iRedMail — IREDAPD Problem

Re: IREDAPD Problem

null@example.com (Casa.it) — Mon, 21 Feb 2011 14:39:38 +0000

Casa.it wrote:

ZhangHuangbin wrote:
Improved iRedAPD, add a new option in iredapd-rr.ini, used to bypass mails sent from postfix 'mynetworks':
in this line missing quotes on sender:
senderDN, senderLdif = self.__get_sender_dn_ldif(sender)

Bye

Sorry it's ok

Re: IREDAPD Problem

null@example.com (ZhangHuangbin) — Mon, 21 Feb 2011 14:39:00 +0000

Casa.it wrote:

in this line missing quotes on sender:
senderDN, senderLdif = self.__get_sender_dn_ldif(sender)

It's correct, because 'sender' is defined in above lines:

                    if bypass_mynetworks == 'yes':
                        sender = map['sasl_username']
                    else:
                        sender = map['sender']
    
                    senderDN, senderLdif = self.__get_sender_dn_ldif(sender)

Re: IREDAPD Problem

null@example.com (Casa.it) — Mon, 21 Feb 2011 14:26:04 +0000

ZhangHuangbin wrote:

Improved iRedAPD, add a new option in iredapd-rr.ini, used to bypass mails sent from postfix 'mynetworks':

in this line missing quotes on sender:

senderDN, senderLdif = self.__get_sender_dn_ldif(sender)

Bye

Re: IREDAPD Problem

null@example.com (ZhangHuangbin) — Mon, 21 Feb 2011 13:58:16 +0000

Casa.it wrote:

I was thinking the ldap query was made with sender address, not with saslusername.

Improved iRedAPD, add a new option in iredapd-rr.ini, used to bypass mails sent from postfix 'mynetworks':

bypass_mynetworks = yes

Code commit log:
http://code.google.com/p/iredmail/sourc … po=iredapd

Re: IREDAPD Problem

null@example.com (Casa.it) — Mon, 21 Feb 2011 13:53:44 +0000

ZhangHuangbin wrote:

That's the root cause.
So, it works for you now?

Yes it work now.

I was thinking the ldap query was made with sender address, not with saslusername.

Thks.

Enrico

Re: IREDAPD Problem

null@example.com (ZhangHuangbin) — Mon, 21 Feb 2011 13:38:47 +0000

Casa.it wrote:

There is no SASL authentication my ip is in mynetwork in main.cf of postfix.

That's the root cause.

So, it works for you now?

Re: IREDAPD Problem

null@example.com (Casa.it) — Mon, 21 Feb 2011 11:40:23 +0000

Now it's run.

here the log:

2011-02-21 12:39:15 DEBUG smtp session: request=smtpd_access_policy
2011-02-21 12:39:15 DEBUG smtp session: protocol_state=RCPT
2011-02-21 12:39:15 DEBUG smtp session: protocol_name=ESMTP
2011-02-21 12:39:15 DEBUG smtp session: client_address=192.168.37.33
2011-02-21 12:39:15 DEBUG smtp session: client_name=unknown
2011-02-21 12:39:15 DEBUG smtp session: reverse_client_name=unknown
2011-02-21 12:39:15 DEBUG smtp session: helo_name=DELL
2011-02-21 12:39:15 DEBUG smtp session: sender=enrico@xxxx.xxxx.com
2011-02-21 12:39:15 DEBUG smtp session: recipient=enri@gmail.com
2011-02-21 12:39:15 DEBUG smtp session: recipient_count=0
2011-02-21 12:39:15 DEBUG smtp session: queue_id=
2011-02-21 12:39:15 DEBUG smtp session: instance=5998.4d624ee3.bdaa3.0
2011-02-21 12:39:15 DEBUG smtp session: size=0
2011-02-21 12:39:15 DEBUG smtp session: etrn_domain=
2011-02-21 12:39:15 DEBUG smtp session: stress=
2011-02-21 12:39:15 DEBUG smtp session: sasl_method=
2011-02-21 12:39:15 DEBUG smtp session: sasl_username=
2011-02-21 12:39:15 DEBUG smtp session: sasl_sender=
2011-02-21 12:39:15 DEBUG smtp session: ccert_subject=
2011-02-21 12:39:15 DEBUG smtp session: ccert_issuer=
2011-02-21 12:39:15 DEBUG smtp session: ccert_fingerprint=
2011-02-21 12:39:15 DEBUG smtp session: encryption_protocol=
2011-02-21 12:39:15 DEBUG smtp session: encryption_cipher=
2011-02-21 12:39:15 DEBUG smtp session: encryption_keysize=0
2011-02-21 12:39:15 DEBUG LDAP connection initialied success.
2011-02-21 12:39:15 DEBUG LDAP bind success.
2011-02-21 12:39:15 DEBUG __get_sender_dn_ldif (sender): enrico@xxxx.xxxx.com
2011-02-21 12:39:15 DEBUG __get_sender_dn_ldif: Quering LDAP
2011-02-21 12:39:15 DEBUG __get_sender_dn_ldif (result): [('mail=enrico@xxxx.xxxx.com,ou=Users,domainName=xxxx.xxxx.com,o=domains,dc=xxxx,dc=xxxx,dc=com', {'shadowAddress': ['enrico@xxxx.xxxx.it'], 'uid': ['enrico'], 'mailQuota': ['1073741824'], 'objectClass': ['inetOrgPerson', 'mailUser', 'shadowAccount', 'amavisAccount'], 'userPassword': ['{SSHA}GsvLTawjgV8xxxxx2LDtB4muFWxxxxw=='], 'homeDirectory': ['/var/vmail/vmail1/xxxx.xxxx.com/e/en/enr/enrico-2010.06.10.17.11.16/'], 'accountStatus': ['active'], 'mailBlacklistRecipient': ['enri@gmail.com'], 'amavisBlacklistSender': ['enri@gmail.com'], 'mtaTransport': ['dovecot'], 'sn': ['enrico'], 'storageBaseDirectory': ['/var/vmail'], 'mail': ['enrico@xxxx.xxxx.com'], 'mailMessageStore': ['vmail1/xxxx.xxxx.com/e/en/enr/enrico-2010.06.10.17.11.16/'], 'enabledService': ['mail', 'smtp', 'deliver', 'pop3', 'pop3secured', 'imap', 'imapsecured', 'managesieve', 'managesievesecured', 'sieve', 'sievesecured', 'internal', 'forward', 'senderbcc', 'recipientbcc', 'shadowaddress', 'displayedInGlobalAddressBook'], 'cn': ['Enrico']})]
2011-02-21 12:39:15 DEBUG Apply plugin (ldap_recipient_restrictions).
2011-02-21 12:39:15 DEBUG Response from plugin (ldap_recipient_restrictions): REJECT Not authorized
2011-02-21 12:39:15 INFO Response from plugin (ldap_recipient_restrictions): REJECT Not authorized
2011-02-21 12:39:15 DEBUG Final action: REJECT Not authorized.
2011-02-21 12:39:15 INFO enrico@xxxx.xxxx.com -> enri@gmail.com, REJECT Not authorized
2011-02-21 12:39:15 DEBUG Connection closed

There is no SASL authentication my ip is in mynetwork in main.cf of postfix.

Re: IREDAPD Problem

null@example.com (ZhangHuangbin) — Mon, 21 Feb 2011 11:15:13 +0000

Forgot to mention that, please paste full log instead of last 20 lines. at least includes full smtp sessions.

Re: IREDAPD Problem

null@example.com (ZhangHuangbin) — Mon, 21 Feb 2011 11:10:27 +0000

I found a strange situation in your debug log, there's no "sasl_username" in smtp session, but there's "sender".

Could you please try to change /opt/iRedAPD-x.y.z/src/iredapd-rr.py, find this line (about line 254):

                senderDN, senderLdif = self.__get_sender_dn_ldif(map['sasl_username'])

Change "sasl_username" to "sender", restart iRedAPD and test it again. If it doesn't work, please paste log content here, thanks.

Did you send this test mail from shell command line, then it bypass SASL authentication?

Re: IREDAPD Problem

null@example.com (Casa.it) — Mon, 21 Feb 2011 09:33:54 +0000

Yes this is only plugin enable in iredapd-rr.ini.

The log iredapd-rr.log is different from irepapd.log:

2011-02-18 11:14:41 DEBUG smtp session: recipient_count=0
2011-02-18 11:14:41 DEBUG smtp session: queue_id=
2011-02-18 11:14:41 DEBUG smtp session: instance=375e.4d5e4691.c36ac.0
2011-02-18 11:14:41 DEBUG smtp session: size=0
2011-02-18 11:14:41 DEBUG smtp session: etrn_domain=
2011-02-18 11:14:41 DEBUG smtp session: stress=
2011-02-18 11:14:41 DEBUG smtp session: sasl_method=
2011-02-18 11:14:41 DEBUG smtp session: sasl_username=
2011-02-18 11:14:41 DEBUG smtp session: sasl_sender=
2011-02-18 11:14:41 DEBUG smtp session: ccert_subject=
2011-02-18 11:14:41 DEBUG smtp session: ccert_issuer=
2011-02-18 11:14:41 DEBUG smtp session: ccert_fingerprint=
2011-02-18 11:14:41 DEBUG smtp session: encryption_protocol=
2011-02-18 11:14:41 DEBUG smtp session: encryption_cipher=
2011-02-18 11:14:41 DEBUG smtp session: encryption_keysize=0
2011-02-18 11:14:41 DEBUG LDAP connection initialied success.
2011-02-18 11:14:41 DEBUG LDAP bind success.
2011-02-18 11:14:41 DEBUG __get_sender_dn_ldif (sender):
2011-02-18 11:14:41 DEBUG __get_sender_dn_ldif: Sender is not a valid email address.
2011-02-18 11:14:41 DEBUG Sender DN or LDIF is none.
2011-02-18 11:14:41 DEBUG Final action: DUNNO.

Re: IREDAPD Problem

null@example.com (ZhangHuangbin) — Mon, 21 Feb 2011 09:20:18 +0000

Which plugins are enabled in iredapd-rr.ini? It should be:

plugins = ldap_recipient_restrictions

Re: IREDAPD Problem

null@example.com (Casa.it) — Mon, 21 Feb 2011 09:02:21 +0000

There is any news?
Do you need other informarmation?

Thks

Enrico

Re: IREDAPD Problem

null@example.com (Casa.it) — Fri, 18 Feb 2011 11:14:26 +0000

alias_database = hash:/etc/postfix/aliases
alias_maps = hash:/etc/postfix/aliases
allow_min_user = no
append_dot_mydomain = no
biff = no
bounce_queue_lifetime = 1d
broken_sasl_auth_clients = yes
config_directory = /etc/postfix
content_filter = smtp-amavis:[127.0.0.1]:10024
delay_warning_time = 0h
disable_vrfy_command = yes
enable_original_recipient = no
home_mailbox = Maildir/
inet_interfaces = all
inet_protocols = ipv4
mail_name = iRedMail
mail_version = 0.6.1
mailbox_command = /usr/lib/dovecot/deliver
mailbox_size_limit = 15728640
maximal_backoff_time = 4000s
maximal_queue_lifetime = 1d
minimal_backoff_time = 300s
mydestination = localhost, localhost.localdomain, localhost.$myhostname
mydomain =xxxx.xxxxx.com
myhostname = xxxx.xxxx.com
mynetworks = 127.0.0.0/8, 192.168.37.33
mynetworks_style = subnet
myorigin = xxxx.xxxx.com
proxy_read_maps = $canonical_maps $lmtp_generic_maps $local_recipient_maps $mydestination $mynetworks $recipient_bcc_maps $recipient_canonical_maps $relay_domains $relay_recipient_maps $relocated_maps $sender_bcc_maps $sender_canonical_maps $smtp_generic_maps $smtpd_sender_login_maps $transport_maps $virtual_alias_domains $virtual_alias_maps $virtual_mailbox_domains $virtual_mailbox_maps
queue_run_delay = 300s
readme_directory = no
recipient_bcc_maps = proxy:ldap:/etc/postfix/ldap_recipient_bcc_maps_domain.cf, proxy:ldap:/etc/postfix/ldap_recipient_bcc_maps_user.cf
recipient_delimiter = +
relay_domains = $mydestination, proxy:ldap:/etc/postfix/ldap_relay_domains.cf
relayhost =
sender_bcc_maps = proxy:ldap:/etc/postfix/ldap_sender_bcc_maps_domain.cf, proxy:ldap:/etc/postfix/ldap_sender_bcc_maps_user.cf
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
smtpd_data_restrictions = reject_unauth_pipelining
smtpd_enforce_tls = no
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks,permit_sasl_authenticated, check_helo_access pcre:/etc/postfix/helo_access.pcre
smtpd_recipient_restrictions = reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_non_fqdn_sender, reject_non_fqdn_recipient, reject_unlisted_recipient, reject_unauth_pipelining, reject_invalid_hostname, check_policy_service inet:127.0.0.1:7777, permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, check_policy_service inet:127.0.0.1:10031
smtpd_reject_unlisted_recipient = yes
smtpd_reject_unlisted_sender = yes
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = no
smtpd_sasl_local_domain =
smtpd_sasl_path = private/dovecot-auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_sender_login_maps = proxy:ldap:/etc/postfix/ldap_sender_login_maps.cf
smtpd_sender_restrictions = check_policy_service inet:127.0.0.1:7778, permit_mynetworks, reject_sender_login_mismatch, permit_sasl_authenticated
smtpd_tls_cert_file = /etc/ssl/certs/iRedMail_CA.pem
smtpd_tls_key_file = /etc/ssl/private/iRedMail.key
smtpd_tls_loglevel = 0
smtpd_tls_security_level = may
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_use_tls = yes
tls_random_source = dev:/dev/urandom
transport_maps = proxy:ldap:/etc/postfix/ldap_transport_maps_user.cf, proxy:ldap:/etc/postfix/ldap_transport_maps_domain.cf
virtual_alias_maps = proxy:ldap:/etc/postfix/ldap_virtual_alias_maps.cf, proxy:ldap:/etc/postfix/ldap_virtual_group_maps.cf, proxy:ldap:/etc/postfix/ldap_sender_login_maps.cf, proxy:ldap:/etc/postfix/ldap_catch_all_maps.cf
virtual_gid_maps = static:1001
virtual_mailbox_base = /var/vmail
virtual_mailbox_domains = proxy:ldap:/etc/postfix/ldap_virtual_mailbox_domains.cf
virtual_mailbox_maps = proxy:ldap:/etc/postfix/ldap_virtual_mailbox_maps.cf
virtual_minimum_uid = 1001
virtual_transport = dovecot
virtual_uid_maps = static:1001

Re: IREDAPD Problem

null@example.com (ZhangHuangbin) — Fri, 18 Feb 2011 11:04:23 +0000

Can you show us your postfix config with command "postconf -n"?

Re: IREDAPD Problem

null@example.com (Casa.it) — Fri, 18 Feb 2011 09:39:15 +0000

There is a problem iredapd test a recipient address not a sender address.

the last ldap query that you have post run if I use the sender address.

log is this:

2011-02-18 10:42:39 DEBUG LDAP bind success.
2011-02-18 10:42:39 DEBUG __get_recipient_dn_ldif (recipient): enri@gmail.com
2011-02-18 10:42:39 DEBUG __get_recipient_dn_ldif (ldap query filter): (&(|(mail=enri@gmail.com)(shadowAddress=enri@gmail.com))(|(objectClass=mailUser)(objectClass=mailList)(objectClass=mailAlias)))
2011-02-18 10:42:39 DEBUG Can not find recipient in LDAP server.
2011-02-18 10:42:39 DEBUG Recipient DN or LDIF is None.
2011-02-18 10:42:39 DEBUG Final action: DUNNO.