OPEN Relay on Grommunio Appliance ?

Vanumo

Hi!
I have install a new Mailserver with the offered Appliance.
Users are Synced over LDAP AD.
Submission ist set to smtpd_recipient_restrictions = sasl_auth.
But Relay Connection possible ? How can i disable the Open Relay?

Thank You.

BR Vanumo

WalterH

Vanumo But Relay Connection possible ?

How did you checked that a relay connection works?

WalterH

Did you changed anything in Postfix configuration?

Vanumo

WalterH

Dear Walter,

no nothing was changed in the Configuration. Install the Appliance and use the Wizard for Configuration.

BR,
Vanumo

Vanumo

WalterH

I have check also with Telnet to P25 on my MailServer, possible to sent message without passwort.

BR,
Vanumo

Vanumo

MXTOOLBOX and other TOOLS, and i See foreign Mails in my mailqueue.

Vanumo

WHICH logs should i post here for better understanding the issue ?
Thank you.

WalterH

post this lines from /etc/postfix/main.cf

mynetworks =
smtpd_client_restrictions =
smtpd_sender_restrictions = 
smtpd_recipient_restrictions = 
smtpd_relay_restrictions =

Vanumo

hi:

mynetworks = 127.0.0.0/28 , 192.168.1.0/24
smtpd_client_restrictions =

smtpd_helo_restrictions = permit_mynetworks,permit_sasl_authenticated,reject_invalid_hostname,reject_non_fqdn_hostname

smtpd_sender_restrictions = reject_non_fqdn_sender,permit_sasl_authenticated,permit_mynetworks

smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,check_recipient_access pcre:/etc/postfix/grommunio-archiver-envelope.cf,reject_unknown_recipient_domain

WalterH

In /etc/postfix/main.cf set compatibility_level = 3.7 or to the maximum of your postfix version, restart postfix.
Than read this: https://www.postfix.org/SMTPD_ACCESS_README.html and activate and test the restrictions.

WalterH

I did not see any relay restrictions, try this restriction:

smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination

and restart Postfix.

cbka

he probably DNAT 25:25 from 0.0.0.0:192.168.1.X to Grommunio. So the Source of every request is 192.168.1.X . Therfore postfix thinks its private relay and accepts messages ..

WalterH

cbka A good idea!

Vanumo

Good Evening,

i would say thank you to cbka and WalterH. I have solved the problem -> on the Router a Masquerading Rule was misconfigurated. Afer clear the Setup and Check Again the DNAT Rulez all work as it should.

Please mark the Topic als Solved.

BR.
Vanumo