Re: RES: RES: RES: Deny outbound connections

From: Victor Duchovni (no email)
Date: Mon Nov 01 2004 - 15:16:30 EST


On Mon, Nov 01, 2004 at 04:01:35PM -0300, Danilo Montagna - NetworkBrasil wrote:

> Postfix version = 2.1.5
>
> mydestination = $myhostname, $mydomain, $transport_maps

This is a bad idea. Just waiting for an accident where you suddenly
become a relay for say hotmail.com, just because you may need to tune
a transport entry for this destination.

This also makes all domains in the transport table local, with their
sub-domains implicitly designated as relay domains (default relay_domains
= $mydestination). This also means that your recipient validation is wrong,
because you want local_recipient_maps not relay_recipient_maps for most
domains.

> transport_maps = mysql:/etc/postfix/mysql_transport_maps.cf

The transport table is performance critical, I recommend virtual(5)
instead and either no transport table at all, or just one that
special-cases a few domains. Per-user transport is available and robust
(no mail silently lost), but especially over MySQL/LDAP/PgSQL/... not
highly performant and too prone to outages and so is not recommended
(by me).

> relay_recipient_maps = $virtual_mailbox_maps

This mixing of address classes is often bogus. Use virtual_mailbox_domains
for virtual mailboxes.

> failback_transport = /ust/bin/maildrop

What?

> virtual_alias_maps = mysql:/etc/postfix/mysql_virtual_alias_maps.cf
> virtual_gid_maps = static:108
> virtual_mailbox_base = /postfix
> virtual_mailbox_limit = 25000000
> virtual_mailbox_maps = mysql:/etc/postfix/mysql_virtual_mailbox_maps.cf
> virtual_uid_maps = static:108

Use virtual_mailbox_domains, not transport_maps to define which domains
are delivered to virtual users. Or use "mailbox_transport" via local(8).
See:

    http://www.postfix.org/VIRTUAL_README.html
    http://www.postfix.org/MAILDROP_README.html

> >Why are your virtual mailbox users in "relay_domains"?
>
> My virtual mailbox users aren't in "relay_domains". My relay control are
> taken by $transport_maps in "mydestination" line. Like you can see above..
>
> If the final destination domain is listed on mysql_transport_maps.cf, then
> the relay will be accepted. If the domain isn't there, they will get a
> "relay access denied" ..
>
> Like I said before, my postfix setup don't have problems.. The only problem
> that a had was to reject unknown mail users..
>

It has problems, you just have not found them yet.

-- 
	Viktor.
Disclaimer: off-list followups get on-list replies or get ignored.
Please do not ignore the "Reply-To" header.
To unsubscribe from the postfix-users list, visit
http://www.postfix.org/lists.html or click the link below:
<mailto:?body=unsubscribe%20postfix-users>







Hosted Email Solutions

Invaluement Anti-Spam DNSBLs



Powered By FreeBSD   Powered By FreeBSD