[Postfixbuch-users] Client host rejected: Access denied
Robert Felber
r.felber at ek-muc.de
Di Apr 10 11:57:07 CEST 2007
On Tue, Apr 10, 2007 at 11:48:06AM +0200, David Obando wrote:
> Robert Felber schrieb am 10.04.2007 11:36:
> > On Tue, Apr 10, 2007 at 09:31:44AM +0200, David Obando wrote:
> >
> >> Guten Morgen,
> >>
> >> in meinen Logs fand ich folgende Einträge:
> >>
> >> Apr 6 12:04:14 black postfix/smtpd[5190]: connect from
> >> cedis01.cedis.fu-berlin.de[160.45.168.7]
> >> Apr 6 12:04:14 black postfix/smtpd[5190]: setting up TLS connection
> >> from cedis01.cedis.fu-berlin.de[160.45.168.7]
> >> Apr 6 12:04:14 black postfix/smtpd[5190]: TLS connection established
> >> from cedis01.cedis.fu-berlin.de[160.45.168.7]: SSLv3 with cipher RC4-MD5
> >> (128/128 bits)
> >> Apr 6 12:04:14 black postfix/smtpd[5190]: NOQUEUE: reject: RCPT from
> >> cedis01.cedis.fu-berlin.de[160.45.168.7]: 554 5.7.1
> >> <cedis01.cedis.fu-berlin.de [160.45.168.7]>: Client host rejected:
> >> Access denied; from=<xxx at web.de> to=<xxx at notmail.org> proto=ESMTP
> >> helo=<cedis01.cedis.fu-berlin.de>
> >> Apr 6 12:04:14 black postfix/smtpd[5190]: disconnect from
> >> cedis01.cedis.fu-berlin.de[160.45.168.7]
> >>
> >> Apr 9 17:49:39 black postfix/smtpd[5638]: connect from
> >> cedis01.cedis.fu-berlin.de[160.45.168.7]
> >> Apr 9 17:49:39 black postfix/smtpd[5638]: setting up TLS connection
> >> from cedis01.cedis.fu-berlin.de[160.45.168.7]
> >> Apr 9 17:49:39 black postfix/smtpd[5638]: TLS connection established
> >> from cedis01.cedis.fu-berlin.de[160.45.168.7]: SSLv3 with cipher RC4-MD5
> >> (128/128 bits)
> >> Apr 9 17:49:40 black postfix/smtpd[5638]: NOQUEUE: reject: RCPT from
> >> cedis01.cedis.fu-berlin.de[160.45.168.7]: 554 5.7.1
> >> <cedis01.cedis.fu-berlin.de [160.45.168.7]>: Client host rejected:
> >> Access denied; from=<xxx at zedat.fu-berlin.de> to=<xxx at notmail.org>
> >> proto=ESMTP helo=<cedis01.cedis.fu-berlin.de>
> >> Apr 9 17:49:40 black postfix/smtpd[5638]: disconnect from
> >> cedis01.cedis.fu-berlin.de[160.45.168.7]
> >>
> >>
> >> Wieso werden diese Mails rejected?
> >>
> >
> > postconf -n
> > und master.cf
> >
> >
> >
> OK, hier also:
>
> alias_database = hash:/etc/aliases
> alias_maps = hash:/etc/aliases
> append_dot_mydomain = no
> biff = no
> broken_sasl_auth_clients = yes
> config_directory = /etc/postfix
> content_filter = smtp-amavis:[127.0.0.1]:10024
> home_mailbox = Maildir/
> mailbox_size_limit = 0
> message_size_limit = 20480000
> mydestination = $mydomain, black, $myhostname, localhost,
> localhost.$mydomain
> myhostname = black.cryptix.de
> mynetworks = 127.0.0.0/8 10.0.0.0/24 83.137.101.96/27
> myorigin = /etc/mailname
> recipient_delimiter = +
> smtp_tls_CAfile = /etc/ssl/certs/ca-comodo.crt
> smtp_tls_cert_file = /etc/ssl/certs/mail.cryptix.de.cert
> smtp_tls_key_file = /etc/ssl/private/mail.cryptix.de.key
> smtp_tls_session_cache_database = btree:${queue_directory}/smtp_scache
> smtp_use_tls = yes
> smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
> smtpd_helo_required = yes
> smtpd_recipient_restrictions = permit_mynetworks,
> permit_sasl_authenticated, check_client_access
> hash:/var/lib/pop-before-smtp/hosts,
Steht da irgendwie ein reject drinnen?
> reject_non_fqdn_hostname, reject_non_fqdn_sender,
> reject_non_fqdn_recipient, reject_unauth_destination,
> reject_unauth_pipelining, reject_invalid_helo_hostname
> reject_unknown_sender_domain, reject_unknown_recipient_domain,
> reject_rbl_client zen.spamhaus.org, reject_rbl_client
> zombie.dnsbl.sorbs.net, reject_rbl_client list.dsbl.org, permit
> smtpd_sasl_auth_enable = yes
> smtpd_sasl_authenticated_header = no
> smtpd_sasl_local_domain = $myhostname
> smtpd_sasl_path = private/auth
> smtpd_sasl_security_options = noanonymous
> smtpd_sasl_type = dovecot
> smtpd_tls_CAfile = /etc/ssl/certs/ca-comodo.crt
> smtpd_tls_auth_only = yes
> smtpd_tls_cert_file = /etc/ssl/certs/mail.cryptix.de.cert
> smtpd_tls_key_file = /etc/ssl/private/mail.cryptix.de.key
> smtpd_tls_loglevel = 1
> smtpd_tls_received_header = yes
> smtpd_tls_session_cache_database = btree:${queue_directory}/smtpd_scache
> smtpd_tls_session_cache_timeout = 3600s
> smtpd_use_tls = yes
> tls_random_source = dev:/dev/urandom
> virtual_alias_maps = proxy:mysql:/etc/postfix/mysql_virtual_alias_maps.cf
> virtual_gid_maps = static:114
> virtual_mailbox_base = /home/vmail
> virtual_mailbox_domains =
> proxy:mysql:/etc/postfix/mysql_virtual_domains_maps.cf
> virtual_mailbox_maps =
> proxy:mysql:/etc/postfix/mysql_virtual_mailbox_maps.cf
> virtual_minimum_uid = 115
> virtual_transport = virtual
> virtual_uid_maps = static:115
>
> und master.cf:
> #
> # Postfix master process configuration file. For details on the format
> # of the file, see the master(5) manual page (command: "man 5 master").
> #
> # ==========================================================================
> # service type private unpriv chroot wakeup maxproc command + args
> # (yes) (yes) (yes) (never) (100)
> # ==========================================================================
> smtp inet n - - - - smtpd
> submission inet n - n - - smtpd
> -o smtpd_etrn_restrictions=reject
> -o smtpd_sasl_auth_enable=yes
> -o smtpd_client_restrictions=permit_sasl_authenticated,reject
> -o content_filter=smtp-amavis:[127.0.0.1]:10026
> smtps inet n - n - - smtpd
> -o smtpd_tls_wrappermode=yes
> -o smtpd_sasl_auth_enable=yes
> -o smtpd_client_restrictions=permit_sasl_authenticated,reject
> -o content_filter=smtp-amavis:[127.0.0.1]:10026
ich kann mich taeuschen, und ich kenn den wrappermode nicht mehr so
genau, das reject am ende, trifft das hosts die ueber port 25 einliefern?
> #628 inet n - - - - qmqpd
> pickup fifo n - - 60 1 pickup
> -o content_filter=
> cleanup unix n - - - 0 cleanup
> qmgr fifo n - n 300 1 qmgr
> #qmgr fifo n - - 300 1 oqmgr
> tlsmgr unix - - - 1000? 1 tlsmgr
> rewrite unix - - - - - trivial-rewrite
> bounce unix - - - - 0 bounce
> defer unix - - - - 0 bounce
> trace unix - - - - 0 bounce
> verify unix - - - - 1 verify
> flush unix n - - 1000? 0 flush
> proxymap unix - - n - - proxymap
> smtp unix - - - - - smtp
> # When relaying mail as backup MX, disable fallback_relay to avoid MX loops
> relay unix - - - - - smtp
> -o fallback_relay=
> # -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
> showq unix n - - - - showq
> error unix - - - - - error
> discard unix - - - - - discard
> local unix - n n - - local
> virtual unix - n n - - virtual
> lmtp unix - - - - - lmtp
> anvil unix - - - - 1 anvil
> scache unix - - - - 1 scache
> #
> # ====================================================================
> # Interfaces to non-Postfix software. Be sure to examine the manual
> # pages of the non-Postfix software to find out what options it wants.
> #
> # Many of the following services use the Postfix pipe(8) delivery
> # agent. See the pipe(8) man page for information about ${recipient}
> # and other message envelope options.
> # ====================================================================
> #
> # maildrop. See the Postfix MAILDROP_README file for details.
> # Also specify in main.cf: maildrop_destination_recipient_limit=1
> #
> maildrop unix - n n - - pipe
> flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
> #
> # See the Postfix UUCP_README file for configuration details.
> #
> uucp unix - n n - - pipe
> flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail
> ($recipient)
> # Vacation
> vacation unix - n n - - pipe
> flags=Rq user=vacation argv=/var/spool/vacation/vacation.pl -f
> ${sender} -- ${recipient}
> #
> # Other external delivery methods.
> #
> ifmail unix - n n - - pipe
> flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
> bsmtp unix - n n - - pipe
> flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender
> $recipient
> scalemail-backend unix - n n - 2 pipe
> flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store
> ${nexthop} ${user} ${extension}
> mailman unix - n n - - pipe
> flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
> ${nexthop} ${user}
> smtp-amavis unix - - n - - smtp
> -o smtp_data_done_timeout=1200
> -o smtp_send_xforward_command=yes
> -o disable_dns_lookups=yes
> -o max_use=20
>
> 127.0.0.1:10025 inet n - n - - smtpd
> -o content_filter=
> -o local_recipient_maps=
> -o relay_recipient_maps=
> -o smtpd_restriction_classes=
> -o smtpd_delay_reject=no
> -o smtpd_client_restrictions=permit_mynetworks,reject
> -o smtpd_helo_restrictions=
> -o smtpd_sender_restrictions=
> -o smtpd_recipient_restrictions=permit_mynetworks,reject
> -o smtpd_data_restrictions=reject_unauth_pipelining
> -o smtpd_end_of_data_restrictions=
> -o mynetworks=127.0.0.0/8
> -o smtpd_error_sleep_time=0
> -o smtpd_soft_error_limit=1001
> -o smtpd_hard_error_limit=1000
> -o smtpd_client_connection_count_limit=0
> -o smtpd_client_connection_rate_limit=0
> -o
> receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_address_mappings
>
>
> Grüße,
> David
>
> --
> The day microsoft makes something that doesn't suck is the day they start making vacuum cleaners.
> gpg --keyserver pgp.mit.edu --recv-keys 1920BD87
> Key fingerprint = 3326 32CE 888B DFF1 DED3 B8D2 105F 29CB 1920 BD87
>
> --
> _______________________________________________
> Postfixbuch-users -- http://www.postfixbuch.de
> Heinlein Professional Linux Support GmbH
>
> Postfixbuch-users at listi.jpberlin.de
> http://listi.jpberlin.de/mailman/listinfo/postfixbuch-users
--
Robert Felber (PGP: 896CF30B)
Munich, Germany
Mehr Informationen über die Mailingliste Postfixbuch-users