Configuring postfix on Mountain Lion Server

Question

Level 1

143 points

Configuring postfix on Mountain Lion Server

I'm trying to upgrade from Snow Leopard Server to Mountain Lion Server and did an install of Mountain Lion Server on top of a working instance of Snow Leopard Server. The "crippled" GUI on Mountain Lion Server is forcing me into using terminal to configure Postfix to handle incoming email.

I would like to configure Postfix to only accept email that is forwarded from a gmail business account. The public email address is john.doe@public.com which is received by Google Mail, goes through their spam filters and then is auto-forwarded to incoming@nonpublic.com

The server WAN domain is nonpublic.com The ip address is 96.231.165.126

The server LAN is nonpublic.local The ip address is 10.6.18.201

The server is a MacMini running Mountain Lion Server 10.6.8 hostname server so the FQDN is server.public.com.

The network on the MacMini is configured to handle both LAN and WAN traffic through the 1GB physical ethernet port which plugs into a CISCO 3750 switch. The external traffic to the WAN flows through the switch as tagged packets. The LAN traffic is not tagged. The VLAN connection is running 802.1q

When an email is sent through the WAN to john.doe@public.com the Postfix SMTP log shows:

Jun 7 19:29:22 server.public.com postfix/smtpd[42181]: connect from cisco.public.com[96.231.165.123]

Jun 7 19:29:22 server.public.com postfix/smtpd[42181]: disconnect from cisco.public.com[96.231.165.123]

I can send emails from a client on the LAN through this server with no problems. The incoming mail server can connect to the machine via the Cisco router/switch but Postfix just shows "cisco" as the connection (that's the router's DNS name) and provides no more info. I suspect Postfix possibly doesn't like the 802.1q connection and drops the SMTP request to connect on port 25.

I have turned on "debug" logging in Postfix, but that is all that appears in the SMTP log file

I've spent most of the week reading through everything I can find on how to install and configure postfix on Mountain Lion Server and work around the cripled GUI in the "server" application. I'm barely OK using Terminal and not familiar at all with configuring Postfix directling editing the config file.

What is the best approach to configure Postfix to allow SMTP connections from the outside to deliver incoming email that is forwarded from gmail.com?

I did find an "aliases" file in /etc/postfix/aliases but I'm not sure how to add the aliases and if adding aliases with a text editor is going to cause the "server" app problems and if the changes will be lost when the machine is restarted.

Any help would be appreciated.

Mac mini, OS X Mountain Lion (10.8.2), Mountain Lion Server

Posted on Jun 7, 2013 4:50 PM

Reply

Answer 1

Linc Davis

Level 10

209,547 points

Jun 7, 2013 5:30 PM in response to Paul Derby

Maybe I don't understand what you're trying to do, but why don't you set up a task with either fetchmail or mpop to retrieve the mail using POP and then serve it on your network from dovecot?

Reply

Answer 2

etresoft

Level 8

46,312 points

Jun 7, 2013 6:07 PM in response to Paul Derby

I have asked the hosts to move your post to the server forum. I can configure my own email servers but I'm clueless about Server.

Reply

Answer 3

Paul Derby Author

Level 1

143 points

Jun 7, 2013 6:14 PM in response to Linc Davis

We need to capture and archive email and to have email sync across multiple devices. Do iMap is preferable than POP. We have POP disabled.

We have email account set up for each individual on the server. Mail gets sent with a "reply to" for the external email address which is tied to Google Apps. The MX record for the "reply to" is Google's email server. When the email hits Google's server, it is forwarded (minus all the spam) to the user's internal server email account, archived on that server, Users can use their iPad, iPhone, Android or whatever with iMap to retrieve, delete, send and all the emails are synced on all the devices.

My post was to figure out how to get postfix to accept the incoming email that Google sends to our server. It was trivial with Snow Leopard Server. Mountain Lion Server is a pain to deal with using the SERVER gui.

I'm not looking for alternative ways to handle our email. Just advice on how to configure postfix to accept incoming email only from google and block all other email senders.

Reply

Answer 4

Jun 8, 2013 5:33 AM in response to Paul Derby

Post the output of a postconf -n command as a starting point. Expurgate your domain(s) to example.com, example.net, etc if you prefer, but please be careful to keep the host names consistent.

I do not prefer to use .local as the server domain and would strongly recommend against that, particularly when mixing DNS and mDNS. Use a subdomain of your real and registered domain, or use a separate registered domain for your internal stuff.

On your server, you can verify local DNS with the diagnostic, no-changes-will-be-made sudo changeip -checkhostname command at the Terminal.app prompt — that'll tell you local DNS is correct, or that changes are required. And again, I'd get out of .local for your LAN DNS for at least your server.

That cisco.public.com resolution is presumably your gateway's external IP address.

If that external IP address is not been expurgated, then the associated external mail server DNS configuration for your "private" domain is incorrect; the reverse DNS for that host is not going to match the MX record for the domain, and that mismatch cause other mail servers to reject mail to and from your mail server. There is nothing you can do about that with your servers other than correcting your DNS, as this is detected and enforced by other mail servers as an anti-spam measure. Bad or mismatched DNS is presumed to be a spam engine, so no matter how much you want to hide that domain, you're still going to be subject to the anti-spam features of the SMTP servers that will be connecting to that mail server.

There's also nothing you can do about the spam engines, they don't care about DNS and will efficiently find and try to spam your mail server, or relay through it.

Reply

Answer 5

Paul Derby Author

Level 1

143 points

Jun 8, 2013 6:07 AM in response to MrHoffman

MrHoffman, thank you for your response to my challenge to get the new test server working. This is a migration from Snow Leopard Server to Mountain Lion Server.

Here is the "checkhostname" test results:

blue:~ admin$ sudo changeip -checkhostname

Password:

Primary address = 96.231.165.211

Current HostName = blue.pderby.com

DNS HostName = blue.pderby.com

The names match. There is nothing to change.

dirserv:success = "success"

blue:~ admin$

Here is the response from postconf -n

blue:~ admin$ postconf -n

biff = no

command_directory = /usr/sbin

config_directory = /etc/postfix

daemon_directory = /usr/libexec/postfix

data_directory = /var/lib/postfix

debug_peer_level = 2

debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin xxgdb $daemon_directory/$process_name $process_id & sleep 5

dovecot_destination_recipient_limit = 1

html_directory = /usr/share/doc/postfix/html

imap_submit_cred_file = /Library/Server/Mail/Config/postfix/submit.cred

inet_interfaces = loopback-only

inet_protocols = all

mail_owner = _postfix

mailbox_size_limit = 0

mailq_path = /usr/bin/mailq

manpage_directory = /usr/share/man

message_size_limit = 10485760

mydomain_fallback = localhost

newaliases_path = /usr/bin/newaliases

queue_directory = /Library/Server/Mail/Data/spool

readme_directory = /usr/share/doc/postfix

recipient_delimiter = +

sample_directory = /usr/share/doc/postfix/examples

sendmail_path = /usr/sbin/sendmail

setgid_group = _postdrop

smtpd_tls_ciphers = medium

smtpd_tls_exclude_ciphers = SSLv2, aNULL, ADH, eNULL

tls_random_source = dev:/dev/urandom

unknown_local_recipient_reject_code = 550

use_sacl_cache = yes

blue:~ admin$

I agree that I should change the LAN domain from .local to something like .internal or whatever. I've been running with .local for 5 years on snow leopard server and never had any problems so that was a low priority.

I hope I'm just not seeing some obvious setting in main.cf

Reply

Answer 6

Paul Derby Author

Level 1

143 points

Jun 8, 2013 9:21 AM in response to MrHoffman

I think I know what the problem might be. In SYSTEM PREFERENCES / NETWORK the network connections are listed in service order.

On the Snow Leopard Server the network service order was ETHERNET followed by VLAN2, a configuration that works.

On the Mountain Lion Server the network service order was VLAN2 followed by ETHERNET, a configuration that accepts local email but not email from the WAN.

When I installed Mountain Lion Server I didn't pay any attention to the order of the services.

When MrHoffman suggested I run CHECKHOSTNAME that was a clue. Even though the names matched, the names should have been the LAN IP address and the LAN name, not the WAN address and name.

So I moved the service order with ETHERNET at the top and vlan2 second using the "set service order" under the gear icon in PREFERENCES NETWORK

With that change, the SERVER app reported that the host name had changed.

That explains why the only entry I would see in the POSTFIX log was "CISCO" the DNS name of my router. The connection should have been coming directly to the Mac Mini through its IP address instead of being routed through the LAN's CISCO router.

So now email traffic seems to be flowing into the machine just fine. Now the problem I'm facing is redoing open directory so the mail can get to the user. With the change in the primary hostname and IP address all the pointers in open directory are messed up. The Server APP has a workflow to correct this problem for the ETHERNET side of the network, but isn't aware of the VLAN network service.

I just spent the better part of this week trying to debug a POSTFIX config file that was just fine.

Reply

Answer 7

Jun 8, 2013 12:30 PM in response to Paul Derby

FWIW, I prefer to avoid running a server as an expensive and fairly clumsy IP router. That can work, but it's more of a hassle than I'd prefer, and it's way too easy to end up with 'net-facing open ports due to a software install or software reconfiguration. Much prefer to use a dedicated gateway box, and preferably with an embedded VPN server to allow the VPN connections to avoid traversing NAT.

Reply

Answer 8

Paul Derby Author

Level 1

143 points

Jun 8, 2013 1:38 PM in response to MrHoffman

I agree. We don't run the Mountain Lion server email and web server box as a router. The two network connections give access from either the WAN or the LAN for those with access credentials, but the box doesn't route and NAT is not enabled. The only services available to the outside are those that are intended on a handful of ports.

We do routing with CISCO routers running IOS that support VPNs and take care of NAT

Thanks for you help.

Reply