554 5.7.1 Relay access denied Postfix Open Relay

kryspek · 04-26-2017, 05:50 AM

My task is to set up a Postfix Open Relay Server, which allows all users inside & outside network to relay their email through it! Also Included Spamassassin and ClamaV (I know Open Relay is not advised! But this is the task in my project, so have to go with it, later on i will play around with my networks and firewall, Currently im doing this for ISP so they will list their networks that are allowed to relay but for the moment i want everyone to be allowed!)
When i'm testing online for an open relay it says it's closed! (https://mxtoolbox.com/)

Heres my main.cf Postfix configuration :

Quote:

# See /usr/share/postfix/main.cf.dist for a commented, more complete version

# Debian specific: Specifying a file name will cause the first
# line of that file to be used as the name. The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname

smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

readme_directory = no

# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
myhostname = testmail.*****.ie
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
mydomain = *****.ie
myorigin = $mydomain
mydestination =
local_transport = error:local mail delivery is disabled
relayhost =
mynetworks = 0.0.0.0
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = ipv4

header_checks = regexp:/etc/postfix/header_checks

content_filter = scan:127.0.0.1:10025

receive_override_options = no_address_mappings

master.cf

Quote:

#
# Postfix master process configuration file. For details on the format
# of the file, see the master(5) manual page (command: "man 5 master" or
# on-line: http://www.postfix.org/master.5.html).
#
# Do not forget to execute "postfix reload" after editing this file.
#
# ==========================================================================
# service type private unpriv chroot wakeup maxproc command + args
# (yes) (yes) (no) (never) (100)
# ==========================================================================
smtp inet n - n - - smtpd
-o content_filter=spamassassin
#smtp inet n - y - 1 postscreen
#smtpd pass - - y - - smtpd
#dnsblog unix - - y - 0 dnsblog
#tlsproxy unix - - y - 0 tlsproxy
#submission inet n - y - - smtpd
# -o syslog_name=postfix/submission
# -o smtpd_tls_security_level=encrypt
# -o smtpd_sasl_auth_enable=yes
# -o smtpd_reject_unlisted_recipient=no
# -o smtpd_client_restrictions=$mua_client_restrictions
# -o smtpd_helo_restrictions=$mua_helo_restrictions
# -o smtpd_sender_restrictions=$mua_sender_restrictions
# -o smtpd_recipient_restrictions=
# -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
# -o milter_macro_daemon_name=ORIGINATING
#smtps inet n - y - - smtpd
# -o syslog_name=postfix/smtps
# -o smtpd_tls_wrappermode=yes
# -o smtpd_sasl_auth_enable=yes
# -o smtpd_reject_unlisted_recipient=no
# -o smtpd_client_restrictions=$mua_client_restrictions
# -o smtpd_helo_restrictions=$mua_helo_restrictions
# -o smtpd_sender_restrictions=$mua_sender_restrictions
# -o smtpd_recipient_restrictions=
# -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
# -o milter_macro_daemon_name=ORIGINATING
#628 inet n - y - - qmqpd
pickup unix n - y 60 1 pickup
cleanup unix n - y - 0 cleanup
qmgr unix n - n 300 1 qmgr
#qmgr unix n - n 300 1 oqmgr
tlsmgr unix - - y 1000? 1 tlsmgr
rewrite unix - - y - - trivial-rewrite
bounce unix - - y - 0 bounce
defer unix - - y - 0 bounce
trace unix - - y - 0 bounce
verify unix - - y - 1 verify
flush unix n - y 1000? 0 flush
proxymap unix - - n - - proxymap
proxywrite unix - - n - 1 proxymap
smtp unix - - y - - smtp
relay unix - - y - - smtp
# -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
showq unix n - y - - showq
error unix - - y - - error
retry unix - - y - - error
discard unix - - y - - discard
#local unix - n n - - local
virtual unix - n n - - virtual
lmtp unix - - y - - lmtp
anvil unix - - y - 1 anvil
scache unix - - y - 1 scache
#
# ====================================================================
# Interfaces to non-Postfix software. Be sure to examine the manual
# pages of the non-Postfix software to find out what options it wants.
#
# Many of the following services use the Postfix pipe(8) delivery
# agent. See the pipe(8) man page for information about ${recipient}
# and other message envelope options.
# ====================================================================
#
# maildrop. See the Postfix MAILDROP_README file for details.
# Also specify in main.cf: maildrop_destination_recipient_limit=1
#
maildrop unix - n n - - pipe
flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
#
# ====================================================================
#
# Recent Cyrus versions can use the existing "lmtp" master.cf entry.
#
# Specify in cyrus.conf:
# lmtp cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
#
# Specify in main.cf one or more of the following:
# mailbox_transport = lmtp:inet:localhost
# virtual_transport = lmtp:inet:localhost
#
# ====================================================================
#
# Cyrus 2.1.5 (Amos Gouaux)
# Also specify in main.cf: cyrus_destination_recipient_limit=1
#
#cyrus unix - n n - - pipe
# user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
#
# ====================================================================
# Old example of delivery via Cyrus.
#
#old-cyrus unix - n n - - pipe
# flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
#
# ====================================================================
#
# See the Postfix UUCP_README file for configuration details.
#
uucp unix - n n - - pipe
flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
#
# Other external delivery methods.
#
ifmail unix - n n - - pipe
flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp unix - n n - - pipe
flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
scalemail-backend unix - n n - 2 pipe
flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
mailman unix - n n - - pipe
flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
${nexthop} ${user}

spamassassin unix - n n - - pipe
user=spamd argv=/usr/bin/spamc -f -e /usr/sbin/sendmail -oi -f ${sender} ${recipient}

# AV scan filter (used by content_filter)
scan unix - - n - 16 smtp
-o smtp_send_xforward_command=yes
# For injecting mail back into postfix from the filter
127.0.0.1:10026 inet n - n - 16 smtpd
-o content_filter=
-o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
-o smtpd_helo_restrictions=
-o smtpd_client_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,reject
-o mynetworks_style=host
-o smtpd_authorized_xforward_hosts=127.0.0.0/8

var/log/mail.log

Quote:

Apr 26 11:49:59 testmail postfix/smtpd[4844]: connect from pws3.mxtoolbox.com[64.20.227.134]
Apr 26 11:50:01 testmail postfix/smtpd[4844]: NOQUEUE: reject: RCPT from pws3.mxtoolbox.com[64.20.227.134]: 554 5.7.1 <test@example.com>: Relay access denied; from=<supertool@mxtoolbox.com> to=<test@example.com> proto=ESMTP helo=<PWS3.mxtoolbox.com>
Apr 26 11:50:02 testmail postfix/smtpd[4844]: disconnect from pws3.mxtoolbox.com[64.20.227.134] ehlo=1 mail=1 rcpt=0/1 quit=1 commands=3/4

Also im still waiting for my Reverse DNS to be set up, would this be the cause of Relay Access Denied ? If not, are my configurations set up right ?

descendant_command · 04-26-2017, 06:12 AM

Quote:

Originally Posted by kryspek

but for the moment i want everyone to be allowed!

No, you really don't.

Thread reported as duplicate!

kryspek · 04-26-2017, 06:19 AM

As i said this is a part of the project i was given, they want it like that and it has to be like that.
Post is not a duplicate!..
Thanks for the unhelpful comment!

TB0ne · 04-26-2017, 07:53 AM

Quote:

Originally Posted by kryspek

As i said this is a part of the project i was given, they want it like that and it has to be like that. Post is not a duplicate!

Are you SURE ABOUT THAT???
http://www.linuxquestions.org/questi...sp-4175604146/
http://www.linuxquestions.org/questi...ha-4175604428/

...because this sure SEEMS like the third time you've posted about the exact same thing.

Quote:

Thanks for the unhelpful comment!

And thank you for ignoring the forum rules, and the very clear reply you received, telling you what to put in to what file, along with the documentation explaining how to do what you're after.

kryspek · 04-26-2017, 08:21 AM

Yes I admit, these two threads are similar asking for help HOW to set up Postix, but don't know if you even read this post, by the looks you didn't. Now the postfix is set up and running but I'm getting an error, that's why i created this thread with complete different subject. So where do you see a duplicate thread here?

Again thanks for these unnecessary comments from your side. The other threads are reported to be deleted, if you have no help to offer rather than pointing out mistakes which have nothing to do with this thread, keep them to yourself please.

jeremy · 04-26-2017, 08:35 AM

An externally accessible open relay will be found very quickly, used to send spam, and be blacklisted. This isn't something we can help you setup at LQ (and frankly, isn't something you should be doing at all).

--jeremy