SMTP Relay - virtual domain

Discussion in 'Server Operation' started by KamilKrK, Oct 22, 2019.

Tags:
  1. KamilKrK

    KamilKrK New Member

    Hello for the first time

    He started with a difficult topic right away from me.

    I need help configuring SMTP Relay to work like the SMTP_Relay.JPG schema.
    I mean exactly that it would be possible to configure SMTP Relay in such a way that depending on what e-mail address will get the message redirected to the appropriate mail server and account. However, I take into account that if you can't do the rule on the email address only on the domain then you will have to do it.
    Additionally, for one of the mechanisms it needs authorization.
    This is a strange case because the program tells you to enter the login and password for the SMTP service so that you can save the settings, but unfortunately it does not work with the O365 service, therefore in this case it also needs SMTP Relay.
    Mechanism description:
    1. A message is sent to SMTP Relay from mail address @ domain1.com. SMTP Relay recognizes the email address @ domain1.com and knows that it should route this message to the GMAIL mail server at 123 @ gmail.com.
    2. A message is sent to SMTP Relay from the address mail1 @ domain2.com. Authorization to SMTP Relay is done via login and password and is sent on port 587/465. SMTP Relay recognizes the address mail1 @ domain2.com and knows that it is to forward this message to the O365 mail server to the address mail1 @ ourdomain.com.
    3. A message is sent to SMTP Relay from mail2 @ domain2.com. SMTP Relay recognizes the address mail2 @ domain2.com and knows that it is to forward this message to the GMAIL mail server to address 456 @ gmail.com.
    4. A message is sent to SMTP Relay from mail address @ domain3.com. SMTP Relay recognizes the email address @ domain3.com and knows that it is to forward this message to the O365 mail server to the address mail2 @ outdomain.com.
    5. A message is sent to SMTP Relay from the address @ domain4.com. SMTP Relay recognizes the mail address @ domain4.com and knows that it is to forward this message to the O365 mail server to mail2 @ outdomain.com.

    [​IMG]
    [​IMG]

    In each of the above cases, SMTP Relay is authorized with accounts (O365, GMAIL) by login and password and the appropriate port.

    I tried solving the virtual domain but unfortunately it didn't work for some reason.

    Has anyone tried to extend SMTP Relay to the above requirements and is it even possible?

    Please help.
     
  2. KamilKrK

    KamilKrK New Member

    Ubuntu 18 version and postfix program .
    Unfortunately, I couldn't do it that way .
    Below is all the configuration I've done .

    /etc/postfix/main . cf

    # default relayhost setting
    relayhost = [smtp . gmail . com]:587

    # sender-dependent sasl authentication
    smtp_sender_dependent_authentication = yes
    sender_dependent_relayhost_maps = hash:/etc/postfix/sender_relay

    # smtp authentication settings
    smtp_use_tls = yes
    #smtp_sasl_auth_enable = yes
    smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
    smtp_sasl_security_options = noanonymous
    smtp_tls_security_level = encrypt
    smtp_tls_CAfile = /etc/ssl/certs/ca-certificates . crt
    smtp_sasl_mechanism_filter = plain

    /etc/postfix/sasl_passwd

    # per-sender authentication
    vcenter@mydomain . local account2@gmail . com:password
    icinga@mydomain . local account1@gmail . com:password
    upc@mydomain . local account2@gmail . com:password
    apc@mydomain . local account3@gmail . com:password

    # default relayhost
    [smtp . gmail . com]:587 account1@gmail . com:password

    /etc/postfix/sender_relay

    #GMAIL
    account1@gmail . com [smtp . gmail . com]:587
    account2@gmail . com [smtp . gmail . com]:587
    account3@gmail . com [smtp . gmail . com]:587

    Until then, everything is working properly and I can send messages from different addresses to different gmail addresses .
    Now I want to add an additional configuration under O365 and here the problem begins .
    I added such lines:

    /etc/postfix/main . cf
    # Configure for O365
    smtp_generic_maps = hash:/etc/postfix/generic
    smtp_sasl_tls_security_options = noanonymous
    smtp_always_send_ehlo = yes

    /etc/postfix/sasl_passwd
    O365@mydomain . local accountO365@mydomain . com:password

    /etc/postfix/sender_relay
    accountO365@mydomain . com [smtp . office365 . com]:587

    /etc/postfix/generic
    O365@mydomain . local accountO365@mydomain . com


    What combinations would I not try, I am not able to run two relayhost to gmail and O365 simultaneously .

    How do I add an entry to
    # default relayhost setting
    relayhost = [smtp . gmail . com]: 587
    relayhost = [smtp . office365 . com]: 587
    This gets the message:
    postfix: warning: /etc/postfix/main . cf, line 55: overriding earlier entry: relayhost = [smtp . gmail . com]: 587

    However, if I leave only relayhost = [smtp . gmail . com]: 587 then messages that were to go to O365 ida on gmail .

    So the question is whether it can be done at all and if so what I am doing wrong .
     
  3. Steini86

    Steini86 Active Member

    Have not done it myself, but it looks like your are searching for this postfix option:
    smtp_sender_dependent_authentication = yes
    sender_dependent_relayhost_maps

    http://www.postfix.org/postconf.5.html#sender_dependent_relayhost_maps

    [edit]
    Sorry, I have seen your are already using it. But it seems not correctly implemented. You have to add your o365 lines to the same sender_relay file than the gmail ones (or specify both), just with the different address. There can only be one "default" relay host.
    "A sender-dependent override for the global relayhost parameter setting. The tables are searched by the envelope sender address and @domain. A lookup result of DUNNO terminates the search without overriding the global relayhost parameter setting"

    Otherwise your post is to complicated to me. Post your config files with the settings you want to have and show what is not working. To see why postfix is not doing what you want, use http://www.postfix.org/DEBUG_README.html
     
    Last edited: Nov 13, 2019
    KamilKrK likes this.
  4. KamilKrK

    KamilKrK New Member

    I did something like this and it still doesn't work .

    /etc/postfix/Main . cf
    mynetworks = 127 . 0 . 0 . 0/8, [ : : ffff : 127 . 0 . 0 . 0]/104, [ : : 1]/128, 192 . 168 . 1 . 0/24,
    mydestination = $myhostname, smtprelay, localhost . localdomain, , localhost, localhost . o365 . local, localhost . gmail . local
    # default relayhost setting
    relayhost = [smtp . gmail . com] : 587
    # sender-dependent sasl authentication
    smtp_sender_dependent_authentication = yes
    sender_dependent_relayhost_maps = hash : /etc/postfix/sender_relay
    # smtp authentication settings
    smtp_use_tls = yes
    smtp_sasl_auth_enable = yes
    smtp_sasl_password_maps = hash : /etc/postfix/sasl_passwd
    smtp_sasl_security_options = noanonymous
    smtp_tls_security_level = encrypt
    smtp_tls_CAfile = /etc/ssl/certs/ca-certificates . crt
    smtp_sasl_mechanism_filter = plain
    transport_maps = hash : /etc/postfix/transport
    --------------------------------------------------------------------------------------------------------------------------
    /etc/postfix/sasl_passwd
    gmail@gmail . local account1@gmail . com : Start321!
    o365@o365 . local account1@mydomain . com : Start321!
    ------------------------------------------------------------------------------------------------------------------------
    /etc/postfix/sender_relay
    account1@gmail . com [smtp . gmail . com] : 587
    account1@mydomain . com [smtp . office365 . com] : 587
    ----------------------------------------------------------------------------------------------------------------------
    /etc/postfix/transport
    gmail . local smtp : [smtp . gmail . com] : 587
    o365 . local smtp : [smtp . office365 . com] : 587

    At this time, only sending from gmail@gmail . local works and for O365 there is such an error :

    321D0100A34 : from=<o365@o365 . local>, size=422, nrcpt=1 (queue active)
    Nov 14 10 : 30 : 51 smtprelay postfix/smtp[6261] : 321D0100A34 : SASL authentication failed; server smtp . gmail . com[173 . 194 . 73 . 108] said : 535-5 . 7 . 8 Username and Password not accepted . Learn more at?535 5 . 7 . 8 https : //support . google . com/mail/?p=BadCredentials i22sm2015187ljg . 94 - gsmtp
    Nov 14 10 : 30 : 51 smtprelay postfix/smtp[6261] : connect to smtp . gmail . com[2a00 : 1450 : 4010 : c0d : : 6d] : 587 : Network is unreachable
    Nov 14 10 : 30 : 51 smtprelay postfix/smtp[6261] : 321D0100A34 : to=<myemail@mydomain . com>, relay=none, delay=0 . 43, delays=0 . 07/0/0 . 36/0, dsn=4 . 4 . 1, status=deferred (connect to smtp . gmail . com[2a00 : 1450 : 4010 : c0d : : 6d] : 587 : Network is unreachable)

    After hashing the entry #relayhost = [smtp . gmail . com] : 587 in main . cf, nothing works and every message wants to come out via O365 but he fails .

    Nov 14 10 : 16 : 08 smtprelay postfix/qmgr[5995] : 31D7F100A34 : from=<o365@o365 . local>, size=422, nrcpt=1 (queue active)
    Nov 14 10 : 16 : 38 smtprelay postfix/smtp[6013] : connect to xxx . mail . protection . outlook . com[104 . 47 . 1 . 36] : 25 : Connection timed out

    Nov 14 10 : 15 : 00 smtprelay postfix/qmgr[5995] : 560EF100A34 : from=<gmail@gmail . local>, size=437, nrcpt=1 (queue active)
    Nov 14 10 : 15 : 30 smtprelay postfix/smtp[6013] : connect to xxx . mail . protection . outlook . com[104 . 47 . 0 . 36] : 25 : Connection timed out

    What's wrong with the configuration?
     
  5. Steini86

    Steini86 Active Member

    Looks like it is trying to connect to gmail, not o365.
    Does this help? https://secopsmonkey.com/mail-relaying-postfix-through-office-365.html

    It is connecting to port 25, not 587 ?!
     
  6. KamilKrK

    KamilKrK New Member

    Hello,

    Thank you for your answer.
    In the first case it is as you wrote. So he is trying to authorize gmail via o365 account. But you will notice the message is sent from [email protected] and should be redirected to the server smtp.office365.com and not to smtp.gmail.com. So it doesn't look at the settings in the transport file at all.

    In the second case, it is strange because it does not matter if I send from the address gmail.com or o365.local it is always redirected to the address smtp.office365.com, which means that it does not pay attention to the settings in the trasport file and tries to connect on port 25 which is blocked for this service we get a time out message. As you can see in the configuration files, port 587 is everywhere.
     
  7. Steini86

    Steini86 Active Member

  8. KamilKrK

    KamilKrK New Member

    The final configuration where accounts for gmail and O365 work on one posftix.

    /etc/posftix/main.cf
    # default relayhost setting
    relayhost = [smtp.gmail.com]:587

    # sender-dependent sasl authentication
    smtp_sender_dependent_authentication = yes
    sender_dependent_relayhost_maps = hash:/etc/postfix/sender_relay

    # smtp authentication settings
    smtp_use_tls = yes
    smtp_sasl_auth_enable = yes
    smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
    smtp_sasl_security_options = noanonymous
    smtp_tls_security_level = encrypt
    smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
    smtp_generic_maps = hash:/etc/postfix/generic
    transport_maps = hash:/etc/postfix/transport

    /etc/postfix/sasl_passwd
    # default relayhost
    [smtp.gmail.com]:587 [email protected]:password
    #Gmail per-sender authentication
    [email protected] [email protected]:password
    # O365 per-sender authentication
    [email protected] [email protected]:password

    /etc/posftix/transport
    [email protected] smtp:[smtp.gmail.com]:587
    [email protected] smtp:[smtp.office365.com]:587

    /etc/postfix/sender relay
    [email protected] [smtp.gmail.com]:587
    [email protected] [smtp.office365.com]:587
     
    Steini86 likes this.
  9. Steini86

    Steini86 Active Member

    Thanks a lot for posting the working configratoin as reference for other users. Not many do this!
    nb: you can use the [ code ] tags to show this as a sourcecode. The forum software will then stop converting to smilies .. :rolleyes:
     

Share This Page