On 13.08.26 15:48, Peymaneh Nejad via Postfix-users wrote:
main.cf:
```
smtpd_recipient_restrictions =
check_recipient_access hash:/etc/postfix/spamfilter_access,
permit_mynetworks,
permit_sasl_authenticated,
reject_unauth_destination,
check_policy_service unix:private/policy-spf
```
Where this is the content of /etc/postfix/spamfilter_access:
```
[email protected] FILTER spamassassin:
...
```
Now it seems that this setups allows unauthenticated and forged
mails from a nonexistent user via port 25 to be signed with a DKIM
signature by us:
On 8/13/26 16:39, Matus UHLAR - fantomas via Postfix-users wrote:
Neither of these calls opendkim
On 13.08.26 18:28, Peymaneh Nejad via Postfix-users wrote:
Sorry, I did not include that part of main.cf:
```
milter_default_action = accept
milter_protocol = 6
smtpd_milters =
inet:127.0.0.1:12301 # opendkim
inet:127.0.0.1:8893 # opendmarc
non_smtpd_milters = inet:localhost:12301
```
To me the https://www.postfix.org/FILTER_README.html suggests that the
"FILTER" is a "after queue" filter action, is the current placement
(smtpd_recipient_restriction) an issue?
the FILTER is not an issue.
The FILTER passes incoming mail to "spamassassin" service defined in
main.cf, which is then expected to pass mail back to postfix somehow.
According to your logs, the "spamassassin" uses pickup service, which
indicates that the mail is send via sendmail binary
Mail received locally via sendmail then connects to opendkim which signs the
e-mail and this is your problem.
And what does your spamassassin filter do?
I mean, what exactly does "sendmail" service in master.cf do?
Perhaps it could feed mail back to postfix on a port where opendkim does not run
Excuse me if this is an ignorant question, but would you know how to
let spamassassin do that?
The postfix manpage states:
FILTER transport:destination
After the message is queued, send the entire message through the
specified external content filter. The transport name specifies
the first field of a mail delivery agent definition in mas-
ter.cf; the syntax of the next-hop destination is described in
the manual page of the corresponding delivery agent. More
information about external content filters is in the Postfix
FILTER_README file.
The spamassassin documentation does not provide any hints on its
usage/configuration as a "delivery agent"
spamassassin is only a mail filter, it does not receive nor deliver mail.
You need a glue application that pushed mail to spamassassin and back.
Common glue apps are amavis, spamass-milter, rspamd.
your glue application causes mail being reinjected to postfix the way it
get's DKIM-signed.
--
Matus UHLAR - fantomas, [email protected] ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
It's now safe to throw off your computer.
_______________________________________________
Postfix-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
