DKIM-signature (amavis problem) Solved

Discussion in 'Installation/Configuration' started by Zague, Aug 5, 2019.

  1. Zague

    Zague New Member

    The problem is when I send mail from outside (connecting to 587 port) using mailclient (thunderbird/android mail/etc) it doesn't get dkim-signature.
    My amavis can't set originating flag while passing originating policy. Here it is on 10026 (only for sasl_authenticated on 587 (submission port is configured in postfix master.cf), foreign senders go to 10024 by default):

    interface_policy{'10026'} = 'ORIGINATING';
    $policy_bank{'ORIGINATING'} = { # mail supposedly originating from our users
    originating => 1, # declare that mail was submitted by our smtp client
    allow_disclaimers => 1, # enables disclaimer insertion if available
    # notify administrator of locally originating malware
    virus_admin_maps => ["virusalert\@$mydomain"],
    spam_admin_maps => ["virusalert\@$mydomain"],
    warnbadhsender => 1,
    # forward to a smtpd service providing DKIM signing service
    forward_method => 'smtp:[127.0.0.1]:10027',
    # force MTA conversion to 7-bit (e.g. before DKIM signing)
    smtpd_discard_ehlo_keywords => ['8BITMIME'],
    bypass_banned_checks_maps => [1], # allow sending any file names and types
    terminate_dsn_on_notify_success => 0, # don't remove NOTIFY=SUCCESS option
    };

    Nevertheless, mails from @mynetworks (e.g. roundcube, or console, or local network) successfully get DKIM-signature without problem. DKIM keys are correct and configured properly.

    I had an experiment adding client's ip-address to @mynetworks - and guess what? Mail was successfully signed, of course.
    So that is the question: why can't amavis set this originating flag (originating => 1)? (now it says "dkim: not signing mail which is not originating from our site"). The policy 'ORIGINATING' really works, i see it in a maillog.

    Thanks for any advice!
     

    Attached Files:

  2. Jesse Norell

    Jesse Norell Well-Known Member

    Are the clients authenticating on port 587?

    What do you have for the submission entry in master.cf?
     
  3. Zague

    Zague New Member

    Jesse thank you for reply
    Yes, the client are authenticating on port 587, they are sending emails without issue (the only problem is dkim signature)

    Here is my master.cf
    Regards
    Code:
    #
    # Postfix master process configuration file.  For details on the format
    # of the file, see the master(5) manual page (command: "man 5 master").
    #
    # Do not forget to execute "postfix reload" after editing this file.
    #
    # ==========================================================================
    # service type  private unpriv  chroot  wakeup  maxproc command + args
    #               (yes)   (yes)   (yes)   (never) (100)
    # ==========================================================================
    smtp      inet  n       -       n       -       -       smtpd
    #smtp      inet  n       -       n       -       1       postscreen
    #smtpd     pass  -       -       n       -       -       smtpd
    #dnsblog   unix  -       -       n       -       0       dnsblog
    #tlsproxy  unix  -       -       n       -       0       tlsproxy
    submission inet n       -       n       -       -       smtpd
      -o syslog_name=postfix/submission
      -o smtpd_tls_security_level=encrypt
      -o smtpd_sasl_auth_enable=yes
      -o smtpd_reject_unlisted_recipient=no
      -o smtpd_client_restrictions=$mua_client_restrictions
      -o smtpd_helo_restrictions=$mua_helo_restrictions
      -o smtpd_sender_restrictions=$mua_sender_restrictions
      -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
      -o milter_macro_daemon_name=ORIGINATING
    #smtps     inet  n       -       n       -       -       smtpd
    #  -o syslog_name=postfix/smtps
    #  -o smtpd_tls_wrappermode=yes
    #  -o smtpd_sasl_auth_enable=yes
    #  -o smtpd_reject_unlisted_recipient=no
    #  -o smtpd_client_restrictions=$mua_client_restrictions
    #  -o smtpd_helo_restrictions=$mua_helo_restrictions
    #  -o smtpd_sender_restrictions=$mua_sender_restrictions
    #  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
    #  -o milter_macro_daemon_name=ORIGINATING
    #628       inet  n       -       n       -       -       qmqpd
    pickup    unix  n       -       n       60      1       pickup
    cleanup   unix  n       -       n       -       0       cleanup
    qmgr      unix  n       -       n       300     1       qmgr
    #qmgr     unix  n       -       n       300     1       oqmgr
    tlsmgr    unix  -       -       n       1000?   1       tlsmgr
    rewrite   unix  -       -       n       -       -       trivial-rewrite
    bounce    unix  -       -       n       -       0       bounce
    defer     unix  -       -       n       -       0       bounce
    trace     unix  -       -       n       -       0       bounce
    verify    unix  -       -       n       -       1       verify
    flush     unix  n       -       n       1000?   0       flush
    proxymap  unix  -       -       n       -       -       proxymap
    proxywrite unix -       -       n       -       1       proxymap
    smtp      unix  -       -       n       -       -       smtp
    relay     unix  -       -       n       -       -       smtp
    #       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
    showq     unix  n       -       n       -       -       showq
    error     unix  -       -       n       -       -       error
    retry     unix  -       -       n       -       -       error
    discard   unix  -       -       n       -       -       discard
    local     unix  -       n       n       -       -       local
    virtual   unix  -       n       n       -       -       virtual
    lmtp      unix  -       -       n       -       -       lmtp
    anvil     unix  -       -       n       -       1       anvil
    scache    unix  -       -       n       -       1       scache
    #
    # ====================================================================
    # Interfaces to non-Postfix software. Be sure to examine the manual
    # pages of the non-Postfix software to find out what options it wants.
    #
    # Many of the following services use the Postfix pipe(8) delivery
    # agent.  See the pipe(8) man page for information about ${recipient}
    # and other message envelope options.
    # ====================================================================
    #
    # maildrop. See the Postfix MAILDROP_README file for details.
    # Also specify in main.cf: maildrop_destination_recipient_limit=1
    #
    maildrop  unix  -       n       n       -       -       pipe
      flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient} ${extension} ${recipient} ${user} ${nexthop} ${sender}
    #
    # ====================================================================
    #
    # Recent Cyrus versions can use the existing "lmtp" master.cf entry.
    #
    # Specify in cyrus.conf:
    #   lmtp    cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
    #
    # Specify in main.cf one or more of the following:
    #  mailbox_transport = lmtp:inet:localhost
    #  virtual_transport = lmtp:inet:localhost
    #
    # ====================================================================
    #
    # Cyrus 2.1.5 (Amos Gouaux)
    # Also specify in main.cf: cyrus_destination_recipient_limit=1
    #
    #cyrus     unix  -       n       n       -       -       pipe
    #  user=cyrus argv=/usr/lib/cyrus-imapd/deliver -e -r ${sender} -m ${extension} ${user}
    #
    # ====================================================================
    #
    # Old example of delivery via Cyrus.
    #
    #old-cyrus unix  -       n       n       -       -       pipe
    #  flags=R user=cyrus argv=/usr/lib/cyrus-imapd/deliver -e -m ${extension} ${user}
    #
    # ====================================================================
    #
    # See the Postfix UUCP_README file for configuration details.
    #
    #uucp      unix  -       n       n       -       -       pipe
    #  flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
    #
    # ====================================================================
    #
    # Other external delivery methods.
    #
    #ifmail    unix  -       n       n       -       -       pipe
    #  flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
    #
    #bsmtp     unix  -       n       n       -       -       pipe
    #  flags=Fq. user=bsmtp argv=/usr/local/sbin/bsmtp -f $sender $nexthop $recipient
    #
    #scalemail-backend unix -       n       n       -       2       pipe
    #  flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store
    #  ${nexthop} ${user} ${extension}
    #
    #mailman   unix  -       n       n       -       -       pipe
    #  flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
    #  ${nexthop} ${user}
    dovecot   unix  -       n       n       -       -       pipe
      flags=DRhu user=vmail:vmail argv=/usr/libexec/dovecot/deliver -f ${sender} -d ${user}@${nexthop}
    
    amavis unix - - - - 2 smtp
            -o smtp_data_done_timeout=1200
            -o smtp_send_xforward_command=yes
            -o smtp_bind_address=
    
    
    127.0.0.1:10025 inet n - n - - smtpd
            -o content_filter=
            -o local_recipient_maps=
            -o relay_recipient_maps=
            -o smtpd_restriction_classes=
            -o smtpd_client_restrictions=
            -o smtpd_helo_restrictions=
            -o smtpd_sender_restrictions=
            -o smtpd_recipient_restrictions=permit_mynetworks,reject
            -o mynetworks=127.0.0.0/8
            -o strict_rfc821_envelopes=yes
            -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
            -o smtp_send_xforward_command=yes
            -o disable_dns_lookups=yes
    
    
    127.0.0.1:10027 inet n - n - - smtpd
            -o content_filter=
            -o local_recipient_maps=
            -o relay_recipient_maps=
            -o smtpd_restriction_classes=
            -o smtpd_client_restrictions=
            -o smtpd_helo_restrictions=
            -o smtpd_sender_restrictions=
            -o smtpd_recipient_restrictions=permit_mynetworks,reject
            -o mynetworks=127.0.0.0/8
            -o strict_rfc821_envelopes=yes
            -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
            -o smtp_send_xforward_command=yes
            -o milter_default_action=accept
            -o milter_macro_daemon_name=ORIGINATING
            -o disable_dns_lookups=yes
     
  4. Jesse Norell

    Jesse Norell Well-Known Member

    What do you have $mua_client_restrictions and $mua_sender_restrictions set to?

    As a reference, on a debian 9 server here, those are unset (the default), and this is working submission entry:
    Code:
    submission inet  n       -       y       -       -       smtpd
        -o syslog_name=postfix/submission
        -o smtpd_tls_security_level=encrypt
        -o smtpd_sasl_auth_enable=yes
        -o smtpd_client_restrictions=permit_sasl_authenticated,reject
    #  -o smtpd_reject_unlisted_recipient=no
    #  -o smtpd_client_restrictions=$mua_client_restrictions
    #  -o smtpd_helo_restrictions=$mua_helo_restrictions
    #  -o smtpd_sender_restrictions=$mua_sender_restrictions
    #  -o smtpd_recipient_restrictions=
    #  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
    #  -o milter_macro_daemon_name=ORIGINATING
    
     
  5. Zague

    Zague New Member

    Jesse;
    This is the output of postconf -n if you see there are warnings about those variables
    Code:
    [[email protected] zague]# postconf -n
    postconf: warning: /etc/postfix/master.cf: undefined parameter: mua_sender_restrictions
    postconf: warning: /etc/postfix/master.cf: undefined parameter: mua_client_restrictions
    postconf: warning: /etc/postfix/master.cf: undefined parameter: mua_helo_restrictions
    in the main.cf there are these entries:
    smtpd_client_restrictions = check_client_access mysql:/etc/postfix/mysql-virtual_client.cf

    smtpd_sender_restrictions = check_sender_access mysql:/etc/postfix/mysql-virtual_sender.cf regexp:/etc/postfix/tag_as_originating.re, permit_mynetworks, permit_sasl_authenticated, check_sender_access regexp:/etc/postfix/tag_as_foreign.re

    smtpd_helo_restrictions = permit_sasl_authenticated, permit_mynetworks, check_helo_access regexp:/etc/postfix/helo_access, reject_invalid_hostname, reject_non_fqdn_hostname, reject_invalid_helo_hostname, reject_unknown_helo_hostname, check_helo_access regexp:/etc/postfix/blacklist_helo

    Do you know what is the impact to unset those entries?
    I will test comment them and let you know.
    Regards
     
  6. Jesse Norell

    Jesse Norell Well-Known Member

    No, my guess is either the settings (smtpd_client_restrictions, etc.) are set to empy or to their default value, but I don't know for sure.

    I'm guessing that will fix it. If needed, refer to the Perfect Server guide you installed from, it should show you what to use.
     
    Zague likes this.
  7. Zague

    Zague New Member

    Jesse,
    You are right leave those lines commented solved the issue
    This is how submission configuration worked:
    Code:
    submission inet n       -       n       -       -       smtpd
      -o syslog_name=postfix/submission
      -o smtpd_tls_security_level=encrypt
      -o smtpd_sasl_auth_enable=yes
      -o smtpd_client_restrictions=permit_sasl_authenticated,reject
      -o smtpd_reject_unlisted_recipient=no
    #  -o smtpd_client_restrictions=$mua_client_restrictions
    #  -o smtpd_helo_restrictions=$mua_helo_restrictions
    #  -o smtpd_sender_restrictions=$mua_sender_restrictions
      -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
      -o milter_macro_daemon_name=ORIGINATING
    Thank you for your support and time!!
     

Share This Page