fzfxru
BANNED | Редактировать | Профиль | Сообщение | Цитировать | Сообщить модератору
Всем привет. Имеется связка Debian lenny beta2 + exim 4.69-5 + dovecot. Без БД. С dovecot'ом проблем не наблюдается. С Exim'ом пытаюсь разобраться уже третьи сутки безуспешно по следующей проблеме: стойкое ощущение, что Exim на моём сервере релеит почту от левых доменов на левые домены. Вывод сделан на основании записей в mainlog'е чуть ниже. Для части левых сообщений как я понимаю срабатывает "domainlist relay_to_domains = 'fzfx.ru'", для части, увы, нет; обратите внимание на строки с "Message accepted for delivery", которые меня и беспокоят - домены, которые фигурируют там я не разрешал.
---
2008-08-15 23:42:53 [16419] H=123-204-7-66.dynamic.seed.net.tw (84.52.116.106) [123.204.7.66]:1052 I=[192.168.1.99]:25 F=<ecpluonvqhhiqycps@ms32.hinet.net> rejected RCPT <tychen@niu.edu.tw>: relay not permitted: nether local recipient nor domain allowed for relaying over our domain
2008-08-15 23:42:53 [16419] H=123-204-7-66.dynamic.seed.net.tw (84.52.116.106) [123.204.7.66]:1052 I=[192.168.1.99]:25 F=<ecpluonvqhhiqycps@ms32.hinet.net> rejected RCPT <kelvin@mail.fetl.com.tw>: relay not permitted: nether local recipient nor domain allowed for relaying over our domain
2008-08-15 23:42:54 [16419] H=123-204-7-66.dynamic.seed.net.tw (84.52.116.106) [123.204.7.66]:1052 I=[192.168.1.99]:25 incomplete transaction (QUIT) from <ecpluonvqhhiqycps@ms32.hinet.net>
2008-08-15 23:42:54 [16419] SMTP connection from 123-204-7-66.dynamic.seed.net.tw (84.52.116.106) [123.204.7.66]:1052 I=[192.168.1.99]:25 closed by QUIT
2008-08-15 23:43:07 [16423] 1KRDCc-0007xs-K6 => v1203308@ms39.hinet.net F=<joseph_pa@xuite.net> P=<joseph_pa@xuite.net> R=dnslookup T=remote_smtp S=2805 H=ms39a.hinet.net [168.95.5.39]:25 C="250 DAA14068 Message accepted for delivery" QT=1w22h3m45s DT=17s
2008-08-15 23:43:07 [16423] 1KRDCc-0007xs-K6 => v1203271@ms37.hinet.net F=<joseph_pa@xuite.net> P=<joseph_pa@xuite.net> R=dnslookup T=remote_smtp S=2805 H=ms37a.hinet.net [168.95.5.37]:25 C="250 DAA05061 Message accepted for delivery" QT=1w22h3m45s DT=17s
2008-08-15 23:43:07 [16429] 1KSOip-0001Q9-9i == lcclight@ms34.hinet.net routing defer (-51): reusing SMTP connection skips previous routing defer
2008-08-15 23:43:07 [16429] 1KSOip-0001Q9-9i == lcclight@ms36.hinet.net routing defer (-51): reusing SMTP connection skips previous routing defer
2008-08-15 23:43:07 [16429] 1KSOip-0001Q9-9i == lcclin@ms5.hinet.net routing defer (-51): reusing SMTP connection skips previous routing defer
2008-08-15 23:43:07 [16429] 1KSOip-0001Q9-9i == lcclww@ms5.hinet.net routing defer (-51): reusing SMTP connection skips previous routing defer
2008-08-15 23:43:08 [16430] 1KRDCc-0007xs-K6 Remote host ms43a.hinet.net [168.95.5.43] closed connection in response to initial connection
2008-08-15 23:43:08 [16423] 1KRDCc-0007xs-K6 == v1203326@ms43.hinet.net R=dnslookup T=remote_smtp defer (-18): Remote host ms43a.hinet.net [168.95.5.43] closed connection in response to initial connection
2008-08-15 23:43:08 [16434] 1KU5CW-0004H4-68 <= <> R=1KSOip-0001Q9-9i U=Debian-exim P=local S=2506 from <> for benjao@hotmail.com
2008-08-15 23:43:09 [16435] 1KU5CW-0004H4-68 => benjao@hotmail.com F=<> P=<> R=dnslookup T=remote_smtp S=2589 H=mx3.hotmail.com [65.54.244.200]:25 C="250 <E1KU5CW-0004H4-68@melchior.nwlt.ru> Queued mail for delivery" QT=1s DT=1s
2008-08-15 23:43:09 [16435] 1KU5CW-0004H4-68 Completed QT=1s
2008-08-15 23:43:25 [16423] 1KRDCc-0007xs-K6 => v120333@ms15.hinet.net F=<joseph_pa@xuite.net> P=<joseph_pa@xuite.net> R=dnslookup T=remote_smtp S=2805 H=ms15a.hinet.net [168.95.5.15]:25 C="250 DAA08401 Message accepted for delivery" QT=1w22h4m3s DT=18s
2008-08-15 23:43:25 [16423] 1KRDCc-0007xs-K6 ** v1203326@ms43.hinet.net: retry timeout exceeded
2008-08-15 23:43:25 [16440] 1KSRxa-0000pL-Ro == lin61130@ms45.hinet.net routing defer (-51): reusing SMTP connection skips previous routing defer
2008-08-15 23:43:25 [16440] 1KSRxa-0000pL-Ro == lin62708@ms58.hinet.net routing defer (-51): reusing SMTP connection skips previous routing defer
2008-08-15 23:43:25 [16441] 1KU5Cn-0004HB-KT <= <> R=1KRDCc-0007xs-K6 U=Debian-exim P=local S=3558 from <> for joseph_pa@xuite.net
2008-08-15 23:43:25 [16423] 1KRDCc-0007xs-K6 Completed QT=1w22h4m3s
2008-08-15 23:43:27 [16440] 1KSRxa-0000pL-Ro => lin61131@ms15.hinet.net F=<phoebe.jason@gmail.com> P=<phoebe.jason@gmail.com> R=dnslookup T=remote_smtp S=3786 H=ms15a.hinet.net [168.95.5.15]:25* C="250 DAA08568 Message accepted for delivery" QT=4d12h6m29s DT=2s
2008-08-15 23:43:27 [16446] 1KSRx1-0000iv-9v == sunfull6@ms58.hinet.net routing defer (-51): reusing SMTP connection skips previous routing defer
2008-08-15 23:43:28 [16443] 1KU5Cn-0004HB-KT ** joseph_pa@xuite.net F=<> P=<> R=dnslookup T=remote_smtp: SMTP error from remote mail server after RCPT TO:<joseph_pa@xuite.net>: host filter4.mail.xuite.net [210.242.46.179]: 550 #5.1.0 Rejected by bounce verification.
2008-08-15 23:43:28 [16443] 1KU5Cn-0004HB-KT Frozen (delivery error message)
---
Увы, почтовым сервером занимаюсь впервые. На выходных вообще сделал глупость - не погасил после экспериментов exim и буквально за сутки им попользовалось очень много народу в своих целях. ( Суточные логи весили по 200 метров... Сейчас ситуация намного более радостная - на половину сообщений с левых доменов на левые домены exim отвечает "relay not permitted". Но на другую половину подобных мессаг - другие ответы, в т. ч. и (ужас!) приёмы и доставки этих сообщений.
Воскуривание мануалов мне помогает увы слабо, ибо топчусь вокруг одних и тех же параметров в конфиге, касающихся relay_to и иже с ним, а результата лучшего чем того что привожу добиться не удалось.
Привожу малую часть конфига, боюсь что за весь запинаете. Огромная к вам просьба - подтолкните, задайте наводящие вопросы, запросите результаты команд для exim'а в шелле, направьте на альтернативный мануал (желательно русскоязычный), отличный от того что на exim.org... Если можно сюда положить весь конфиг - сообщите, выложу; весит 21 КБ, но я могу его пропарсить вручную, убрав явно лишнее, могу отсечь те части, на которые укажете вы. Вообще же конфиг (autogenerated.conf) - почти дефолтный из пакета exim4 для debian с минимальными изменениями. Заранее спасибо.
---
exim_path = /usr/sbin/exim4
CONFDIR = /etc/exim4
UPEX4CmacrosUPEX4C = 1
MAIN_PACKAGE_VERSION=4.69-5
MAIN_LOCAL_DOMAINS=@:localhost:fzfx.ru
MAIN_RELAY_TO_DOMAINS=fzfx.ru
ETC_MAILNAME=fzfx.ru
LOCAL_DELIVERY=mail_spool
MAIN_RELAY_NETS=127.0.0.1 : 127.0.0.1 : ::::1
DCreadhost=empty
DCsmarthost=empty
DC_eximconfig_configtype=internet
DCconfig_internet=1
###
domainlist local_domains = MAIN_LOCAL_DOMAINS
domainlist relay_to_domains = 'fzfx.ru'
hostlist relay_from_hosts = MAIN_RELAY_NETS
qualify_domain = ETC_MAILNAME
local_interfaces = 192.168.1.99
LOCAL_DELIVERY=mail_spool
gecos_pattern = ^([^,:]*)
gecos_name = $1
CHECK_RCPT_LOCAL_LOCALPARTS = ^[.] : ^.*[@%!/|`#&?]
CHECK_RCPT_REMOTE_LOCALPARTS = ^[./|] : ^.*[@%!`#&?] : ^.*/\\.\\./
MAIN_ACL_CHECK_MAIL = acl_check_mail
acl_smtp_mail = MAIN_ACL_CHECK_MAIL
MAIN_ACL_CHECK_RCPT = acl_check_rcpt
acl_smtp_rcpt = MAIN_ACL_CHECK_RCPT
MAIN_ACL_CHECK_DATA = acl_check_data
acl_smtp_data = MAIN_ACL_CHECK_DATA
begin acl
acl_local_deny_exceptions:
accept
hosts = ${if exists{CONFDIR/host_local_deny_exceptions}\
{CONFDIR/host_local_deny_exceptions}\
{}}
accept
senders = ${if exists{CONFDIR/sender_local_deny_exceptions}\
{CONFDIR/sender_local_deny_exceptions}\
{}}
accept
hosts = ${if exists{CONFDIR/local_host_whitelist}\
{CONFDIR/local_host_whitelist}\
{}}
accept
senders = ${if exists{CONFDIR/local_sender_whitelist}\
{CONFDIR/local_sender_whitelist}\
{}}
.ifdef LOCAL_DENY_EXCEPTIONS_LOCAL_ACL_FILE
.include LOCAL_DENY_EXCEPTIONS_LOCAL_ACL_FILE
.endif
.ifdef WHITELIST_LOCAL_DENY_LOCAL_ACL_FILE
.include WHITELIST_LOCAL_DENY_LOCAL_ACL_FILE
.endif
acl_check_mail:
.ifdef CHECK_MAIL_HELO_ISSUED
deny
message = no HELO given before MAIL command
condition = ${if def:sender_helo_name {no}{yes}}
.endif
accept
acl_check_rcpt:
accept
hosts = :
.ifdef CHECK_RCPT_LOCAL_LOCALPARTS
deny
domains = +local_domains
local_parts = CHECK_RCPT_LOCAL_LOCALPARTS
message = restricted characters in address
.endif
.ifdef CHECK_RCPT_REMOTE_LOCALPARTS
deny
domains = !+local_domains
local_parts = CHECK_RCPT_REMOTE_LOCALPARTS
message = restricted characters in address
.endif
accept
.ifndef CHECK_RCPT_POSTMASTER
local_parts = postmaster
.else
local_parts = CHECK_RCPT_POSTMASTER
.endif
domains = +local_domains : +relay_to_domains
.ifdef CHECK_RCPT_VERIFY_SENDER
deny
message = Sender verification failed
!acl = acl_local_deny_exceptions
!verify = sender
.endif
deny
!acl = acl_local_deny_exceptions
senders = ${if exists{CONFDIR/local_sender_callout}\
{CONFDIR/local_sender_callout}\
{}}
!verify = sender/callout
accept
hosts = +relay_from_hosts
control = submission/sender_retain
accept
authenticated = *
control = submission/sender_retain
require
message = relay not permitted: nether local recipient nor domain allowed for relaying over our domain
domains = +local_domains : +relay_to_domains
require
verify = recipient
deny
!acl = acl_local_deny_exceptions
recipients = ${if exists{CONFDIR/local_rcpt_callout}\
{CONFDIR/local_rcpt_callout}\
{}}
!verify = recipient/callout
deny
message = sender envelope address $sender_address is locally blacklisted here. If you think this is wrong, get in touch with postmaster
!acl = acl_local_deny_exceptions
senders = ${if exists{CONFDIR/local_sender_blacklist}\
{CONFDIR/local_sender_blacklist}\
{}}
deny
message = sender IP address $sender_host_address is locally blacklisted here. If you think this is wrong, get in touch with postmaster
!acl = acl_local_deny_exceptions
hosts = ${if exists{CONFDIR/local_host_blacklist}\
{CONFDIR/local_host_blacklist}\
{}}
begin authenticators
plain_server:
driver = plaintext
public_name = PLAIN
server_condition = "${if crypteq{$auth3}{${extract{1}{:}{${lookup{$auth2}lsearch{CONFDIR/passwd}{$value}{*:*}}}}}{1}{0}}"
server_set_id = $auth2
server_prompts = :
cram_md5_server:
driver = cram_md5
public_name = CRAM-MD5
server_secret = ${extract{2}{:}{${lookup{$auth1}lsearch{CONFDIR/passwd}{$value}fail}}}
server_set_id = $auth1
cram_md5:
driver = cram_md5
public_name = CRAM-MD5
client_name = ${extract{1}{:}{${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}}}
client_secret = ${extract{2}{:}{${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}}}
--- |
