<div dir="ltr"><div dir="ltr">On Tue, Aug 4, 2020 at 6:19 PM Patrick Ben Koetter <<a href="mailto:p@sys4.de">p@sys4.de</a>> wrote:<br></div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Ian,<br>
<br>
* Ian Evans <<a href="mailto:dheianevans@gmail.com" target="_blank">dheianevans@gmail.com</a>>:<br>
> On Tue, Aug 4, 2020 at 3:38 PM Matus UHLAR - fantomas <<a href="mailto:uhlar@fantomas.sk" target="_blank">uhlar@fantomas.sk</a>><br>
> wrote:<br>
> <br>
> > >Open relay? Nonlocal recips but not originating: [person I'm emailing]<br>
> ><br>
> > this happens when 'originating' flag is not set and recipient is not local.<br>
> > maybe you don't have $mynetworks amavis variable set<br>
> ><br>
> <br>
> Okay bizarre. Just did a grep on my conf.d dir and 'originating' and<br>
> '$mynetworks' don't appear in any of these files:<br>[snip]> <br>
> Again except for these outgoing notices in the logs, the server has worked<br>
> fine for years. Amavis, Postfix and Dovecot are all on the same server.<br>
<br>
for any domain/recipient that amavis should feel responsible for add its name<br>
to @local_domains_maps or let amavis read it from a file, e.g.<br>
/etc/postfix/relay_domains:<br>
<br>
@local_domains_maps = (<br>
".$mydomain",<br>
read_hash('/etc/postfix/relay_domains')<br>
);<br>
<br>
This will tell amavis what it should classify as "incoming".<br>
<br>
For any IP address/network that is internal add it to @mynetworks. This will<br>
tell amavis which sources are internal:<br>
<br>
@mynetworks = qw(<br>
<a href="http://127.0.0.0/8" rel="noreferrer" target="_blank">127.0.0.0/8</a><br>
);<br>
<br>
In reverse conclusion all other senders not listed in @mynetworks are<br>
considered to be "outside".<br>
<br>
If your authenticated senders submit messages via Port 465 or 587 then route<br>
their messages into a dedicated port into amavis and assign that port to a<br>
policy bank, where you declare everything in that policy bank as originating:<br>
<br>
# Claim the port:<br>
@listen_sockets = (<br>
# Release<br>
'[::1]:9998',<br>
# Post-Queue, Submission<br>
'[::1]:10024',<br>
# Pre-Queue, MTA zu MTA<br>
"$MYHOME/amavisd.sock"<br>
);<br>
<br>
# Assign the port to a $policy_bank:<br>
$interface_policy{'10024'} = 'SUBMISSION';<br>
<br>
# Tag everything as $originating in that policy_bank:<br>
$policy_bank{'SUBMISSION'} = {<br>
originating => 1,<br>
bypass_spam_checks_maps => [1],<br>
final_virus_destiny => D_BOUNCE,<br>
final_banned_destiny=> D_PASS,<br>
final_bad_header_destiny => D_PASS,<br>
banned_filename_maps => ['MYNETS-DEFAULT'],<br>
warnbadhsender => 0,<br>
forward_method => 'smtp:<a href="http://127.0.0.1:10025" rel="noreferrer" target="_blank">127.0.0.1:10025</a>',<br>
notify_method => 'smtp:<a href="http://127.0.0.1:10025" rel="noreferrer" target="_blank">127.0.0.1:10025</a>',<br>
undecipherable_subject_tag => undef,<br>
};<br>
<br>
<br>
> Just so I don't upset the apple cart, what do I need to add and to which<br>
> file do I need to add it?<br>
<br>
I suggest you copy over 50-user to 60-mysystem and add your local config<br>
there. It will never be overwritten by an update.<br>
<br></blockquote><div> </div><div> Patrick, thanks for the detailed notes. I wanted to respond when I had time to look at my setup. A few questions:</div><div><br></div><div>I only handle email for my domain so I'm assuming this is okay?</div><div><br></div><div> @local_domains_maps = (<br>
".$mydomain"<br>
);<br></div><div>@mynetworks = qw(<br> <a href="http://127.0.0.0/8" rel="noreferrer" target="_blank">127.0.0.0/8</a><br>); </div><div><br></div><div>My biggest question and config I don't want to foul up is the submission section for the amavis config.</div><div><br></div><div>Here's what's in my <a href="http://master.cf">master.cf</a> in Postfix:</div><div><br></div>submission inet n - - - - smtpd<br> -o syslog_name=postfix/submission<br> -o smtpd_tls_security_level=encrypt<br> -o smtpd_sasl_auth_enable=yes<br> -o smtpd_reject_unlisted_recipient=no<br> -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject<br> -o milter_macro_daemon_name=ORIGINATING</div><div class="gmail_quote">#OpenDKIM signing<br> -o smtpd_milters=inet:localhost:12345</div><div class="gmail_quote"><br></div><div class="gmail_quote">So the email is sent to port 587 and processed through OpenDKIM. Being coffee and sleep-deprived I don't want to FUBAR anything in the amavis config? Your example said to claim the port:</div><div class="gmail_quote"><br></div><div class="gmail_quote"> # Claim the port:<br>
@listen_sockets = (<br>
# Release<br>
'[::1]:9998',<br>
# Post-Queue, Submission<br>
'[::1]:10024',<br>
# Pre-Queue, MTA zu MTA<br>
"$MYHOME/amavisd.sock"<br>
); </div><div class="gmail_quote"><br></div><div class="gmail_quote">So which one do I change? And will that interfere with the <a href="http://master.cf">master.cf</a> submission interfacing with OpenDKIM.</div><div class="gmail_quote"><br></div><div class="gmail_quote">Thanks again. If I was feeling better I'm sure this would be clearer to me.</div><div class="gmail_quote"><br></div><div class="gmail_quote">Take care. </div></div>