Hi all,

I run OpenSMTPD 7.6.0-portable on a personal debian server (alpha) with
no ports exposed to the public internet. It listens for submission on a
WireGuard interface only. Inbound mail from other MTAs arrives through
an HTTP gateway that speaks LMTP to dovecot directly.

The reason I do this is that WireGuard is the only way through alpha
from outside. Everything else is firewalled, so port 25 is not an option
to begin with.

smtpd therefore acts as a submission relay for my own clients plus a
local router.

The relevant part of /etc/smtpd.conf:

    table secrets  file:/etc/smtpd/secrets
    table vusers   file:/etc/smtpd/virtuals

    listen on lo
    listen on wg0 port 587

    action "local" lmtp "/var/run/dovecot/lmtp" rcpt-to virtual <vusers>

    action "out" relay host smtp+tls://[email protected]:2525 \
                 auth <secrets> helo "dilluti0n.com"

    action "out-local" relay host smtp+tls://[email protected]:2525 \
                 auth <secrets> helo "dilluti0n.com" \
                 mail-from "[email protected]"

    match from any              for rcpt-to "[email protected]" action "local"
    match from local            for any action "out-local"
    match from src 10.42.0.0/24 for any action "out"

And /etc/smtpd/virtuals is a single line:

    [email protected]  vmail

Without the rcpt-to option on the "local" action, delivery to my own
domain failed repeatedly. From journalctl:

    878b3aa132064ccf mda delivery evpid=b92e4508d04b1462 
from=<[email protected]> to=<[email protected]> rcpt=<[email protected]> 
user=vmail delay=0s result=TempFail stat=Error (temporary failure: "mail.lmtp: 
LMTP server error: 550 5.1.1 <vmail> User doesn't exist: vmail")

On the dovecot side, userdb key is the full address [email protected],
and mailboxes are owned by the Unix user vmail. Adding rcpt-to fixed
delivery.

I wonder whether I am using vusers incorrectly. I understood it as the
Unix user owning the /var/run/dovecot/lmtp socket, but it appears to be
used as RCPT TO when the mail is sent over LMTP. My question is: does
<vusers> still do anything on this action, or should I drop the table
and match on the domain instead?

Thanks,
Hee-Suk Kim

--
https://dilluti0n.com

Attachment: signature.asc
Description: PGP signature

Reply via email to