Thread: Debian 6 +Postfix user doesn't need to authenticate when sending a mail to himself??

hi there,

time have problem postfix configuration , i'm not able fix it. hope, can me out here, because it's drives me crazy..

have debian 6 (64bit)+postfix +dovecot server (all packages date). e-mail delivery works great, imap , pop3 , ssl/tls authentication on smtp relay. thought i'm ready, while testing noticed following thing: user (let's call user@company.com) can not send e-mails through server without authentication (which great, that's want), reason can send e-mail himself without auth!!

mean is, when set user account in outlook, if don't put auth data smtp relay server, correct e-mail address (user@company.com) can send e-mail without problem user@company.com. don't want because way knows e-mail address , server ip can send e-mails/spams user user's address..

have idea how prevent this? tried lot of things, including removing "permit_mynetworks" smtpd_recipient_restrictions didn't work. when add simple "reject" @ end of smtpd_recipient_restrictions, works expected, user can not recieve e-mails outside world..

realy kills me. appreciate.

here's main.cf

thank much.

david


# see /usr/share/postfix/main.cf.dist commented, more complete version
# debian specific: specifying file name cause first
# line of file used name. debian default
# /etc/mailname.
# should fqdn of machine
myhostname=mail.company.com
# internet domain name of system.
# default use $myhostname without sub-domain
mydomain=company.com
# domain local emails from: root@example.org
myorigin=$mydomain
# set localhost, because handle domains via virtual_mailbox_domains
mydestination = localhost
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
inet_interfaces = all
mailbox_size_limit = 0
recipient_delimiter = +
# debug level messages in log. level 2 default one
debug_peer_level=2
# debug request coming ip
#debug_peer_list=127.0.0.1
# banner mail system greet client opens socket us
smtpd_banner=$myhostname esmtp $mail_name
# disable information messages local users new emails
biff=no
# don't use relayhost, set empty
relayhost=
# disable showing why user not exist in system
show_user_unknown_table_name=no
# appending .domain mua's job.
append_dot_mydomain = no
# uncomment next line generate "delayed mail" warnings
#delay_warning_time = 4h
# local aliases postmaster, root, ...
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
# virtual domain options
###############################
# save destination of incoming mails
virtual_mailbox_base=/var/vmail
# following 3 files 2-columns files. call left column left side handed (lsh) , right column right side handed (rsh)
# contains domain names emails accepted. lsh contains names, rsh string @ least 1 char (e.g. ok)
virtual_mailbox_domains=hash:/etc/postfix/virtual_mailbox_domains
# contains virtual mailboxes emails saved on system. lsh: incoming e-mail address, rsh: location of mailbox relative $virt$
virtual_mailbox_maps=hash:/etc/postfix/virtual_mailbox_maps
# contains redirections. lsh: incoming e-mail address, rsh: forwarding e-mail address, multiple forwading addresses seperated comma
virtual_alias_maps=hash:/etc/postfix/virtual_alias_maps
# userid of virtual mailbox user created
virtual_minimum_uid=100
virtual_uid_maps=static:5000
# groupid of virtual mailbox user created
virtual_gid_maps=static:5000
# delivery agent use save mails
virtual_transport=dovecot
# tls parameters
###############################
# own certificate
smtpd_tls_cert_file=/etc/apache2/ssl/mail.company.com.pem
smtpd_tls_key_file=/etc/apache2/ssl/mail.company.com.key
# accepted ca certificates
smtpd_tls_cafile=/etc/ssl/certs/ca-certificates.crt
smtp_tls_cafile=/etc/ssl/certs/ca-certificates.crt
smtp_use_tls=yes
smtpd_use_tls=yes
smtpd_tls_loglevel=1
smtpd_tls_received_header=yes
tls_random_source=dev:/dev/urandom
smtp_tls_note_starttls_offer=yes
smtpd_tls_session_cache_timeout=3600s
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
queue_directory=/var/spool/postfix
smtpd_sasl_type=dovecot
smtpd_sasl_path=private/auth
#smtpd_sasl_path=auth/dovecot
smtpd_sasl_auth_enable=yes
broken_sasl_auth_clients=yes
smtpd_sasl_security_options=noanonymous
smtpd_sasl_tls_security_options=$smtpd_sasl_securi ty_options
smtpd_sasl_local_domain=$myhostname
smtpd_sasl_application_name=smtpd
smtpd_helo_required=yes
smtpd_helo_restrictions=reject_invalid_helo_hostna me
smtpd_recipient_restrictions=
permit_mynetworks
permit_sasl_authenticated
reject_unauth_destination
reject_unauth_pipelining
reject_invalid_hostname
reject_non_fqdn_sender
reject_unknown_sender_domain
reject_non_fqdn_recipient
reject_unknown_recipient_domain

hi,

found solution own question. turned out, missing correct order in smtpd_recipient_restrictions. here is:

smtpd_recipient_restrictions=
permit_sasl_authenticated
reject_non_fqdn_sender,
reject_non_fqdn_recipient,
reject_non_fqdn_hostname,
reject_invalid_hostname,
permit_mynetworks,
reject_unauth_pipelining,
reject_unknown_sender_domain,
reject_unknown_recipient_domain,
reject_unauth_destination,
reject_unknown_client,
permit

Forum The Ubuntu Forum Community Other Discussion and Support Other OS Support and Projects Other Operating Systems Any Other OS Debian 6 +Postfix user doesn't need to authenticate when sending a mail to himself??

Ubuntu