[+] postfix i zlewka na smtpd_sender_restrictions
: 24 kwietnia 2014, 14:37
Witam!
Ostatnio robiłem aktualizację jednego z serwerków z lenny->squeeze->wheezy
dziś zauważyłem, że postfix kompletnie olewa smtpd_sender_restrictions
Konfiguracja: postfix, normalni użytkownicy, courier, amavis, sasl. itp.
W linijce smtpd_sender_restrictions mam: reject_unknown_sender_domain, reject_sender_login_mismatch, permit_mynetworks, permit_sasl_authenticated
Mogę sobie dla użytkownika sprawdzonego przez sasl zmienic nazwe jego domeny na nie instniejącą i wiadomość wychodzi, zmienić na innego usera (reject_sender_login_mismatch) i wiadomość wychodzi. O co może chodzić?
Próbowałem komentować permit_my_networks, permit_sasl_authenticated ale nic to nie daje, ogólnie najbardziej mi zależy na tym, żeby userzy authenticated nie mogli zmieniać pola From:
Zwartość main.cf:
Master.cf:
Ostatnio robiłem aktualizację jednego z serwerków z lenny->squeeze->wheezy
dziś zauważyłem, że postfix kompletnie olewa smtpd_sender_restrictions
Konfiguracja: postfix, normalni użytkownicy, courier, amavis, sasl. itp.
W linijce smtpd_sender_restrictions mam: reject_unknown_sender_domain, reject_sender_login_mismatch, permit_mynetworks, permit_sasl_authenticated
Mogę sobie dla użytkownika sprawdzonego przez sasl zmienic nazwe jego domeny na nie instniejącą i wiadomość wychodzi, zmienić na innego usera (reject_sender_login_mismatch) i wiadomość wychodzi. O co może chodzić?
Próbowałem komentować permit_my_networks, permit_sasl_authenticated ale nic to nie daje, ogólnie najbardziej mi zależy na tym, żeby userzy authenticated nie mogli zmieniać pola From:
Zwartość main.cf:
Kod: Zaznacz cały
# see /usr/share/postfix/main.cf.dist for a commented, fuller
# version of this file.
# Do not change these directory settings - they are critical to Postfix
# operation.
command_directory = /usr/sbin
daemon_directory = /usr/lib/postfix
#program_directory = /usr/lib/postfix
smtpd_banner = $myhostname ESMTP $mail_name. We block/report all spam.
setgid_group = postdrop
biff = no
# appending .domain is the MUA's job.
append_dot_mydomain = no
#append_at_myorigin = no
myhostname = costam.pl
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
masquerade_domains = costam.pl
mydestination = costam.pl
relayhost =
mynetworks = 127.0.0.0/8,192.168.1.0/24
mailbox_command = procmail -a "$EXTENSION"
home_mailbox = Maildir/
mailbox_size_limit = 0
recipient_delimiter = +
smtpd_sasl_local_domain = $myhostname
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_helo_required = yes
smtpd_helo_restrictions = reject_unknown_address, permit
broken_sasl_auth_clients = yes
smtpd_sender_login_maps = hash:/etc/postfix/virtualsender
smtpd_sender_restrictions = reject_unknown_sender_domain, reject_sender_login_mismatch, permit_mynetworks, permit_sasl_authenticated
smtpd_data_restrictions =
reject_unauth_pipelining,
permit_sasl_authenticated,
check_client_access pcre:/etc/postfix/add_auth_header.regexp
smtpd_recipient_restrictions =
permit_sasl_authenticated,
permit_mynetworks,
reject_unknown_address,
reject_unauth_destination,
reject_rbl_client zen.spamhaus.org,
reject_rbl_client bl.spamcop.net,
reject_rbl_client cbl.abuseat.org,
check_recipient_access hash:/etc/postfix/recipient_access,
check_policy_service inet:127.0.0.1:10023,
check_policy_service unix :p rivate/spfpolicy,
check_sender_access hash:/etc/postfix/access,
permit
inet_interfaces = all
default_transport=smtp-external
smtpd_tls_auth_only = no
smtp_use_tls = yes
smtpd_use_tls = yes
smtp_tls_note_starttls_offer = yes
smtpd_tls_key_file = /etc/postfix/ssl/postfix_private_key.pem
smtpd_tls_cert_file = /etc/postfix/ssl/postfix_public_cert.pem
smtpd_tls_CAfile = /etc/postfix/ssl/cacert.pem
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom
virtual_alias_maps=hash:/etc/postfix/virtual
virtual_alias_domains = i tu domeny
content_filter = amavis:[127.0.0.1]:10024
receive_override_options = no_address_mappings
header_checks = regexp:/etc/postfix/header_checks
message_size_limit = 68157440
disable_vrfy_command = yes
sender_bcc_maps = hash:/etc/postfix/sender_bccKod: Zaznacz cały
smtp inet n - - - - smtpd
submission inet n - - - - smtpd
-o smtpd_client_restrictions=
-o smtpd_helo_restrictions=
-o smtpd_sender_restrictions=reject_sender_login_mismatch,permit
-o smtpd_sender_restrictions=permit_sasl_authenticated,reject
-o smtpd_recipient_restrictions=reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_sasl_authenticated,reject
pickup fifo n - - 60 1 pickup
cleanup unix n - - - 0 cleanup
qmgr fifo n - - 300 1 qmgr
rewrite unix - - - - - trivial-rewrite
bounce unix - - - - 0 bounce
defer unix - - - - 0 bounce
flush unix n - - 1000? 0 flush
smtp unix - - - - - smtp
smtp-external unix - - y - - smtp -o smtp_bind_address=moj.adres.ip.tu
showq unix n - - - - showq
error unix - - - - - error
local unix - n n - - local
virtual unix - n n - - virtual
lmtp unix - - n - - lmtp
cyrus unix - n n - - pipe
flags=R user=cyrus argv=/usr/sbin/cyrdeliver -e -m ${extension} ${user}
uucp unix - n n - - pipe
flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
ifmail unix - n n - - pipe
flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp unix - n n - - pipe
flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -d -t$nexthop -f$sender $recipient
scalemail-backend unix - n n - 2 pipe
flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
smtps inet n - n - - smtpd -o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes
amavis unix - - - - 2 smtp
-o smtp_data_done_timeout=1200
-o smtp_send_xforward_command=yes
127.0.0.1:10025 inet n - - - - smtpd
-o content_filter=
-o local_recipient_maps=
-o relay_recipient_maps=
-o smtpd_restriction_classes=
-o smtpd_client_restrictions=
-o smtpd_helo_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,reject
-o mynetworks=127.0.0.0/8
-o strict_rfc821_envelopes=yes
-o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
proxymap unix - - n - - proxymap
trace unix - - - - 0 bounce
verify unix - - - - 1 verify
relay unix - - n - - smtp
tlsmgr unix - - - 1000? 1 tlsmgr
anvil unix - - - - 1 anvil
scache unix - - - - 1 scache
discard unix - - - - - discard
spfpolicy unix - n n - - spawn user=nobody argv=/usr/bin/perl /etc/postfix/spf-policy.pl
retry unix - - - - - error