2

I have a postfix server configured with reject_unknown_client_hostname and reject_unknown_helo_hostname. Regardless the server accepts non sasl_authenticated connections from clients and HELO names with no DNS entry. Tested with telnet and nc (actual mailserver domain replaced with mymailserver.com):

nc mymailserver.com 25
220 mymailserver.com ESMTP Postfix (2.9.6)
HELO inexistent.domain.com    
250 mymailserver.com

Postfix log with debug_peer_level = 2:

Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: connect from dslb-178-005-067-030.pools.arcor-ip.net[178.5.67.30]
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: smtp_stream_setup: maxtime=300 enable_deadline=0
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: match_hostname: dslb-178-005-067-030.pools.arcor-ip.net ~? 127.0.0.0/8
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: match_hostaddr: 178.5.67.30 ~? 127.0.0.0/8
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: match_hostname: dslb-178-005-067-030.pools.arcor-ip.net ~? [::ffff:127.0.0.0]/104
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: match_hostaddr: 178.5.67.30 ~? [::ffff:127.0.0.0]/104
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: match_hostname: dslb-178-005-067-030.pools.arcor-ip.net ~? [::1]/128
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: match_hostaddr: 178.5.67.30 ~? [::1]/128
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: match_list_match: dslb-178-005-067-030.pools.arcor-ip.net: no match
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: match_list_match: 178.5.67.30: no match
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: auto_clnt_open: connected to private/anvil
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: send attr request = connect
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: send attr ident = smtp:178.5.67.30
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: private/anvil: wanted attribute: status
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: input attribute name: status
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: input attribute value: 0
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: private/anvil: wanted attribute: count
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: input attribute name: count
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: input attribute value: 1
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: private/anvil: wanted attribute: rate
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: input attribute name: rate
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: input attribute value: 1
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: private/anvil: wanted attribute: (list terminator)
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: input attribute name: (end)
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: > dslb-178-005-067-030.pools.arcor-ip.net[178.5.67.30]: 220 mymailserver.com ESMTP Postfix (2.9.6)
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: watchdog_pat: 0x7f1fcb7f5aa0
Mar 19 16:55:33 mymailserver postfix/smtpd[4941]: < dslb-178-005-067-030.pools.arcor-ip.net[178.5.67.30]: HELO jksdnfsdmf.de
Mar 19 16:55:33 mymailserver postfix/smtpd[4941]: > dslb-178-005-067-030.pools.arcor-ip.net[178.5.67.30]: 250 mymailserver.com
Mar 19 16:55:33 mymailserver postfix/smtpd[4941]: watchdog_pat: 0x7f1fcb7f5aa0

Is there something wrong in my configuration or missed I something? Or is the test case wrong?

Postfix configuration:

smtpd_helo_required = yes
smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unknown_client_hostname
smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated,  reject_unknown_helo_hostname
smtpd_sender_restrictions = reject_unknown_sender_domain, reject_authenticated_sender_login_mismatch, permit_sasl_authenticated, check_policy_service unix:private/policy-spf
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_data_restrictions = reject_unauth_pipelining
jojoob
  • 194
  • 6
  • Why have you added `permit_sasl_authenticated` in `smtpd_helo_restrictions`? First let us solve `HELO` issue. Try `smtpd_helo_restrictions = permit_mynetworks, reject_unknown_helo_hostname`. Also set `smtpd_helo_required = yes` in your `main.cf` – clement Mar 19 '14 at 18:58
  • Because a (authenticated) MUA doesn't send a known helo hostname in most cases. When just using the reject_non_fqdn_helo_hostname restriction instead we don't need permit_sasl_authenticated. smtpd_helo_required = yes is set how you can see in my question. – jojoob Mar 19 '14 at 22:42

1 Answers1

1

Ok, the test case was wrong. Respectively I was not aware of the the smtpd_delay_reject option which is by default set to yes. With this option postifx does not check the restriction right after each command but waits with all checks until HELO, MAIL FROM and RCPT TO commands received. See http://www.postfix.org/postconf.5.html#smtpd_delay_reject

telnet mymailserver.com 25
220 mymailserver.com ESMTP Postfix (2.9.6)
HELO inexistent.domain.com
250 mymailserver.com
MAIL FROM: me@inexistent.domain.com
250 2.1.0 Ok
RCPT TO: to@somedomain.net
450 4.7.1 <inexistent.domain.com>: Helo command rejected: Host not found
jojoob
  • 194
  • 6