0

I recently added a new user account to our LDAP directory. But somehow, Postfix just refuses to find that user when sending an email.
The accounts login works everywhere. Our Mailserver is a dedicated server with its own LDAP, but that's just mirroring the main LDAP. It doesn't look like an error with the LDAP. The directory for the emails is created and the entry does show up in the LDAP directory correctly. But when logging in the user only gets the message "no Mailbox selected" (Webmailer is SOGo). And with that not enough, when trying to send an email to that user it just doesn't work, neither from SOGo nor other clients.
The log says

Apr 30 12:03:14 mail postfix/smtpd[1355]: NOQUEUE: reject: RCPT from localhost[127.0.0.1]: 550 5.1.1 <[email protected](opens in new tab)>: Recipient address rejected: User unknown in local recipient table; from=<[email protected](opens in new tab)> to=<[email protected](opens in new tab)> proto=ESMTP helo=<localhost>

When disabling the local recipient table by adding the line "local_recipient_maps =" to the postfix main.cfg the error changes to

Mai 02 12:59:04 mail postfix/local[8909]: 1EA11100379: to=<[email protected](opens in new tab)>, relay=local, delay=0.22, delays=0.13/0.01/0/0.08, dsn=5.1.1, status=bounced (unknown user: "user")

I can't think of any solution for that problem. The only discussions about that topic I could find where because of misconfigurations. But the point is that there haven't been any changes to the configuration in a very long time. The only things that have changed are the packages that received updates. And that new user is currently the only one I know about having any problems.

About our setup:
Debian 10.4 running the nightly version of SOGo 4, postfix 3.4, slapd 2.4.47 and dovecot 2.3.4.1 with pigeonhole 0.5.4.

Postfix config:

# See /usr/share/postfix/main.cf.dist for a commented, more complete version
# Debian specific:  Specifying a file name will cause the first
# line of that file to be used as the name.  The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
biff = no
# appending .domain is the MUA's job.
append_dot_mydomain = no
# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h
readme_directory = /usr/share/doc/postfix
# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/mail.domain.de.cert.pem
smtpd_tls_key_file=/etc/ssl/private/mail.domain.de.private.pem
smtp_tls_CAfile = /etc/ssl/certs/CA.crt
smtpd_tls_mandatory_ciphers = high
smtpd_tls_mandatory_exclude_ciphers = aNull, MD5
tls_high_cipherlist=!EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:!CAMELLIA256:+AES256:!CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:!CAMELLIA256-SHA:AES256-SHA:!CAMELLIA128-SHA:AES128-SHA
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_tls_dh1024_param_file = /etc/ssl/private/dhparams.pem
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.
myhostname = mail.domain.de
alias_maps = hash:/etc/aliases
virtual_alias_maps = mysql:/etc/postfix/mysql-forwards.cf
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = domain.de, mail.domain.de
relayhost = smarthost.maindomain.de
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
message_size_limit = 67108864
mailbox_command = /usr/lib/dovecot/deliver -d $USER
recipient_delimiter = +
inet_interfaces = all
html_directory = /usr/share/doc/postfix/html
# Mailman config
relay_domains = lists.domain.de
transport_maps = hash:/etc/postfix/transport
mailman_destination_recipient_limit = 1
relay_recipient_maps = hash:/var/lib/mailman/data/virtual-mailman
# disable VRFY and EXPN command as per ITC recommendation
disable_vrfy_command = yes
# Older configurations combine relay control and spam control. To
# use this with Postfix ≥ 2.10 specify "smtpd_relay_restrictions=".
smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks
smtpd_relay_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination
# Configuration for rspamd
smtpd_milters=inet:localhost:11332
non_smtpd_milters = inet:localhost:11332
milter_protocol = 6
milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}
milter_default_action = accept

PS: if the postfix config seems strange, our mail server isn't directly connected to the internet. We get our emails from our organizations central servers over our organizations network.

4
  • Authentication seems to be done via Dovecot. I would advise adding the dovecot config to the question. May 19, 2020 at 15:51
  • @RuiFRibeiro I did not set up the server myself. it's definetely not inside the dovecot.conf. in conf.d there are several auth files, which one would be the correct? I have auth-checkpassword.conf.ext, auth-deny.conf.ext, auth-dict.conf.ext, auth-master.conf.ext, auth-passwdfile.conf.ext, auth-sql.conf.ext, auth-static.conf.ext, auth-system.conf.ext and auth-vpopmail.conf.ext. In 10-auth.conf the is only "auth_mechanisms = plain" uncommented May 19, 2020 at 19:19
  • /etc/postfix/mysql-forwards.cf.... The user probably has to be added in MySQL for it to accept emails. I would ask instructions for whoever set it up. May 19, 2020 at 19:30
  • @RuiFRibeiro no, the database is only handling forwardings. No user is listed there. I just checked that May 19, 2020 at 20:19

1 Answer 1

0

ok, I've now found the (very strange) error. User authentication is done by pam through LDAP. For some reason nslcd refused to get the latest users from the local LDAP. Searching the LDAP directly showed everything as supposed, but an id username for the newest users just came back with "user not found". I checked the configration a few times and compared it to the configuration of our Desktop Linux machine. The only differences where that the Desktop machine was running Debian 11 testing instead of 10 stable and that it used the main LDAP.
I fixed the error by setting nslcd on the mail server to the main LDAP and then back to the local LDAP directory. It now finds the new users even with id username, sending them emails also is no problem. Very strange error but in the end easy to fix

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .