From: Brian Carroll (BCarrollsecurenetdesigns.com)
Date: Tue Mar 04 2008 - 21:49:34 CST

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

> -----Original Message-----
> From: owner-postfix-userspostfix.org [mailto:owner-postfix-
> userspostfix.org] On Behalf Of Victor Duchovni
> Sent: Tuesday, March 04, 2008 10:35 PM
> To: postfix-userspostfix.org
> Subject: Re: 554 Client host rejected Access denied
>
> On Tue, Mar 04, 2008 at 10:28:15PM -0500, Brian Carroll wrote:
>
> > > > Also, if you see anything that seems incorrect in my config,
feel
> > free
> > > > to point it out.
> > >
> > > DO NOT use the postfix uid/gid (89) as the owner of user
mailboxes.
> > This
> > > uid should ONLY be used as the owner of the Postfix spool
directories.
> >
> > As I understand my config, Postfix is my LDA.
>
> No, Postfix is an MTA, but it MUST not own user mailboxes, use a
separate
> uid/gid for that. Using the Postfix uid/gid for delivery is a misuse
of
> the mail system, and will likely stop working in future releases (if
not
> already in 2.4 or 2.5).
>
> > I use Dovecot for
> > POP/IMAP. I thought I needed to have Postfix as the owner of the
> > mailboxes since it is LDA. If I change to a *different* (purpose
> > created?) user, how do I allow Postfix to then deliver the mail? Is
> > using Postfix as the LDA a no-no also?
>
> Postfix will deliver as any user you specify, that why the uid/gid is
> configurable. It must not be "root" or the "postfix" user.
>
 
Ok, I see what you are saying and will fix it. Thanks.

> As for your original question, the log entry you show cannot be
produced
> by the configuration you posted. So either master.cf contains
additional
> settings for smtpd, or your evidence is inaccurate or incomplete.
>

Here is my complete master.cf with all lines commented taken out:

[rootmail ~]# more /etc/postfix/master.cf

smtp inet n - y - - smtpd
   -o cleanup_service_name=pre-cleanup
465 inet n - y - - smtpd
   -o cleanup_service_name=pre-cleanup
smtps inet n - y - - smtpd
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  -o cleanup_service_name=pre-cleanup
pre-cleanup unix n - y - 0 cleanup
    -o virtual_alias_maps=
    -o canonical_maps=
    -o sender_canonical_maps=
    -o recipient_canonical_maps=
    -o masquerade_domains=
pickup fifo n - y 60 1 pickup
    -o cleanup_service_name=pre-cleanup
cleanup unix n - y - 0 cleanup
    -o mime_header_checks=
    -o nested_header_checks=
    -o body_checks=
    -o header_checks=
qmgr fifo n - y 300 1 qmgr
#qmgr fifo n - n 300 1 oqmgr
tlsmgr unix - - y 1000? 1 tlsmgr
rewrite unix - - n - - trivial-rewrite
bounce unix - - y - 0 bounce
defer unix - - y - 0 bounce
trace unix - - y - 0 bounce
verify unix - - y - 1 verify
flush unix n - y 1000? 0 flush
proxymap unix - - y - - proxymap
smtp unix - - y - - smtp
relay unix - - y - - smtp
        -o fallback_relay=
showq unix n - y - - showq
error unix - - y - - error
discard unix - - y - - discard
local unix - n n - - local
virtual unix - n n - - virtual
lmtp unix - - n - - lmtp
anvil unix - - y - 1 anvil
scache unix - - y - 1 scache
maildrop unix - n n - - pipe
  flags=DRhu user=vmail argv=/usr/local/bin/maildrop -d ${recipient}
old-cyrus unix - n n - - pipe
  flags=R user=cyrus argv=/usr/lib/cyrus-imapd/deliver -e -m
${extension} ${user}
cyrus unix - n n - - pipe
  user=cyrus argv=/usr/lib/cyrus-imapd/deliver -e -r ${sender} -m
${extension} ${user}
uucp unix - n n - - pipe
  flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail
($recipient)
ifmail unix - n n - - pipe
  flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp unix - n n - - pipe
  flags=Fq. user=foo argv=/usr/local/sbin/bsmtp -f $sender $nexthop
$recipient
amavis unix - - - - 3 smtp
        -o smtp_data_done_timeout=1200
        -o smtp_send_xforward_command=yes

127.0.0.1:10025 inet n - - - - smtpd
        -o content_filter=
        -o smtp_delay_reject=no
        -o local_recipient_maps=
        -o relay_recipient_maps=
        -o smtpd_restriction_classes=
        -o smtpd_client_restrictions=
        -o smtpd_helo_restrictions=
        -o smtpd_sender_restrictions=
        -o smtpd_recipient_restrictions=permit_mynetworks,reject
        -o mynetworks=127.0.0.0/8
        -o strict_rfc821_envelopes=yes
        -o smtpd_error_sleep_time=0
        -o smtpd_soft_error_limit=1001
        -o smtpd_hard_error_limit=1000
        -o smtpd_client_connection_count_limit=0
        -o smtpd_client_connection_rate_limit=0
        -o
receive_override_options=no_unknown_recipient_checks,no_header_body_chec
ks
        -o smtpd_bind_address=127.0.0.1
        -o local_header_rewrite_clients=

Brian Carroll

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]