Já li centenas de postagens em toda a Internet e não consegui encontrar nada que resolva o meu problema. Então eu decidi escrever este post e espero que alguém possa me ajudar. Primeiro, quero pedir desculpas pelo meu mau inglês. Espero que você entenda o que quero dizer. Se não, não se incomode em fazer perguntas.
Problema:
Eu tenho um problema com a limitação de usuários autenticados por sams para enviar e-mails apenas a partir da configuração do postfix. Eu sei que isso pode ser feito usando as tags "reject_sender_login_mismatch" e "smtpd_sender_login_maps" no postfix main.cf.
Mas o problema é que o postfix não corresponde ao campo de email FROM em relação ao smtpd_sender_login_maps, em vez disso, corresponde ao nome de usuário sasl (no meu caso, também um endereço de e-mail). É claro que essa condição é sempre verdadeira porque o nome de usuário sasl existe, não importa o que realmente está escrito no campo FROM.
Eu notei isso quando liguei a depuração (debug_peer_list = ip do cliente ) e enviei um e-mail do endereço falsificado any_other@any_other.xy com o Thunderbird para [email protected]. Eu não vejo o campo FROM real no mail.log, em vez disso, o login sasl ([email protected]) é interpretado como endereço FROM.
Extraia o formulário /var/log/mail.log:
....
postfix/smtps/smtpd[3525]: watchdog_pat: 0xXXXXXXXXX
postfix/smtps/smtpd[3525]: < unknown[XXXXXXXXX]: AUTH PLAIN XXXXXXXXX
postfix/smtps/smtpd[3525]: query milter states for other event
postfix/smtps/smtpd[3525]: milter8_other_event: milter local:/opendkim/opendkim.sock
postfix/smtps/smtpd[3525]: xsasl_dovecot_server_first: sasl_method PLAIN, init_response XXXXXXXXX
postfix/smtps/smtpd[3525]: xsasl_dovecot_handle_reply: auth reply: [email protected]?
postfix/smtps/smtpd[3525]: > unknown[XXXXXXXXX]: 235 2.7.0 Authentication successful
postfix/smtps/smtpd[3525]: watchdog_pat: 0xXXXXXXXXX
postfix/smtps/smtpd[3525]: < unknown[XXXXXXXXX]: MAIL FROM:<[email protected]> BODY=8BITMIME SIZE=443
postfix/smtps/smtpd[3525]: extract_addr: input: <[email protected]>
postfix/smtps/smtpd[3525]: smtpd_check_addr: [email protected]
postfix/smtps/smtpd[3525]: connect to subsystem private/rewrite
postfix/smtps/smtpd[3525]: send attr request = rewrite
postfix/smtps/smtpd[3525]: send attr rule = local
postfix/smtps/smtpd[3525]: send attr address = ""
....
Quando falo sobre o syslog e o mail.log para o endereço real do FROM, não encontro nada para:
root@XXXXXX:/etc/postfix# cat /var/log/syslog /var/log/mail.log |grep -i any_other@any_other.xy
Configurações:
raiz @ XXXXXX: / etc / postfix # postconf -n
alias_database = hash:/etc/aliases
alias_maps =
append_dot_mydomain = no
biff = no
broken_sasl_auth_clients = yes
content_filter = smtp-amavis:[127.0.0.1]:10024
delay_warning_time = 3h
disable_vrfy_command = yes
dovecot_destination_recipient_limit = 1
inet_interfaces = all
inet_protocols = ipv4, ipv6
local_transport = error:Local Transport Disabled
luser_relay = webmaster@XXXXXX
mailbox_size_limit = 0
message_size_limit = 20480000
milter_default_action = accept
milter_protocol = 6
mydestination = XXXXXX, localhost, localhost.localdomain, localhost, autoreply.XXXXXX
mydomain = XXXXXX
myhostname = XXXXXX
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 XXXXXX/24
myorigin = /etc/mailname
non_smtpd_milters = local:/opendkim/opendkim.sock
policyd-spf_time_limit = 3600
postscreen_greet_action = enforce
readme_directory = no
recipient_delimiter = +
relayhost =
smtpd_banner = $myhostname ESMTP XXXXXX (Linux)
smtpd_client_new_tls_session_rate_limit = 10
smtpd_client_restrictions = check_client_access cidr:/etc/postfix/drop.cidr
smtpd_data_restrictions = reject_multi_recipient_bounce
smtpd_delay_reject = no
smtpd_helo_required = yes
smtpd_helo_restrictions = reject_invalid_hostname
smtpd_milters = local:/opendkim/opendkim.sock
smtpd_recipient_restrictions = reject_sender_login_mismatch permit_mynetworks reject_unknown_recipient_domain check_policy_service inet:127.0.0.1:12340 reject_unauth_destination check_policy_service unix:private/policyd-spf permit_sasl_authenticated check_sender_ns_access cidr:/etc/postfix/drop.cidr check_sender_mx_access cidr:/etc/postfix/drop.cidr check_policy_service inet:127.0.0.1:10023 reject_rbl_client ix.dnsbl.manitu.net reject_rbl_client bl.spamcop.net reject_rbl_client pbl.spamhaus.org reject_rbl_client xbl.spamhaus.org reject_rbl_client zen.spamhaus.org reject_rbl_client sbl.spamhaus.org reject_rbl_client b.barracudacentral.org reject_rbl_client bl.spamcannibal.org permit
smtpd_reject_footer = For assistance, write webmaster@XXXXXX. Please provide the following information in your problem report: time ($localtime), client ($client_address) client Port ($client_port) and server ($server_name).
smtpd_relay_restrictions = reject_non_fqdn_recipient reject_authenticated_sender_login_mismatch reject_unknown_recipient_domain permit_mynetworks permit_sasl_authenticated check_sender_ns_access cidr:/etc/postfix/drop.cidr check_sender_mx_access cidr:/etc/postfix/drop.cidr check_policy_service inet:127.0.0.1:10023 reject_rbl_client ix.dnsbl.manitu.net reject_unauth_destination permit
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_sender_login_maps = ldap:/etc/postfix/ldap_user_maps.cf
smtpd_sender_restrictions = reject_unknown_sender_domain, reject_non_fqdn_sender, reject_authenticated_sender_login_mismatch, reject_unlisted_sender, reject_unauth_pipelining,
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /etc/postfix/sslcert/server.crt
smtpd_tls_dh1024_param_file = ${config_directory}/certs/dh_1024.pem
smtpd_tls_dh512_param_file = ${config_directory}/certs/dh_512.pem
smtpd_tls_eecdh_grade = strong
smtpd_tls_key_file = /etc/postfix/sslcert/server.key
smtpd_tls_loglevel = 0
smtpd_tls_mandatory_ciphers = high
smtpd_tls_mandatory_exclude_ciphers = aNULL, MD5 , DES, ADH, RC4, PSD, SRP, 3DES, eNULL
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
smtpd_tls_protocols = !SSLv2, !SSLv3
smtpd_tls_security_level = may
smtpd_tls_session_cache_database = btree:/var/lib/postfix/smtpd_session_cache
smtpd_use_tls = yes
soft_bounce = yes
tls_preempt_cipherlist = yes
tls_random_source = dev:/dev/urandom
transport_maps = hash:/etc/postfix/transports
virtual_alias_maps = ldap:/etc/postfix/ldap_virtual_alias_maps-vacation.cf ldap:/etc/postfix/ldap-virtual_alias_maps-forward.cf proxy:ldap:/etc/postfix/ldap_virtual_aliases.cf ldap:/etc/postfix/ldap_virtual_mail_distribution.cf ldap:/etc/postfix/ldap_virtual_mail_redirect.cf
virtual_mailbox_domains = hash:/etc/postfix/virtual_domains
virtual_mailbox_maps = proxy:ldap:/etc/postfix/ldap_virtual_recipients.cf
virtual_transport = dovecot
cat /etc/postfix/master.cf
...
...
smtp inet n - - - - smtpd
-o smtpd_tls_security_level=may
#smtp inet n - - - 1 postscreen
#smtpd pass - - - - - smtpd
#dnsblog unix - - - - 0 dnsblog
#tlsproxy unix - - - - 0 tlsproxy
submission inet n - - - - smtpd
-o syslog_name=postfix/submission
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_tls_security_level=encrypt
smtps inet n - - - - smtpd
-o syslog_name=postfix/smtps
-o smtpd_tls_wrappermode=yes
-o smtpd_sasl_auth_enable=yes
-o smtpd_tls_security_level=encrypt
...
cat /etc/postfix/ldap_user_maps.cf
bind = yes
bind_dn = xxxx
bind_pw = xxxx
server_host = ldaps://domain.xy:636
search_base = dc=xxxx,dc=xxxx
query_filter = (&(mail=%s))
result_attribute = mail, uid, AlternateAddress
Sourcode do email falsificado
Return-Path: <[email protected]>
X-Original-To: [email protected]
Delivered-To: [email protected]
Received: from localhost (XXXXXXXXXXXXXXX [127.0.0.1])
by XXXXXXXXXXXXXXX (Postfix) with ESMTP id XXXXXXXXXXXXXXX
for <[email protected]>; Thu, 10 Aug 2017 20:15:39 +0000 (UTC)
Received: from XXXXXXXXXXXXXXX ([127.0.0.1])
by localhost (XXXXXXXXXXXXXXX [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id XXXXXX-XXXXXX for <[email protected]>;
Thu, 10 Aug 2017 20:15:39 +0000 (UTC)
Received-SPF: Softfail (mailfrom) identity=mailfrom; client-ip=XXXXXXXXXXXXXXX; helo=[XXXXXXXXXXXXXXX]; [email protected]; receiver=<UNKNOWN>
Received: from [XXXXXXXXXXXXXXX] (unknown [XXXXXXXXXXXXXXX])
(Authenticated sender: [email protected])
by XXXXXXXXXXXXXXX (Postfix) with ESMTPSA id XXXXXXXX
for <[email protected]>; Thu, 10 Aug 2017 20:15:38 +0000 (UTC)
To: Recipient <[email protected]>
From: Any other user <any_other@any_other.xy>
Subject: sdfsdf
Message-ID: <6xxx5ab6-7x1c-4x3b-55x6-ab8ba3xxxx1@XXXXXXXXXXXXXXX>
Date: Thu, 10 Aug 2017 22:15:36 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:51.2) Gecko/20100101
Thunderbird/51.8.16
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Content-Language: en-US
Se você precisar de mais informações, não se incomode em perguntar.
Obrigado pela sua ajuda