OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: why does postfix say helo=<127.0.0.1>?

From: Bill Cole (postfixlists-070913billmail.scconsult.com)
Date: Tue Dec 18 2007 - 08:26:57 CST


At 12:08 PM +0200 12/18/07, AlxFrag wrote:
>Sandy Drobic wrote:
>>AlxFrag wrote:
>>
>>
>>>>>i've used smtp_helo_name=mydomain but postfix insists in saying
>>>>>helo=<127.0.0.1> :(
>>>>>

[...]

>>
>>What does the log say?
>>
>>
>**********************************************
>part of the logs in var/log/mail:
>
>Dec 18 11:59:19 hermes postfix/smtpd[18416]: 0DE0E2BBD7:
>client=unknown[client_ip], sasl_method=PLAIN,
>sasl_username=my_username
>Dec 18 11:59:19 hermes postfix/cleanup[18228]: 0DE0E2BBD7: hold:
>header Received: from [127.0.0.1] (unknown [client_ip])??by
>hermes.mydomain (Postfix) with ESMTP id 0DE0E2BBD7??for
><alxfraggmail.com>; Tue, 18 Dec 2007 11:59:19 +0200 (EET) from
>unknown[client_ip]; from=<my_usernamemydomain>
>to=<alxfraggmail.com> proto=ESMTP helo=<[127.0.0.1]>
>**********************************************

That DOES NOT show Postfix using [127.0.0.1] as a HELO. It shows
something else that you've obfuscated saying 'HELO [127.0.0.1]' *to*
Postfix.

There is something broken in this case, because anything speaking
SMTP but not on the loopback address should never be claiming to be
127.0.0.1, but whatever it is that tried to do that does not appear
to be your Postfix.

In general, it is a useful tactic to reject mail on any SMTP session
that is not on the loopback where the client claims your own identity
in the HELO, i.e. localhost, [127.*], your hostname, your IP, etc.

--
Bill Cole
billscconsult.com