我想拒绝特定用户的外发邮件，因此首先我添加这样的策略：
Name | Priority | Description | Disabled
__________________________________________________________________________
Not outgoing | 0 | Dont allow outgoing mails | no
并向此策略添加成员：
Source | Destination | Disabled
___________________________________________________________
[email protected] | !%internal_domains | no
并向访问控制列表添加一条新记录：
Policy | Name | Verdict | Data | Disabled
______________________________________________________________________________________
Not outgoing | Reject Outbound | REJECT | No outbound mail allowed | no
另一方面，我有一个政策组：
Name | Disabled
____________________________
internal_domains | no
并将其添加为成员（这是我的本地域）：
Member | Disabled
____________________________
@mydomain.io | no
因此，在完成所有这些准备工作后，我尝试向外部邮件地址发送电子邮件，并期望 policyd 会拒绝此邮件，但结果却不同。因此，检查了 postfix 和 policyd 日志，但我什么都不明白。以下是一封邮件的 postfix 日志：
postfix | Feb 27 15:58:55 local postfix/smtpd[720]: connect from yartu_sync-engine_1.yartu_yartu-network[172.22.1.4]
postfix | Feb 27 15:58:55 local postfix/smtpd[720]: Anonymous TLS connection established from yartu_sync-engine_1.yartu_yartu-network[172.22.1.4]: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
postfix | Feb 27 15:58:55 local postfix/smtpd[720]: C368F381ABC: client=yartu_sync-engine_1.yartu_yartu-network[172.22.1.4], sasl_method=PLAIN, [email protected]
postfix | Feb 27 15:58:55 local postfix/cleanup[724]: C368F381ABC: message-id=<[email protected]>
postfix | Feb 27 15:58:55 local postfix/qmgr[348]: C368F381ABC: from=<[email protected]>, size=1075, nrcpt=1 (queue active)
postfix | Feb 27 15:58:55 local postfix/smtpd[720]: disconnect from yartu_sync-engine_1.yartu_yartu-network[172.22.1.4] ehlo=2 starttls=1 auth=1 mail=1 rcpt=1 data=1 quit=1 commands=8
postfix | Feb 27 15:58:59 local postfix/smtp[726]: Trusted TLS connection established to gmail-smtp-in.l.google.com[108.177.15.26]:25: TLSv1.2 with cipher ECDHE-RSA-CHACHA20-POLY1305 (256/256 bits)
postfix | Feb 27 15:59:00 local postfix/smtp[726]: C368F381ABC: replace: header Received: from [172.22.1.4] (yartu_sync-engine_1.yartu_yartu: Received: from localhost (localhost [127.0.0.1]) (Authenticated sender: [email protected])??by local.yartu.io (Postcow) with ESMTPSA id C368F381ABC??for <[email protected]>; Wed, 27 Feb 2019 15:58:55 +0300 (+03)
postfix | Feb 27 15:59:00 local postfix/smtp[726]: C368F381ABC: to=<[email protected]>, relay=gmail-smtp-in.l.google.com[108.177.15.26]:25, delay=4.7, delays=0.15/0.03/4/0.51, dsn=2.0.0, status=sent (250 2.0.0 OK 1551272340 y14si8903503wru.408 - gsmtp)
postfix | Feb 27 15:59:00 local postfix/qmgr[348]: C368F381ABC: removed
以及策略日志：
policyd | [2019/02/27-12:52:34 - 41] [CORE] INFO: Starting "1" children
policyd | 2019-02-27 12:52:34,379 DEBG 'cbpolicyd' stderr output:
policyd | [2019/02/27-12:52:34 - 41] [CORE] INFO: Starting "1" children
policyd |
policyd | 2019-02-27 12:52:34,379 DEBG 'cbpolicyd' stderr output:
policyd | [2019/02/27-12:52:34 - 243] [CORE] INFO: 2019/02/27-12:52:34 CONNECT TCP Peer: "[172.22.1.17]:33264" Local: "[172.22.1.200]:10031"
policyd |
policyd | [2019/02/27-12:52:34 - 243] [CORE] INFO: 2019/02/27-12:52:34 CONNECT TCP Peer: "[172.22.1.17]:33264" Local: "[172.22.1.200]:10031"
policyd | [2019/02/27-12:52:34 - 252] [CORE] DEBUG: Child Preforked (252)
policyd | 2019-02-27 12:52:34,380 DEBG 'cbpolicyd' stderr output:
policyd | [2019/02/27-12:52:34 - 252] [CORE] DEBUG: Child Preforked (252)
policyd |
policyd | [2019/02/27-12:52:34 - 252] [CBPOLICYD] DEBUG: Starting up caching engine
policyd | 2019-02-27 12:52:34,380 DEBG 'cbpolicyd' stderr output:
policyd | [2019/02/27-12:52:34 - 252] [CBPOLICYD] DEBUG: Starting up caching engine
policyd |
policyd | [2019/02/27-12:53:01 - 73] [CORE] INFO: 2019/02/27-12:53:01 CONNECT TCP Peer: "[172.22.1.17]:33654" Local: "[172.22.1.200]:10031"
policyd | 2019-02-27 12:53:01,599 DEBG 'cbpolicyd' stderr output:
policyd | [2019/02/27-12:53:01 - 73] [CORE] INFO: 2019/02/27-12:53:01 CONNECT TCP Peer: "[172.22.1.17]:33654" Local: "[172.22.1.200]:10031"
policyd |
policyd | [2019/02/27-12:53:31 - 41] [CORE] INFO: Killing "1" children
policyd | 2019-02-27 12:53:31,635 DEBG 'cbpolicyd' stderr output:
policyd | [2019/02/27-12:53:31 - 41] [CORE] INFO: Killing "1" children
policyd |
policyd | [2019/02/27-12:53:31 - 252] [CBPOLICYD] DEBUG: Shutting down caching engine (252)
policyd | 2019-02-27 12:53:31,636 DEBG 'cbpolicyd' stderr output:
policyd | [2019/02/27-12:53:31 - 252] [CBPOLICYD] DEBUG: Shutting down caching engine (252)
下面是我的 postfix main.cf（172.22.1.200 是 policyd 的 ip 地址）：
...
smtpd_recipient_restrictions = check_policy_service inet:172.22.1.200:10031, permit_mynetworks, permit_sasl_authenticated, check_recipient_access proxy:mysql:/opt/postfix/conf/sql/mysql_tls_enforce_in_policy.cf, reject_invalid_helo_hostname, reject_unknown_reverse_client_hostname, reject_unauth_destination
...
和master.cf：
...
tlsproxy unix - - n - 0 tlsproxy
dnsblog unix - - n - 0 dnsblog
pickup fifo n - n 60 1 pickup
cleanup unix n - n - 0 cleanup
qmgr fifo n - n 300 1 qmgr
tlsmgr unix - - n 1000? 1 tlsmgr
rewrite unix - - n - - trivial-rewrite
bounce unix - - n - 0 bounce
defer unix - - n - 0 bounce
trace unix - - n - 0 bounce
verify unix - - n - 1 verify
flush unix n - n 1000? 0 flush
proxymap unix - - n - - proxymap
proxywrite unix - - n - 1 proxymap
smtp unix - - n - - smtp
relay unix - - n - - smtp
showq unix n - n - - showq
error unix - - n - - error
retry unix - - n - - error
discard unix - - n - - discard
local unix - n n - - local
virtual unix - n n - - virtual
lmtp unix - - n - - lmtp
anvil unix - - n - 1 anvil
scache unix - - n - 1 scache
maildrop unix - n n - - pipe flags=DRhu
user=vmail argv=/usr/bin/maildrop -d ${recipient}
policy-spf unix - n n - - spawn
user=nobody argv=/usr/sbin/postfix-policyd-spf-perl
# start zeyple
zeyple unix - n n - - pipe
user=zeyple argv=/usr/local/bin/zeyple.py ${recipient}
127.0.0.1:10026 inet n - n - 10 smtpd
-o content_filter=
-o receive_override_options=no_unknown_recipient_checks,no_header_body_checks,no_milters
-o smtpd_helo_restrictions=
-o smtpd_client_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,reject
-o mynetworks=127.0.0.0/8
-o smtpd_authorized_xforward_hosts=127.0.0.0/8
# end zeyple
...
我哪里错了？
答案1
[server]
# Protocols to load
protocols=<<EOT
Postfix
Bizanga
EOT
# Modules to load
modules=<<EOT
Core
##### I Added next line for solution #####
AccessControl
CheckHelo
CheckSPF
Greylisting
Quotas
EOT
# User to run this daemon as
user=root
#group=
我忘了在 cluebringer.conf 上添加模块，但一切正常。