OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: My server is an open relay

From: Patrick Ben Koetter (pstate-of-mind.de)
Date: Tue May 03 2005 - 03:24:41 CDT


* Jaskula Thomas <thomas.jaskulabci-info.com>:
> Hello everybody,
>
> First of all, sorry for my bad English. I'm newbie to the mailing list and
> to Postfix. I tried to set-up a secure mail server based on postfix but it
> seems that my configuration has some serious problems. I already tried
> tutorials from postfix.org and searched through archives but I'm not able to
> set up properly the server to not relay.
>
> I have a domain "mydomain.com" and would like to deliver mail only to valid
> users of this domain (users are in mysql database). Other mails should be
> directly deleted by postfix.

A server that accepts any mail for its domain is not an open relay. An open
relay is a server that accepts mail from any third party and sends the mail to
other third parties.

You probably want Postfix to accept messages only for existing mail accounts,
right? In this case take a look at the local_recipient_maps parameter.

prick

>
> Can anybody look at my configuration and point me to the error? Thanks in
> advance.
>
> Here is my configuration:
>
> My system is Linux Mandrak 9.1 2.4.21-0.13mdk #1 Fri Mar 14 15:08:06 EST
> 2003 i686 unknown unknown GNU/Linux
>
> Postfix version 2.0.16:
>
> Postconf -n
>
> alias_database =
> hash:/etc/aliases,hash:/var/www/http/Portail/aliasessympa/aliases-sympa
> alias_maps =
> hash:/etc/aliases,hash:/var/www/http/Portail/aliasessympa/aliases-sympa
> command_directory = /usr/sbin
> config_directory = /etc/postfix
> content_filter = smtp-amavis:[localhost]:10024
> daemon_directory = /usr/lib/postfix
> debug_peer_level = 2
> delay_warning_time = 4
> disable_vrfy_command = yes
> fallback_transport = virtual
> header_checks = regexp:/etc/postfix/header_checks
> inet_interfaces = all
> local_recipient_maps = $alias_maps, $virtual_mailbox_maps
> local_transport = local
> mail_owner = postfix
> mailq_path = /usr/bin/mailq.postfix
> manpage_directory = /usr/share/man
> maps_rbl_domains = sbl.spamhaus.org, relays.ordb.org,
> opm.blitzed.org,dun.dnsrbl.net, spam.dnsrbl.net
> mydestination = $myhostname, localhost.$mydomain, $mydomain
> mydomain = mydomain.com
> myhostname = myserver.mydomain.com
> mynetworks = 192.168.207.0/24, 127.0.0.0/8, 192.168.200.0/24
> mynetworks_style = host
> myorigin = $mydomain
> newaliases_path = /usr/bin/newaliases.postfix
> queue_directory = /var/spool/postfix
> queue_minfree = 8000000
> readme_directory = /usr/share/doc/postfix-2.0.6/README_FILES
> relay_domains = $mydestination
> sample_directory = /usr/share/doc/postfix-2.0.6/samples
> sendmail_path = /usr/sbin/sendmail.postfix
> setgid_group = postdrop
> smtpd_banner = $myhostname ESMTP $mail_name ($mail_version) (Mandrake Linux)
> smtpd_client_restrictions = permit_mynetworks, reject_unauth_pipelining,
> reject_unknown_client, reject_maps_rbl
> smtpd_delay_reject = no
> smtpd_helo_required = yes
> smtpd_helo_restrictions = permit_mynetworks, reject_invalid_hostname,
> reject_unknown_hostname, reject_non_fqdn_hostname, reject_maps_rbl
> smtpd_recipient_restrictions = permit_mynetworks, reject_unauth_destination,
> check_recipient_access $virtual_mailbox_maps, reject_non_fqdn_recipient,
> check_relay_domains
> smtpd_sender_restrictions = permit_mynetworks, reject_unauth_pipelining,
> reject_unknown_sender_domain, reject_non_fqdn_sender
> strict_rfc821_envelopes = yes
> unknown_local_recipient_reject_code = 450
> virtual_gid_maps = mysql:/etc/postfix/mysql.gid_users
> virtual_mailbox_base = /var/spool/webmail
> virtual_mailbox_maps = mysql:/etc/postfix/mysql.users
> virtual_transport = virtual
> virtual_uid_maps = mysql:/etc/postfix/mysql.uid_users
>
> Thanks in advance
>
> Cheers,
>
> Thomas Jaskula
>

--
The Book of Postfix
<http://www.postfix-book.com>
SMTP AUTH debug utility:
<http://postfix.state-of-mind.de/patrick.koetter/saslfinger/>