hi,
I am configuring a postfix-based mailserver at home, using the
docker-based mailserver
https://github.com/docker-mailserver/docker-mailserver
Under the hood the version is:
# postconf mail_version
mail_version = 3.5.17
I am trying to use a cidr table to whitelist. But contrary to what I
assumed it seems to read the ascii file, not the db file postmap makes.
Can people perhaps confirm that is how it should be?
from my main.cf:
# egrep client_checks /etc/postfix/main.cf
smtpd_sender_restrictions = permit_mynetworks, check_client_access
cidr:/etc/postfix/client_checks, reject_unknown_client_hostname,
reject_authenticated_sender_login_mismatch, permit_sasl_authenticated,
reject_unknown_sender_domain
so it is about this line: check_client_access
cidr:/etc/postfix/client_checks
If I have only the text file in /etc/postfix like so, it works fine:
ls -all /etc/postfix/c*
-rw-r--r-- 1 root root 86 Feb 26 13:06 /etc/postfix/client_checks
# cat /etc/postfix/client_checks
84.241.192.0/18 OK
89.205.128.0/17 OK
1.141.128.0/17 OK
But if I create a db file by doing
postmap /etc/postfix/client_checks
with this result
# ls -all /etc/postfix/c*
-rw-r--r-- 1 root root 86 Feb 26 13:06 /etc/postfix/client_checks
-rw-r--r-- 1 root root 12288 Feb 26 13:56 /etc/postfix/client_checks.db
and I delete the ascii file
I get errors.
# postmap -q 89.205.128.1 cidr:/etc/postfix/client_checks
postmap: fatal: open /etc/postfix/client_checks: No such file or directory
# postmap -q 89.205.128.1 cidr:/etc/postfix/client_checks.db
postmap: warning: cidr map /etc/postfix/client_checks.db, line 1: no
address pattern: skipping this rule
and below you can see this is really fatal as no email is accepted.
root@mail [ ~/containers/mailserver ]# tail -f
/var/lib/docker/volumes/mailserver_log/_data/mail/mail.log
Feb 26 13:04:27 mail postfix/dnsblog[1088]: addr 209.85.166.42 listed by
domain list.dnswl.org as 127.0.5.0
Feb 26 13:04:29 mail postfix/dnsblog[1090]: addr 209.85.166.42 listed by
domain dnsbl.sorbs.net as 127.0.0.6
Feb 26 13:04:29 mail postfix/postscreen[1084]: PASS NEW
[209.85.166.42]:38780
Feb 26 13:04:29 mail postfix/smtpd[1104]: error: open
/etc/postfix/client_checks: No such file or directory
Feb 26 13:04:29 mail postfix/smtpd[1104]: connect from
mail-io1-f42.google.com[209.85.166.42]
Feb 26 13:04:29 mail postfix/smtpd[1104]: Anonymous TLS connection
established from mail-io1-f42.google.com[209.85.166.42]: TLSv1.3 with
cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519
server-signature RSA-PSS (2048 bits) server-digest SHA256
Feb 26 13:04:30 mail postfix/smtpd[1104]: warning:
cidr:/etc/postfix/client_checks is unavailable. open
/etc/postfix/client_checks: No such file or directory
Feb 26 13:04:30 mail postfix/smtpd[1104]: warning:
cidr:/etc/postfix/client_checks lookup error for "mail-io1-f42.google.com"
Feb 26 13:04:30 mail postfix/smtpd[1104]: NOQUEUE: reject: RCPT from
mail-io1-f42.google.com[209.85.166.42]: 451 4.3.5
<mail-io1-f42.google.com[209.85.166.42]>: Client host rejected: Server
configuration error; from=<[email protected]>
to=<[email protected]> proto=ESMTP helo=<mail-io1-f42.google.com>
But if I (re)move the db file
mv /etc/postfix/client_checks.db /etc/postfix/client_checks2
# ls -all /etc/postfix/c*
-rw-r--r-- 1 root root 86 Feb 26 13:06 /etc/postfix/client_checks
no errors at all .
So my conclusion it: for a cidr table you do not have to use postmap to
create a db file at all and it will work file.
Can anyone confirm this?
Perhaps everybody knows this, but I didnt (if true)
greetings
Hans-Cees
