OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Unnecessary LDAP lookups

From: Bernhard Schmidt (bernibirkenwald.de)
Date: Tue Aug 21 2007 - 17:16:43 CDT


Hi,

I'm running Postfix 2.4.5 as an (experimental) incoming relay. It should
get the list of domains it relays for from LDAP

relay_domains = ldap:.../ldap.relay_domains.conf

smtpd_client_restrictions =
         sleep 1,
         check_client_access regexp:.../access.client.connect-stage.pcre,
         reject_unauth_pipelining,
         reject_unknown_client_hostname

smtpd_recipient_restrictions =
         reject_non_fqdn_sender,
         reject_unknown_sender_domain,
         reject_non_fqdn_recipient,
         reject_unknown_recipient_domain,
         reject_unauth_destination,
         check_client_access regexp:.../access.client.pcre,
         check_sender_access regexp:.../access.sender.pcre,
         check_recipient_access regexp:.../access.rcpt.pcre,
         check_policy_service inet:127.0.0.1:12525,
         check_policy_service inet:10.156.6.113:10998

However, debugging the LDAP lookups I noticed that Postfix does LDAP
Lookups for the _sender_ address as soon as the client does "MAIL FROM:
". Which means I can see

9 Filter: (servicedSMTPDomains=ymt.bbiq.jp)
11 Filter: (servicedSMTPDomains=bbiq.jp)
14 Filter: (servicedSMTPDomains=jp)

as soon as the client does

MAIL FROM: <abcdymt.bbiq.jp>

Although this is not causing any problems at the moment I'd like to know
  what postfix statement might be causing this lookup. The LDAP
configuration file with servicedSMTPDomains is not listed anywhere
except for relay_domains, which to my knowledge should not lookup
anything sender-specific.

Thanks,
Bernhard