Submission clients bypass MYNETS policy
Alex
mysqlstudent at gmail.com
Mon Sep 19 23:04:45 CEST 2011
Hi,
I have set up an amavisd-new with postfix/spamassassin on fedora15.
I'm trying to set up a disclaimer footer using amavisd because I also
need always_bcc, and was having a problem with postfix duplicating the
messages as a result.
Webmail now properly attaches the disclaimer footer using my amavisd
config, but somehow submission clients are bypassing the MYNETS
policy, which is where "allow_disclaimers = 1" is set.
Here's a snapshot from the logs. "remotenet.net" is the remote host
and "mylocalnet.net" is the amavisd host.
Sep 19 16:42:42 mail postfix/smtpd[25223]: 298372202AC:
client=orion.remotenet.net[68.195.xxx.yy], sasl_method=PLAIN,
sasl_username=gdadmin
Sep 19 16:42:42 mail postfix/cleanup[23849]: 298372202AC:
message-id=<4E77A940.7050902 at mylocalnet.net>
Sep 19 16:42:42 mail postfix/qmgr[13505]: 298372202AC:
from=<gdadmin at mylocalnet.net>, size=778, nrcpt=1 (queue active )
Sep 19 16:42:42 mail amavis[25188]: (25188-01) ESMTP::10024
/var/spool/amavisd/tmp/amavis-20110919T164242-25188:
<gdadmin at mylocalnet.net> -> <gdadmin at remotenet.net> SIZE=778 Received:
from mail.mylocalnet.net ([127.0.0.1]) by localhost
(mail.mylocalnet.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP
for <gdadmin at remotenet.net>; Mon, 19 Sep 2011 16:42:42 -0400 (EDT)
Sep 19 16:42:42 mail amavis[25188]: (25188-01) Checking: gVCO0A-ajTZ8
[68.195.xxx.yy] <gdadmin at mylocalnet.net> -> <gdadmin at remotenet.net>
Sep 19 16:42:42 mail amavis[25188]: (25188-01) Open relay? Nonlocal
recips but not originating: gdadmin at remotenet.net
Sep 19 16:42:42 mail amavis[25188]: (25188-01) p001 1 Content-Type:
text/plain, size: 10 B, name:
Sep 19 16:42:42 mail postfix/smtpd[25223]: disconnect from
orion.remotenet.net[68.195.xxx.yy]
Sep 19 16:42:43 mail amavis[25188]: (25188-01) mangling NO: 0 (orig:
disclaimer), discl_allowed=0, <gdadmin at mylocalnet.net> ->
<gdadmin at remotenet.net>
Sep 19 16:42:43 mail postfix/smtpd[23853]: connect from localhost[127.0.0.1]
Sep 19 16:42:43 mail postfix/smtpd[23853]: 0AB1C2202C4:
client=orion.remotenet.net[68.195.xxx.yy]
Sep 19 16:42:43 mail postfix/cleanup[23849]: 0AB1C2202C4:
message-id=<4E77A940.7050902 at mylocalnet.net>
Sep 19 16:42:43 mail postfix/qmgr[13505]: 0AB1C2202C4:
from=<gdadmin at mylocalnet.net>, size=1269, nrcpt=2 (queue active)
Sep 19 16:42:43 mail amavis[25188]: (25188-01) FWD via SMTP:
<gdadmin at mylocalnet.net> -> <gdadmin at remotenet.net>,BODY=7BIT 250
2.0.0 Ok, id=25188-01, from MTA([127.0.0.1]:10025): 250 2.0.0 Ok:
queued as 0AB1C2202C4
Sep 19 16:42:43 mail amavis[25188]: (25188-01) Passed CLEAN,
[68.195.xxx.yy] [68.195.xxx.yy] <gdadmin at mylocalnet.net> ->
<gdadmin at remotenet.net>, Message-ID:
<4E77A940.7050902 at mylocalnet.net>, mail_id: gVCO0A-ajTZ8, Hits: -2.9,
size: 778, queued_as: 0AB1C2202C4, 744 ms
I also don't understand why it's complaining about "nonlocal recips"
when mylocalnet.net is in the local_domains_maps. Here is the relevant
amavisd.conf config:
@local_domains_maps = ( [".$mydomain", "mylocalnet.net"] ); # list of
all local domains
$altermime = '/usr/bin/altermime';
@altermime_args_disclaimer = qw( --verbose \
--disclaimer=/etc/postfix/disclaimer.txt \
--disclaimer-html=/etc/postfix/disclaimer.txt);
$defang_maps_by_ccat{+CC_CATCHALL} = [ 'disclaimer' ];
$defang_maps_by_ccat{+CC_UNCHECKED} = [ 'disclaimer' ];
$policy_bank{'MYNETS'} = { # mail originating from @mynetworks
originating => 1, # is true in MYNETS by default, but let's make it explicit
os_fingerprint_method => undef, # don't query p0f for internal clients
allow_disclaimers => 1,
terminate_dsn_on_notify_success => 0, # don't remove NOTIFY=SUCCESS option
};
Here is my postfix config:
smtp inet n - n - - smtpd
-o receive_override_options=no_address_mappings
submission inet n - n - - smtpd
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
-o receive_override_options=no_address_mappings
smtp-amavis unix - - n - 2 smtp
-o smtp_data_done_timeout=1200
-o smtp_send_xforward_command=yes
-o disable_dns_lookups=yes
-o max_use=20
127.0.0.1:10025 inet n - n - 2 smtpd
-o content_filter=
-o smtpd_delay_reject=no
-o smtpd_client_restrictions=permit_mynetworks,reject
-o smtpd_helo_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,reject
-o smtpd_data_restrictions=reject_unauth_pipelining
-o smtpd_end_of_data_restrictions=
-o smtpd_restriction_classes=
-o mynetworks=127.0.0.0/8
-o smtpd_error_sleep_time=0
-o smtpd_soft_error_limit=1001
-o smtpd_hard_error_limit=1000
-o smtpd_client_connection_count_limit=0
-o smtpd_client_connection_rate_limit=0
-o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_milters
-o smtp_send_xforward_command=yes
-o local_header_rewrite_clients=
main.cf:
~~~~~~~~~~~~~~~
alias_database = hash:/etc/postfix/aliases
alias_maps = hash:/etc/postfix/aliases
always_bcc = emailcomp at mylocalnet.net
biff = no
command_directory = /usr/sbin
config_directory = /etc/postfix
content_filter = smtp-amavis:[127.0.0.1]:10024
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
delay_warning_time = 4h
disable_vrfy_command = yes
header_checks = pcre:/etc/postfix/header_checks.pcre
html_directory = no
mail_owner = postfix
mailbox_size_limit = 2000000000
mailq_path = /usr/bin/mailq
manpage_directory = /usr/share/man
maximal_queue_lifetime = 5d
message_size_limit = 15360000
mydestination = $myhostname, localhost.$mydomain, mylocaldomain.net
mydomain = mylocaldomain.net
myhostname = mail.mylocaldomain.net
mynetworks = 127.0.0.0/8, 192.168.1.0/24, 68.115.xxx.yyy/32
newaliases_path = /usr/bin/newaliases
queue_directory = /var/spool/postfix
rbl_reply_maps = ${stress?hash:/etc/postfix/rbl_reply_maps}
readme_directory = /usr/share/doc/postfix-2.7.5/README_FILES
relay_clientcerts = hash:/etc/postfix/relay_clientcerts
relay_domains = $mydestination, $transport_maps
relayhost =
sample_directory = /usr/share/doc/postfix-2.7.5/samples
sender_canonical_maps =
sendmail_path = /usr/sbin/sendmail
setgid_group = postdrop
smtp_sasl_security_options = noplaintext, noanonymous
smtp_send_xforward_command = yes
smtp_tls_CAfile = /etc/pki/tls/cacert.pem
smtpd_authorized_xforward_hosts = $mynetworks
smtpd_recipient_restrictions = reject_non_fqdn_recipient,
check_client_access hash:/etc/postfix/client_checks_special,
check_sender_access
hash:/etc/postfix/sender_checks_special, reject_non_fqdn_sender, permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_invalid_helo_hostname, check_client_access
hash:/etc/postfix/client_checks, check_sender_access
hash:/etc/postfix/sender_checks, check_recipient_access
pcre:/etc/postfix/relay_recips_access, reject_rbl_client
zen.spamhaus.org, permit
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous, noplaintext
smtpd_sasl_tls_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /etc/pki/dovecot/certs/dovecot.pem
smtpd_tls_key_file = /etc/pki/dovecot/private/dovecot.pem
smtpd_tls_received_header = yes
smtpd_tls_security_level = may
smtpd_tls_session_cache_database =
btree:/var/lib/postfix/smtpd_tls_session_cache
tls_random_source = dev:/dev/urandom
transport_maps =
virtual_alias_maps = hash:/etc/postfix/virtual
Any suggestions greatly appreciated.
Thanks,
Alex
More information about the amavis-users
mailing list