Bug 467170 – Postfix update configuration smtpd_recipient_restrictions

• Product: [OLD] Docs on www.gentoo.org
• Status: RESOLVED OBSOLETE

[Description Ivan Borisov 2013-04-25 09:05:47 UTC]

i think it will be helpful for peoples:

http://www.gentoo.org/doc/en/virt-mail-howto.xml


6.  Adding SSL and SASL support to Postfix

Code Listing 6.1: /etc/postfix/main.cf

...

smtpd_recipient_restrictions =
   permit_sasl_authenticated,
   permit_mynetworks,
   reject_unauth_destination

With Postfix versions before 2.10, the rules for relay permission and 
spam blocking were combined under smtpd_recipient_restrictions, 
resulting in error-prone configuration. As of Postfix 2.10, relay 
permission rules are preferably implemented with 
smtpd_relay_restrictions, so that a permissive spam blocking policy 
under smtpd_recipient_restrictions will no longer result in a permissive 
mail relay policy.

For backwards compatibility, sites that migrate from Postfix versions 
before 2.10 can set smtpd_relay_restrictions to the empty value, and use 
smtpd_recipient_restrictions exactly as before.

http://www.postfix.org/postconf.5.html#smtpd_recipient_restrictions

[Comment 1 Philipp Hocke 2013-05-03 22:06:37 UTC]

This is really not an unimportant point. 

I just struggled with  a 571 error for a couple of hours, because I didn't expect this kind of change in that version.

Thank you very much for the information!

[Comment 2 Christian Burger 2013-07-21 14:28:46 UTC]

Just had a similar problem, I think. I installed version 2.10.0 of mail-mta/postfix. Suddenly, I could not relay e-mails with

554 5.7.1 <[e-mail]>: Relay access denied

Luckily, when I realized the error, version 2.10.1 appeared in the tree and after installing that all worked fine again. Talk about dumb luck.

Problem was, that I did not adapt my configuration to the new relay feature. I think 2.10.1 handles this "misconfiguration" more gracefully. I know: One should read the release notes beforehand ... 

Though my old config works now again with 2.10.1, just in case, I adapted to the changes by configuring the new services in master.cf

proxywrite unix -       -       n       -       1       proxymap
relay     unix  -       -       n       -       -       smtp
retry     unix  -       -       n       -       -       error

(Don't know why those three lines were not there before, seems to me they should have. But my postfix setup worked without them.)

And I changed in main.cf my customized

smtpd_recipient_restrictions = reject_non_fqdn_recipient,
                               reject_unknown_recipient_domain,
                               permit_mynetworks,
                               permit_sasl_authenticated,
                               reject_unauth_destination,
                               reject_unverified_recipient, 
                               check_policy_service inet:127.0.0.1:12525,
                               permit_auth_destination


into

smtpd_relay_restrictions =     permit_mynetworks,
                               permit_sasl_authenticated,
                               reject_unauth_destination

smtpd_recipient_restrictions = reject_non_fqdn_recipient,
                               reject_unknown_recipient_domain,
                               permit_mynetworks,
                               permit_sasl_authenticated,
                               reject_unauth_destination,
                               reject_unverified_recipient,
                               check_policy_service inet:127.0.0.1:12525,
                               permit_auth_destination

as proposed in the release notes
ftp://ftp.gwdg.de/pub/misc/postfix/official/postfix-2.10.1.RELEASE_NOTES

[Comment 3 Sven Vermeulen (RETIRED) 2013-08-01 19:21:08 UTC]

This document has been marked as obsolete. However, a more active document can be found on the Gentoo Wiki at https://wiki.gentoo.org/wiki/Complete_Virtual_Mail_Server. We welcome any contributions on this guide and recommend you create an account (if you do not have one already) and make the adjustments to the article as needed. In case of doubt, use the Talk page to discuss potential changes before applying them.

If needed, the wiki-style version of the old document is available at https://wiki.gentoo.org/wiki/User:SwifT/Wikified_but_not_merged_documents/Virtual_mail_HOWTO so any previously existing content can, if needed, be reused on the wiki.