Override postfix master configuration

[bkraul]

Due to having residential internet service, I use a hassle-free SMTP service to receive mail, called ghetosmtp. I have set up my domain to route all mail sent to my domain through that server. The server in turn, communicates with my inhouse mail server to deliver the mail.

This works on a mail server in a standalone VPS machine I have. However, the mailserver docker install rejects the email as follows:

NOQUEUE: reject: RCPT from in1.ghettosmtp.com[104.237.130.186]: 554 5.7.1 <in1.ghettosmtp.com[104.237.130.186]>: Client host rejected: Access denied; from=<******@*****> to=<****@******> proto=ESMTP helo=<in1.ghettosmtp.com>

I have added the IP 104.237.130.186 to my list of RELAY_NETWORKS. However, this seems to have no effect, even after making sure the IP appears in /etc/postfix/main.cf.

I have been reading that this can be fixed by commenting out the line:

-o smtpd_client_restrictions=permit_sasl_authenticated,reject

in /etc/postfix/master.cf. However, there seems to be no override functionality for items in master.cf, only for main.cf

Anyone have any idea how overcome this issue?

[bkraul]

UPDATE: So, what I ended up doing in the meantime was to override the master.cf file in my volumes section of the compose, and commenting out the smptd_client_restrictions lines as outlined above, and this seems to work. I am just wondering if there is a cleaner method to accomplish this.

[hardware]

Same as #262

The default configuration should works, you should check your client settings, because this is not a relaying issue. Your client seems not sasl authenticated.

[bkraul]

@hardware No, it was not a relaying issue for me, but a client issue, as outlined above. Ultimately I secured a little better by re-adding the IP of my ghettosmtp server to my networks, and modifying the line in master.cf to:

-o smtpd_client_restrictions=permit_sasl_authenticated,permit_mynetworks,reject

That way it is no longer open-ended. The thing with ghettosmtp is that it does not need authentication all it is doing is redirecting mail to my server from the outside on a different port, due to my ISP blocking port 25, so I know to accept it.

Since my issue is mostly resolved, and my oiriginal question had to do with trying to find out if there is a way to override settings in master.cf and there being none, I will go ahead and close my issue. Thanks for the feedback.

[hardware]

The thing with ghettosmtp is that it does not need authentication all it is doing is redirecting mail to my server from the outside on a different port, due to my ISP blocking port 25

I understand now why you must use the submission port.

Since my issue is mostly resolved, and my oiriginal question had to do with trying to find out if there is a way to override settings in master.cf and there being none

You can use a custom master.cf with docker volumes.

volumes:
  - /path/to/your/custom-master.cf:/etc/postfix/master.cf

This method should not breaks anytime soon, but it could happen if I make conflicts changes during container preparation (run.sh), you must keep this in mind.

[bkraul]

Yes, that is what I ended up doing, which is why I asked if there was a way to override master.cf settings in the same way main.cf can be overriden with custom.conf

[hardware]

I asked if there was a way to override master.cf settings in the same way main.cf can be overriden with custom.conf

Currently it is not possible, but you can implement that with postconf -P :

With -P, edit the master.cf configuration file, and add or
update one or more service parameter settings (-o parame-
ter=value settings) with new values as specified with "ser-
vice/type/parameter=value" on the postconf(1) command line.

http://www.postfix.org/postconf.1.html

Example :

postconf -P "submission/inet/permit_sasl_authenticated,permit_mynetworks,reject"

You can make all pull request if you want. Your script can parse a custom-master.conf with this format :

# /mnt/docker/mail/postfix/custom-master.conf

M|submission inet n       -       -       -       -       smtpd
P|submission/inet/smtpd_tls_security_level=may
P|submission/inet/smtpd_tls_ciphers=medium
P|submission/inet/smtpd_client_restrictions=permit_sasl_authenticated,permit_mynetworks,reject

Each lines starting with M (service) go through postconf -M and each lines with P (parameter) go through postconf -P. The value being obtained by splitting the line with the character |.

It's just an example, but it should work.

Example with main.cf :

mailserver/rootfs/usr/local/bin/run.sh

Lines 280 to 292 in 570e3b7

	# POSTFIX CUSTOM CONFIG
	# ---------------------------------------------------------------------------------------------
	# Override Postfix configuration
	if [ -f /var/mail/postfix/custom.conf ]; then
	# Ignore blank lines and comments
	sed -e '/^\s*$/d' -e '/^#/d' /var/mail/postfix/custom.conf | \
	while read line; do
	echo "[INFO] Override : ${line}"
	postconf -e "$line"
	done
	echo "[INFO] Custom Postfix configuration file loaded"
	fi

[hardware]

@bkraul do you plan to implement this feature and make a pull request ?

[bkraul]

@hardware while I am relatively familiar with postconf and bash scripting, I am still learning in terms of working with docker image configuration and scripting, so I don't think I'd be quite able to provide a good PR for this.