LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices


Reply
  Search this Thread
Old 03-31-2020, 01:04 PM   #1
vincix
Senior Member
 
Registered: Feb 2011
Distribution: Ubuntu, Centos
Posts: 1,136

Rep: Reputation: 85
postfix allows mail relaying for any random subdomains


I'm running a postfix send-only mail relay (postfix-3.4.5) with restrictions per IPs (my networks, that is to say) and a restriction for domains that can be used to send e-mails for.
The latter is being enforced using the following directive:
Code:
smtpd_recipient_restrictions = reject_non_fqdn_recipient, reject_unknown_recipient_domain, check_sender_access hash:/etc/postfix/allowed_senders, reject
/etc/postfix/allowed_senders (already mapped to db)
Code:
domain.eu	OK
domain.com	OK
example.de	OK
The problem is that postfix also accepts the relay of e-mails for any random subdomains of these main domains and I haven't yet found a solution for rejecting this.
This works when I enforce login maps, for instance, so that certain users can send e-mails using only certain e-mail addresses, but this mail relay is configured differently and I would have expected being able to allow only the domains I'm specifying, and not any other subdomains.

Any ideas?
 
Old 03-31-2020, 04:11 PM   #2
TB0ne
LQ Guru
 
Registered: Jul 2003
Location: Birmingham, Alabama
Distribution: SuSE, RedHat, Slack,CentOS
Posts: 22,710

Rep: Reputation: 6245Reputation: 6245Reputation: 6245Reputation: 6245Reputation: 6245Reputation: 6245Reputation: 6245Reputation: 6245Reputation: 6245Reputation: 6245Reputation: 6245
Quote:
Originally Posted by vincix View Post
I'm running a postfix send-only mail relay (postfix-3.4.5) with restrictions per IPs (my networks, that is to say) and a restriction for domains that can be used to send e-mails for.
The latter is being enforced using the following directive:
Code:
smtpd_recipient_restrictions = reject_non_fqdn_recipient, reject_unknown_recipient_domain, check_sender_access hash:/etc/postfix/allowed_senders, reject
/etc/postfix/allowed_senders (already mapped to db)
Code:
domain.eu	OK
domain.com	OK
example.de	OK
The problem is that postfix also accepts the relay of e-mails for any random subdomains of these main domains and I haven't yet found a solution for rejecting this.
This works when I enforce login maps, for instance, so that certain users can send e-mails using only certain e-mail addresses, but this mail relay is configured differently and I would have expected being able to allow only the domains I'm specifying, and not any other subdomains.
Seen this once before, but it's been a while. Run
Code:
postconf -n
...and see if the smtpd_access_maps directive is enabled. If so, remove it from your config and bounce postfix. Found in the postfix manual.
http://www.postfix.org/access.5.html

From that page:
Code:
domain.tld
              Matches domain.tld as the domain part of an email address.

              The pattern domain.tld also matches subdomains,  but  only  when
              the  string  smtpd_access_maps  is  listed  in  the Postfix par-
              ent_domain_matches_subdomains configuration setting.

Last edited by TB0ne; 03-31-2020 at 08:41 PM.
 
1 members found this post helpful.
Old 04-02-2020, 07:59 AM   #3
vincix
Senior Member
 
Registered: Feb 2011
Distribution: Ubuntu, Centos
Posts: 1,136

Original Poster
Rep: Reputation: 85
Hi,

Thanks for the reply. It did work indeed by removing the smtpd_access_maps from the parent_domain_matches_subdomains:
Code:
parent_domain_matches_subdomains = debug_peer_list,fast_flush_domains,mynetworks,permit_mx_backup_networks,qmqpd_authorized_clients,relay_domains
It seems to also work by eliminating all the values:
Code:
parent_domain_matches_subdomains =
But to be honest, I can't understand exactly why. Would you happen to know why?

Thanks for the help, anyway, it solved the problem.
 
  


Reply

Tags
mail, postfix, relaying, restrict


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Postfix Smarthost not relaying mail to Exchange for one user severian23 Linux - General 1 09-14-2009 08:10 AM
sendmail SMTP AUTH allows relaying ganesh_914 Linux - Server 0 07-23-2009 05:12 AM
Relaying mail with Postfix kayasaman Linux - Server 10 11-07-2008 10:56 PM
Postfix: Relaying all mail to different mailaccount Marix Linux - Software 1 01-08-2006 07:52 AM
Postfix relaying mail to internal mail server tradecraft1 Linux - Networking 2 10-28-2003 03:01 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Server

All times are GMT -5. The time now is 03:06 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration