.123] greeted me with my own
hostname mail.my-domain.tld
Jun 8 00:39:50 mail postfix/smtpd[7866]: NOQUEUE: reject: HELO from mail.my-domain.tld[123.123.123.123]: 554
<mail.my-domain.tld>: Helo command rejected: Your machine is not part of my-domain.tld. Forgery is not tolerated here.;
proto=SMTP helo=<mail.my-domain.tld>
Jun 8 00:39:50 mail postfix/smtp[7868]: connect to mail.my-domain.tld[123.123.123.123]: server refused mail service
(port 25)
Jun 8 00:39:50 mail postfix/smtp[7868]: A90AEC89AD: to=<valid-usermy-domain.tld>, relay=none, delay=2, status=deferred
(connect to mail.my-domain.tld[123.123.123.123]: server refused mail service)
Jun 8 00:39:50 mail postfix/smtpd[7866]: lost connection after CONNECT from mail.my-domain.tld[123.123.123.123]
Jun 8 00:39:50 mail postfix/smtpd[7866]: disconnect from mail.my-domain.tld[123.123.123.123]

This is a log snippet showing that mail that originates on the LAN was processed and delivered without problem:

Jun 7 22:54:03 mail postfix/smtpd[6837]: connect from internal_ip.my-domain.tld[10.16.16.16]
Jun 7 22:54:03 mail postfix/smtpd[6837]: 1FC4AC89AD: client=internal_ip.my-domain.tld[10.16.16.16]
Jun 7 22:54:03 mail postfix/smtpd[6837]: 8FA1BC89AD: client=internal_ip.my-domain.tld[10.16.16.16]
Jun 7 22:54:03 mail postfix/cleanup[6838]: 8FA1BC89AD: message-id=<007f01c44d15$132e7440$1000090awinbox>
Jun 7 22:54:03 mail postfix/qmgr[6833]: 8FA1BC89AD: from=<valid-user1my-domain.tld>, size=762, nrcpt=1 (queue active)
Jun 7 22:54:04 mail postfix/smtpd[6837]: disconnect from internal_ip.my-domain.tld[10.16.16.16]
Jun 7 22:54:13 mail postfix/smtpd[6840]: connect from filterbox.my-domain.tld[10.22.22.22]
Jun 7 22:54:13 mail postfix/smtpd[6840]: A17F8C89AE: client=filterbox.my-domain.tld[10.22.22.22]
Jun 7 22:54:13 mail postfix/cleanup[6838]: A17F8C89AE: message-id=<007f01c44d15$132e7440$1000090awinbox>
Jun 7 22:54:13 mail postfix/qmgr[6833]: A17F8C89AE: from=<valid-user1my-domain.tld>, size=1233, nrcpt=1 (queue active)
Jun 7 22:54:13 mail postfix/smtpd[6840]: disconnect from filterbox.my-domain.tld[10.22.22.22]
Jun 7 22:54:13 mail postfix/smtp[6839]: 8FA1BC89AD: to=<another-valid-user2my-domain.tld>,
relay=10.22.22.22[10.22.22.22], delay=10, status=sent (250 2.6.0 Ok, id=02008-02, from MTA: 250 Ok: queued as
A17F8C89AE)
Jun 7 22:54:13 mail postfix/virtual[6841]: A17F8C89AE: to=<another-valid-user2my-domain.tld>, relay=virtual, delay=0,
status=sent (mailbox)