3

I'm trying to use postfix + policyd2 to limit amount of outgoing emails. But when implementing policyd2 policies i get Access denied - no mater what i do i get denied.

  • Postfix version 2.11.4
  • PolicyD2 (cluebringer) version 2.0.14-1

Error box from email client:

An error occurred while sending mail. The mail server responded: 4.7.1 <22222@gmail.com>: Recipient address rejected: Access denied. Please check the message recipient 22222@gmail.com and try again.

When i turn off policyd2 in postfix /etc/postfix/main.cf everything works:

smtpd_end_of_data_restrictions=check_policy_service inet:127.0.0.1:10031
smtpd_recipient_restrictions=check_policy_service inet:127.0.0.1:10031,

If i turn it back on, this is what i get /var/log/maillog:

postfix/smtpd[3228]: >>> START Helo command RESTRICTIONS <<<
postfix/smtpd[3228]: generic_checks: name=reject_invalid_helo_hostname                   
postfix/smtpd[3228]: reject_invalid_hostaddr: [192.168.0.10]
postfix/smtpd[3228]: generic_checks: name=reject_invalid_helo_hostname status=0
postfix/smtpd[3228]: >>> END Helo command RESTRICTIONS <<<
postfix/smtpd[3228]: >>> START Recipient address RESTRICTIONS <<<
postfix/smtpd[3228]: generic_checks: name=check_policy_service
postfix/smtpd[3228]: trying... [127.0.0.1]
postfix/smtpd[3228]: auto_clnt_open: connected to 127.0.0.1:10031
postfix/smtpd[3228]: send attr request = smtpd_access_policy
postfix/smtpd[3228]: send attr protocol_state = RCPT
postfix/smtpd[3228]: send attr protocol_name = ESMTP
postfix/smtpd[3228]: send attr client_address = 88.88.88.88
postfix/smtpd[3228]: send attr client_name = example.pl
postfix/smtpd[3228]: send attr reverse_client_name = example.pl
postfix/smtpd[3228]: send attr helo_name = [192.168.0.10]
postfix/smtpd[3228]: send attr sender = guest@example.pl
postfix/smtpd[3228]: send attr recipient = 22222@gmail.com
postfix/smtpd[3228]: send attr recipient_count = 0
postfix/smtpd[3228]: send attr queue_id = 
postfix/smtpd[3228]: send attr instance = c9c.5584b989.ab0c0.0
postfix/smtpd[3228]: send attr size = 368
postfix/smtpd[3228]: send attr etrn_domain = 
postfix/smtpd[3228]: send attr stress = 
postfix/smtpd[3228]: send attr sasl_method = PLAIN
postfix/smtpd[3228]: send attr sasl_username = guest@example.pl
postfix/smtpd[3228]: send attr sasl_sender = 
postfix/smtpd[3228]: send attr ccert_subject = 
postfix/smtpd[3228]: send attr ccert_issuer = 
postfix/smtpd[3228]: send attr ccert_fingerprint = 
postfix/smtpd[3228]: send attr ccert_pubkey_fingerprint = 
postfix/smtpd[3228]: send attr encryption_protocol = TLSv1
postfix/smtpd[3228]: send attr encryption_cipher = ECDHE-RSA-AES256-SHA
postfix/smtpd[3228]: send attr encryption_keysize = 256
postfix/smtpd[3228]: 127.0.0.1:10031: wanted attribute: action
postfix/smtpd[3228]: input attribute name: action
postfix/smtpd[3228]: input attribute value: DEFER
postfix/smtpd[3228]: 127.0.0.1:10031: wanted attribute: (list terminator)
postfix/smtpd[3228]: input attribute name: (end)
postfix/smtpd[3228]: check_table_result: inet:127.0.0.1:10031 DEFER policy query
postfix/smtpd[3228]: NOQUEUE: reject: RCPT from example.pl[88.88.88.88]: 450 4.7.1 <22222@gmail.com>: Recipient address rejected: Access denied; from=<guest@example.pl> to=<22222@gmail.com> proto=ESMTP helo=<[192.168.0.10]>
postfix/smtpd[3228]: generic_checks: name=check_policy_service status=2
postfix/smtpd[3228]: >>> END Recipient address RESTRICTIONS <<<
postfix/smtpd[3228]: > example.pl[88.88.88.88]: 450 4.7.1 <22222@gmail.com>: Recipient address rejected: Access denied
postfix/smtpd[3228]: watchdog_pat: 0x83b23a8

Policy example.

Create policy:

INSERT INTO policies VALUES (1, 'In Out', 10, 'In Out Policy', 0);
INSERT INTO policy_members VALUES (1, 1, 'any', 'any', '' ,0);

Add quotas - actions:

INSERT INTO quotas (PolicyID,Name,Track,Period,Verdict,Data) VALUES (1,'Sender:user@domain', 'Sender:user@domain', 60, 'DEFER', 'Deferring: To many messages from sender in last 60s.');
INSERT INTO quotas (PolicyID,Name,Track,Period,Verdict,Data) VALUES (1,'Recipient:@domain', 'Recipient:@domain', 60, 'REJECT', 'Quota limit reached.');

Add quota limits:

INSERT INTO quotas_limits (QuotasID, Type, CounterLimit) VALUES (1,'MessageCount', 12);
INSERT INTO quotas_limits (QuotasID, Type, CounterLimit) VALUES (2,'MessageCount', 20);

Can't use web gui (no PHP) - so I'm not sure if it is correct. Was searching and trying different policy examples but the error remains exactly the same.

Abc Xyz
  • 608
  • 1
  • 8
  • 17

1 Answers1

3

Permissions on policyd2 sqlite3 database file were wrong.

PolicyD2 has capability to run daemon as specific user, in my case:

/etc/policyd.conf
# User to run this daemon as
user=policyd
group=policyd

Permissions on the database were root:root.

-rw-r--r-- root root policyd2.db

After changing to policyd:policyd i could send emails.

-rw-r--r-- policyd policyd policyd2.db

Now Acces denied error make sense.

Abc Xyz
  • 608
  • 1
  • 8
  • 17
  • Thanks for the solution :). Can you elaborate this answer like (1) how you track down the problems until you can pinpoint it to sqlite problem (2) Can you share the policyd log stating that sqlite permission was wrong (3) Can you share how the permission of sqlite db before and after fixing? – masegaloeh Jun 22 '15 at 23:49
  • 1) I went to bed, to reset myself again, i knew that policyd2 check_policy_service was the problem. I was editing policyd2.db from root account, (because policyd account does not have a shell), removed policyd2.db couple times while creating policies and forgot to change permissions. When i woke up i realized that it might be the problem. Because policyd has its own user:group permissions. 2) Never looked into policyd2.log was focused on maillog. Right now i can't see anything that would point into wrong permissions on policyd2.db. – Abc Xyz Jun 23 '15 at 08:49
  • +1 Great explanation. Thanks for sharing the solution with us :) – masegaloeh Jun 23 '15 at 09:02