search

schweikert / postgrey

Postfix Greylisting Policy-Daemon
https://postgrey.schweikert.ch/
GNU General Public License v2.0
162 stars 47 forks source link

Postgrey with exim greylists outgoing emails #70

Open plutocrat opened 5 years ago

plutocrat commented 5 years ago

Hi, Having used postgrey before when I was using postfix, I wanted to try to get it going on a client's exim-based server. I followed the instructions here. https://github.com/schweikert/postgrey/blob/master/README.exim

First of all, a suggestion. On my server the postgrey installation used a URL+port socket. The correct way to represent this in exim is readsocket{inet:127.0.0.1:10023}. Might be handy to mention this.

OK, so now, having got the config working, I left my server running overnight and saw all the expected greylist entries in /var/log/exim4/mainlog. Great. However, when I tried to send out an email from my email client, using the server as my SMTP server, I found out it was greylisting outgoing emails! My email would be rejected with a greylisting message in Thunderbird, then allowed when I tried again a few minutes later. This process was repeated each time I had a different recipient. 

2019-01-19 16:47:59 H=([10.11.10.11]) [123.45.56.67] X=TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128 CV=no F=<my@email.com> A=dovecot_plain:my@email.com temporarily rejected RCPT <email1@externalhost.com>: greylisted host 123.45.56.67
2019-01-19 16:55:52 H=([10.11.10.11]) [123.45.56.67] X=TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128 CV=no F=<my@email.com> A=dovecot_plain:my@email.com temporarily rejected RCPT <email2@otherhost.com>: greylisted host 123.45.56.67

So obviously this isn't the intended behaviour. Greylisting should only happen on incoming emails, surely? Any way of making this happen? I initially thought I could use the Whitelist file, but the host 123.45.56.67 is my external IP address, which changes every so often, not the IP address of the mail server running exim.

fleish commented 5 years ago

I'm not familiar with exim, but this sounds like an MTA issue vs. an issue with postgrey. If you are submitting all messages processed by exim regardless of if they are incoming our outgoing, you could perhaps use postgrey's whitelist feature to skip your internal IP address blocks. Otherwise, I would recommend looking into how to keep exim from submitting outgoing messages to postgrey completely.

plutocrat commented 5 years ago

Yeah, I was looking at the whitelisting approach, but the host IP will change, so I'd have to add it to the whitelist each time that happened. I've been looking around at other approaches. The one on the Exim wiki uses this line to accept all authenticated users. That might be a useful addition to this acl? accept authenticated = *