[Postfixbuch-users] Postfix mit mysql-Support und 450 für nicht existierende Empfänger

[Michael Nausch]

Griaseichallemidananda!

Ich habe da ein kleines aber feines Mailserverchen geerbt, welches ich 
betreuen und upgraden soll.

Bevor ich das Ding aber neu baue, habe ich mir gesagt, ich nehm es mal 
auseinander und kucke mal, welche faulen Eier mir da ins Nest gelegt 
wurden. ;)

Und eines dieser faulen Eier, die ich gefunden habe, ist die Anbindung 
an die mysql für die Verwaltung der virtuellen Domänen und deren User. 
Das Ganze klappt eigentlich recht gut, bis auf einen feinen Umstand.

Werden eMails an nicht existierende Benutzer angeliefert, wird statt 
einem 550er ein temporärer Fehler ausgeworfen.

Bsp:
======================================================================
[micael at pml010045 ~]$ telnet mx1.it-ignorant.org 25
Trying 88.198.173.2...
Connected to mx1.it-ignorant.org.
Escape character is '^]'.
220 mx1.it-ignorant.org ESMTP ma1L5Y573m V0n 17-1Rn0rAn7.0r9
helo mx1.nausch.org
250 mx1.it-ignorant.org
mail from:<michael at nausch.org>
250 2.1.0 Ok
rcpt to:<diese-email-adresse-gibt-es-nicht at it-ignorant.org>
451 4.3.0 <diese-email-adresse-gibt-es-nicht at it-ignorant.org>: Temporary 
lookup failure
quit
221 2.0.0 Bye
Connection closed by foreign host.
======================================================================

Im Maillog taucht entsprechend auf:
======================================================================
Sep 24 17:41:38 mailbitch postfix/smtpd[29153]: connect from 
mx1.nausch.org[88.217.187.21]
Sep 24 17:41:48 mailbitch postfix/policyd-weight[21479]: decided 
action=PREPEND X-policyd-weight:  NOT_IN_SBL_XBL_SPAMHAUS=-1.5 
NOT_IN_SPAMCOP=-1.5 NOT_IN_BL_NJABL=-1.5 (only DNSBL check requested); 
<client=88.217.187.21> <helo=mx1.nausch.org> <from=michael at nausch.org> 
<to=diese-email-adresse-gibt-es-nicht at it-ignorant.org>; delay: 0s
Sep 24 17:41:48 mailbitch postfix/proxymap[28436]: warning: connect to 
mysql server localhost: Access denied for user 'postfix'@'localhost' 
(using password: YES)
Sep 24 17:41:48 mailbitch postfix/smtpd[29153]: NOQUEUE: reject: RCPT 
from mx1.nausch.org[88.217.187.21]: 451 4.3.0 
<diese-email-adresse-gibt-es-nicht at it-ignorant.org>: Temporary lookup 
failure; from=<michael at nausch.org> 
to=<diese-email-adresse-gibt-es-nicht at it-ignorant.org> proto=SMTP 
helo=<mx1.nausch.org>
Sep 24 17:41:53 mailbitch postfix/smtpd[29153]: disconnect from 
mx1.nausch.org[88.217.187.21]
======================================================================

Bemerkenswert ist die Meldung "Access denied for user 
'postfix'@'localhost'" die jedesmal kommt, wenn kein Treffer in der 
zugehörigen Datenbank(tabelle) gefunden wird. Gibt es einen Treffer, 
gibt es einen 250er und alles ist gut.

Die Postfixkonfiguration kuckt wie folgt aus:

======================================================================
# postconf -n
address_verify_map = btree:/var/spool/postfix/data/verify.db
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
anvil_rate_time_unit = 60s
append_dot_mydomain = no
body_checks = pcre:/etc/postfix/body_check_maps
bounce_size_limit = 8192
bounce_template_file = /etc/postfix/bounce.de-DE.cf
broken_sasl_auth_clients = no
config_directory = /etc/postfix
enable_original_recipient = no
header_checks = pcre:/etc/postfix/header_check_maps
inet_interfaces = all
mailbox_size_limit = 0
mydestination = localhost.localdomain, localhost
mydomain = it-ignorant.org
myhostname = mx1.it-ignorant.org
mynetworks = 127.0.0.0/8 10.0.0.0/26
myorigin = $mydomain
readme_directory = no
recipient_canonical_maps = btree:/etc/postfix/recipient_canonical_maps
recipient_delimiter = +
relay_clientcerts = btree:/etc/postfix/relay_clientcerts
relay_domains = lists.it-ignorant.org
relay_recipient_maps = hash:/var/lib/mailman/data/virtual-mailman 
hash:/var/lib/mailman/data/virtual-mailman-manual
relayhost =
relocated_maps = btree:/etc/postfix/relocated_maps
sender_canonical_maps = btree:/etc/postfix/sender_canonical_maps
smtp_generic_maps = btree:/etc/postfix/smtp_generic_maps
smtp_tls_CAfile = /etc/pki/postfix/ca-certificates.crt
smtp_tls_loglevel = 1
smtp_tls_security_level = may
smtpd_banner = $myhostname ESMTP ma1L5Y573m V0n 17-1Rn0rAn7.0r9
smtpd_client_connection_count_limit = 20
smtpd_client_connection_rate_limit = 20
smtpd_client_message_rate_limit = 50
smtpd_client_recipient_rate_limit = 50
smtpd_recipient_limit = 250
smtpd_recipient_restrictions = check_recipient_access 
btree:/etc/postfix/access_recipient-rfc    check_client_access 
cidr:/etc/postfix/access_client    check_helo_access 
btree:/etc/postfix/access_helo    check_sender_access 
btree:/etc/postfix/access_sender    check_recipient_access 
btree:/etc/postfix/access_recipient    reject_non_fqdn_sender 
reject_non_fqdn_recipient    reject_unknown_sender_domain 
reject_unknown_recipient_domain    permit_sasl_authenticated 
permit_mynetworks    reject_rbl_client zen.spamhaus.org 
reject_rbl_client ix.dnsbl.manitu.net    reject_rbl_client 
bl.spamcop.net    reject_rbl_client dnsbl.njabl.org 
check_client_access btree:/etc/postfix/policyd_weight_client_whitelist 
   check_policy_service inet:127.0.0.1:12525 
reject_unverified_recipient    reject_unauth_destination        permit
smtpd_sasl_auth_enable = yes
smtpd_sasl_local_domain = $mydomain
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_tls_ask_ccert = yes
smtpd_tls_auth_only = no
smtpd_tls_cert_file = /etc/pki/postfix/server.crt
smtpd_tls_key_file = /etc/pki/postfix/server.key
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_security_level = may
smtpd_tls_session_cache_database = btree:/var/spool/postfix/data/smtp_scache
tls_random_source = dev:/dev/urandom
transport_maps = hash:/etc/postfix/transport,	 
proxy:mysql:/etc/postfix/mysql_transport_test.cf
unknown_address_reject_code = 550
unknown_client_reject_code = 550
unknown_hostname_reject_code = 550
unknown_local_recipient_reject_code = 550
virtual_alias_maps = 
proxy:mysql:/etc/postfix/mysql_virtual_alias_maps.cf, 
proxy:mysql:/etc/postfix/mysql_virtual_alias_domain_maps.cf, 
proxy:mysql:/etc/postfix/mysql_virtual_test.cf, 
proxy:mysql:/etc/postfix/mysql_virtual_alias_domain_catchall_maps.cf
virtual_mailbox_domains = 
proxy:mysql:/etc/postfix/mysql_virtual_domains_maps.cf
virtual_mailbox_maps = 
proxy:mysql:/etc/postfix/mysql_virtual_mailbox_maps.cf, 
proxy:mysql:/etc/postfix/mysql_virtual_alias_domain_mailbox_maps.cf
virtual_transport = dovecot
======================================================================

So und nun beisst auch mal wieder bei mir aus. Warum nur werden 
unbekannte Empfänger nicht mit einem 550er abgelehnt?


Pfiadseich
Michael