Timeout issue and 'open relay' issue

[Danilo Godec]

Hello,

I have amavisd-new 2.7.0 and postfix 2.5.13 running on SLES 11. It's
setup in a pretty much standard 'SuSE' way:

master.cf:

smtp      inet  n       -       n       -       10       smtpd -o
receive_override_options=no_address_mappings -o
content_filter=smtp:[127.0.0.1]:10024

localhost:10025 inet    n       -       n       -       -       smtpd -o
smtpd_autorized_xforward_hosts=127.0.0.0/8 -o content_filter= -o
receive_override_options=no_unknown_recipient_checks,no_header_body_checks,no_address_mappings


I also have this in amavisd.conf:

@mynetworks = qw( 127.0.0.0/8 [::1] [FE80::]/10 [FEC0::]/10
                  10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 );


The first issue I had was this:

an 29 09:10:55 mail amavis[24469]: (24469-11) (!!)TROUBLE in check_mail:
forwarding FAILED: Error writing to socket: Broken pipe at
/usr/sbin/amavisd line 6843.
Jan 29 09:10:55 mail amavis[24469]: (24469-11) (!!)TROUBLE in
process_request: Error writing to socket: Broken pipe at
/usr/sbin/amavisd line 6843.

I increased log level to 5 and then I got this (just a part of the log -
I can send full log if required):

> Jan 29 09:10:55 mail amavis[24469]: (24469-11) smtp session reuse
> (smtp:[127.0.0.1]:10025), 1 transactions so far
> Jan 29 09:10:55 mail amavis[24469]: (24469-11) establish_or_refresh,
> state: ehlo
> Jan 29 09:10:55 mail amavis[24469]: (24469-11) smtp session most
> likely still valid (short idle 15.9 s)
> Jan 29 09:10:55 mail amavis[24469]: (24469-11) Remote host presents
> itself as: mail.sender_domain, handles DSN, handles PIPELINING
> Jan 29 09:10:55 mail amavis[24469]: (24469-11) AUTH not needed,
> user='', MTA offers ''
> Jan 29 09:10:55 mail amavis[24469]: (24469-11) smtp cmd> MAIL
> FROM:<sender at sender_domain> BODY=8BITMIME
> Jan 29 09:10:55 mail amavis[24469]: (24469-11) smtp cmd> RCPT
> TO:<recipient at recipient_domain> ORCPT=rfc822;recipient at recipient_domain
> Jan 29 09:10:55 mail amavis[24469]: (24469-11) smtp cmd> DATA
> Jan 29 09:10:55 mail amavis[24469]: (24469-11) rw_loop: needline=0,
> flush=1, wr=1, timeout=120
> Jan 29 09:10:55 mail amavis[24469]: (24469-11) rw_loop: receiving
> Jan 29 09:10:55 mail amavis[24469]: (24469-11) rw_loop read 49 chars<
> 421 4.4.2 mail.sender_domain Error: timeout exceeded\r\n
> Jan 29 09:10:55 mail amavis[24469]: (24469-11) rw_loop: sending
> Jan 29 09:10:55 mail amavis[24469]: (24469-11) rw_loop sent 164> MAIL
> FROM:<sender at sender_domain> BODY=8BITMIME\r\nRCPT
> TO:<recipient at recipient_domain>
> ORCPT=rfc822;recipient at recipient_domain\r\nDATA\r\n
> Jan 29 09:10:55 mail amavis[24469]: (24469-11) smtp resp to MAIL
> (pip): 421 4.4.2 mail.sender_domain Error: timeout exceeded
> Jan 29 09:10:55 mail amavis[24469]: (24469-11) rw_loop: needline=1,
> flush=0, wr=0, timeout=300
> Jan 29 09:10:55 mail amavis[24469]: (24469-11) rw_loop: receiving
> Jan 29 09:10:55 mail amavis[24469]: (24469-11) rw_loop read: got eof

What timeout would that be? I'm running several amavisd-new setups and I
can't remember having to increase Postfix timeouts...


The other issue is this - despite having 'mynetworks' setup correctly (I
think, as we use 192.168.0.0/23), amavisd still consideres my local IP's
as 'non-local' and marks outgoing mail as 'RelayedOpenRelay':


> Jan 29 09:51:17 mail amavis[15819]: (15819-15)
> fish_out_ip_from_received: 192.168.0.213
> Jan 29 09:51:17 mail amavis[15819]: (15819-15) lookup_ip_acl
> (publicnetworks) arr.obj: key="192.168.0.213" matches
> "!192.168.0.0/16", result=0
> Jan 29 09:51:17 mail amavis[15819]: (15819-15)
> parse_ip_address_from_received: 192.168.0.213
> Jan 29 09:51:17 mail amavis[15819]: (15819-15) Passed CLEAN
> {RelayedOpenRelay}, [192.168.0.213] <sender at sender_domain> ->
> <recipient at recipient_domain>, Message-ID: <51078D0A.3040904 at inles.si>,
> mail_id: qM5I2
> vutMZVM, Hits: -0.999, size: 27788, queued_as: A7B2B76338, 449 ms
> Jan 29 09:51:17 mail amavis[15819]: (15819-15) Open relay? Nonlocal
> recips but not originating: recipient at recipient_domain


What's wrong there?


Best regards,

 Danilo