Hello,
Je suis en train de configurer Horde, avec bien des difficultés… mais j’y arrive quand même au final, à une exception prêt, et pas des moindres, impossible d’envoyer un mail.
Je pense que le problème se situe côté Postfix.
La particularité de mon installation est ici que mon webmail (Horde IMP) n’est pas situé sur la même machine que le serveur postfix, par le fait, je pense la subtilité se situe au niveau de mes restrictions de smtpd_client_restrictions .
Mais avant d’aller plus loin, voilà le message d’erreur côté HORDE :
Server is not accepting SMTP connections
Et le message d’erreur côté Postfix :
Feb 25 14:17:53 mail postfix/submission/smtpd[7753]: NOQUEUE: reject: RCPT from dev1.mydomain.org[51.75..]: 554 5.7.1 <dev1.mydomain.org[51.75..]>: Client host rejected: Access denied; from=surveillance@mydomain.ovh to=*****@gmail.com proto=ESMTP helo=<mail.mydomain.org>
Ma conf postfix est la suivante :
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
allow_percent_hack = no
append_dot_mydomain = no
biff = no
bounce_notice_recipient = root
broken_sasl_auth_clients = no
compatibility_level = 2
default_destination_concurrency_limit = 5
default_destination_rate_delay = 4s
delay_notice_recipient = root
delay_warning_time = 4h
disable_vrfy_command = yes
error_notice_recipient = root
header_checks = regexp:/etc/postfix/header_checks
inet_interfaces = all
inet_protocols = ipv4
lmtp_tls_session_cache_database = btree:${data_directory}/lmtp_scache
mailbox_size_limit = 0
message_size_limit = 10240000
milter_default_action = accept
milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}
milter_protocol = 6
mime_header_checks = regexp:/etc/postfix/header_checks
mydestination = $myhostname, mail, localhost.localdomain, localhost
mydomain = mydomain.org
myhostname = mail.mydomain.org
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
myorigin = $myhostname
non_smtpd_milters = inet:localhost:11332
notify_classes = bounce, delay, resource, software
policyd-spf_time_limit = 3600s
postscreen_access_list = permit_mynetworks, cidr:/etc/postfix/postscreen_access.cidr
postscreen_blacklist_action = drop
postscreen_dnsbl_action = drop
postscreen_dnsbl_sites = zen.spamhaus.org*3 dbl.spamhaus.org bl.spamcop.net*2 cbl.abuseat.org dnsbl-1.uceprotect.net multi.uribl.com
postscreen_dnsbl_threshold = 3
postscreen_greet_action = enforce
postscreen_greet_banner = Patience est mere de vertue
readme_directory = no
recipient_delimiter = +
relayhost =
show_user_unknown_table_name = no
slow_destination_concurrency_failed_cohort_limit = 10
slow_destination_concurrency_limit = 2
slow_destination_rate_delay = 5s
slow_destination_recipient_limit = 20
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
smtp_tls_loglevel = 1
smtp_tls_mandatory_ciphers = high
smtp_tls_mandatory_protocols = !SSLv2, !SSLv3
smtp_tls_note_starttls_offer = yes
smtp_tls_protocols = !SSLv2, !SSLv3
smtp_tls_security_level = may
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_banner = $myhostname ESMTP
smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated, permit_inet_interfaces, reject_unknown_reverse_client_hostname,
smtpd_data_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_multi_recipient_bounce, reject_unauth_pipelining
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, check_helo_access hash:/etc/postfix/helo_access, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, reject_unknown_helo_hostname, reject_unauth_pipelining
smtpd_milters = inet:localhost:11332
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_recipient, reject_unauth_destination, reject_unknown_recipient_domain,
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
smtpd_sasl_local_domain = $myhostname
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_tls_security_options = $smtpd_sasl_security_options
smtpd_sasl_type = dovecot
smtpd_sender_restrictions = permit_mynetworks, permit_sasl_authenticated, check_policy_service unix:private/policyd-spf, reject_sender_login_mismatch, reject_unauth_destination, reject_unknown_sender_domain, reject_unlisted_sender, reject_non_fqdn_sender, reject_unauth_pipelining
smtpd_tls_CAfile = $smtp_tls_CAfile
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /etc/letsencrypt/live/cert_global_mydomain/fullchain.pem
smtpd_tls_dh1024_param_file = $config_directory/dh4096.pem
smtpd_tls_dh512_param_file = $config_directory/dh512.pem
smtpd_tls_eecdh_grade = auto
smtpd_tls_key_file = /etc/letsencrypt/live/cert_global_mydomain/privkey.pem
smtpd_tls_loglevel = 2
smtpd_tls_mandatory_ciphers = high
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
smtpd_tls_protocols = !SSLv2, !SSLv3
smtpd_tls_received_header = yes
smtpd_tls_security_level = may
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtputf8_autodetect_classes = verify
strict_rfc821_envelopes = yes
swap_bangpath = no
tls_preempt_cipherlist = yes
tls_random_source = dev:/dev/urandom
tls_ssl_options = no_ticket, no_compression
transport_maps = hash:/etc/postfix/transport
veryslow_destination_concurrency_failed_cohort_limit = 10
veryslow_destination_concurrency_limit = 1
veryslow_destination_rate_delay = 10s
veryslow_destination_recipient_limit = 10
virtual_alias_maps = mysql:/etc/postfix/mysql-virtual-alias-maps.cf
virtual_gid_maps = static:5000
virtual_mailbox_base = /var/mail
virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual-mailbox-domains.cf
virtual_mailbox_maps = mysql:/etc/postfix/mysql-virtual-mailbox-maps.cf
virtual_minimum_uid = 5000
virtual_transport = lmtp:unix:private/dovecot-lmtp
virtual_uid_maps = static:5000
Auriez-vous une petite idée ?
Lorsque je lève toute les restrictions de smtpd_client_restrictions, là je vais à peine plus loin et me prend un “relay access denied”.
Il y a un truc qui m’échappe, car au final, mon webmail distant n’a ni plus ni moins que le même comportement que n’importe quel client mail, non ? Pourquoi, lui, on lui refuse l’accès alors que pour les clients lourds classiques, ça fonctionne très bien ?
