nickdbush commented 6 years ago

Impacted versions

Distribution: Ubuntu
Codename: Bionic Beaver
Arch: 64 Bits
Database: PostgreSQL

Steps to reproduce

Install a fresh copy of modoboa using the installer
Create an identity
Try to send an email from that identity

Full trace using --debug option or current behaviour

NOQUEUE: reject: RCPT from [HOME_IP_ADDRESS]:61079: 550 5.7.1 Service unavailable; client [HOME_IP_ADDRESS] blocked using zen.spamhaus.org

I'm not sure if it could have anything to do with another error in the log: fatal: in parameter smtpd_relay_restrictions or smtpd_recipient_restrictions, specify at least one working instance of: reject_unauth_destination, defer_unauth_destination, reject, defer, defer_if_permit or check_relay_domains

I haven't touched any file on the server since the installer ran. Reinstalled the entire OS once and had the same results.

Expected behavior

The user authenticates properly and the message sends. This works from the webmail dashboard, and fails using any email client (tested with Windows and Thunderbird).

Thanks for making such an amazing tool and I am very much looking forward to resolving these small issues!

nickdbush commented 6 years ago

Possibly related to #205, however I can successfully receive email outside of 127.0.0.1, so I doubt it. Is there a preference order in Postfix that would put a spamcheck above an authorised user?

tonioo commented 6 years ago

@nickdbush How did you configure your email client? The error you pasted should be fixed anyway, can you paste the complete config file somewhere please?

nickdbush commented 6 years ago

/etc/postfix/main.cf (only modification is removing SORBS)

# This file was automatically installed on 2018-09-13T23:53:07.547595
inet_interfaces = all
inet_protocols = ipv4
myhostname = mail.thestudentpress.co.uk
myorigin = $myhostname
mydestination = $myhostname
mynetworks = 127.0.0.0/8
smtpd_banner = $myhostname ESMTP
biff = no
unknown_local_recipient_reject_code = 550
unverified_recipient_reject_code = 550

# appending .domain is the MUA's job.
append_dot_mydomain = no

readme_directory = no

mailbox_size_limit = 0
message_size_limit = 11534336
recipient_delimiter = +

alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases

## Proxy maps
proxy_read_maps =
        proxy:unix:passwd.byname
        proxy:pgsql:/etc/postfix/sql-domains.cf
        proxy:pgsql:/etc/postfix/sql-domain-aliases.cf
        proxy:pgsql:/etc/postfix/sql-aliases.cf
        proxy:pgsql:/etc/postfix/sql-relaydomains.cf
        proxy:pgsql:/etc/postfix/sql-autoreplies-transport.cf
        proxy:pgsql:/etc/postfix/sql-maintain.cf
        proxy:pgsql:/etc/postfix/sql-relay-recipient-verification.cf
        proxy:pgsql:/etc/postfix/sql-sender-login-map.cf
        proxy:pgsql:/etc/postfix/sql-spliteddomains-transport.cf
        proxy:pgsql:/etc/postfix/sql-transport.cf

## TLS settings
#
smtpd_use_tls = yes
smtpd_tls_auth_only = no
smtpd_tls_CApath = /etc/ssl/certs
smtpd_tls_key_file = /etc/letsencrypt/live/[..]/privkey.pem
smtpd_tls_cert_file = /etc/letsencrypt/live/[..]/fullchain.pem
smtpd_tls_dh1024_param_file = ${config_directory}/dh2048.pem
smtpd_tls_loglevel = 1
smtpd_tls_session_cache_database = btree:$data_directory/smtpd_tls_session_cache
smtpd_tls_security_level = may
smtpd_tls_received_header = yes

# Disallow SSLv2 and SSLv3, only accept secure ciphers
smtpd_tls_protocols = !SSLv2, !SSLv3
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
smtpd_tls_mandatory_ciphers = high
smtpd_tls_mandatory_exclude_ciphers = aNULL, MD5 , DES, ADH, RC4, PSD, SRP, 3DES, eNULL
smtpd_tls_exclude_ciphers = aNULL, MD5 , DES, ADH, RC4, PSD, SRP, 3DES, eNULL

# Enable elliptic curve cryptography
smtpd_tls_eecdh_grade = strong

# Use TLS if this is supported by the remote SMTP server, otherwise use plaintext.
smtp_tls_CApath = /etc/ssl/certs
smtp_tls_security_level = may
smtp_tls_loglevel = 1
smtp_tls_exclude_ciphers = EXPORT, LOW

## Virtual transport settings
#
virtual_transport = lmtp:unix:private/dovecot-lmtp

virtual_mailbox_domains = proxy:pgsql:/etc/postfix/sql-domains.cf
virtual_alias_domains = proxy:pgsql:/etc/postfix/sql-domain-aliases.cf
virtual_alias_maps =
        proxy:pgsql:/etc/postfix/sql-aliases.cf

## Relay domains
#
relay_domains =
        proxy:pgsql:/etc/postfix/sql-relaydomains.cf
transport_maps =
    proxy:pgsql:/etc/postfix/sql-transport.cf
        proxy:pgsql:/etc/postfix/sql-spliteddomains-transport.cf
        proxy:pgsql:/etc/postfix/sql-autoreplies-transport.cf

## SASL authentication through Dovecot
#
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
broken_sasl_auth_clients = yes
smtpd_sasl_security_options = noanonymous

## SMTP session policies
#

# We require HELO to check it later
smtpd_helo_required = yes

# We do not let others find out which recipients are valid
disable_vrfy_command = yes

# MTA to MTA communication on Port 25. We expect (!) the other party to
# specify messages as required by RFC 821.
strict_rfc821_envelopes = yes

# Verify cache setup
address_verify_map = proxy:btree:$data_directory/verify_cache

proxy_write_maps =
    $smtp_sasl_auth_cache_name
    $lmtp_sasl_auth_cache_name
    $address_verify_map

# OpenDKIM setup
smtpd_milters = inet:127.0.0.1:12345
non_smtpd_milters = inet:127.0.0.1:12345
milter_default_action = accept
milter_content_timeout = 30s

# List of authorized senders
smtpd_sender_login_maps =
        proxy:pgsql:/etc/postfix/sql-sender-login-map.cf

# Recipient restriction rules
smtpd_recipient_restrictions =
      permit_mynetworks
      permit_sasl_authenticated
      check_recipient_access
          proxy:pgsql:/etc/postfix/sql-maintain.cf
          proxy:pgsql:/etc/postfix/sql-relay-recipient-verification.cf
      reject_unverified_recipient
      reject_unauth_destination
      reject_non_fqdn_sender
      reject_non_fqdn_recipient
      reject_non_fqdn_helo_hostname

## Postcreen settings
#
postscreen_access_list =
       permit_mynetworks
       cidr:/etc/postfix/postscreen_spf_whitelist.cidr
postscreen_blacklist_action = enforce 

# Use some DNSBL
postscreen_dnsbl_sites = 
    zen.spamhaus.org*3 
    bl.spameatingmonkey.net*2 
    dnsbl.habl.org 
    bl.spamcop.net 
postscreen_dnsbl_threshold = 3 
postscreen_dnsbl_action = enforce 

postscreen_greet_banner = Welcome, please wait... 
postscreen_greet_action = enforce

postscreen_pipelining_enable = yes
postscreen_pipelining_action = enforce

postscreen_non_smtp_command_enable = yes
postscreen_non_smtp_command_action = enforce

postscreen_bare_newline_enable = yes
postscreen_bare_newline_action = enforce

nickdbush commented 6 years ago

/etc/postfix/master.cf

# This file was automatically installed on 2018-09-13T23:53:07.548926
#
# Postfix master process configuration file.  For details on the format
# of the file, see the master(5) manual page (command: "man 5 master" or
# on-line: http://www.postfix.org/master.5.html).
#
# Do not forget to execute "postfix reload" after editing this file.
#
# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (yes)   (never) (100)
# ==========================================================================
smtp      inet  n       -       -       -       1       postscreen
smtpd     pass  -       -       -       -       -       smtpd
  -o smtpd_proxy_filter=inet:[127.0.0.1]:10024 
  -o smtpd_proxy_options=speed_adjust
dnsblog   unix  -       -       -       -       0       dnsblog

tlsproxy  unix  -       -       -       -       0       tlsproxy
submission inet n       -       -       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o tls_preempt_cipherlist=yes
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_reject_unlisted_recipient=no
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  -o smtpd_helo_restrictions=
  -o smtpd_sender_restrictions=reject_sender_login_mismatch
  -o smtpd_recipient_restrictions=
  -o milter_macro_daemon_name=ORIGINATING
  -o smtpd_proxy_filter=inet:[127.0.0.1]:10026
#smtps     inet  n       -       -       -       -       smtpd
#  -o syslog_name=postfix/smtps
#  -o smtpd_tls_wrappermode=yes
#  -o smtpd_sasl_auth_enable=yes
#  -o smtpd_reject_unlisted_recipient=no
#  -o smtpd_client_restrictions=$mua_client_restrictions
#  -o smtpd_helo_restrictions=$mua_helo_restrictions
#  -o smtpd_sender_restrictions=$mua_sender_restrictions
#  -o smtpd_recipient_restrictions=
#  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
#  -o milter_macro_daemon_name=ORIGINATING
#628       inet  n       -       -       -       -       qmqpd
pickup    unix  n       -       -       60      1       pickup
cleanup   unix  n       -       -       -       0       cleanup
qmgr      unix  n       -       n       300     1       qmgr
#qmgr     unix  n       -       n       300     1       oqmgr
tlsmgr    unix  -       -       -       1000?   1       tlsmgr
rewrite   unix  -       -       -       -       -       trivial-rewrite
bounce    unix  -       -       -       -       0       bounce
defer     unix  -       -       -       -       0       bounce
trace     unix  -       -       -       -       0       bounce
verify    unix  -       -       -       -       1       verify
flush     unix  n       -       -       1000?   0       flush
proxymap  unix  -       -       n       -       -       proxymap
proxywrite unix -       -       n       -       1       proxymap
smtp      unix  -       -       -       -       -       smtp
relay     unix  -       -       -       -       -       smtp
#       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
showq     unix  n       -       -       -       -       showq
error     unix  -       -       -       -       -       error
retry     unix  -       -       -       -       -       error
discard   unix  -       -       -       -       -       discard
local     unix  -       n       n       -       -       local
virtual   unix  -       n       n       -       -       virtual
lmtp      unix  -       -       -       -       -       lmtp
anvil     unix  -       -       -       -       1       anvil
scache    unix  -       -       -       -       1       scache
#
# ====================================================================
# Interfaces to non-Postfix software. Be sure to examine the manual
# pages of the non-Postfix software to find out what options it wants.
#
# Many of the following services use the Postfix pipe(8) delivery
# agent.  See the pipe(8) man page for information about ${recipient}
# and other message envelope options.
# ====================================================================
#
# maildrop. See the Postfix MAILDROP_README file for details.
# Also specify in main.cf: maildrop_destination_recipient_limit=1
#
maildrop  unix  -       n       n       -       -       pipe
  flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}

uucp      unix  -       n       n       -       -       pipe
  flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
#
# Other external delivery methods.
#
ifmail    unix  -       n       n       -       -       pipe
  flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp     unix  -       n       n       -       -       pipe
  flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
scalemail-backend unix  -   n   n   -   2   pipe
  flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
mailman   unix  -       n       n       -       -       pipe
  flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
  ${nexthop} ${user}

# Modoboa autoreply service
#
autoreply unix        -       n       n       -       -       pipe
  flags= user=vmail:vmail argv=/srv/modoboa/env/bin/python /srv/modoboa/instance/manage.py autoreply $sender $mailbox

# Amavis return path
#
127.0.0.1:10025 inet n    -       n       -       -     smtpd 
        -o content_filter= 
        -o smtpd_authorized_xforward_hosts=127.0.0.0/8 
        -o smtpd_delay_reject=no 
        -o smtpd_client_restrictions=permit_mynetworks,reject 
        -o smtpd_helo_restrictions= 
        -o smtpd_sender_restrictions= 
        -o smtpd_recipient_restrictions=permit_mynetworks,reject 
        -o smtpd_data_restrictions=reject_unauth_pipelining 
        -o smtpd_end_of_data_restrictions= 
        -o smtpd_restriction_classes= 
        -o mynetworks=127.0.0.0/8 
        -o smtpd_error_sleep_time=0 
        -o smtpd_soft_error_limit=1001 
        -o smtpd_hard_error_limit=1000 
        -o smtpd_client_connection_count_limit=0 
        -o smtpd_client_connection_rate_limit=0 
        -o receive_override_options=no_header_body_checks,no_unknown_recipient_checks 
        -o local_header_rewrite_clients=

nickdbush commented 6 years ago

Can send mail from email apps on my phone using mobile data, however my home network is the one that is being blocked from accessing. My IP range is on a blocklist, but that's because it's a residential connection (owned by Plusnet, an ISP).

tonioo commented 6 years ago

Are you using port 587 with authentication for your email client?

nickdbush commented 6 years ago

Yes, 587 with STARTTLS. Having changed that line, and without changing my account settings further, the emails are now sent.

modoboa / modoboa-installer

Desktop client rejected #237

Impacted versions

Steps to reproduce

Full trace using --debug option or current behaviour

Expected behavior