OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Problems with either canonical_maps or alias_maps

From: Ron Winograd (ron.winogradnovelics.com)
Date: Sat Jul 14 2007 - 23:28:54 CDT


Hello,

I'm continuing to have a problem with either canonical_maps or
alias_maps, but I'm not sure which. My domain is mydomain.com The
problem is that email to useranydomain gets changed to usermydomain.com.

I am using an internal email server which provides SMTP services for
internal users, delivers email for internal users to an IMAP server via
lmtp, and receives forwarded email from a gateway email server.

I use IMAP for storage, and the mailboxes are keyed with the username.
Our formal email addresses are first.lastmydomain.com. There is the
additional requirement that usernamemydomain.com also be accepted,
however all outbound email must have addresses translated into
first.lastmydomain.com.

I use LDAP for user entries and to tie username to first.last. I use
canonical_maps to translate usernamemydomain.com to
first.lastmydomain.com on the way out. I use alias_maps to accept
usernamemydomain.com on the way in. However as I said, one of these is
causing usernameanydomain.com to be translated to usernamemydomain.com

As Wietse pointed out in my previous post canonical_maps should only be
consulted for local recipients, and I thought the same is true for
alias_maps, but perhaps I am still not understanding something here.

Running postfix 2.2.8
postconf -n:
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases, ldap:/etc/postfix/ldap-aliases.cf,
ldap:/etc/postfix/ldap-group-aliases.cf
broken_sasl_auth_clients = yes
canonical_maps = ldap:/etc/postfix/ldap-canonical.cf
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
debug_peer_level = 2
debug_peer_list = smtp.bizmail.mail.yahoo4.akadns.net
delay_warning_time = 4h
html_directory = no
inet_interfaces = all
local_header_rewrite_clients = permit_mynetworks
mail_owner = postfix
mailbox_transport = lmtp:unix:/var/lib/imap/socket/lmtp
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
masquerade_domains = novelics.com
message_size_limit = 51200000
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
mydomain = novelics.com
myhostname = srv-vantis.novelics.com
mynetworks = 192.168.140.0/24, 192.168.141.0/24, localhost, 127.0.0.1
myorigin = $mydomain
newaliases_path = /usr/bin/newaliases.postfix
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-2.2.8/README_FILES
recipient_bcc_maps = hash:/etc/postfix/recipient_bcc_maps
sample_directory = /usr/share/doc/postfix-2.2.8/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtpd_recipient_restrictions = check_recipient_access
hash:/etc/postfix/protected_destinations
permit_sasl_authenticated permit_mynetworks
reject_unauth_destination
smtpd_restriction_classes = all_authorized_only
smtpd_sasl_auth_enable = yes
transport_maps = hash:/etc/postfix/transport
unknown_local_recipient_reject_code = 550

ldap-aliases.cf:
server_host = ldap.mydomain.com
search_base = ou=People,dc=novelics,dc=com
query_filter = (mail=%umydomain.com)
result_attribute = uid
result_format = %s
version = 3
debug = 10

ldap-canonical.cf:
server_host = ldap.mydomain.com
search_base= ou=People,dc=novelics,dc=com
query_filter= (uid=%u)
result_attribute= mail
result_format=%u

Relevant parts of sample LDAP entry:
dn: cn=Ron Winograd,ou=External,ou=People,dc=novelics,dc=com
o: Novelics
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top
uid: ron
cn: Ron Winograd
mail: ron.winogradmydomain.com

Example session:
[adminsrv-vantis ~]$ telnet localhost 25
Trying 127.0.0.1...
Connected to localhost.localdomain (127.0.0.1).
Escape character is '^]'.
220 srv-vantis.mydomain.com ESMTP Postfix
HELO mydomain.com
250 srv-vantis.mydomain.com
MAIL FROM: ronmydomain.com
250 Ok
RCPT TO: ronyahoo.com
250 Ok
DATA
354 End data with <CR><LF>.<CR><LF>
Sample message
.
250 Ok: queued as BDB293118010
QUIT
221 Bye
Connection closed by foreign host.
[adminsrv-vantis ~]$

Jul 14 21:14:52 srv-vantis lmtpunix[369]: accepted connection
Jul 14 21:14:52 srv-vantis lmtpunix[369]: lmtp connection preauth'd as
postman
Jul 14 21:14:52 srv-vantis master[836]: about to exec
/usr/lib/cyrus-imapd/lmtpd
Jul 14 21:14:52 srv-vantis lmtpunix[369]: duplicate_check:
<20070715041445.BDB293118010srv-vantis.mydomain.com> user.ron 0
Jul 14 21:14:52 srv-vantis lmtpunix[836]: executed
Jul 14 21:14:52 srv-vantis lmtpunix[369]: duplicate_mark:
<20070715041445.BDB293118010srv-vantis.mydomain.com>
user.ron 1184472892 13483
Jul 14 21:14:52 srv-vantis lmtpunix[369]: duplicate_mark:
<20070715041445.BDB293118010srv-vantis.mydomain.com>
.ron+.sieve. 1184472892 0
Jul 14 21:14:52 srv-vantis postfix/lmtp[835]: BDB293118010:
to=<ronmydomain.com>, orig_to=<ronyahoo.com>,
relay=/var/lib/imap/socket/lmtp[/var/lib/imap/socket/lmtp], delay=12,
status=sent (250 2.1.5 Ok)
Jul 14 21:14:52 srv-vantis postfix/qmgr[333]: BDB293118010: removed
Jul 14 21:14:55 srv-vantis postfix/smtpd[819]: disconnect from
localhost.localdomain[127.0.0.1]

As you can see from the above log entry, ronyahoo.com was changed to
ronmydomain.com and I can't seem to figure out why.

Thank you for your consideration,

-- Ron