SMTP auth do not log in on relay server

authenticationpostfixsmtp

I'm trying to configure a secondary postfix to enable SMTP AUTH against my main postfix server (postfix + ldap auth + cyrus)

I've follow http://www.postfix.org/SASL_README.html#client_sasl adding:

smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous 
relayhost = [192.168.66.98]

the config files of secondary postfix are:

# postconf -n
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
debug_peer_level = 2
html_directory = no
inet_interfaces = localhost, 192.168.66.85
inet_protocols = all
local_recipient_maps =
mail_owner = postfix
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
mydestination = $myhostname, localhost.$mydomain, localhost
mydomain = ddol-test.com
mynetworks = 192.168.66.0/24, 127.0.0.0/8
myorigin = $myhostname
newaliases_path = /usr/bin/newaliases.postfix
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-2.6.6/README_FILES
relay_domains = $mydestination
relayhost = [192.168.66.98]
sample_directory = /usr/share/doc/postfix-2.6.6/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
transport_maps =
unknown_local_recipient_reject_code = 550

# cat /etc/postfix/sasl_passwd
[192.168.66.98]         666mgimeno@pre.ddol.es:1234

When I send a mail, it is correctly redirected to .66.98 but it do not auth on it and the behavior of the email is like it for a non authenticated user.

This is my main postfix configuration:

# cat main.cf

...
...
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes

smtpd_sasl_authenticated_header = yes
smtpd_sasl_path = smtpd

smtpd_helo_restrictions =
        permit_mynetworks,
        permit_sasl_authenticated,
        reject_non_fqdn_helo_hostname,
        reject_invalid_helo_hostname,
        permit

smtpd_sender_restrictions =
        reject_authenticated_sender_login_mismatch,
        permit

smtpd_recipient_restrictions =
        reject_unauth_pipelining,
        reject_non_fqdn_sender,
        reject_non_fqdn_recipient,
        check_policy_service inet:127.0.0.1:10031,
        permit_mynetworks,
        permit_sasl_authenticated,
        reject_unauth_destination,
        reject_unverified_recipient,
        check_policy_service inet:127.0.0.1:10045,
        reject_rbl_client bl.spamcop.net,
        reject_rbl_client psbl.surriel.com,
        reject_rbl_client sbl.spamhaus.org,
        reject_rbl_client xbl.spamhaus.org,
        reject_rbl_client zen.spamhaus.org,
        reject_rbl_client combined.rbl.msrbl.net,
        reject_rbl_client relays.ordb.org,
        reject_rbl_client list.dsbl.org,
        reject_rbl_client sbl-xbl.spamhaus.org,
        reject_rbl_client dnsbl.njabl.org,
        permit

header_checks = pcre:/etc/postfix/header_checks

smtpd_end_of_data_restrictions =
        check_policy_service inet:127.0.0.1:10031

soft_bounce = no

smtpd_helo_required = yes

smtpd_delay_reject = yes
disable_vrfy_command = yes

smtpd_sender_login_maps = ldap:/etc/postfix/sender_maps

amavisd-new_destination_concurrency_limit = 20

virtual_alias_maps = ldap:/etc/postfix/mailRedirect ldap:/etc/postfix/virtual ldap:/etc/postfix/catch-all

smtpd_sasl_local_domain =

smtp_tls_security_level = may
smtpd_tls_security_level = may
smtpd_tls_auth_only = no
smtp_tls_note_starttls_offer = yes
smtpd_tls_key_file = /etc/ssl/private/smtpd.key
smtpd_tls_cert_file = /etc/ssl/certs/smtpd.crt
smtpd_tls_CAfile = /etc/ssl/certs/cacert.pem
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom

message_size_limit=15728640

Right now, any mail sent from secondary postfix, is relayed to main postfix but it passes all the checks as it was for a non authenticated user, but I don't want that. I would like that the behavior of the email was the same as an authenticated user and stops in "permit_sasl_authenticated" in smtpd_recipient_restrictions.

Best Answer

Your problem is here:

smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
relayhost = [192.168.66.98]

Note that you've used 'smtpd' rather than 'smtp'. This means you're setting up sasl for the listening deamon, not the sending agent.

Here's what I use in mine:

# use authentication
relayhost = [mail.messagingengine.com]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/saslpass
smtp_sasl_security_options = noanonymous

And it's working fine.

Oh - and the content of saslpass is:

mail.messagingengine.com myuser@my.domain:mypass

Note the colon and the space. I'm guessing you'll need to do the IP address there instead, or put an entry in /etc/hosts and use a name. The @my.domain is because messagingengine uses fully qualified email addresses for login. You probably just need a username.

Related Topic