主页 / unix / 问题 / 740643
Accepted
ehammer
Asked: 2023-03-23 05:33:49 +0800 CST

Postfix 拒绝除 relay_domains 之外的所有中继域目标

  • 772

我正在运行带有 Postfix 3.5.17 的 Debian 11，但我无法限制客户端可以将邮件中继到的域（来自提交的邮件）。

我已将 relay_domains 配置为仅将邮件中继到的特定域，但如果我向 domain.com 发送测试邮件，日志会显示它与它的连接，尽管它不在 relay_domains 中。

似乎 relay_domains 现在实际上并没有拒绝任何东西，是否需要额外的配置选项或限制才能生效？

后配置-n：

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
anvil_rate_time_unit = 60s
append_dot_mydomain = no
biff = no
compatibility_level = 2
default_destination_rate_delay = 5s
disable_vrfy_command = yes
inet_interfaces = all
inet_protocols = all
invalid_hostname_reject_code = 550
mailbox_size_limit = 0
maximal_backoff_time = 3h
minimal_backoff_time = 180s
mydestination = localhost
mydomain = localmail.com
myhostname = localmail.com
mynetworks = 127.0.0.0/8 172.20.0.0/16 10.10.0.0/16 192.168.0.0/16
myorigin = $mydomain
non_fqdn_reject_code = 550
readme_directory = no
recipient_delimiter = +
relay_domains = protonmail.com, protonmail.ch, mail.protonmail.ch, mailsec.protonmail.ch
relayhost =
smtp_always_send_ehlo = yes
smtp_helo_timeout = 15s
smtp_rcpt_timeout = 15s
smtp_tls_security_level = encrypt
smtpd_banner = $myhostname ESMTP $mail_name
smtpd_client_message_rate_limit = 10
smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated,
smtpd_delay_reject = yes
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname
smtpd_recipient_limit = 40
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_recipient, reject_unknown_recipient_domain, reject_unlisted_recipient, reject_unauth_destination
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, defer_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous, noplaintext
smtpd_sasl_tls_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_sender_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_sender, reject_unknown_sender_domain
smtpd_timeout = 30s
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /etc/ssl/certs/mailtls-selfsigned.crt
smtpd_tls_key_file = /etc/ssl/private/mailtls-selfsigned.key
smtpd_tls_security_level = encrypt
smtpd_use_tls = yes
strict_rfc821_envelopes = yes
unknown_address_reject_code = 550
unknown_client_reject_code = 550
unknown_hostname_reject_code = 550
unverified_recipient_reject_code = 550
unverified_sender_reject_code = 550
virtual_alias_maps = mysql:/etc/postfix/mysql-virtual-alias-maps.cf, mysql:/etc/postfix/mysql-virtual-email2email.cf
virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual-mailbox-domains.cf
virtual_mailbox_maps = mysql:/etc/postfix/mysql-virtual-mailbox-maps.cf
virtual_transport = lmtp:unix:private/dovecot-lmtp
email

1 个回答

  1. Best Answer

    限制的顺序很重要，第一个匹配的规则获胜。

    因为您之前有permit_mynetworks任何其他限制，所以您本地网络上的主机可以中继到任何地方。同样，您有permit_sasl_authenticated第二个限制，它允许经过身份验证的客户端中继到任何域。

    如果你不想这样，请在andreject_unauth_destination 之前 加上。permit_mynetworkspermit_sasl_authenticated

    来自man 5 postconf:

    reject_unauth_destination

    拒绝请求，除非满足以下条件之一：

    • Postfix 是邮件转发器：解析的 RCPT TO 域匹配 $relay_domains或其子域，并且不包含发件人指定的路由（user@elsewhere@domain），

    • Postfix 是最终目的地：解析的 RCPT TO 域匹配$mydestination, $inet_interfaces, $proxy_interfaces, $virtual_alias_domains, 或$virtual_mailbox_domains, 并且不包含发件人指定的路由 (user@elsewhere@domain)。

    该relay_domains_reject_code参数指定拒绝请求的响应代码（默认值：554）。

    • 1

相关问题