Discussion:
[SLE] Postfix+Cyrus+SASL: Problems to redirect mails from unknown users to postmaster
(too old to reply)
Achim Schön
2004-06-03 15:10:49 UTC
Permalink
Hello everybody,

On my mail system mails to unknown users are replied automatically and
host public/lmtp[public/lmtp] said: 550-Mailbox unknown.
Either there is no mailbox associated with this 550-name or you do
not have
authorization to see it. 550 5.1.1 User unknown (in reply to RCPT TO
command)
In times where hundreds of virus mails arrived this is of course not the
right choice, but I've not managed to redirect mails to unknown users to
the postmaster account.

I'm currently running postfix with cyrus and SASL. Mailbox transport is
set to lmtp:unix:public/lmtp and therefor luser_relay does not work.


Any ideas how to configure the mail system in the desired way are welcome.

Thanks in advance
Achim


For more information the output of postconf is appended in the following
lines:

2bounce_notice_recipient = postmaster
access_map_reject_code = 554
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
allow_mail_to_commands = alias,forward
allow_mail_to_files = alias,forward
allow_min_user = no
allow_percent_hack = yes
allow_untrusted_routing = no
alternate_config_directories =
always_bcc =
append_at_myorigin = yes
append_dot_mydomain = yes
authorized_verp_clients = $mynetworks
berkeley_db_create_buffer_size = 16777216
berkeley_db_read_buffer_size = 131072
best_mx_transport =
biff = yes
body_checks =
body_checks_size_limit = 51200
bounce_notice_recipient = postmaster
bounce_service_name = bounce
bounce_size_limit = 50000
broken_sasl_auth_clients = no
canonical_maps = hash:/etc/postfix/canonical
cleanup_service_name = cleanup
command_directory = /usr/sbin
command_expansion_filter =
1234567890!@%-_=+:,./abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
command_time_limit = 1000s
config_directory = /etc/postfix
content_filter =
daemon_directory = /usr/lib/postfix
daemon_timeout = 18000s
debug_peer_level = 2
debug_peer_list =
default_database_type = hash
default_delivery_slot_cost = 5
default_delivery_slot_discount = 50
default_delivery_slot_loan = 3
default_destination_concurrency_limit = 20
default_destination_recipient_limit = 50
default_extra_recipient_limit = 1000
default_minimum_delivery_slots = 3
default_privs = nobody
default_process_limit = 100
default_rbl_reply = $rbl_code Service unavailable; $rbl_class
[$rbl_what] blocked using $rbl_domain${rbl_reason?; $rbl_reason}
default_recipient_limit = 10000
default_transport = smtp
default_verp_delimiters = +=
defer_code = 450
defer_service_name = defer
defer_transports =
delay_notice_recipient = postmaster
delay_warning_time = 0h
deliver_lock_attempts = 20
deliver_lock_delay = 1s
disable_dns_lookups = no
disable_mime_input_processing = no
disable_mime_output_conversion = no
disable_verp_bounces = no
disable_vrfy_command = no
dont_remove = 0
double_bounce_sender = double-bounce
duplicate_filter_limit = 1000
empty_address_recipient = MAILER-DAEMON
error_notice_recipient = postmaster
error_service_name = error
expand_owner_alias = no
export_environment = TZ MAIL_CONFIG
extract_recipient_limit = 10240
fallback_relay =
fallback_transport = smtp:***@buw-soft.de
fast_flush_domains = $relay_domains
fast_flush_purge_time = 7d
fast_flush_refresh_time = 12h
fault_injection_code = 0
flush_service_name = flush
fork_attempts = 5
fork_delay = 1s
forward_expansion_filter =
1234567890!@%-_=+:,./abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
forward_path =
$home/.forward${recipient_delimiter}${extension},$home/.forward
hash_queue_depth = 1
hash_queue_names = incoming,active,deferred,bounce,defer,flush,hold
header_address_token_limit = 10240
header_checks =
header_size_limit = 102400
helpful_warnings = yes
home_mailbox =
hopcount_limit = 50
ignore_mx_lookup_error = no
import_environment = MAIL_CONFIG MAIL_DEBUG MAIL_LOGTAG TZ XAUTHORITY
DISPLAY
in_flow_delay = 1s
inet_interfaces = all
initial_destination_concurrency = 5
invalid_hostname_reject_code = 501
ipc_idle = 100s
ipc_timeout = 3600s
line_length_limit = 2048
lmtp_cache_connection = yes
lmtp_connect_timeout = 0s
lmtp_data_done_timeout = 600s
lmtp_data_init_timeout = 120s
lmtp_data_xfer_timeout = 180s
lmtp_lhlo_timeout = 300s
lmtp_mail_timeout = 300s
lmtp_quit_timeout = 300s
lmtp_rcpt_timeout = 300s
lmtp_rset_timeout = 300s
lmtp_sasl_auth_enable = no
lmtp_sasl_password_maps =
lmtp_sasl_security_options = noplaintext, noanonymous
lmtp_skip_quit_response = no
lmtp_tcp_port = 24
local_command_shell =
local_destination_concurrency_limit = 2
local_destination_recipient_limit = 1
local_recipient_maps =
local_transport = local:$myhostname
luser_relay = ***@buw-soft.de
mail_name = Postfix
mail_owner = postfix
mail_release_date = 20030305
mail_spool_directory = /var/mail
mail_version = 2.0.6
mailbox_command =
mailbox_command_maps =
mailbox_delivery_lock = fcntl, dotlock
mailbox_size_limit = 5120000000
mailbox_transport = lmtp:unix:public/lmtp
mailq_path = /usr/bin/mailq
manpage_directory = /usr/share/man
maps_rbl_domains =
maps_rbl_reject_code = 554
masquerade_classes = envelope_sender, header_sender, header_recipient
masquerade_domains =
masquerade_exceptions = root
max_idle = 100s
max_use = 100
maximal_backoff_time = 4000s
maximal_queue_lifetime = 5d
message_size_limit = 1024000000
mime_boundary_length_limit = 2048
mime_header_checks = $header_checks
mime_nesting_limit = 100
minimal_backoff_time = 1000s
mydestination = $myhostname, localhost.$mydomain, $mydomain,
buwmail.dnsalias.com,buw.dnsalias.com,buw-soft.com,DSL01.212.114.214.245.NEFkom.net

mydomain = buw-soft.de
myhostname = buwserver.buw-soft.de
mynetworks = 127.0.0.0/8 131.188.115.0/24
mynetworks_style = subnet
myorigin = $mydomain
nested_header_checks = $header_checks
newaliases_path = /usr/bin/newaliases
non_fqdn_reject_code = 504
notify_classes = resource,software,bounce,2bounce,delay,policy,protocol
owner_request_special = yes
parent_domain_matches_subdomains =
debug_peer_list,fast_flush_domains,mynetworks,permit_mx_backup_networks,qmqpd_authorized_clients,relay_domains,smtpd_access_maps

permit_mx_backup_networks =
pickup_service_name = pickup
prepend_delivered_header = command, file, forward
process_id_directory = pid
program_directory = /usr/lib/postfix
propagate_unmatched_extensions = canonical, virtual
proxy_interfaces = 1.2.3.4
proxy_read_maps = $local_recipient_maps $mydestination
$virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps
$virtual_mailbox_domains $relay_recipient_maps $relay_domains
$canonical_maps $sender_canonical_maps $recipient_canonical_maps
$relocated_maps $transport_maps $mynetworks
qmgr_clog_warn_time = 300s
qmgr_fudge_factor = 100
qmgr_message_active_limit = 20000
qmgr_message_recipient_limit = 20000
qmgr_message_recipient_minimum = 10
qmqpd_authorized_clients =
qmqpd_error_delay = 1s
qmqpd_timeout = 300s
queue_directory = /var/spool/postfix
queue_file_attribute_count_limit = 100
queue_minfree = 0
queue_run_delay = 1000s
queue_service_name = qmgr
rbl_reply_maps =
readme_directory = /usr/share/doc/packages/postfix/README_FILES
recipient_canonical_maps =
recipient_delimiter =
reject_code = 554
relay_clientcerts =
relay_domains = $mydestination
relay_domains_reject_code = 554
relay_recipient_maps =
relay_transport = relay
relayhost =
relocated_maps = hash:/etc/postfix/relocated
require_home_directory = no
resolve_dequoted_address = yes
rewrite_service_name = rewrite
sample_directory = /usr/share/doc/packages/postfix/samples
sender_canonical_maps = hash:/etc/postfix/sender_canonical
sendmail_path = /usr/sbin/sendmail
service_throttle_time = 60s
setgid_group = maildrop
show_user_unknown_table_name = yes
showq_service_name = showq
smtp_always_send_ehlo = yes
smtp_bind_address =
smtp_connect_timeout = 30s
smtp_data_done_timeout = 600s
smtp_data_init_timeout = 120s
smtp_data_xfer_timeout = 180s
smtp_destination_concurrency_limit = $default_destination_concurrency_limit
smtp_destination_recipient_limit = $default_destination_recipient_limit
smtp_enforce_tls = no
smtp_helo_name = $myhostname
smtp_helo_timeout = 300s
smtp_line_length_limit = 990
smtp_mail_timeout = 300s
smtp_never_send_ehlo = no
smtp_pix_workaround_delay_time = 10s
smtp_pix_workaround_threshold_time = 500s
smtp_quit_timeout = 300s
smtp_randomize_addresses = yes
smtp_rcpt_timeout = 300s
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options =
smtp_skip_4xx_greeting = yes
smtp_skip_5xx_greeting = yes
smtp_skip_quit_response = yes
smtp_starttls_timeout = 300s
smtp_tls_CAfile =
smtp_tls_CApath =
smtp_tls_cert_file =
smtp_tls_cipherlist =
smtp_tls_dcert_file =
smtp_tls_dkey_file = $smtp_tls_dcert_file
smtp_tls_enforce_peername = yes
smtp_tls_key_file = $smtp_tls_cert_file
smtp_tls_loglevel = 0
smtp_tls_note_starttls_offer = no
smtp_tls_per_site =
smtp_tls_session_cache_database =
smtp_tls_session_cache_timeout = 3600s
smtp_use_tls = no
smtpd_banner = $myhostname ESMTP $mail_name
smtpd_client_restrictions =
smtpd_data_restrictions =
smtpd_delay_reject = yes
smtpd_enforce_tls = no
smtpd_error_sleep_time = 1s
smtpd_etrn_restrictions =
smtpd_expansion_filter =
\t\40!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~

smtpd_hard_error_limit = 20
smtpd_helo_required = no
smtpd_helo_restrictions =
smtpd_history_flush_threshold = 100
smtpd_junk_command_limit = 100
smtpd_noop_commands =
smtpd_null_access_lookup_key = <>
smtpd_recipient_limit = 1000
smtpd_recipient_restrictions = permit_mynetworks,reject_unauth_destination
smtpd_restriction_classes =
smtpd_sasl_auth_enable = no
smtpd_sasl_local_domain =
smtpd_sasl_security_options = noanonymous
smtpd_sender_login_maps =
smtpd_sender_restrictions = hash:/etc/postfix/access
smtpd_soft_error_limit = 10
smtpd_timeout = 300s
smtpd_tls_CAfile =
smtpd_tls_CApath =
smtpd_tls_ask_ccert = no
smtpd_tls_auth_only = no
smtpd_tls_ccert_verifydepth = 5
smtpd_tls_cert_file =
smtpd_tls_cipherlist =
smtpd_tls_dcert_file =
smtpd_tls_dh1024_param_file =
smtpd_tls_dh512_param_file =
smtpd_tls_dkey_file = $smtpd_tls_dcert_file
smtpd_tls_key_file = $smtpd_tls_cert_file
smtpd_tls_loglevel = 0
smtpd_tls_received_header = no
smtpd_tls_req_ccert = no
smtpd_tls_session_cache_database =
smtpd_tls_session_cache_timeout = 3600s
smtpd_tls_wrappermode = no
smtpd_use_tls = no
soft_bounce = no
stale_lock_time = 500s
strict_7bit_headers = no
strict_8bitmime = no
strict_8bitmime_body = no
strict_mime_encoding_domain = no
strict_rfc821_envelopes = no
sun_mailtool_compatibility = no
swap_bangpath = yes
syslog_facility = mail
syslog_name = postfix
tls_daemon_random_bytes = 32
tls_daemon_random_source =
tls_random_bytes = 32
tls_random_exchange_name = ${config_directory}/prng_exch
tls_random_prng_update_period = 60s
tls_random_reseed_period = 3600s
tls_random_source =
transport_maps = hash:/etc/postfix/transport
transport_retry_time = 60s
trigger_timeout = 10s
undisclosed_recipients_header = To: undisclosed-recipients:;
unknown_address_reject_code = 450
unknown_client_reject_code = 450
unknown_hostname_reject_code = 450
unknown_local_recipient_reject_code = 450
unknown_relay_recipient_reject_code = 550
unknown_virtual_alias_reject_code = 550
unknown_virtual_mailbox_reject_code = 550
verp_delimiter_filter = -=+
virtual_alias_domains = $virtual_alias_maps
virtual_alias_maps = $virtual_maps
virtual_gid_maps =
virtual_mailbox_base =
virtual_mailbox_domains = $virtual_mailbox_maps
virtual_mailbox_limit = 51200000
virtual_mailbox_lock = fcntl
virtual_mailbox_maps =
virtual_minimum_uid = 100
virtual_transport = virtual
virtual_uid_maps =
--
*********************************
* Achim Schön
* B&W Software GmbH
* Weisse-Herz-Str 2a
* D-91054 Erlangen
*
* fon ++49 (0) 9131 / 5 33 87-03
* fax ++49 (0) 9131 / 5 33 87-20
*
*********************************
--
Check the headers for your unsubscription address
For additional commands send e-mail to suse-linux-e-***@suse.com
Also check the archives at http://lists.suse.com
Please read the FAQs: suse-linux-e-***@suse.com
Patrick Shanahan
2004-06-03 15:48:21 UTC
Permalink
Post by Achim Schön
On my mail system mails to unknown users are replied automatically and
host public/lmtp[public/lmtp] said: 550-Mailbox unknown.
Either there is no mailbox associated with this 550-name or you do
not have
authorization to see it. 550 5.1.1 User unknown (in reply to RCPT TO
command)
In times where hundreds of virus mails arrived this is of course not
the right choice, but I've not managed to redirect mails to unknown
users to the postmaster account.
I'm currently running postfix with cyrus and SASL. Mailbox transport is
set to lmtp:unix:public/lmtp and therefor luser_relay does not work.
Any ideas how to configure the mail system in the desired way are welcome.
smtpd_client_restrictions =
smtpd_client_restrictions = reject_rbl_client dnsbl.njabl.org, reject_rbl_client cbl.abuseat.org, reject_rbl_client blackholes.mail-abuse.org, reject_rbl_client sbl.spamhaus.org, reject_rbl_client bl.spamcop.net
Post by Achim Schön
smtpd_helo_required = no
smtpd_helo_required = yes
Post by Achim Schön
smtpd_sender_restrictions = hash:/etc/postfix/access
smtpd_sender_restrictions = hash:/etc/postfix/access, reject_unknown_sender_domain


warning: you may get an occasional valid post rejected
usual disclaimer applies, ymmv
--
Patrick Shanahan Registered Linux User #207535
http://wahoo.no-ip.org @ http://counter.li.org
HOG # US1244711
--
Check the headers for your unsubscription address
For additional commands send e-mail to suse-linux-e-***@suse.com
Also check the archives at http://lists.suse.com
Please read the FAQs: suse-linux-e-***@suse.com
Achim Schön
2004-06-03 16:04:32 UTC
Permalink
Patrick,

thanks for your reply, but this is not 100% the answer I'm searching. I
do not search for further mechanism to restrict incoming or outgoing
mails. I'm searching for a mechanism to redirect mails that are send to
an unknown recipient to a defined account.

Anyway, thanks for your answer.

Achim
Post by Patrick Shanahan
Post by Achim Schön
smtpd_client_restrictions =
smtpd_client_restrictions = reject_rbl_client dnsbl.njabl.org, reject_rbl_client cbl.abuseat.org, reject_rbl_client blackholes.mail-abuse.org, reject_rbl_client sbl.spamhaus.org, reject_rbl_client bl.spamcop.net
Post by Achim Schön
smtpd_helo_required = no
smtpd_helo_required = yes
Post by Achim Schön
smtpd_sender_restrictions = hash:/etc/postfix/access
smtpd_sender_restrictions = hash:/etc/postfix/access, reject_unknown_sender_domain
warning: you may get an occasional valid post rejected
usual disclaimer applies, ymmv
Patrick Shanahan
2004-06-03 16:10:02 UTC
Permalink
Post by Achim Schön
Patrick,
thanks for your reply, but this is not 100% the answer I'm searching. I
do not search for further mechanism to restrict incoming or outgoing
mails. I'm searching for a mechanism to redirect mails that are send to
an unknown recipient to a defined account.
Anyway, thanks for your answer.
Achim
Post by Patrick Shanahan
Post by Achim Schön
smtpd_client_restrictions =
smtpd_client_restrictions = reject_rbl_client dnsbl.njabl.org,
reject_rbl_client cbl.abuseat.org, reject_rbl_client
blackholes.mail-abuse.org, reject_rbl_client sbl.spamhaus.org,
reject_rbl_client bl.spamcop.net
Post by Achim Schön
smtpd_helo_required = no
smtpd_helo_required = yes
Post by Achim Schön
smtpd_sender_restrictions = hash:/etc/postfix/access
smtpd_sender_restrictions = hash:/etc/postfix/access,
reject_unknown_sender_domain
warning: you may get an occasional valid post rejected
usual disclaimer applies, ymmv
Guess I missed your intent. I, presonally, would not want mail sent
to my domain for someone who does not exist. It is *all* spam, etc.
It is just that much more mail that I do *not* need to handle, sort
for virii/spam, etc.
--
Patrick Shanahan Registered Linux User #207535
http://wahoo.no-ip.org @ http://counter.li.org
HOG # US1244711
--
Check the headers for your unsubscription address
For additional commands send e-mail to suse-linux-e-***@suse.com
Also check the archives at http://lists.suse.com
Please read the FAQs: suse-linux-e-***@suse.com
Carlos E. R.
2004-06-04 11:22:40 UTC
Permalink
Post by Patrick Shanahan
Guess I missed your intent. I, presonally, would not want mail sent
to my domain for someone who does not exist. It is *all* spam, etc.
It is just that much more mail that I do *not* need to handle, sort
for virii/spam, etc.
Those rules will probably reject "me" as well.
--
Cheers,
Carlos Robinson
--
Check the headers for your unsubscription address
For additional commands send e-mail to suse-linux-e-***@suse.com
Also check the archives at http://lists.suse.com
Please read the FAQs: suse-linux-e-***@suse.com
Patrick Shanahan
2004-06-04 11:42:34 UTC
Permalink
Post by Carlos E. R.
Post by Patrick Shanahan
Guess I missed your intent. I, presonally, would not want mail sent
to my domain for someone who does not exist. It is *all* spam, etc.
It is just that much more mail that I do *not* need to handle, sort
for virii/spam, etc.
Those rules will probably reject "me" as well.
You know that I don't reject you. I see *all*, afaict, of your
postings.

# ACCESS(5) ACCESS(5)
#
# NAME
# access - format of Postfix access table
#
.....
# DESCRIPTION
# The optional access table directs the Postfix SMTP server
# to selectively reject or accept mail. Access can be
# allowed or denied for specific host names, domain names,
# networks, host network addresses or mail addresses.
.....
robin1.<edited-out> ACCEPT
cerobinson.<edited-out> ACCEPT
e-gold.com REJECT



IIANM, we went thru this exercise off-list about a year ago.
--
Patrick Shanahan Registered Linux User #207535
http://wahoo.no-ip.org @ http://counter.li.org
HOG # US1244711 Photo Album: http://wahoo.no-ip.org/photos
--
Check the headers for your unsubscription address
For additional commands send e-mail to suse-linux-e-***@suse.com
Also check the archives at http://lists.suse.com
Please read the FAQs: suse-linux-e-***@suse.com
Carlos E. R.
2004-06-05 00:55:36 UTC
Permalink
Post by Patrick Shanahan
Post by Carlos E. R.
Those rules will probably reject "me" as well.
You know that I don't reject you. I see *all*, afaict, of your
postings.
I know, I know :-)

But you had to write an exception for me, because those rules alone would
reject me.
--
Cheers,
Carlos Robinson
--
Check the headers for your unsubscription address
For additional commands send e-mail to suse-linux-e-***@suse.com
Also check the archives at http://lists.suse.com
Please read the FAQs: suse-linux-e-***@suse.com
Patrick Shanahan
2004-06-05 01:14:24 UTC
Permalink
Post by Carlos E. R.
Post by Patrick Shanahan
Post by Carlos E. R.
Those rules will probably reject "me" as well.
You know that I don't reject you. I see *all*, afaict, of your
postings.
I know, I know :-)
But you had to write an exception for me, because those rules alone
would reject me.
Not you, tiscali dot es. They apparently have a <bad> reputation.
--
Patrick Shanahan Registered Linux User #207535
http://wahoo.no-ip.org @ http://counter.li.org
HOG # US1244711 Photo Album: http://wahoo.no-ip.org/photos
--
Check the headers for your unsubscription address
For additional commands send e-mail to suse-linux-e-***@suse.com
Also check the archives at http://lists.suse.com
Please read the FAQs: suse-linux-e-***@suse.com
Carlos E. R.
2004-06-05 12:45:15 UTC
Permalink
Post by Patrick Shanahan
Post by Carlos E. R.
Post by Patrick Shanahan
You know that I don't reject you. I see *all*, afaict, of your
postings.
I know, I know :-)
But you had to write an exception for me, because those rules alone
would reject me.
Not you, tiscali dot es. They apparently have a <bad> reputation.
That's the address on the "from" header, but the connection itself usually
belongs to teleline, now terra, aka lycos. And they are very often
blacklisted - although they are the biggest ISP here.
--
Cheers,
Carlos Robinson
--
Check the headers for your unsubscription address
For additional commands send e-mail to suse-linux-e-***@suse.com
Also check the archives at http://lists.suse.com
Please read the FAQs: suse-linux-e-***@suse.com
Loading...