0
[root@server ~]# postconf -n
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
debug_peer_level = 2
debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5
html_directory = no
inet_interfaces = localhost
inet_protocols = all
mail_owner = postfix
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
mydestination = $myhostname, localhost.$mydomain, localhost
mydomain = foo.bar.com
myhostname = server.foo.bar.com
mynetworks = 127.0.0.0/8
myorigin = $mydomain
newaliases_path = /usr/bin/newaliases.postfix
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-2.10.1/README_FILES
relayhost = 1.2.3.4
sample_directory = /usr/share/doc/postfix-2.10.1/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtp_connect_timeout = 600s
smtp_tls_note_starttls_offer = yes
smtp_tls_security_level = may
unknown_local_recipient_reject_code = 550
[root@server ~]# 
[root@server ~]# cat /etc/redhat-release 
Red Hat Enterprise Linux Server release 7.2 (Maipo)
[root@server ~]#
[root@server ~]# rpm -qa|grep -i postfix
postfix-2.10.1-6.el7.x86_64
[root@server ~]# 

Q: does this config cause an open relay? How could I know?

  • You don't have any smtpd_* options, so probably not. – Satō Katsura Jan 30 '17 at 11:57
0

Does this config cause an open relay?

This question is a bit hard to answer without seeing the whole picture, the best way to find out is to test your config for open relay (more on that further down).

That being said let me make a note on

relayhost = 1.2.3.4

As per postfix documentation this is "The next-hop destination of non-local mail" so any mail that is not for local delivery will be sent to 1.2.3.4, which potentially can cause postfix (in conjunction with 1.2.3.4) to act as open relay.

Probably you have already looked at Postfix documentation, but let me give you some pointers.

This is a good starting point with few defaults with explanation of what each line does. http://www.postfix.org/STANDARD_CONFIGURATION_README.html

This is also a good read regarding relay and access control. http://www.postfix.org/SMTPD_ACCESS_README.html

How could I know?

You should really test you setup. There are number of online tools like http://mxtoolbox.com/diagnostic.aspx that will check if your server acts as open relay (obviusly for that you need configured and exposed to Internet server).

If your server isn't yet connected to Internet or if you want to test how your server acts for clients on the local network (mynetworks directive can specify trusted clients) you can use telnet to send emails and test for open relay.

Here is example (personal information obscured) where I try to send mail from gmail account to gmail account on server that has nothing to do with gmail. obviously the email was rejected.

[root@db ~]# telnet xxxx.domain.com 25
Trying 192.168.1.1...
Connected to xxxx.domain.com.
Escape character is '^]'.
220 mail.domain.com Microsoft ESMTP MAIL Service ready at Tue, 31 Jan 2017 12:45:31 +0200
helo localhost
250 xxxx.domain.com Hello [10.191.1.1]
mail from: filip.xxxx@gmail.com
250 2.1.0 Sender OK
rcpt to: filip.xxxx@gmail.com
550 5.7.1 Unable to relay
quit
221 2.0.0 Service closing transmission channel
Connection closed by foreign host.

In a well designed smtp server you will probably want to have clients authenticate before sending email through your server to the outside world or define trusted networks that can send email regardless (that is if you trust the users on your network).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.