Le 22/07/2025 16:26, Xavier Humbert via Postfix-users a écrit :
Le 22/07/2025 16:19, Wietse Venema via Postfix-users a écrit :
Xavier Humbert via Postfix-users:
Hi,
I recently experienced strange errors in mailq :
[root@numenor ~]# mailq
-Queue ID- --Size-- ----Arrival Time---- -Sender/Recipient-------
56BF31C9391 2320 Fri Jul 18 03:42:33 i...@quora.com
(temporary failure. Command output: lda(postfix): Error:
net_connect_unix(/var/run/dovecot/stats-writer) failed: Permission
denied)
post...@groumpf.org
All other messages are getting in without error.
Furthermore these are probably spam which shouldn't get in, since
postfix@ is not in the authorized recipients
When it happens, it is always spam for postfix@
You have configured Postfix to run a Dovecot 'lda' command, with
the privileges of the 'postfix' user.
It should use different privileges> It should not use the
privileges of the recipient.
How is Postfix configured to run the Dovecot LDA?
Wietse
_______________________________________________
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org
Here is the output of postconf -n :
[root@numenor ~]# postconf -n
alias_database = hash:/etc/mail/aliases
alias_maps = hash:/etc/mail/aliases
bounce_size_limit = 1
broken_sasl_auth_clients = yes
command_directory = /usr/local/sbin
compatibility_level = 3.6
config_directory = /usr/local/etc/postfix
content_filter = amavisfeed:[127.0.0.1]:10024
daemon_directory = /usr/local/libexec/postfix
data_directory = /var/db/postfix
debug_peer_level = 3
debugger_command = PATH=/bin:/usr/bin:/usr/local/bin; export PATH;
(echo cont; echo where) | gdb $daemon_directory/$process_name
$process_id 2>&1 >$config_directory/$process_name.$process_id.log &
sleep 5
default_privs = dovecot
header_checks = regexp:$config_directory/header_checks
home_mailbox = Maildir/
html_directory = /usr/local/share/doc/postfix
inet_interfaces = all
inet_protocols = all
local_recipient_maps = proxy:unix:passwd.byname, $alias_maps,
hash:$config_directory/localusers
mail_owner = postfix
mail_spool_directory = /var/mail
mailbox_command = /usr/local/libexec/dovecot/dovecot-lda -f "$SENDER"
-a "$RECIPIENT"
mailbox_size_limit = 512000000
mailq_path = /usr/local/bin/mailq
manpage_directory = /usr/local/man
maximal_queue_lifetime = 5
message_size_limit = 30000000
meta_directory = /usr/local/libexec/postfix
mydestination = $myhostname, localhost.$mydomain, $mydomain,
127.0.0.1, hash:$config_directory/relay_domains
myhostname = numenor.groumpf.org
mynetworks = 192.168.100.0/24, 127.0.0.1, [::1], 78.251.129.10/32,
176.31.180.205/32, [2a01:e34:efb8:10a0::]/64
myorigin = $mydomain
newaliases_path = /usr/local/bin/newaliases
queue_directory = /var/spool/postfix
readme_directory = /usr/local/share/doc/postfix
recipient_delimiter = +
relay_domains = $mydestination, groumpf.org, xavierhumbert.net, amdh.fr
sample_directory = /usr/local/etc/postfix
sendmail_path = /usr/local/sbin/sendmail
setgid_group = maildrop
shlib_directory = /usr/local/lib/postfix
smtp_helo_name = numenor.groumpf.org
smtp_host_lookup = native
smtp_sasl_auth_enable = no
smtp_sasl_security_options = noplaintext
smtpd_banner = $myhostname ESMTP $mail_name ($mail_version - NO UCE)
smtpd_etrn_restrictions = permit_mynetworks, reject
smtpd_forbid_bare_newline = yes
smtpd_forbid_bare_newline_exclusions = $mynetworks
smtpd_helo_required = yes
smtpd_helo_restrictions = check_helo_access
regexp:$config_directory/helo.access reject_invalid_helo_hostname
smtpd_recipient_limit = 2500
smtpd_recipient_restrictions = permit_auth_destination
permit_mynetworks permit_sasl_authenticated check_sender_access
hash:$config_directory/sender_checks check_client_access
hash:$config_directory/access reject_non_fqdn_sender
reject_non_fqdn_recipient reject_unauth_destination
check_policy_service unix:private/spf-policy
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated
defer_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_local_domain = $myhostname
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous, noplaintext
smtpd_sasl_type = dovecot
smtpd_sender_restrictions = permit_mynetworks
permit_sasl_authenticated reject_unknown_reverse_client_hostname
smtpd_tls_auth_only = yes
smtpd_tls_cert_file =
/usr/local/etc/letsencrypt/live/smtp.groumpf.org/cert.pem
smtpd_tls_key_file =
/usr/local/etc/letsencrypt/live/smtp.groumpf.org/privkey.pem
smtpd_tls_loglevel = 1
smtpd_tls_mandatory_ciphers = medium
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtpd_tls_security_level = may
smtpd_tls_session_cache_database = btree:/var/db/postfix/smtpd_tls_cache
smtpd_tls_session_cache_timeout = 3600s
soft_bounce = no
tls_medium_cipherlist =
ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
tls_preempt_cipherlist = no
tls_random_exchange_name = /var/db/postfix/prng_exch
tls_random_source = dev:/dev/urandom
transport_maps = hash:$config_directory/transport
unknown_local_recipient_reject_code = 550
Regards
Xavier
At least I know why it gets in :
local_recipient_maps = proxy:unix:passwd.byname, $alias_maps,
hash:$config_directory/localusers
I don't need proxy:unix:passwd.byname
--
Xavier HUMBERT - Unix/Win/MacOSX Sysadmin/Network Engineer
https://www.amdh.fr
_______________________________________________
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org
