Postfix: "smtpd_client_restrictions" takes no effect?

Chowroc · 10-26-2005, 12:32 AM

This is about: POSTFIX ACCESS control base on IP. When I use:

Code:

mynetworks=hash:/etc/postfix/access

/etc/postfix/access:
192.168.0.1 OK

OK, 192.168.0.1 can mail. But when I use:

Code:

smtpd_client_restrictions = hash:/etc/postfix/access
OR
smtpd_client_restrictions = check_client_access hash:/etc/postfix/access

I GET:

Oct 25 22:13:43 master01 postfix/smtpd[13075]: connect from unknown[192.168.0.1]
Oct 25 22:13:43 master01 postfix/smtpd[13075]: NOQUEUE: reject: RCPT from unknown[192.168.0.1]: 554 <Chowroc_Z@yahoo.com.cn>: Relay access denied; from=<Chowroc_Z@example.com.cn> to=<Chowroc_Z@yahoo.com.cn> proto=ESMTP helo=<[127.0.0.1]>
Oct 25 22:13:44 master01 postfix/smtpd[13075]: disconnect from unknown[192.168.0.1]

What is wrong? Why "smtpd_client_restrictions" taks no effect?

Berhanie · 10-27-2005, 10:08 AM

smtpd_client_restrictions controls who is allowed to request an SMTP connection. It takes effect before the client gives the HELO command. By default, it is empty, which means that anyone is allowed to connect. For more info about the various parameters,

Code:

man 5 postconf

Even though anyone is allowed to make an SMTP connection to the mail server, by default the only allowable RCPT TO: addresses are those of local users. If you want to control which machines on your local network can relay mail, you can use the mynetwoks_style parameter.

Examples:

1. Allow relay for mail submitted by this machine only:

Code:

mynetworks_style = host

2. Allow relay for mail submitted by any machine on my local network:

Code:

mynetworks_style = subnet

For finer control, use the mynetworks parameter instead.

3. Mail server has address 192.168.0.2, but allows relay for mail submitted by machine 192.168.0.4:

Code:

mynetworks = 127.0.0.0/8 192.168.0.2/32 192.168.0.4/32

Chowroc · 10-30-2005, 11:30 PM

Thank you.

But I think your meaning is still the "smtpd_client_restrictions" takes no effect, I can only control the connections with mynetworks ranther than "smtpd_client_restrictions"?

Then why that paramiters designed?

Berhanie · 10-31-2005, 11:17 AM

Quote:

I think your meaning is still the "smtpd_client_restrictions" takes no effect

Not so. I think your mail was rejected because of a relay access problem, not an access problem. Look at the value of smtpd_recipient_restrictions. This is the default:

Code:

smtpd_recipient_restrictions = permit_mynetworks, reject_unauth_destination

That's why adding an IP address mynetworks solves the problem.

Chowroc · 11-01-2005, 12:59 AM

Oh, I see. you mean that "smtpd_recipient_restrictions" will be check before "smtpd_client_restrictions"? or has higher priority?

Thank you very much. I will look up the details.

Berhanie · 11-01-2005, 09:42 AM

The order of evaluation is:

smtpd_client_restrictions
smtpd_helo_restrictions
smtpd_sender restrictions
smtpd_recipient_restrictions
smtpd_data_restrictions

Each of the above corresponds to a particular stage of the SMTP conversation. In your case, you were able to pass the smtpd_client_restrictions rules, but not the smtpd_recipient_restrictions.

You might also want to look up smtpd_delay_reject. More detail on all the above is found in the postconf(5) man page.

[Edit:] Before reading the man pages, you might find the documentation on the postfix site here useful. Start with one labeled 'Basic configuration'. It addresses everything you need to start running a mail server. The rest of the documentation becomes more important as your needs become complex.