get rid of "Open relay?" and set up DKIM

[Matus UHLAR - fantomas]

Hello,

I am trying to get rid of annoying "Open relay?" messages and later set up
DKIM signing, which both I believe are doable by properly setting
@mynetworks.

the README.lookups says:

@mynetworks_maps = (read_array('/etc/amavisd-mynetworks'), \@mynetworks);

or

@mynetworks_maps = (read_hash('/etc/amavisd-mynetworks'), \@mynetworks);

and https://sourceforge.net/p/amavis/mailman/message/24573173/ recommends
"not to forget to re-evaluate the @client_ipaddr_policy after/if
@mynetworks_maps is changed:"

@client_ipaddr_policy = map(($_,'MYNETS'), @mynetworks_maps);


I have tried it all.

I have even assigned direct IP addresses to @mynetworks:

@mynetworks = qw(127.0.0.1 192.168.20.40 );

but the message still appears:

Oct 18 16:15:48 smtp2 amavis[1814]: (01814-15) Checking: WwuVqzvm1fVY AM.PDP-SOCK [192.168.20.40] <censored> -> <censored>
Oct 18 16:15:48 smtp2 amavis[1814]: (01814-15) Open relay? Nonlocal recips but not originating: censored

I am using amavisd-milter to process mail at SMTP level.
do I need to play with policy banks?

amavisd-new-2.10.1, Debian 8.

[Dusan Obradovic]

Post by Matus UHLAR - fantomas
Hello,
I am trying to get rid of annoying "Open relay?" messages and later set up
DKIM signing, which both I believe are doable by properly setting
@mynetworks.
@mynetworks_maps = (read_array('/etc/amavisd-mynetworks'), \@mynetworks);
or
@mynetworks_maps = (read_hash('/etc/amavisd-mynetworks'), \@mynetworks);
and https://sourceforge.net/p/amavis/mailman/message/24573173/ recommends
@mynetworks_maps is changed:"
@client_ipaddr_policy = map(($_,'MYNETS'), @mynetworks_maps);
I have tried it all.
@mynetworks = qw(127.0.0.1 192.168.20.40 );
Oct 18 16:15:48 smtp2 amavis[1814]: (01814-15) Checking: WwuVqzvm1fVY AM.PDP-SOCK [192.168.20.40] <censored> -> <censored>
Oct 18 16:15:48 smtp2 amavis[1814]: (01814-15) Open relay? Nonlocal recips but not originating: censored
I am using amavisd-milter to process mail at SMTP level. do I need to play with policy banks?
amavisd-new-2.10.1, Debian 8.
--
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
You have the right to remain silent. Anything you say will be misquoted,
then used against you.

I have it working using read_cidr().

@mynetworks = @{ read_cidr('/etc/postfix/mynetworks') };

$policy_bank{'MYNETS'} = {
originating => 1,
os_fingerprint_method => undef,
};


amavisd-new-2.8.0 release notes:

- added a subroutine read_cidr() which can read a Postfix style CIDR file,
with a syntax interpreted according a Postfix cidr_table(5) man page.
The subroutine returns a ref to an array by default (but can also
produce a hash, and is able to add data to an existing array or hash).

Typical use:
@mynetworks_maps = ( read_cidr('/etc/postfix/mynetworks.cidr') );
@client_ipaddr_policy = map(($_,'MYNETS'), @mynetworks_maps);

or:
@mynetworks = @{ read_cidr('/etc/postfix/mynetworks.cidr') };

For details and more complex usage see leading comments in the read_cidr
subroutine;

[Matus UHLAR - fantomas]

Post by Dusan Obradovic

Post by Matus UHLAR - fantomas
I am trying to get rid of annoying "Open relay?" messages and later set up
DKIM signing, which both I believe are doable by properly setting
@mynetworks.

I have it working using read_cidr().
@mynetworks = @{ read_cidr('/etc/postfix/mynetworks') };
$policy_bank{'MYNETS'} = {
originating => 1,
os_fingerprint_method => undef,
};

seems that THIS was the missing part.
And that THIS is the easiest way with 2.10.1:

&read_array(\@mynetworks, '/etc/postfix/mynetworks');
$policy_bank{'MYNETS'} = {
originating => 1,
};

The result, no "Open relay?" in logs:

Oct 19 16:25:59 smtp1 amavis[18591]: (18591-04) Checking: ECoZlvtVhUm8 AM.PDP-SOCK/MYNETS [192.168.20.40] <censored> -> <censored>

note the "AM.PDP-SOCK/MYNETS"

I was hoping that MYNETS automatically sets "originating" flag, which it
apparently did not.

I should fill out bugreport - I believe in huge possibilities plus sane
defaults which should make configuration minimal for most of cases.

[Dominic Raferd]

Post by Matus UHLAR - fantomas
Hello,
I am trying to get rid of annoying "Open relay?" messages and later set up
DKIM signing, which both I believe are doable by properly setting
@mynetworks.
@mynetworks_maps = (read_array('/etc/amavisd-mynetworks'), \@mynetworks);
or
@mynetworks_maps = (read_hash('/etc/amavisd-mynetworks'), \@mynetworks);
and https://sourceforge.net/p/amavis/mailman/message/24573173/ recommends
@mynetworks_maps is changed:"
@client_ipaddr_policy = map(($_,'MYNETS'), @mynetworks_maps);
I have tried it all.
@mynetworks = qw(127.0.0.1 192.168.20.40 );
Oct 18 16:15:48 smtp2 amavis[1814]: (01814-15) Checking: WwuVqzvm1fVY
AM.PDP-SOCK [192.168.20.40] <censored> -> <censored>
Oct 18 16:15:48 smtp2 amavis[1814]: (01814-15) Open relay? Nonlocal recips
but not originating: censored
I am using amavisd-milter to process mail at SMTP level.
do I need to play with policy banks?
amavisd-new-2.10.1, Debian 8.

I too have had this problem. But now, based on studying
amavisd.conf-default, I think the problem is that when we set a policy_bank
it overwrites (for emails that are covered by it) with default values many
variables that may be specifically defined by us outside the policy bank -
which is not the behaviour you or I would expect. This includes
@mynetworks; so you need to define @mynetworks *inside* the policy bank for
it to be effective for these emails - in your case this means inside
$policy_bank { 'AM.PDP-SOCK' }.

HTH, Dominic

[Ralph Seichter]

Post by Dominic Raferd
be effective for these emails - in your case this means inside
$policy_bank { 'AM.PDP-SOCK' }.

The following works for me with amavisd-new 2.10.1

$inet_socket_bind = ['127.0.0.1', '[::1]'];
$inet_socket_port = [1234, 5678];

$policy_bank{'SUBMISSION'} = {
originating => 1,
final_virus_destiny => D_REJECT,
smtpd_discard_ehlo_keywords => ['8BITMIME', 'STARTTLS'],
# ...
};

$interface_policy{'5678'} = 'SUBMISSION';

This opens port 5678 to deal with mail that enters through Postfix'
submission process (listening on port 587), which is either done by
authenticated users or matches Postfix' "mynetworks" setting. Binding a
policy bank to a localhost port that is only ever accessed by Postfix
ensures that only outbound mail passes through, so Amavis can add DKIM
signatures.

-Ralph