Hi all, I run OpenSMTPD 7.6.0-portable on a personal debian server (alpha) with no ports exposed to the public internet. It listens for submission on a WireGuard interface only. Inbound mail from other MTAs arrives through an HTTP gateway that speaks LMTP to dovecot directly.
The reason I do this is that WireGuard is the only way through alpha
from outside. Everything else is firewalled, so port 25 is not an option
to begin with.
smtpd therefore acts as a submission relay for my own clients plus a
local router.
The relevant part of /etc/smtpd.conf:
table secrets file:/etc/smtpd/secrets
table vusers file:/etc/smtpd/virtuals
listen on lo
listen on wg0 port 587
action "local" lmtp "/var/run/dovecot/lmtp" rcpt-to virtual <vusers>
action "out" relay host smtp+tls://[email protected]:2525 \
auth <secrets> helo "dilluti0n.com"
action "out-local" relay host smtp+tls://[email protected]:2525 \
auth <secrets> helo "dilluti0n.com" \
mail-from "[email protected]"
match from any for rcpt-to "[email protected]" action "local"
match from local for any action "out-local"
match from src 10.42.0.0/24 for any action "out"
And /etc/smtpd/virtuals is a single line:
[email protected] vmail
Without the rcpt-to option on the "local" action, delivery to my own
domain failed repeatedly. From journalctl:
878b3aa132064ccf mda delivery evpid=b92e4508d04b1462
from=<[email protected]> to=<[email protected]> rcpt=<[email protected]>
user=vmail delay=0s result=TempFail stat=Error (temporary failure: "mail.lmtp:
LMTP server error: 550 5.1.1 <vmail> User doesn't exist: vmail")
On the dovecot side, userdb key is the full address [email protected],
and mailboxes are owned by the Unix user vmail. Adding rcpt-to fixed
delivery.
I wonder whether I am using vusers incorrectly. I understood it as the
Unix user owning the /var/run/dovecot/lmtp socket, but it appears to be
used as RCPT TO when the mail is sent over LMTP. My question is: does
<vusers> still do anything on this action, or should I drop the table
and match on the domain instead?
Thanks,
Hee-Suk Kim
--
https://dilluti0n.com
signature.asc
Description: PGP signature
