LinuxQuestions.org
Register a domain and help support LQ
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices

Reply
 
Search this Thread
Old 02-08-2007, 02:31 PM   #1
wheel
Member
 
Registered: Sep 2003
Posts: 33

Rep: Reputation: 16
Postgrey (greylisting) on Mandriva problems


I've installed greylisting/postgrey on my server using the Mandriva (2006) install tools. Everything seems to be installed and running fine, mail is getting deferred (and apparently lots of bounces and the like from mail servers not responding - I'm guessing that's the spam getting dropped).

I've run into a problem - I can't send email from my PC. I added one line to my main.cf file (as required by postgrey) and adding it in or removing it turns off or turns on my ability to send email from here. Here's my main.cf, the last line is the killer.

readme_directory = /usr/share/doc/postfix-2.1.5/README_FILES
sample_directory = /usr/share/doc/postfix-2.1.5/samples
html_directory = /usr/share/doc/postfix-2.1.5/html
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
command_directory = /usr/sbin
manpage_directory = /usr/share/man
daemon_directory = /usr/lib/postfix
newaliases_path = /usr/bin/newaliases.postfix
mailq_path = /usr/bin/mailq.postfix
queue_directory = /var/spool/postfix
mail_owner = postfix
myhostname = mail.XXXXXXXX.com
inet_interfaces = all
virtual_alias_maps = hash:/etc/postfix/virtual
virtual_alias_domains = $virtual_alias_maps
mynetworks_style = host
delay_warning_time = 4h
smtpd_banner = $myhostname ESMTP $mail_name ($mail_version) (Mandrakelinux)
unknown_local_recipient_reject_code = 450
append_at_myorigin = yes
smtp-filter_destination_concurrency_limit = 2
setgid_group = postdrop
command_directory = /usr/sbin
manpage_directory = /usr/share/man
daemon_directory = /usr/lib/postfix
newaliases_path = /usr/bin/newaliases.postfix
mailq_path = /usr/bin/mailq.postfix
queue_directory = /var/spool/postfix
mail_owner = postfix
myhostname = mail.XXXXXXXX.com
inet_interfaces = all
virtual_alias_maps = hash:/etc/postfix/virtual
virtual_alias_domains = $virtual_alias_maps
mynetworks_style = host
delay_warning_time = 4h
smtpd_banner = $myhostname ESMTP $mail_name ($mail_version) (Mandrakelinux)
unknown_local_recipient_reject_code = 450
append_at_myorigin = yes
smtp-filter_destination_concurrency_limit = 2
lmtp-filter_destination_concurrency_limit = 2
smtpd_sasl_path = /etc/postfix/sasl:/usr/lib/sasl2
mynetworks = XX.XX.XX.XX {my IP address}
mydestination = $myhostname, $mydomain, localhost.$mydomain, mail.$mydomain, {additional list of domains}
smtpd_helo_required = yes
#the following line causes the problem - but is required for greylisting
#smtpd_recipient_restrictions = check_policy_service unix:extern/postgrey/socket

Bonus question : Is there a file somewhere that can be used to moniter what's going on with the greylisting, like status or logs? I had a look at the list of files containing 'postgrey' but nothing stands out. And documentation online seems slim.
 
Old 02-08-2007, 03:00 PM   #2
billymayday
Guru
 
Registered: Mar 2006
Location: Sydney, Australia
Distribution: Fedora, CentOS, OpenSuse, Slack, Gentoo, Debian, Arch, PCBSD
Posts: 6,678

Rep: Reputation: 122Reputation: 122
According to the postfix site, and this method works for me, the smtpd_recipient_restrictions is

check_policy_service unixrivate/policy

Give that a go
 
Old 02-08-2007, 03:55 PM   #3
wheel
Member
 
Registered: Sep 2003
Posts: 33

Original Poster
Rep: Reputation: 16
Thanks Billy. I tried that and it didn't work, same symptom.

I'm suspicious that the problem is not directly the newly added line, but instead something else in the file. Now that I scratch my head a bit I remember I've seen similiar behaviour in the past when I've made changes to main.cf. Something else I'm doing in that file causes this to happen, likely something I've added to increase security or limit spam. Unfortunately I'm postfix illiterate and most of the stuff in there is either default or cut and paste from the internet .

Anyway, still open to suggestions. In the meantime I'll do some investigating on other aspects of that config file.
 
Old 02-08-2007, 04:28 PM   #4
billymayday
Guru
 
Registered: Mar 2006
Location: Sydney, Australia
Distribution: Fedora, CentOS, OpenSuse, Slack, Gentoo, Debian, Arch, PCBSD
Posts: 6,678

Rep: Reputation: 122Reputation: 122
Podt the output of postconf -n
 
Old 02-09-2007, 07:33 AM   #5
wheel
Member
 
Registered: Sep 2003
Posts: 33

Original Poster
Rep: Reputation: 16
Output of postconf -n before adding that line:

append_at_myorigin = yes
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/lib/postfix
delay_warning_time = 4h
html_directory = /usr/share/doc/postfix-2.1.5/html
inet_interfaces = all
mail_owner = postfix
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
mydestination = $myhostname, $mydomain, localhost.$mydomain, mail.$mydomain, {other domains}
smtpd_helo_required = yes
myhostname = mail.insurancesquared.com
mynetworks = xxx.xxx.xxx.xxx, xxx.xxx.xxx.xxx
mynetworks_style = host
newaliases_path = /usr/bin/newaliases.postfix
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-2.1.5/README_FILES
sample_directory = /usr/share/doc/postfix-2.1.5/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtpd_banner = $myhostname ESMTP $mail_name ($mail_version) (Mandrakelinux)
smtpd_sasl_path = /etc/postfix/sasl:/usr/lib/sasl2
unknown_local_recipient_reject_code = 450
virtual_alias_domains = $virtual_alias_maps
virtual_alias_maps = hash:/etc/postfix/virtual



Output of postconf -n after adding that line added to main.cf and with postgrey running:

append_at_myorigin = yes
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/lib/postfix
delay_warning_time = 4h
html_directory = /usr/share/doc/postfix-2.1.5/html
inet_interfaces = all
mail_owner = postfix
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
mydestination = $myhostname, $mydomain, localhost.$mydomain, mail.$mydomain, {list of domains}
smtpd_helo_required = yes
myhostname = mail.insurancesquared.com
mynetworks = xxx.xxx.xxx.xxx,xxx.xxx.xxx.xxx
mynetworks_style = host
newaliases_path = /usr/bin/newaliases.postfix
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-2.1.5/README_FILES
sample_directory = /usr/share/doc/postfix-2.1.5/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtpd_banner = $myhostname ESMTP $mail_name ($mail_version) (Mandrakelinux)
smtpd_recipient_restrictions = check_policy_service unix:extern/postgrey/socket
smtpd_sasl_path = /etc/postfix/sasl:/usr/lib/sasl2
unknown_local_recipient_reject_code = 450
virtual_alias_domains = $virtual_alias_maps
virtual_alias_maps = hash:/etc/postfix/virtual


Doesn't seem to be anything funky there.
 
Old 02-09-2007, 01:13 PM   #6
billymayday
Guru
 
Registered: Mar 2006
Location: Sydney, Australia
Distribution: Fedora, CentOS, OpenSuse, Slack, Gentoo, Debian, Arch, PCBSD
Posts: 6,678

Rep: Reputation: 122Reputation: 122
What does the log say after you've tried to send?
 
Old 02-09-2007, 02:22 PM   #7
Child of Wonder
Member
 
Registered: Jul 2004
Location: Sioux Falls, SD
Distribution: Debian, Ubuntu, Fedora, Red Hat
Posts: 69

Rep: Reputation: 16
There's nothing in your smtpd_recipients check to bypass greylisting for your PC.

Take a look at mine:

Quote:
smtpd_recipient_restrictions =
permit_mynetworks
permit_sasl_authenticated
reject_unlisted_recipient
reject_unauth_destination
reject_non_fqdn_recipient
reject_unknown_recipient_domain
check_policy_service inet:127.0.0.1:60000
Look at each entry as a step.

permit_mynetworks - Is the connecting IP part of mynetworks? Yes, you get to skip the rest of the recipient checks. No, go to next step.

permit_sasl_authenticated - Did the connecting IP authenticate? Yes, they can skip the rest of the recipient checks. No, go to next step.

... etc... etc..

Those first two checks are essential because it allows any IP in "mynetworks" or anyone who authenticates via SASL to bypass the checks normally associated with incoming mail, such as Greylisting (check_policy_service inet:127.0.0.1:60000).
 
Old 02-09-2007, 02:24 PM   #8
wheel
Member
 
Registered: Sep 2003
Posts: 33

Original Poster
Rep: Reputation: 16
Hey, thanks so much for the clear outline. I don't know postfix very well, but I can certainly take it from here, given your explanation.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Grey Listing with postgrey dlublink Linux - Networking 2 09-22-2006 12:32 PM
LXer: Tip of the Trade: Postgrey LXer Syndicated Linux News 0 08-02-2006 01:21 PM
LXer: Killing That Spam With Postgrey And Postfix LXer Syndicated Linux News 0 07-02-2006 11:54 AM
Greylisting sanjibgupta Linux - Newbie 1 11-22-2005 11:40 AM
greylisting DrNeil Linux - Security 3 09-11-2004 09:36 AM


All times are GMT -5. The time now is 08:42 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration