On 05/01/2012 16:18, Mark Rogers wrote:

I have an Ubuntu server running Virtualmin (with Postfix).

It is steadfastly refusing to allow me to relay when I authenticate. However I can't make any sense of what is going on.

Postfix's main.cf says: smtpd_sasl_auth_enable = yes smtpd_recipient_restrictions = permit_sasl_authenticated permit_mynetworks reject_unauth_destination .. which I understand to mean that provided I authenticate I can send anywhere.

The error I'm getting is: connect from [...] NOQUEUE: reject: RCPT from [...]: 550 5.1.1 user@example.com: Recipient address rejected: User unknown in virtual alias table; from=user@mysite to=user@example.com proto=ESMTP helo=<[...]> disconnect from [...]

.. where [...] is my IP/hostname, user@example.com is the address I'm trying to relay to, user@mysite is the user I'm trying to authenticate as.

If I disable authentication in my mail client, I get "relaying denied" which I would expect. If I change my password I get a password error, so I am definitely authenticating correctly. If I try sending an email (no authentication, plain SMTP) to invaliduser@mysite I get the same error as above, which is when I would expect to get it (trying to send to a user on my server that doesn't exist). However I'm trying to relay to a different server altogether so I can make sense of the error message in that context at all?

Mark

I agree with Stuart, it sounds as if you haven't started tls/sasl properly.

smtp_use_tls = yes smtpd_use_tls = yes

smtpd_sasl_auth_enable = yes smtpd_sasl2_auth_enable = yes

and so on.

You'll need certificates, and lots of info on that can be found in: http://www.eclectica.ca/howto/ssl-cert-howto.php

Note too, that SASL can't deal with encrypted passwords, so plain one is required. We use virtual users/accresses in a mysql db, with encrypted passwords, but can either use the existing database by using the encrypted one from the database as plain text, or set up a special use for relaying access with a plain password.

All that said, this error looks like something different:

"NOQUEUE: reject: RCPT from [...]: 550 5.1.1 user@example.com: Recipient address rejected: User unknown in virtual alias table;"

It looks as if you may need a "relay_domains = mydomain.com" statement in main.cf

If you need specific help, I can help as I do this stuff a lot.

Cheers, Laurie.

Apologies for breaking threading, for some reason I haven't received any replies, even though I can see them in the archive (where I can't reply to them!) [*]

Mick (mbm@rlogin.net) writes:

Try adding:

smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_non_fqdn_sender, reject_unknown_sender_domain

Sounds plausible, but just tried it to no avail.

Stuart Bailey (stuart@linusoft.co.uk) writes:

Have you configured saslauthd? I followed the example inhttp://www.postfix.org/SASL_README.html - only I'm authenticating against LDAP and that works fine (OpenSUSE 11.2).

No I haven't, although I believe that VirtualMin has done this for me. Given that I can access the account via IMAP with STARTTLS, and that I seem to be authenticating with SMTP (on the basis I get very different results if I try with an incorrect user or pass), I've sort of assumed that SASL is set up correctly. Although it seems odd that mail.log makes no reference to it?

Laurie Brown (laurie@brownowl.com) writes:

I agree with Stuart, it sounds as if you haven't started tls/sasl properly.

smtp_use_tls = yes smtpd_use_tls = yes

smtpd_sasl_auth_enable = yes smtpd_sasl2_auth_enable = yes

and so on.

Of those settings, only smtp_use_tls = yes smtpd_sasl2_auth_enable = yes .. were missing, and adding them hasn't made any difference.

All that said, this error looks like something different:

"NOQUEUE: reject: RCPT from [...]: 550 5.1.1<user at example.com http://lists.alug.org.uk/mailman/listinfo/main>: Recipient address rejected: User unknown in virtual alias table;"

Agreed, the error doesn't seem to stack up with what is going on. Postfix seems to be trying to deliver the email locally not relay it.

[*] Any suggestions why I'm not seeing replies? I receive the list normally. My email address routes to a Google Apps account.