# [Postfix] Suis-je un relay ouvert ?

## jjay

Hello,

Malgrés un maximum de protetion prises pour que mon serveur Postfix ne soit pas un relay ouvert je ne suis pas sur d'y etre arrivé au vu des logs suivant dans postfix.log :

```
Dec 21 18:54:31 genteway postfix/smtp[22125]: F11BB25A93: to=<info@etam.biz>, relay=none, delay=158064, delays=158033/0.05/31/0, dsn=4.4.1, status=deferred (connect to mailin1.etam.biz[212.129.62.87]: Connection timed out)

Dec 21 20:04:31 genteway postfix/smtp[22490]: F11BB25A93: to=<info@etam.biz>, relay=none, delay=162263, delays=162233/0.05/30/0, dsn=4.4.1, status=deferred (connect to mailin1.etam.biz[212.129.62.87]: Connection timed out)

Dec 21 21:14:31 genteway postfix/smtp[22779]: F11BB25A93: to=<info@etam.biz>, relay=none, delay=166463, delays=166433/0.05/30/0, dsn=4.4.1, status=deferred (connect to mailin1.etam.biz[212.129.62.87]: Connection timed out)

Dec 21 22:24:31 genteway postfix/smtp[23117]: F11BB25A93: to=<info@etam.biz>, relay=none, delay=170664, delays=170634/0.05/30/0, dsn=4.4.1, status=deferred (connect to mailin1.etam.biz[212.129.62.87]: Connection timed out)

Dec 21 23:34:31 genteway postfix/smtp[23389]: F11BB25A93: to=<info@etam.biz>, relay=none, delay=174864, delays=174834/0.05/30/0, dsn=4.4.1, status=deferred (connect to mailin1.etam.biz[212.129.62.87]: Connection timed out)

Dec 22 00:44:31 genteway postfix/smtp[23602]: F11BB25A93: to=<info@etam.biz>, relay=none, delay=179064, delays=179034/0.05/30/0, dsn=4.4.1, status=deferred (connect to mailin1.etam.biz[212.129.62.87]: Connection timed out)

Dec 22 01:54:31 genteway postfix/smtp[23884]: F11BB25A93: to=<info@etam.biz>, relay=none, delay=183263, delays=183233/0.05/30/0, dsn=4.4.1, status=deferred (connect to mailin1.etam.biz[212.129.62.87]: Connection timed out)

Dec 22 03:04:31 genteway postfix/smtp[24161]: F11BB25A93: to=<info@etam.biz>, relay=none, delay=187464, delays=187434/0.05/30/0, dsn=4.4.1, status=deferred (connect to mailin1.etam.biz[212.129.62.87]: Connection timed out)

Dec 22 04:14:31 genteway postfix/smtp[24373]: F11BB25A93: to=<info@etam.biz>, relay=none, delay=191664, delays=191634/0.04/30/0, dsn=4.4.1, status=deferred (connect to mailin1.etam.biz[212.129.62.87]: Connection timed out)

Dec 22 05:24:32 genteway postfix/smtp[24689]: F11BB25A93: to=<info@etam.biz>, relay=none, delay=195864, delays=195834/0.13/30/0, dsn=4.4.1, status=deferred (connect to mailin1.etam.biz[212.129.62.87]: Connection timed out)

Dec 22 06:34:31 genteway postfix/smtp[24913]: F11BB25A93: to=<info@etam.biz>, relay=none, delay=200063, delays=200033/0.1/30/0, dsn=4.4.1, status=deferred (connect to mailin1.etam.biz[212.129.62.87]: Connection timed out)

Dec 22 07:10:08 genteway postfix/smtp[25054]: 48330259EE: to=<contact@emailing.somewhere.fr>, relay=inc2smtp1.edc.dartmail.net[216.73.94.204]:25, delay=1, delays=0.09/0.03/0.55/0.34, dsn=2.0.0, status=sent (250 Ok: queued as 63308330B2D)

Dec 22 07:44:31 genteway postfix/smtp[25135]: F11BB25A93: to=<info@etam.biz>, relay=none, delay=204264, delays=204234/0.05/30/0, dsn=4.4.1, status=deferred (connect to mailin1.etam.biz[212.129.62.87]: Connection timed out)

Dec 22 08:54:31 genteway postfix/smtp[25373]: F11BB25A93: to=<info@etam.biz>, relay=none, delay=208463, delays=208433/0.05/30/0, dsn=4.4.1, status=deferred (connect to mailin1.etam.biz[212.129.62.87]: Connection timed out)

Dec 22 10:04:31 genteway postfix/smtp[25676]: F11BB25A93: to=<info@etam.biz>, relay=none, delay=212664, delays=212633/0.04/30/0, dsn=4.4.1, status=deferred (connect to mailin1.etam.biz[212.129.62.87]: Connection timed out)

Dec 22 11:10:14 genteway postfix/smtp[25933]: 01E66259EE: to=<Alerte-98602-free@BilletReduc.com>, relay=mail2.ftd.fr[217.151.0.56]:25, delay=6.7, delays=0.05/0.02/0.24/6.4, dsn=2.0.0, status=sent (250 ok 1198318239 qp 34750)

Dec 22 11:14:31 genteway postfix/smtp[25939]: F11BB25A93: to=<info@etam.biz>, relay=none, delay=216864, delays=216834/0.05/30/0, dsn=4.4.1, status=deferred (connect to mailin1.etam.biz[212.129.62.87]: Connection timed out)

Dec 22 11:40:08 genteway postfix/smtp[26034]: 6E2CE259EE: to=<bck271@ta271.com>, relay=mx.ta271.com[91.121.90.135]:25, delay=0.37, delays=0.03/0.02/0.26/0.07, dsn=5.1.1, status=bounced (host mx.ta271.com[91.121.90.135] said: 550 5.1.1 <bck271@ta271.com>: Recipient address rejected: User unknown in local recipient table (in reply to RCPT TO command))

Dec 22 12:24:31 genteway postfix/smtp[26301]: F11BB25A93: to=<info@etam.biz>, relay=none, delay=221064, delays=221033/0.02/30/0, dsn=4.4.1, status=deferred (connect to mailin1.etam.biz[212.129.62.87]: Connection timed out)
```

Et surtout  : 

```
Dec 21 23:06:47 genteway postfix/smtp[23294]: ECF8C24EBC: host mx1.free.fr[212.27.48.6] refused to talk to me: 500 Too many spams from your IP (XX.XXX.XXX.XXX), please visit http://postmaster.free.fr/

Dec 21 23:06:47 genteway postfix/smtp[23294]: ECF8C24EBC: host mx1.free.fr[212.27.48.7] refused to talk to me: 500 Too many spams from your IP (XX.XXX.XXX.XXX), please visit http://postmaster.free.fr/

```

Voici mon main.cf : 

```

queue_directory = /var/spool/postfix

command_directory = /usr/sbin

daemon_directory = /usr/lib/postfix

mail_owner = postfix

myhostname = mail.monDomainAMoi.fr

mydomain = monDomainAMoi.fr

myorigin = $mydomain

inet_interfaces = all

mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain, monDomainAMoi.fr, 2ndDomainAMoi.com, 3emDomainAMoi.net, 4emDomainAMoi.fr

unknown_local_recipient_reject_code = 550

mynetworks_style = class

mail_spool_directory = /var/spool/mail

mailbox_command = /usr/bin/procmail -Y -a $DOMAIN

local_destination_concurrency_limit = 2

default_destination_concurrency_limit = 10

debug_peer_level = 2

debugger_command =

         PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin

         xxgdb $daemon_directory/$process_name $process_id & sleep 5

sendmail_path = /usr/sbin/sendmail

newaliases_path = /usr/bin/newaliases

mailq_path = /usr/bin/mailq

setgid_group = postdrop

html_directory = /usr/share/doc/postfix-2.4.5/html

manpage_directory = /usr/share/man

sample_directory = /etc/postfix

readme_directory = /usr/share/doc/postfix-2.1.5-r2/readme

default_destination_concurrency_limit = 2

alias_database = hash:/etc/mail/aliases

alias_maps = hash:/etc/mail/aliases

transport_maps = hash:/etc/mail/transport_maps

smtpd_sasl_auth_enable = yes 

smtpd_sasl_type = dovecot 

smtpd_sasl_path = private/auth 

smtpd_sasl_local_domain = $myhostname

smtpd_recipient_restrictions = 

    permit_mynetworks,

    permit_sasl_authenticated,

    reject_unauth_destination,

    reject_rbl_client blackholes.easynet.nl,

    reject_rbl_client cbl.abuseat.org,

    reject_rbl_client proxies.blackholes.wirehub.net,

    reject_rbl_client bl.spamcop.net,

    reject_rbl_client sbl.spamhaus.org,

    reject_rbl_client dnsbl.njabl.org,

    reject_rbl_client list.dsbl.org,

    reject_rbl_client multihop.dsbl.org

```

Mes besoins sont les suivants :

 - pouvoir recevoir des mails aux adresses : @monDomainAMoi.fr, @2ndDomainAMoi.com, @3emDomainAMoi.net, @4emDomainAMoi.fr

 - pouvoir envoyer des mails depuis mon reseau local en 192.168.0.XX

 - pouvoir envoyer des mails depuis n'importe ou depuis mon portable (ordi et telephone) en smtp authentifié.

 - bloquer les spams si possible avec les regles rbl

Merci

JJay

----------

## lejim

```
mynetworks_style = class 
```

En gros cela veut dire que toutes les conexions venant d'une adresse de ta classe réseau peux relayer des mails. Ce qui inclus d'office ton routeur ( du moins en ip interne ) qui fait du NAT ce qui veut dire que n'importe qui du net qui se connecte au port 25 de ton serveur est vu par l'ip interne de ton routeur ( on va dire 192.168.0.1 au hasard ).

Donc pour faire propre il faut bannir cette ip.

i.e

 *Quote:*   

> mynetworks = 127.0.0.0/8 !192.168.0.1 192.168.0.0/24

 

Si bien sur ton réseau est en 192.168.0.0/24 et que ton routeur possède 192.168.0.1 comme ip.

Et tu vire le mynetworks_style

Avec ça plus de pb.

Voilà quelques liens qui permettent de tester ton serveur pour l'openrelay. 

http://www.antispam-ufrj.pads.ufrj.br/test-relay.html

http://www.spamhelp.org/shopenrelay/

Et ça arrive aussi aux autres j'avais fais la même connerie avant de recevoir un mail de free et avoir envoyer 370000 mails en 24h ....

----------

