1 Topic by alfredo

  • alfredo
  • Member
  • Offline
  • Registered: 2017-09-26
  • Posts: 4

Topic: Weird "Sender address rejected" works for some accounts

==== Required information ====
- iRedMail version (check /etc/iredmail-release): 0.9.7 OPENLDAP edition
- Linux/BSD distribution name and version: Ubuntu 16.04.2
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): LDAP
- Web server (Apache or Nginx): Nginx
- Manage mail accounts with iRedAdmin-Pro? No
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====

Error message I have below, the weird thing is that I get this error for a recently created account. But another one I created couple of days ago works just fine.


Error as seen at /var/log/maillog
...
Sep 25 13:25:09 dc postfix/submission/smtpd[5924]: connect from unknown[i.i.i.21]
Sep 25 13:25:09 dc postfix/submission/smtpd[5924]: Anonymous TLS connection established from unknown[i.i.i.21]: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
Sep 25 13:25:09 dc postfix/submission/smtpd[5924]: NOQUEUE: reject: RCPT from unknown[i.i.i.21]: 550 5.1.0 <bounce+57-res.users-1@XXXXX.XX>: Sender address rejected: User unknown in virtual mailbox table; from=<bounce+57-res.users-1@XXXXX.XX> to=<NNNNN@XXXXX.XX> proto=ESMTP helo=<XXXX.XXX.XXXXX.XX>
Sep 25 13:25:09 dc postfix/submission/smtpd[5924]: disconnect from unknown[i.i.i.21] ehlo=2 starttls=1 auth=1 mail=1 rcpt=0/1 rset=1 quit=1 commands=7/8

settings.py
...
ALLOWED_LOGIN_MISMATCH_SENDERS = ["AAA@XXXXX.XX", "BBB@XXXXX.XX", "CCC@XXXXX.XX"]
...

BBB and CCC work perfectly. I recently created AAA but it continues rejecting. I am using AAA from a odoo instance. Below output from a different odoo instance using CCC successfully

...
Sep 25 13:32:11 dc postfix/submission/smtpd[6094]: connect from unknown[i.i.i.23]
Sep 25 13:32:11 dc postfix/submission/smtpd[6094]: Anonymous TLS connection established from unknown[i.i.i.23]: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
Sep 25 13:32:11 dc postfix/submission/smtpd[6094]: DAA0225C48: client=unknown[i.i.i.23], sasl_method=PLAIN, sasl_username=BBB@XXXXX.XX
Sep 25 13:32:11 dc postfix/cleanup[6097]: DAA0225C48: message-id=<1506364331.741051912307739.689456565507167-openerp-8-res.users@YYYYY-YYYY>
Sep 25 13:32:11 dc postfix/qmgr[5583]: DAA0225C48: from=<bounce+5-res.users-8@YYYYY-YYYY.XXXXX.XX>, size=4410, nrcpt=1 (queue active)
Sep 25 13:32:11 dc postfix/submission/smtpd[6094]: disconnect from unknown[i.i.i.23] ehlo=2 starttls=1 auth=1 mail=1 rcpt=1 data=1 quit=1 commands=8
Sep 25 13:32:12 dc postfix/10025/smtpd[6101]: connect from XX.XXXXX.XX[127.0.0.1]
Sep 25 13:32:12 dc postfix/10025/smtpd[6101]: 4D4DB25C4C: client=XX.XXXXX.XX[127.0.0.1]
Sep 25 13:32:12 dc postfix/cleanup[6097]: 4D4DB25C4C: message-id=<1506364331.741051912307739.689456565507167-openerp-8-res.users@YYYYY-YYYY>
Sep 25 13:32:12 dc postfix/qmgr[5583]: 4D4DB25C4C: from=<bounce+5-res.users-8@YYYYY-YYYY.XXXXX.XX>, size=5420, nrcpt=1 (queue active)
Sep 25 13:32:12 dc postfix/10025/smtpd[6101]: disconnect from XX.XXXXX.XX[127.0.0.1] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5
Sep 25 13:32:12 dc amavis[2294]: (02294-04) Passed CLEAN {RelayedInternal}, ORIGINATING LOCAL [i.i.i.23]:39118 [i.i.i.23] <bounce+5-res.users-8@YYYYY-YYYY.XXXXX.XX> -> <DDDDD@gmail.com>, Queue-ID: DAA0225C48, Message-ID: <1506364331.741051912307739.689456565507167-openerp-8-res.users@YYYYY-YYYY>, mail_id: sfUtdsNyaeuY, Hits: -0.298, size: 4410, queued_as: 4D4DB25C4C, dkim_new=dkim:XXXXX.XX, 409 ms, Tests: [ALL_TRUSTED=-1,HTML_IMAGE_ONLY_20=0.7,HTML_MESSAGE=0.001,URIBL_BLOCKED=0.001]
Sep 25 13:32:12 dc postfix/amavis/smtp[6098]: DAA0225C48: to=<DDDDD@gmail.com>, relay=127.0.0.1[127.0.0.1]:10026, delay=0.54, delays=0.12/0.01/0/0.41, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 4D4DB25C4C)
Sep 25 13:32:12 dc postfix/qmgr[5583]: DAA0225C48: removed
Sep 25 13:32:13 dc postfix/smtp[6102]: 4D4DB25C4C: to=<DDDDD@gmail.com>, relay=127.0.0.1[127.0.0.1]:2534, delay=1.3, delays=0.01/0.02/0.7/0.55, dsn=2.0.0, status=sent (250 Ok 0101015eba4f9cf2-4de02da9-becc-4cca-8ad6-723711fa4f15-000000)
Sep 25 13:32:13 dc postfix/qmgr[5583]: 4D4DB25C4C: removed
...

postconf -n output
alias_database = hash:/etc/postfix/aliases
alias_maps = hash:/etc/postfix/aliases
allow_min_user = no
allow_percent_hack = no
biff = no
body_checks = pcre:/etc/postfix/body_checks.pcre
command_directory = /usr/sbin
compatibility_level = 2
content_filter = smtp-amavis:[127.0.0.1]:10024
daemon_directory = /usr/lib/postfix/sbin
data_directory = /var/lib/postfix
debug_peer_level = 2
debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5
disable_vrfy_command = yes
dovecot_destination_recipient_limit = 1
enable_original_recipient = no
header_checks = pcre:/etc/postfix/header_checks
inet_interfaces = all
inet_protocols = all
lmtp_tls_mandatory_protocols = !SSLv2 !SSLv3
lmtp_tls_protocols = !SSLv2 !SSLv3
mail_owner = postfix
mailq_path = /usr/bin/mailq
message_size_limit = 15728640
mydestination = $myhostname, localhost, localhost.localdomain
mydomain = XX.XXXXX.XX
myhostname = XX.XXXXX.XX
mynetworks = 127.0.0.1 [::1]
myorigin = XX.XXXXX.XX
newaliases_path = /usr/bin/newaliases
postscreen_access_list = permit_mynetworks cidr:/etc/postfix/postscreen_access.cidr
postscreen_blacklist_action = enforce
postscreen_dnsbl_action = enforce
postscreen_dnsbl_reply_map = texthash:/etc/postfix/postscreen_dnsbl_reply
postscreen_dnsbl_sites = zen.spamhaus.org=127.0.0.[2..11]*3 b.barracudacentral.org=127.0.0.[2..11]*2
postscreen_dnsbl_threshold = 2
postscreen_dnsbl_whitelist_threshold = -2
postscreen_greet_action = enforce
proxy_read_maps = $canonical_maps $lmtp_generic_maps $local_recipient_maps $mydestination $mynetworks $recipient_bcc_maps $recipient_canonical_maps $relay_domains $relay_recipient_maps $relocated_maps $sender_bcc_maps $sender_canonical_maps $smtp_generic_maps $smtpd_sender_login_maps $transport_maps $virtual_alias_domains $virtual_alias_maps $virtual_mailbox_domains $virtual_mailbox_maps $smtpd_sender_restrictions $sender_dependent_relayhost_maps
queue_directory = /var/spool/postfix
recipient_bcc_maps = proxy:ldap:/etc/postfix/ldap/recipient_bcc_maps_user.cf proxy:ldap:/etc/postfix/ldap/recipient_bcc_maps_domain.cf
recipient_delimiter = +
relay_domains = $mydestination proxy:ldap:/etc/postfix/ldap/relay_domains.cf
relayhost = 127.0.0.1:2534
sender_bcc_maps = proxy:ldap:/etc/postfix/ldap/sender_bcc_maps_user.cf proxy:ldap:/etc/postfix/ldap/sender_bcc_maps_domain.cf
sender_dependent_relayhost_maps = proxy:ldap:/etc/postfix/ldap/sender_dependent_relayhost_maps_user.cf proxy:ldap:/etc/postfix/ldap/sender_dependent_relayhost_maps_domain.cf
sendmail_path = /usr/sbin/sendmail
setgid_group = postdrop
smtp-amavis_destination_recipient_limit = 1
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_CAfile = $smtpd_tls_CAfile
smtp_tls_loglevel = 1
smtp_tls_mandatory_protocols = !SSLv2 !SSLv3
smtp_tls_note_starttls_offer = yes
smtp_tls_protocols = !SSLv2 !SSLv3
smtp_tls_security_level = may
smtpd_data_restrictions = reject_unauth_pipelining
smtpd_end_of_data_restrictions = check_policy_service inet:127.0.0.1:7777
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks permit_sasl_authenticated check_helo_access pcre:/etc/postfix/helo_access.pcre reject_non_fqdn_helo_hostname reject_unknown_helo_hostname
smtpd_recipient_restrictions = reject_unknown_recipient_domain reject_non_fqdn_recipient reject_unlisted_recipient check_policy_service inet:127.0.0.1:7777 permit_mynetworks permit_sasl_authenticated reject_unauth_destination
smtpd_reject_unlisted_recipient = yes
smtpd_reject_unlisted_sender = yes
smtpd_sasl_path = private/dovecot-auth
smtpd_sasl_type = dovecot
smtpd_sender_login_maps = proxy:ldap:/etc/postfix/ldap/sender_login_maps.cf
smtpd_sender_restrictions = reject_unknown_sender_domain reject_non_fqdn_sender reject_unlisted_sender permit_mynetworks permit_sasl_authenticated check_sender_access pcre:/etc/postfix/sender_access.pcre
smtpd_tls_CAfile = /etc/ssl/certs/iRedMail.crt
smtpd_tls_cert_file = /etc/ssl/certs/iRedMail.crt
smtpd_tls_dh1024_param_file = /etc/ssl/dh2048_param.pem
smtpd_tls_dh512_param_file = /etc/ssl/dh512_param.pem
smtpd_tls_exclude_ciphers = aNULL, eNULL, EXPORT, DES, RC4, MD5, PSK, aECDH, EDH-DSS-DES-CBC3-SHA, EDH-RSA-DES-CDC3-SHA, KRB5-DE5, CBC3-SHA
smtpd_tls_key_file = /etc/ssl/private/iRedMail.key
smtpd_tls_loglevel = 1
smtpd_tls_mandatory_protocols = !SSLv2 !SSLv3
smtpd_tls_protocols = !SSLv2 !SSLv3
smtpd_tls_security_level = may
swap_bangpath = no
tls_random_source = dev:/dev/urandom
transport_maps = proxy:ldap:/etc/postfix/ldap/transport_maps_user.cf proxy:ldap:/etc/postfix/ldap/transport_maps_domain.cf
unknown_local_recipient_reject_code = 550
virtual_alias_domains =
virtual_alias_maps = proxy:ldap:/etc/postfix/ldap/virtual_alias_maps.cf proxy:ldap:/etc/postfix/ldap/virtual_group_maps.cf proxy:ldap:/etc/postfix/ldap/virtual_group_members_maps.cf proxy:ldap:/etc/postfix/ldap/catchall_maps.cf
virtual_gid_maps = static:2000
virtual_mailbox_base = /var/vmail
virtual_mailbox_domains = proxy:ldap:/etc/postfix/ldap/virtual_mailbox_domains.cf
virtual_mailbox_maps = proxy:ldap:/etc/postfix/ldap/virtual_mailbox_maps.cf
virtual_minimum_uid = 2000
virtual_transport = dovecot
virtual_uid_maps = static:2000

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by alfredo

  • alfredo
  • Member
  • Offline
  • Registered: 2017-09-26
  • Posts: 4

Re: Weird "Sender address rejected" works for some accounts

postmap output

sudo postmap -q "AAA@XXXXX.XX" ldap:/etc/postfix/ldap/virtual_mailbox_maps.cf
vmail1/XXXXX.XX/n/o/t/AAA-2017.09.25.10.17.16//Maildir/

3 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,163

Re: Weird "Sender address rejected" works for some accounts

alfredo wrote:

Sender address rejected: User unknown in virtual mailbox table

This means Postfix cannot find the account by ldap query.

Try this:

cd /etc/postfix/ldap/
for cf in $(ls); do postmap -q "AAA@XXXXX.XX" ldap:./$cf; done

Try it with a working account first, then a not working account, compare the output.

Also, how did you create the mail account?

4 Reply by alfredo

  • alfredo
  • Member
  • Offline
  • Registered: 2017-09-26
  • Posts: 4

Re: Weird "Sender address rejected" works for some accounts

ZhangHuangbin wrote:

Try it with a working account first, then a not working account, compare the output.

Output is the same. Sorry for the postfix question but do you know how can I see what user is odoo connecting with? I can't figure that out from /var/log/maillog

This is the output (skipping empty responses) CCC has same output (I mean with CCC instead)

ACCOUNT@HOST:/etc/postfix/ldap$ for cf in $(ls); do echo $cf && sudo postmap -q "AAA@XXXXX.XX" ldap:./$cf ; echo; done

sender_login_maps.cf
AAA@XXXXX.XX

virtual_group_members_maps.cf
AAA@XXXXX.XX

virtual_mailbox_maps.cf
vmail1/XXXXX.XX/n/o/t/AAA-2017.09.25.10.17.16//Maildir/

Some more background. I put logs in reject_sender_login_mismatch.py. I can see my logs for CCC and none for AAA. So postfix is not even trying iredapd. Given that all seems right then perhaps odoo is not using the new configuration given. I am having these issues after decided to delete DDD create AAA and EEE. Then I created DDD as alias of EEE and decided to go with AAA as my address for automatic responses. I suspect odoo is somehow still trying to use DDD instead of AAA but I am not sure how to verify that from postfix.

HOST:/etc/postfix/ldap$ for cf in $(ls); do echo $cf && sudo postmap -q "DDD@XXXXX.XX" ldap:./$cf ; echo; done

virtual_alias_maps.cf
EEE@XXXXX.XX

5 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,163

Re: Weird "Sender address rejected" works for some accounts

Could you please try to send one more testing email to trigger the error and show us related Postfix log?

Note: Show us the original log, but you can replace your domain name by 'mydomain.com'.