OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: Helo command rejected: unknown host reg....

From: MrC (lists-postfixcappella.us)
Date: Fri May 02 2008 - 01:10:29 CDT


Anant S Athavale wrote:
> Dear D Hill,
>
> I want to know, how to log the entry of introducing host in the logs
> when it is correct and resolvable. (ie. mail does not get rejected,
> during that time).
>
> Regards,
> ANANT.
>
>

I'm not clear if you want to do this for a specific host, set of hosts,
or all. Regardless, you could create a WARN action in a helo access check:

main.cf:
    smtpd_recipient_restrictions =
        ...
        permit_mynetworks
        reject_unauth_destination
        check_helo_access pcre:/etc/postfix/helo_checks.pcre
        ...

/etc/postfix/helo_checks.pcre:
...
/./ WARN sample helo WARN log entry

This will generate WARN log entries such as :

May 1 22:57:36 glacier postfix/smtpd[18974]: NOQUEUE: warn: RCPT from
example.com[10.0.0.1]: sample helo warn log entry; from=<meexample.com>
to=<meexample.com> proto=ESMTP helo=<example.net>

Perhaps not a good long term solution, but gives you the data you seek.

MrC

>
> Quoting D Hill :
>
>> On Fri, 2 May 2008 at 10:38 +0530, anant at isac.gov.in confabulated:
>>
>>> Dear List:Following is one line from the postfix logs.
> ---------------------------------------------------------------------------------
>
> May 2 10:05:44 dnserns.isac.gov.in: postfix/smtpd[1536248]: NOQUEUE:
> reject: RCPT from unknown[72.3.227.162]: 502 5.7.1 : Helo command
> rejected: Host not found; from= to= proto=SMTP helo=
> ------------------------------------------------------------------------------As
>
> per the above example, as we have used the policy of
> reject_unknown_hostname and the mails where introducing host is not
> resolvable are getting rejected.Now, when the users complain that,
> some mails are not getting delivered to them, we go through logs and
> find the reason like one above and inform that this is due to this
> and tell the sender also to look into their configuration and resolve
> the issue. And most of the times, they solve the issue.But, when they
> solve, I want to know what their system is now introducing itself as.
> How can I make it part of log? Can it also
>>> b
>> ecome part of Mail headers?Regards, ANANT.
>>
>> Disreguard my previous response. I didn't quite know what the helo log
>> lines contained. You should be looking for lines that have the content:
>>
>> Helo command rejected