OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: A few postfix issues - LDAP / anvil and sasl?

From: Sahil Tandon (sahiltandon.net)
Date: Mon Jun 22 2009 - 10:48:30 CDT


On Jun 22, 2009, at 11:22 AM, Barney Desmond <barneydesmondgmail.com>
wrote:

> 2009/6/22 Evan Platt <phirephotoyahoo.com>:
>>
>> make -f Makefile.init makefiles 'PREFIX=/etc/postfix ' 'CCARGS=-
>> DUSE_TLS -I/sw/include/sasl -DUSE_SASL_AUTH -DUSE_CYRUS_SASL '
>> 'AUXLIBS=-L/opt/local/lib -lsasl2 -lssl -lcrypto' 'CCARGS='-I/usr/
>> local/include -DHAS_LDAP' AUXLIBS='-L/usr/local/lib -lldap -L/usr/
>> local/lib -llber'
>>
>> I'm seeing in the mail.log:
>> Jun 21 11:47:48 www ${multi_instance_name: postfix}$
>> {multi_instance_name?$multi_instance_name}/master[7111]: reload --
>> version 2.6.2, configuration /etc/postfix
>
> Are you literally seeing dollars and curly-braces in the logs? If
> that's obfuscation then it's very unclear. Someone else may have
> suggestions/corrections for your `make` line, but does ldap now appear
> in the output of `postconf -m`?

He is not obfusticating; that is real log output.

>
>> Second, I've disabled anvil in master.cf, but I still see:
>>
>> Jun 21 11:48:27 www postfix/smtpd[7132]: warning: connect to
>> private/anvil: Connection refused
>> Jun 21 11:48:27 www postfix/smtpd[7132]: warning: problem talking
>> to server private/anvil: Connection refused
>>
>> I recall (but can't find it on google) adding anvil=no in main.cf?
>
> I only know enough about anvil to say that you probably don't want, or
> need, to touch it. Why did you disable anvil? It performs connection
> rate-limiting to prevent runaway situations. "It makes too much noise
> in the mail log" isn't a good excuse. Also, I don't see any
> anvil=(yes|no) directive, what makes you think it exists?
> http://www.postfix.org/postconf.5.html#anvil
>
>> I have
>>
>> uid=eplatt,dc=espphotography,dc=com
>> and names of mail, value of example1espphotography.com, example2espphotography.com
>> , etc.
>>
>> with
>> alias_maps = ldap:/etc/postfix/ldap-aliases.cf
>> ldap-aliases.cf:
>> server_host = localhost
>> search_base = dc=espphotography, dc=com
>>
>> all mail is rejected:
>>
>> Jun 20 12:43:37 www postfix/smtpd[1703]: NOQUEUE: reject: RCPT from
>> unknown[192.168.1.4]: 550 5.1.1 <example1espphotography.com>:
>> Recipient address rejected: User unknown in local recipient table;
>> from=<evanespphotography.com> to=<example1espphotography.com>
>> proto=ESMTP helo=<mylaptop.espphotography.com>
>
> I'm no good with LDAP, but I'd suggest trying some manual queries
> against the table, without postfix. Something like this to see if the
> results look "sane":
>
> postmap -q example1espphotography.com ldap:/etc/postfix/ldap-
> aliases.cf
>
> alias_maps is generally for local delivery, which should mean the
> lookup key is just a name, not a full email address. Does that match
> what you have stored in LDAP?
>
>
>> # postconf -n
>> alias_database = hash:/etc/postfix/aliases
>> alias_maps = hash:/etc/postfix/aliases
>
> Usually one posts the "broken" postconf-n output, but we know what you
> mean (assuming you haven't changed anything else except putting in
> LDAP).