<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Moin,<div class=""><br class=""></div><div class="">ich habe hier ein Problem dem ich noch nicht auf die Schliche kommen konnte. Vielleicht hat von euch ja jemand eine Idee.</div><div class=""><br class=""></div><div class=""><b class="">Beschreibung meines Setups</b></div><div class="">Wir haben in einem RZ eine große Groupware als zentrale E-Mail Lösung mit sehr vielen Domains. Außerhalb des RZ betreiben wir eine Menge Mailserver mit klassischem Dovecot, Postfix, AMaViS Geraffel. Der Postfix setzt unter bestimmten Umständen den Transport in Richtung der Groupware was überwiegend Mails für schlagende Herzen sind. Auf den Mailservern selbst bleiben Mails liegen die bspw. maschinell abgeholt und verarbeitet werden.</div><div class=""><br class=""></div><div class="">Ich habe hierfür <i class="">transport_maps</i> genutzt.</div><div class=""><br class=""></div><div class=""><b class="">mysql-transport-maps.cf</b></div><div class=""><blockquote type="cite" class="">SELECT COALESCE(<br class=""> (<br class=""> SELECT 'dovecot' FROM virtual_users<br class=""> LEFT JOIN virtual_domains ON virtual_users.domain_id = <a href="http://virtual_domains.id" class="">virtual_domains.id</a><br class=""> WHERE concat(virtual_users.user,'@',virtual_domains.name) = '%s' LIMIT 1 ),<br class=""> (<br class=""> SELECT 'smtp' FROM virtual_aliases<br class=""> LEFT JOIN virtual_domains ON virtual_aliases.domain_id = <a href="http://virtual_domains.id" class="">virtual_domains.id</a><br class=""> WHERE concat(virtual_aliases.source,'@',virtual_domains.name) = '%s' LIMIT 1),<br class=""> (<br class=""> SELECT 'local' FROM virtual_domains<br class=""> WHERE 'localhost' = (SELECT SUBSTRING_INDEX('%s','@',-1)) LIMIT 1),<br class=""> (<br class=""> SELECT 'smtp:[ip.adresse.der.groupware]:25' FROM virtual_domains<br class=""> WHERE name = (SELECT SUBSTRING_INDEX('%s','@',-1)) LIMIT 1),<br class=""> 'smtp') AS user;</blockquote></div><div class=""><br class=""></div><div class="">Das funktionierte wunderbar, bis wir einige der externen Mailserver in unser RZ geholt haben.</div><div class=""><br class=""></div><div class="">Jetzt habe ich das Problem festgestellt, dass bei einem Alias <i class="">smtp</i> als <i class="">transport</i> verwendet wird. Eigenartigerweise wird <i class="">mydestination</i> nicht respektiert bzw. die <i class="">virtual_domains</i>. Es wird also, um die Adresse des Empfängers (Alias) zu überprüfen, eine SMTP Verbindung zu der öffentlichen IP des Mailserver hergestellt die dann wieder auf dem Mailserver selbst endet. Dies resultiert in der Meldung die wir alle lieben “<b class="">greeted me with my own hostname</b>”.</div><div class=""><br class=""></div><div class="">Auf den externen Mailserver und im RZ läuft die Version 3.1.8-0+deb9u1.</div><div class=""><br class=""></div><div class=""><b class="">Log des fehlgeschlagenen Versuches bei dem Server im RZ</b></div><div class=""><blockquote type="cite" class="">Mar 15 15:28:53 mx-local postfix/postscreen[112663]: CONNECT from [ip.adresse.des.versenders]:38170 to [10.0.0.11]:25<br class="">Mar 15 15:28:53 mx-local postfix/postscreen[112663]: PASS OLD [ip.adresse.des.versenders]:38170<br class="">Mar 15 15:28:53 mx-local postfix/smtpd[112664]: connect from <a href="http://mx.example.com" class="">mx.example.com</a>[ip.adresse.des.versenders]<br class="">Mar 15 15:28:54 mx-local postfix/smtpd[112664]: 15B023FDF5: client=<a href="http://mx.example.com" class="">mx.example.com</a>[ip.adresse.des.versenders]<br class="">Mar 15 15:28:54 mx-local postfix/cleanup[112670]: 15B023FDF5: message-id=<<a href="mailto:8529D5D9-70FE-41A4-9187-A2259D35269A@example.com" class="">8529D5D9-70FE-41A4-9187-A2259D35269A@example.com</a>><br class="">Mar 15 15:28:55 mx-local postfix/qmgr[112638]: 15B023FDF5: from=<<a href="mailto:user1@example.com" class="">user1@example.com</a>>, size=2351, nrcpt=1 (queue active)<br class="">Mar 15 15:28:55 mx-local postfix/postscreen[112663]: CONNECT from [10.0.0.1]:36536 to [10.0.0.11]:25<br class="">Mar 15 15:28:55 mx-local postfix/smtpd[112664]: disconnect from <a href="http://mx.example.com" class="">mx.example.com</a>[ip.adresse.des.versenders] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 commands=7<br class="">Mar 15 15:28:55 mx-local postfix/postscreen[112663]: PASS OLD [10.0.0.1]:36536<br class="">Mar 15 15:28:55 mx-local postfix/smtpd[112664]: connect from unknown[10.0.0.1]<br class="">Mar 15 15:28:55 mx-local postfix/smtp[112671]: warning: host <a href="http://mx.example.net" class="">mx.example.net</a>[externe.ip.des.servers]:25 greeted me with my own hostname <a href="http://mx.example.net" class="">mx.example.net</a><br class="">Mar 15 15:28:55 mx-local postfix/smtp[112671]: warning: host <a href="http://mx.example.net" class="">mx.example.net</a>[externe.ip.des.servers]:25 replied to HELO/EHLO with my own hostname <a href="http://mx.example.net" class="">mx.example.net</a><br class="">Mar 15 15:28:55 mx-local postfix/smtp[112671]: 15B023FDF5: to=<<a href="mailto:user2@example.net" class="">user2@example.net</a>>, relay=<a href="http://mx.example.net" class="">mx.example.net</a>[externe.ip.des.servers]:25, delay=1.8, delays=1.7/0.01/0.13/0, dsn=5.4.6, status=bounced (mail for <a href="http://example.net" class="">example.net</a> loops back to myself)<br class="">Mar 15 15:28:55 mx-local postfix/smtpd[112664]: disconnect from unknown[10.0.0.1] ehlo=1 quit=1 commands=2<br class="">Mar 15 15:28:55 mx-local postfix/cleanup[112670]: C302F3FFDA: message-id=<<a href="mailto:20190315142855.C302F3FFDA@mx.example.net" class="">20190315142855.C302F3FFDA@mx.example.net</a>><br class="">Mar 15 15:28:55 mx-local postfix/qmgr[112638]: C302F3FFDA: from=<>, size=4707, nrcpt=1 (queue active)<br class="">Mar 15 15:28:55 mx-local postfix/bounce[112676]: 15B023FDF5: sender non-delivery notification: C302F3FFDA<br class="">Mar 15 15:28:55 mx-local postfix/qmgr[112638]: 15B023FDF5: removed<br class="">Mar 15 15:28:56 mx-local postfix/smtp[112671]: C302F3FFDA: to=<<a href="mailto:user1@example.com" class="">user1@example.com</a>>, relay=<a href="http://mx.example.com" class="">mx.example.com</a>[ip.adresse.des.versenders]:25, delay=0.22, delays=0.01/0/0.14/0.08, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as E9ABCD840A5)<br class="">Mar 15 15:28:56 mx-local postfix/qmgr[112638]: C302F3FFDA: removed</blockquote></div><div class=""><br class=""></div><div class=""><b class="">Log des erfolgreichen Versuches bei dem Server außerhalb des RZ</b></div><div class=""><blockquote type="cite" class="">Mar 15 15:46:05 mx postfix/postscreen[27628]: CONNECT from [ip.adresse.des.versenders]:37494 to [ip.adresse.des.empfaengers]:25<br class="">Mar 15 15:46:05 mx postfix/postscreen[27628]: PASS OLD [ip.adresse.des.versenders]:37494<br class="">Mar 15 15:46:05 mx postfix/smtpd[27629]: connect from <a href="http://mx.example.com" class="">mx.example.com</a>[ip.adresse.des.versenders]<br class="">Mar 15 15:46:05 mx postfix/smtpd[27629]: 9F28D5F824: client=<a href="http://mx.example.com" class="">mx.example.com</a>[ip.adresse.des.versenders]<br class="">Mar 15 15:46:05 mx postfix/cleanup[27634]: 9F28D5F824: message-id=<<a href="mailto:D5793ECA-36A4-43BA-B036-4C699EDAF278@example.com" class="">D5793ECA-36A4-43BA-B036-4C699EDAF278@example.com</a>><br class="">Mar 15 15:46:05 mx postfix/qmgr[22574]: 9F28D5F824: from=<<a href="mailto:user1@example.com" class="">user1@example.com</a>>, size=2390, nrcpt=1 (queue active)<br class="">Mar 15 15:46:05 mx postfix/smtpd[27629]: disconnect from <a href="http://mx.example.com" class="">mx.example.com</a>[ip.adresse.des.versenders] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 commands=7<br class="">Mar 15 15:46:05 mx postfix/smtpd[27638]: connect from localhost[127.0.0.1]<br class="">Mar 15 15:46:05 mx postfix/smtpd[27638]: B5D675F83B: client=localhost[127.0.0.1]<br class="">Mar 15 15:46:05 mx postfix/cleanup[27634]: B5D675F83B: message-id=<<a href="mailto:D5793ECA-36A4-43BA-B036-4C699EDAF278@example.com" class="">D5793ECA-36A4-43BA-B036-4C699EDAF278@example.com</a>><br class="">Mar 15 15:46:05 mx postfix/qmgr[22574]: B5D675F83B: from=<<a href="mailto:user1@example.com" class="">user1@example.com</a>>, size=1497, nrcpt=1 (queue active)<br class="">Mar 15 15:46:05 mx postfix/smtpd[27638]: disconnect from localhost[127.0.0.1] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5<br class="">Mar 15 15:46:05 mx amavis[28645]: (28645-20) Passed CLEAN {RelayedOpenRelay}, [ip.adresse.des.versenders]:37494 [ip.adresse.des.versenders] <<a href="mailto:user1@example.com" class="">user1@example.com</a>> -> <<a href="mailto:alias1@example.org" class="">alias1@example.org</a>>, Queue-ID: 9F28D5F824, Message-ID: <<a href="mailto:D5793ECA-36A4-43BA-B036-4C699EDAF278@example.com" class="">D5793ECA-36A4-43BA-B036-4C699EDAF278@example.com</a>>, mail_id: AEkFq9VYyvTL, Hits: -, size: 1226, queued_as: B5D675F83B, 78 ms<br class="">Mar 15 15:46:05 mx postfix/smtp[27635]: 9F28D5F824: to=<<a href="mailto:alias1@example.org" class="">alias1@example.org</a>>, relay=127.0.0.1[127.0.0.1]:10024, delay=0.11, delays=0.03/0/0/0.08, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as B5D675F83B)<br class="">Mar 15 15:46:05 mx postfix/qmgr[22574]: 9F28D5F824: removed<br class="">Mar 15 15:46:05 mx postfix/smtp[27639]: B5D675F83B: to=<<a href="mailto:user2@alias.example.org" class="">user2@alias.example.org</a>>, orig_to=<<a href="mailto:alias1@example.org" class="">alias1@example.org</a>>, relay=<a href="http://alias.example.org" class="">alias.example.org</a>[ip.ip.ip.ip]:25, delay=0.1, delays=0.01/0/0.07/0.02, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as CAEA45F87A)<br class="">Mar 15 15:46:05 mx postfix/qmgr[22574]: B5D675F83B: removed</blockquote></div><div class=""><br class=""></div><div class=""><b class="">Zu guter Letzt noch meine <i class="">postconf</i></b></div><div class=""><blockquote type="cite" class="">address_verify_sender = <a href="mailto:double-bounce@mx.example.net" class="">double-bounce@mx.example.net</a><br class="">alias_database = hash:/etc/aliases<br class="">alias_maps = hash:/etc/aliases<br class="">amavisd_milter = inet:10.0.1.10:8899<br class="">append_dot_mydomain = no<br class="">biff = no<br class="">bounce_queue_lifetime = 3d<br class="">broken_sasl_auth_clients = yes<br class="">disable_vrfy_command = yes<br class="">dovecot_destination_recipient_limit = 1<br class="">inet_interfaces = all<br class="">inet_protocols = ipv4<br class="">local_destination_concurrency_limit = 20<br class="">mailbox_size_limit = 0<br class="">maximal_queue_lifetime = 3d<br class="">message_size_limit = 500000000<br class="">milter_default_action = accept<br class="">milter_protocol = 2<br class="">mydestination = $myhostname, localhost.$mydomain, localhost<br class="">myhostname = <a href="http://mx.example.net" class="">mx.example.net</a><br class="">mynetworks = 127.0.0.0/8 10.0.2.10 10.0.2.1 10.0.2.2 10.0.2.3 10.0.2.4<br class="">myorigin = /etc/mailname<br class="">non_smtpd_milters = inet:localhost:8891<br class="">postscreen_access_list = permit_mynetworks<br class="">postscreen_dnsbl_action = enforce<br class="">postscreen_dnsbl_sites = <a href="http://zen.spamhaus.org" class="">zen.spamhaus.org</a>*3 <a href="http://b.barracudacentral.org" class="">b.barracudacentral.org</a>*2 <a href="http://bl.spamcop.net" class="">bl.spamcop.net</a> <a href="http://spam.dnsbl.sorbs.net" class="">spam.dnsbl.sorbs.net</a>=127.0.0.6<br class="">postscreen_dnsbl_threshold = 3<br class="">postscreen_greet_action = enforce<br class="">readme_directory = no<br class="">receive_override_options = no_address_mappings<br class="">recipient_delimiter = +<br class="">relayhost =<br class="">smtp_header_checks = pcre:/etc/postfix/anonymize_headers.pcre<br class="">smtp_mime_header_checks = pcre:/etc/postfix/anonymize_headers.pcre<br class="">smtp_tls_security_level = may<br class="">smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache<br class="">smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)<br class="">smtpd_client_restrictions = permit_mynetworks permit_sasl_authenticated reject_unauth_pipelining reject_rbl_client <a href="http://bl.spamcop.net" class="">bl.spamcop.net</a><br class="">smtpd_discard_ehlo_keyword_address_maps = cidr:/etc/postfix/esmtp_access.cidr<br class="">smtpd_enforce_tls = yes<br class="">smtpd_milters = inet:localhost:8891<br class="">smtpd_recipient_restrictions = permit_mynetworks,permit_sasl_authenticated,reject_unknown_recipient_domain,reject_unverified_recipient<br class="">smtpd_sasl_auth_enable = yes<br class="">smtpd_sasl_authenticated_header = yes<br class="">smtpd_sasl_path = private/auth<br class="">smtpd_sasl_type = dovecot<br class="">smtpd_tls_auth_only = yes<br class="">smtpd_tls_cert_file = /etc/letsencrypt/live/<a href="http://mx.example.net/fullchain.pem" class="">mx.example.net/fullchain.pem</a><br class="">smtpd_tls_key_file = /etc/letsencrypt/live/<a href="http://mx.example.net/privkey.pem" class="">mx.example.net/privkey.pem</a><br class="">smtpd_tls_mandatory_ciphers = high<br class="">smtpd_tls_mandatory_exclude_ciphers = aNULL, MD5 , RC4<br class="">smtpd_tls_mandatory_protocols = SSLv3, TLSv1<br class="">smtpd_tls_security_level = may<br class="">smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache<br class="">transport_maps = mysql:/etc/postfix/mysql-transport-maps.cf<br class="">unverified_recipient_reject_code = 550<br class="">unverified_recipient_reject_reason = 'Recipient address rejected'<br class="">virtual_alias_maps = mysql:/etc/postfix/mysql-virtual-alias-maps.cf,mysql:/etc/postfix/mysql-email2email.cf<br class="">virtual_gid_maps = static:5000<br class="">virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual-mailbox-domains.cf<br class="">virtual_uid_maps = static:5000</blockquote></div><div class=""><br class=""></div><div class=""><b class="">Meine Fragen</b></div><div class="">1. Warum wird überhaupt eine <i class="">smtp</i> Verbindung aufgebaut, wenn ich die Domain doch in den <i class="">virtual_domains</i> definiert habe?</div><div class="">2. Warum verhält sich Postfix korrekt, wenn die externe IP dem System bekannt ist?</div><div class="">3. Wie kann ich <i class="">virtual_aliases</i> wieder korrekt nutzen?</div><div class=""><br class=""></div><div class="">Vielen Dank für alle die bis hier gelesen haben und vorab auch vielen Dank für eure Hilfe.</div><div class=""><br class=""></div><div class="">Vitali</div></body></html>