Полный конфиг:
Код: Выделить всё
#-------PATHS-------
queue_directory=/var/spool/postfix
command_directory = /usr/local/sbin
daemon_directory = /usr/local/libexec/postfix
data_directory = /var/db/postfix
sendmail_path = /usr/local/sbin/sendmail
newaliases_path = /usr/local/bin/newaliases
mailq_path = /usr/local/bin/mailq
html_directory = /usr/local/share/doc/postfix
manpage_directory = /usr/local/man
sample_directory = /usr/local/etc/postfix
readme_directory = /usr/local/share/doc/postfix
config_directory=/usr/local/etc/postfix
alias_maps = hash:/etc/aliases
#-------SYSTEM SETTINGS-------
mail_owner = postfix
default_privs = nobody
debug_peer_level = 5
debugger_command =
PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
ddd $daemon_directory/$process_name $process_id & sleep 5
setgid_group = maildrop
soft_bounce = no
allow_min_user = no
message_size_limit = 10485760
backwards_bounce_logfile_compatibility=yes
helpful_warnings=yes
#-------Additional system settings-------
strict_rfc821_envelopes = yes
disable_vrfy_command = no
smtpd_helo_required = yes
smtp_always_send_ehlo = yes
smtp_never_send_ehlo=no
smtpd_delay_reject = yes
smtpd_reject_unlisted_sender = yes
smtpd_reject_unlisted_recipient = yes
address_verify_sender = <>
allow_untrusted_routing = no
resolve_null_domain = no
resolve_numeric_domain = no
#-------THRESHOLDS & LIMITS-------
smtpd_recipient_limit = 10
smtpd_recipient_overshoot_limit = $smtpd_recipient_limit
default_process_limit = 100
max_use = 70
smtpd_soft_error_limit=5
smtpd_hard_error_limit=10
smtpd_recipient_overshoot_limit = $smtpd_recipient_limit
anvil_rate_time_unit = 1m
anvil_status_update_time = 60s
smtpd_client_event_limit_exceptions=$mynetworks
smtpd_client_connection_rate_limit = 50
smtpd_client_new_tls_session_rate_limit = 50
smtpd_client_connection_count_limit = 25
smtpd_client_message_rate_limit = 25
smtpd_client_recipient_rate_limit = 25
qmgr_message_active_limit = 100
qmgr_message_recipient_limit = 100
qmgr_message_recipient_minimum = 10
#-------TIME INTERVALS-------
smtpd_timeout = 5m
smtpd_starttls_timeout = 5m
smtp_mail_timeout = 5m
smtp_rcpt_timeout = 5m
smtp_data_init_timeout = 2m
smtp_data_xfer_timeout = 3m
smtp_data_done_timeout = 10m
maximal_queue_lifetime = 4d
bounce_queue_lifetime = 1h
queue_run_delay = 30m
minimal_backoff_time = 3h
maximal_backoff_time = 5h
max_idle = 60s
#-------REJECT CODES-------
invalid_hostname_reject_code = 550
non_fqdn_reject_code = 550
unknown_address_reject_code = 550
unknown_client_reject_code = 550
unknown_hostname_reject_code = 550
unverified_recipient_reject_code = 550
unverified_sender_reject_code = 550
unknown_local_recipient_reject_code = 550
relay_domains_reject_code=554
unknown_relay_recipient_reject_code=550
unknown_virtual_alias_reject_code=550
unknown_virtual_mailbox_reject_code=550
multi_recipient_bounce_reject_code=550
#-------ClamSMTP & ClamAV-------
content_filter = clamsmtpd:127.0.0.1:10025
receive_override_options = no_address_mappings
#-------NETWORK SETTINGS-------
smtpd_banner = $mydomain ESMTP $mail_name ($mail_version)
smtp_helo_name = $myhostname
mail_name = Qmail
mail_version = 0.0.69
myhostname = mail.mydomain.ru
mydomain = mydomain.ru
myorigin = $mydomain
inet_interfaces = all
mydestination = $myhostname, localhost.$mydomain, localhost.$myhostname, localhost
mynetworks_style = host
mynetworks = 127.0.0.0/24
inet_protocols = ipv4
#-------ENABLE SASL-------
broken_sasl_auth_clients = yes
smtpd_sasl_auth_enable = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = /var/spool/postfix/private/auth
smtpd_sasl_local_domain = $mydomain
smtpd_sasl_security_options = noanonymous
#-------VIRTUAL USERS-------
virtual_transport = dovecot
virtual_mailbox_base = /usr/home/virtualmail
virtual_mailbox_domains = ldap:$config_directory/ldap/virtual_domain.cf
virtual_minimum_uid = 100
virtual_uid_maps = ldap:$config_directory/ldap/virtual_uid.cf
virtual_gid_maps = $virtual_uid_maps
virtual_mailbox_maps = ldap:$config_directory/ldap/virtual_mailbox_recipient.cf
virtual_alias_maps = ldap:$config_directory/ldap/virtual_aliases.cf
mailbox_transport = dovecot
smtpd_sender_login_maps = ldap:$config_directory/ldap/virtual_sender_login.cf
dovecot_destination_recipient_limit = 1
#-------RESTRICTIONS-------
smtpd_etrn_restrictions =
permit_mynetworks,
reject
smtpd_helo_restrictions =
permit_mynetworks,
# check_helo_access hash:/usr/local/etc/postfix/checks/access_helo,
reject_invalid_helo_hostname,
# reject_non_fqdn_helo_hostname,
#reject_unknown_helo_hostname
smtpd_data_restrictions=
permit_mynetworks,
reject_unauth_pipelining,
#?
reject_multi_recipient_bounce
smtpd_sender_restrictions =
permit_mynetworks,
check_sender_access hash:/usr/local/etc/postfix/checks/access_sender,
reject_authenticated_sender_login_mismatch,
reject_sender_login_mismatch,
reject_unauthenticated_sender_login_mismatch,
permit_sasl_authenticated,
reject_unknown_sender_domain,
reject_unlisted_sender,
#reject_unverified_sender,
reject_non_fqdn_sender,
check_sender_access hash:/usr/local/etc/postfix/checks/access_sender
smtpd_recipient_restrictions=
permit_mynetworks,
#check_policy_service inet:127.0.0.1:10023,
reject_non_fqdn_recipient,
reject_unknown_recipient_domain,
reject_unlisted_recipient,
#reject_unverified_recipient,
permit_sasl_authenticated,
reject_unauth_destination,
permit_auth_destination,
check_recipient_access hash:/etc/aliases
smtpd_client_restrictions=
permit_mynetworks,
permit_tls_all_clientcerts,
permit_sasl_authenticated,
check_client_access hash:/usr/local/etc/postfix/checks/access_client,
check_client_access pcre:/usr/local/etc/postfix/checks/access_client.pcre
#-------CHECKS-------
#header_checks=pcre:$config_directory/checks/header_check
#mime_header_checks=pcre:$config_directory/checks/mime_check
Verify в smtpd_*_restrictions уже поотключал.
Грейлистинг также отключил, чтобы избежать лишних отлупов.
Дебаг включен, но ничего кроме строк, что я привел в первом посте не падает в лог при попытке клиента iphone/ipad отправить почту юзеру из своего же домена.
Предполагаю, что принудиловка с TLS должна решить проблему - юзера должны предоставить сертификат и только после этого SASLиться, но не проверял это пока что... Хочу на этапе простого SMTP решить все проблемы и не лезть пока в SMTPS...
