Re: Question on postfix set up: stopping new connections from outside on smtp server

2013-10-18 Thread Wietse Venema
Noel Jones: > On 10/18/2013 1:47 PM, Viktor Dukhovni wrote: > > On Fri, Oct 18, 2013 at 01:24:09PM -0500, Noel Jones wrote: > > > >>> smtpd_recipient_restrictions = reject_unlisted_recipient, > >>> reject_unknown_recipient_domain, check_recipient_access > >>> hash:/etc/postfix-internal/recipient_a

Re: Question on postfix set up: stopping new connections from outside on smtp server

2013-10-18 Thread Noel Jones
On 10/18/2013 1:47 PM, Viktor Dukhovni wrote: > On Fri, Oct 18, 2013 at 01:24:09PM -0500, Noel Jones wrote: > >>> smtpd_recipient_restrictions = reject_unlisted_recipient, >>> reject_unknown_recipient_domain, check_recipient_access >>> hash:/etc/postfix-internal/recipient_access, >>> permit_sasl_a

Re: Question on postfix set up: stopping new connections from outside on smtp server

2013-10-18 Thread Viktor Dukhovni
On Fri, Oct 18, 2013 at 01:24:09PM -0500, Noel Jones wrote: > > smtpd_recipient_restrictions = reject_unlisted_recipient, > > reject_unknown_recipient_domain, check_recipient_access > > hash:/etc/postfix-internal/recipient_access, > > permit_sasl_authenticated, permit_mynetworks, reject > > The o

Re: Question on postfix set up: stopping new connections from outside on smtp server

2013-10-18 Thread francis picabia
I had imagined sasl authentication would have to be resolved before the smtpd process would be taking commands and responding. I was thinking of how postscreen and postscreen_dnsbl_sites are handled. I've adjusted the picture. I like the suggestion to make it into "access denied", as this is more

Re: Question on postfix set up: stopping new connections from outside on smtp server

2013-10-18 Thread Noel Jones
On 10/18/2013 12:14 PM, francis picabia wrote: > I did have some PERMIT lines in /etc/postfix-internal/recipient_access > which didn't belong there. However, with all PERMIT cases removed > and postmap run on the file, I see a new log entry of "Relay access denied" "Relay access denied" is the re

Re: Question on postfix set up: stopping new connections from outside on smtp server

2013-10-18 Thread Viktor Dukhovni
On Fri, Oct 18, 2013 at 02:48:55PM -0300, francis picabia wrote: > OK, with the syslog entry Noel suggested, I can see traffic has arrived on > submission port. Yet if I grep for the IP connecting, I see no sasl login. > > Oct 18 14:39:24 myserver postfix-internal/submission/smtpd[25329]: > conn

Re: Question on postfix set up: stopping new connections from outside on smtp server

2013-10-18 Thread li...@rhsoft.net
Am 18.10.2013 19:48, schrieb francis picabia: > OK, with the syslog entry Noel suggested, I can see traffic has arrived on > submission port. Yet if I grep for the IP connecting, I see no sasl login. > > Oct 18 14:39:24 myserver postfix-internal/submission/smtpd[25329]: > connect from blk-222-1

Re: Question on postfix set up: stopping new connections from outside on smtp server

2013-10-18 Thread francis picabia
OK, with the syslog entry Noel suggested, I can see traffic has arrived on submission port. Yet if I grep for the IP connecting, I see no sasl login. Oct 18 14:39:24 myserver postfix-internal/submission/smtpd[25329]: connect from blk-222-132-252.eastlink.ca[24.222.132.252] Oct 18 14:39:24 myserve

Re: THREAD CLOSED [Re: Question on postfix set up: stopping new connections from outside on smtp server]

2013-10-18 Thread francis picabia
On Fri, Oct 18, 2013 at 1:35 PM, Viktor Dukhovni wrote: > On Fri, Oct 18, 2013 at 06:19:14PM +0200, Benny Pedersen wrote: > >> Viktor Dukhovni skrev den 2013-10-18 16:44: >> >> >No, that also turns off SMTP for "LAN" clients. >> >> not if adding one more pr lan ip >> >> 192.168.0.1:smtpinet n

Re: Question on postfix set up: stopping new connections from outside on smtp server

2013-10-18 Thread francis picabia
On Fri, Oct 18, 2013 at 12:45 PM, Noel Jones wrote: > On 10/18/2013 8:00 AM, francis picabia wrote: >> Hello, >> >> I'm looking at the logs for an SMTP only service where iptables >> should be stopping new connections on port 25, and I'm >> seeing connects with no sasl auth. They fail to relay, b

THREAD CLOSED [Re: Question on postfix set up: stopping new connections from outside on smtp server]

2013-10-18 Thread Viktor Dukhovni
On Fri, Oct 18, 2013 at 06:19:14PM +0200, Benny Pedersen wrote: > Viktor Dukhovni skrev den 2013-10-18 16:44: > > >No, that also turns off SMTP for "LAN" clients. > > not if adding one more pr lan ip > > 192.168.0.1:smtpinet n - n -60 smtpd This presumes a mach

Re: Question on postfix set up: stopping new connections from outside on smtp server

2013-10-18 Thread Noel Jones
On 10/18/2013 8:00 AM, francis picabia wrote: > Hello, > > I'm looking at the logs for an SMTP only service where iptables > should be stopping new connections on port 25, and I'm > seeing connects with no sasl auth. They fail to relay, but > I'd rather we didn't talk to them at all. > Why do y

Re: Question on postfix set up: stopping new connections from outside on smtp server

2013-10-18 Thread li...@rhsoft.net
Am 18.10.2013 15:00, schrieb francis picabia: > I'm looking at the logs for an SMTP only service where iptables > should be stopping new connections on port 25, and I'm > seeing connects with no sasl auth. They fail to relay, but > I'd rather we didn't talk to them at all why do you need iptable