O postfix não rejeita o nome errado do cliente e do HELO

Question

Eu tenho um servidor de postfix configurado com reject_unknown_client_hostname e reject_unknown_helo_hostname. Independentemente do servidor aceitar conexões não sasl_authenticated de clientes e nomes HELO sem entrada DNS. Testado com telnet e nc (o domínio real do servidor de correio foi substituído por mymailserver.com):

nc mymailserver.com 25
220 mymailserver.com ESMTP Postfix (2.9.6)
HELO inexistent.domain.com    
250 mymailserver.com

Log do Postfix com debug_peer_level = 2:

Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: connect from dslb-178-005-067-030.pools.arcor-ip.net[178.5.67.30]
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: smtp_stream_setup: maxtime=300 enable_deadline=0
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: match_hostname: dslb-178-005-067-030.pools.arcor-ip.net ~? 127.0.0.0/8
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: match_hostaddr: 178.5.67.30 ~? 127.0.0.0/8
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: match_hostname: dslb-178-005-067-030.pools.arcor-ip.net ~? [::ffff:127.0.0.0]/104
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: match_hostaddr: 178.5.67.30 ~? [::ffff:127.0.0.0]/104
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: match_hostname: dslb-178-005-067-030.pools.arcor-ip.net ~? [::1]/128
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: match_hostaddr: 178.5.67.30 ~? [::1]/128
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: match_list_match: dslb-178-005-067-030.pools.arcor-ip.net: no match
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: match_list_match: 178.5.67.30: no match
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: auto_clnt_open: connected to private/anvil
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: send attr request = connect
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: send attr ident = smtp:178.5.67.30
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: private/anvil: wanted attribute: status
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: input attribute name: status
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: input attribute value: 0
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: private/anvil: wanted attribute: count
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: input attribute name: count
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: input attribute value: 1
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: private/anvil: wanted attribute: rate
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: input attribute name: rate
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: input attribute value: 1
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: private/anvil: wanted attribute: (list terminator)
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: input attribute name: (end)
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: > dslb-178-005-067-030.pools.arcor-ip.net[178.5.67.30]: 220 mymailserver.com ESMTP Postfix (2.9.6)
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: watchdog_pat: 0x7f1fcb7f5aa0
Mar 19 16:55:33 mymailserver postfix/smtpd[4941]: < dslb-178-005-067-030.pools.arcor-ip.net[178.5.67.30]: HELO jksdnfsdmf.de
Mar 19 16:55:33 mymailserver postfix/smtpd[4941]: > dslb-178-005-067-030.pools.arcor-ip.net[178.5.67.30]: 250 mymailserver.com
Mar 19 16:55:33 mymailserver postfix/smtpd[4941]: watchdog_pat: 0x7f1fcb7f5aa0

Há algo errado na minha configuração ou eu perdi alguma coisa? Ou o caso de teste está errado?

Configuração do Postfix:

smtpd_helo_required = yes
smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unknown_client_hostname
smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated,  reject_unknown_helo_hostname
smtpd_sender_restrictions = reject_unknown_sender_domain, reject_authenticated_sender_login_mismatch, permit_sasl_authenticated, check_policy_service unix:private/policy-spf
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_data_restrictions = reject_unauth_pipelining

    

Answer 1

Ok, o caso de teste estava errado. Respectivamente eu não estava ciente da opção smtpd_delay_reject, que por padrão é definida como yes. Com esta opção, o postifx não verifica a restrição logo após cada comando, mas aguarda com todas as verificações recebidas até que os comandos HELO, MAIL FROM e RCPT TO sejam recebidos. Consulte o link

telnet mymailserver.com 25
220 mymailserver.com ESMTP Postfix (2.9.6)
HELO inexistent.domain.com
250 mymailserver.com
MAIL FROM: [email protected]
250 2.1.0 Ok
RCPT TO: [email protected]
450 4.7.1 <inexistent.domain.com>: Helo command rejected: Host not found