我有一个配置了reject_unknown_client_hostname和reject_unknown_helo_hostname的postfix服务器。无论如何，服务器都会接受来自客户端的非sasl_authenticated连接以及没有DNS条目的HELO名称。使用telnet和nc进行测试（实际邮件服务器域替换为mymailserver.com）：
nc mymailserver.com 25
220 mymailserver.com ESMTP Postfix (2.9.6)
HELO inexistent.domain.com
250 mymailserver.com
带有 debug_peer_level = 2 的 Postfix 日志：
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: connect from dslb-178-005-067-030.pools.arcor-ip.net[178.5.67.30]
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: smtp_stream_setup: maxtime=300 enable_deadline=0
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: match_hostname: dslb-178-005-067-030.pools.arcor-ip.net ~? 127.0.0.0/8
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: match_hostaddr: 178.5.67.30 ~? 127.0.0.0/8
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: match_hostname: dslb-178-005-067-030.pools.arcor-ip.net ~? [::ffff:127.0.0.0]/104
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: match_hostaddr: 178.5.67.30 ~? [::ffff:127.0.0.0]/104
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: match_hostname: dslb-178-005-067-030.pools.arcor-ip.net ~? [::1]/128
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: match_hostaddr: 178.5.67.30 ~? [::1]/128
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: match_list_match: dslb-178-005-067-030.pools.arcor-ip.net: no match
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: match_list_match: 178.5.67.30: no match
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: auto_clnt_open: connected to private/anvil
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: send attr request = connect
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: send attr ident = smtp:178.5.67.30
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: private/anvil: wanted attribute: status
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: input attribute name: status
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: input attribute value: 0
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: private/anvil: wanted attribute: count
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: input attribute name: count
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: input attribute value: 1
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: private/anvil: wanted attribute: rate
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: input attribute name: rate
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: input attribute value: 1
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: private/anvil: wanted attribute: (list terminator)
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: input attribute name: (end)
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: > dslb-178-005-067-030.pools.arcor-ip.net[178.5.67.30]: 220 mymailserver.com ESMTP Postfix (2.9.6)
Mar 19 16:55:23 mymailserver postfix/smtpd[4941]: watchdog_pat: 0x7f1fcb7f5aa0
Mar 19 16:55:33 mymailserver postfix/smtpd[4941]: < dslb-178-005-067-030.pools.arcor-ip.net[178.5.67.30]: HELO jksdnfsdmf.de
Mar 19 16:55:33 mymailserver postfix/smtpd[4941]: > dslb-178-005-067-030.pools.arcor-ip.net[178.5.67.30]: 250 mymailserver.com
Mar 19 16:55:33 mymailserver postfix/smtpd[4941]: watchdog_pat: 0x7f1fcb7f5aa0
我的配置有问题吗？还是我遗漏了什么？或者是测试用例有误？
Postfix 配置：
smtpd_helo_required = yes
smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unknown_client_hostname
smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unknown_helo_hostname
smtpd_sender_restrictions = reject_unknown_sender_domain, reject_authenticated_sender_login_mismatch, permit_sasl_authenticated, check_policy_service unix:private/policy-spf
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_data_restrictions = reject_unauth_pipelining
答案1
好的，测试用例是错误的。我分别不知道 smtpd_delay_reject 选项，默认情况下设置为 yes。使用此选项，postifx 不会在每个命令后立即检查限制，而是等待所有检查，直到收到 HELO、MAIL FROM 和 RCPT TO 命令。请参阅http://www.postfix.org/postconf.5.html#smtpd_delay_reject
telnet mymailserver.com 25
220 mymailserver.com ESMTP Postfix (2.9.6)
HELO inexistent.domain.com
250 mymailserver.com
MAIL FROM: [email protected]
250 2.1.0 Ok
RCPT TO: [email protected]
450 4.7.1 <inexistent.domain.com>: Helo command rejected: Host not found