1 Topic by Radapompa

  • Radapompa
  • Member
  • Offline
  • Registered: 2016-05-18
  • Posts: 20

Topic: Allow server to use relay on TCP/25 without auth and SSL

==== Required information ====
- iRedMail version (check /etc/iredmail-release): 0.9.7
- Linux/BSD distribution name and version: Debian 8
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): LDAP
- Web server (Apache or Nginx): Nginx
- Manage mail accounts with iRedAdmin-Pro?
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====

We have some systems that we need to have mail from. These systems though dosen't have much of configurations enabled more than setting from/to address and which relay server you want to use. Our relay server is an iredmail server which only handles relay, nothing else. So I thought we could still use it for this.

What I've done so far is change the smtpd settings in master.cf to handle non SSL/TLS connections, disabled sasl_auth, and remove the helo restrictions
smtpd     pass  -       -       -       -       -       smtpd
  -o smtpd_tls_security_level=none
  -o smtpd_sasl_auth_enabled=no
  -o smtpd_helo_required=no
  -o smtpd_helo_restrictions=

On that, I've added one of the machines mailaddresses in iredadmin as an account, and then tried to add it to the sender_access.pcre
/server\@example\.com/        OK

But we're not getting through the relay server. This is the error from mail.log (with changed IP and mailadresses):
postfix/smtpd[30439]: NOQUEUE: reject: RCPT from unknown[10.0.100.10]: 454 4.7.1 <reciever@external.com>: Relay access denied; from=<server@example.com> to=<reciever@external.com> proto=SMTP helo=<NXS-B01-000-13E500B6-0>

So, to me it seems that the sender_access.pcre is not used? Should I add more options to the smtpd in master.cf?

(Also, please update http://www.iredmail.org/docs/allow.user … tion.html, as this is not handling sender_access.pcre)

Best Regards
Johan Olsson

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,793

Re: Allow server to use relay on TCP/25 without auth and SSL

Radapompa wrote:

smtpd     pass  -       -       -       -       -       smtpd

*) This line means it's listening on port 25. Is it intended? Did you try to add "-o smtpd_sender_restrictions=check_sender_access hash:/etc/postfix/accepted_unauth_senders" in this smtpd service?
*) Did you send email without smtp auth?
*) The easier solution is appending the server IP in Postfix parameter "mynetworks =" and iRedAPD parameter "MYNETWORKS =".

3 Reply by Radapompa

  • Radapompa
  • Member
  • Offline
  • Registered: 2016-05-18
  • Posts: 20

Re: Allow server to use relay on TCP/25 without auth and SSL

ZhangHuangbin wrote:
Radapompa wrote:

smtpd     pass  -       -       -       -       -       smtpd

*) This line means it's listening on port 25. Is it intended? Did you try to add "-o smtpd_sender_restrictions=check_sender_access hash:/etc/postfix/accepted_unauth_senders" in this smtpd service?

Yes, it's intended to use port 25. These systems have very limited configuration parameters. So the relay need to respond on port 25. Without auth and without TLS.
I haven't tried that part, but won't it take configuration from main.conf if nothing else is specified? Since in main.conf, there is already a line for check_sender_access which points to sender_access.pcre. Shouldn't that work?
Tried with adding the option, but still getting the same error.

ZhangHuangbin wrote:

*) Did you send email without smtp auth?

Yes, can't even add an auth to the remote system.

ZhangHuangbin wrote:

*) The easier solution is appending the server IP in Postfix parameter "mynetworks =" and iRedAPD parameter "MYNETWORKS =".

This part got it working! Thanks for the help