Re: [qmailtoaster] Re: eMPF requires authentication to work?

Fri, 13 Nov 2009 10:49:47 -0800

Hi Eric,
I must be missing something here.  I decided to give postfix and followed your quickie howto, but I cannot send email out. First this is what I have done.
Stopped qmail-smtpd and qmail-send using svc -d service name and adding the "down" files to the proper directories.
I used yum on my Centos 5.3 system and install postfix-2.3.3-2.1.el5_2.

Then I used these instructions:
# cd /etc/pki/tls/certs
# make postfix.pem
# cd /etc/postfix
# echo "mail.domain.com:587 [email protected]:password" \     I replace mail.domain.com with mail.accsnetwork.com and [email protected]:
    >sasl_passwd
# chmod 600 sasl_passwd
# postmap sasl_passwd

Edit /etc/postfix/main.cf settings:
myorigin = domain.com    Used accsnetwork.com here
#mydestination =
mynetworks_style = host
relayhost = mail.domain.com:587 Used mail.accsnetwork.com:587 here.
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options =
smtp_use_tls = yes
smtp_tls_CAfile = /etc/pki/tls/certs/postfix.pem
smtp_tls_session_cache_database = btree:/var/run/smtp_tls_session_cache

Then I had to create some symbolic links:
# ln -s /usr/sbin/sendmail.postfix /usr/sbin/sendmail
# ln -s /usr/lib/sendmail.postfix /usr/lib/sendmail

started postfix
watched the /var/log/maillog file
sent a test email from the command line
I get this these errors:
Nov 13 12:46:37 inet postfix/pickup[17384]: BA2DD20E0152: uid=0 from=<root>
Nov 13 12:46:37 inet postfix/cleanup[17397]: BA2DD20E0152: message-id=<[email protected]>
Nov 13 12:46:37 inet postfix/qmgr[17385]: BA2DD20E0152: from=<[email protected]>, size=729, nrcpt=1 (queue active)
Nov 13 12:47:07 inet postfix/smtp[17399]: connect to mail.accsnetwork.com[207.224.111.118]: Connection timed out (port 587)
Nov 13 12:47:07 inet postfix/smtp[17399]: BA2DD20E0152: to=<[email protected]>, relay=none, delay=30, delays=0.02/0.04/30/0, dsn=4.4.1, status=deferred (connect to mail.accsnetwork.com[207.224.111.118]: Connection timed out)

Do I need to set something up on the qmailtoaster server?

Thanks,
Dave



Eric Shubert wrote:
I think that postfix is your best route as well.

Just to clarify the log messages a little, when spamdyke issues a DENIED_OTHER message, it's saying that something else (other than spamdyke) rejected the message. This could be absolutely anything further down the pipe. spamdyke is simply saying that "something other than rejected the message, so I'm obeying that rejection".

In this case it appears to be eMPF that's doing the rejecting, but it could also be chkuser, clamav, spamassassin etc. as far as spamdyke knows. There should be a rejection message in the log just before spamdyke's DENIED_OTHER that details the rejection.

HTH.

[email protected] wrote:
Thanks guys for all the input. I should be more descriptive with my
issue.  First, my users do not connect to any email accounts on my
internal servers.  I have different applications running on my internal
servers that need to send email to accounts on my external
(qmail-toaster).  For instance, I run timetrex on one server.  Users
login and clock in and out.  Managers can send email to the time
administrator email account which resides on my external server
([email protected]).  These are the emails that are failing in the
example logs I posted.
Thinking of what Jake was suggesting:
I added 192.168.105.110 to the whitelist_ip and
@local.solution-group.com to whitelist_rdns and whitelist_senders in
/etc/spamdyke.  I still get the "11-10 16:07:45 spamdyke[27917]:
DENIED_OTHER from: [email protected] to: [email protected] origin_ip:
192.168.105.110 origin_rdns: " message in the smtp logfile on the
qmailtoaster.

I can say with 100% confidence that when I remove all entries from the
policy (eMPF) file on the external mail server - these emails are
successfully delivered.  The issue is, timetrex and other application
have no configuration file where I can put the smtp username and
password.  Since eMPF requires a user to authenticate (it has to know
who you are so it can apply a rule if applicable) it fails any message
that does not authenticate.

So, at this point, my best option is to follow the quickie guide to
installing postfix.

If anyone has anything else to add or suggest, I am all ears.

Thanks,
Dave
 

Jake Vickers wrote:
Eric Shubert wrote:
Good question. I don't know the answer to that off hand.

Michael Colvin wrote:
Oh, I totally agree, Eric.  I guess my point was trying to find out
if there
was any reason they needed to do it that way...  Really, the eMPF
functionality should be on his internal server, not the external relay
server...  Then, the internal server could relay to the QMT w/o
having eMPF
on it, and the internal server would still limit user e-mails.

Unless of course the users also connect from externally...

Couldn't he also have the internal server relay via port 587 to the
toaster?
Does eMPF look at 587 traffic also?
I'm 99% sure that it does, since it's a patch applied to the smtp
daemon in a global sense.
Also, isn't this a Spamdyke config issue with the IP addres?

11-10 16:07:45 spamdyke[27917]: DENIED_OTHER from: [email protected] to:
[email protected] origin_ip: 192.168.105.110 origin_rdns:

It reads to me that it was denied because of "DENIED_OTHER" by
spamdyke for origin_rdns.
It's late, so correct me if I'm wrong.



--------------------------------------------------------------------------------- Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! --------------------------------------------------------------------------------- Please visit qmailtoaster.com for the latest news, updates, and packages. To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]

Reply via email to