Why is my postfix an open relay?

My network has one Linux (Mandrake 9.2) server and a few workstations
running various OSes. The LAN is 192.168.0.x and the connection to
the Internet is through ADSL (currently dialing from one of the
Windows workstations and sharing through WinGate).

I installed postfix on the Linux server and configured it to receive
mail from outside to local recipients, plus allow local users to
send to the outside world, or at least I thought that is what I was
doing.

During a test run, I was discovered by a spammer who started relaying
junk mail through me.

I checked and rechecked my configuration, read the fine manual, searched
the mailing list archives, and used an open relay test, and still,
things don't behave as I expect.

In essence, I want local Linux users to be able to send anything, so
I defined this (domain and host name changed to protect the not-so-
innocent):
mydomain = johnj.homeip.net
myhostname = fw.johnj.homeip.net
mynetworks = 192.168.0.0/24, 127.0.0.0/24
smtpd_client_restrictions = permit_mynetworks

and I want outsiders to only be able to send to local Linux users,
so I defined this:
smtpd_recipient_restrictions = reject_unauth_pipelining,
permit_mynetworks, reject

Can anyone point to to my error?

==== my postfix configuration:
$ postconf -n
alias_database = hash:/etc/postfix/aliases
alias_maps = hash:/etc/postfix/aliases
bounce_size_limit = 5000
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/lib/postfix
debug_peer_level = 2
default_destination_concurrency_limit = 6
default_destination_recipient_limit = 30
default_process_limit = 30
delay_warning_time = 3
deliver_lock_delay = 2s
disable_vrfy_command = yes
fork_delay = 2s
in_flow_delay = 10s
initial_destination_concurrency = 4
luser_relay = johnj
mail_spool_directory = /var/spool/mail
mailbox_command = /usr/bin/procmail -Y -a $DOMAIN
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
mydestination = $myhostname, localhost.$mydomain, $mydomain
mydomain = johnj.homeip.net
myhostname = fw.johnj.homeip.net
mynetworks = 192.168.0.0/24, 127.0.0.0/24
mynetworks_style = host
myorigin = $mydomain
newaliases_path = /usr/bin/newaliases.postfix
qmgr_message_active_limit = 10000
readme_directory = /usr/share/doc/postfix-2.0.13/README_FILES
sample_directory = /usr/share/doc/postfix-2.0.13/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtp_destination_concurrency_limit = 6
smtpd_client_restrictions = permit_mynetworks
smtpd_error_sleep_time = 2s
smtpd_hard_error_limit = 5
smtpd_recipient_limit = 30
smtpd_recipient_restrictions = reject_unauth_pipelining,
permit_mynetworks, reject
smtpd_soft_error_limit = 2
unknown_local_recipient_reject_code = 450


==== open relay test results:
$ telnet relay-test.mail-abuse.org
Trying 168.61.4.13...
Connected to relay-test.mail-abuse.org (168.61.4.13).
Escape character is '^]'.
Connecting to ***.***.***.*** ...
<<< 220 fw.johnj.homeip.net ESMTP Postfix
>>> HELO cygnus.mail-abuse.org
<<< 250 fw.johnj.homeip.net
:Relay test: #Quote test
>>> mail from: <spamtest@DSL***-***-***-***.bb.netvision.net.il>
<<< 250 Ok
>>> rcpt to: <"nobody@mail-abuse.org">
<<< 250 Ok
>>> rset
<<< 250 Ok
:Relay test: #Test 1
>>> mail from: <nobody@mail-abuse.org>
<<< 250 Ok
>>> rcpt to: <nobody@mail-abuse.org>
<<< 250 Ok
>>> QUIT
<<< 221 Bye
Tested host banner: 220 fw.johnj.homeip.net ESMTP Postfix
System appeared to accept 1 relay attempts
Connection closed by foreign host.


Can this me related to another postfix problem I've been having?
My log is filled with lines like the following, and I have no clue
how to fix this:

Jan 8 04:02:01 fw kernel: grsec: attempted resource overstep by
requesting 3608952648 for RLIMIT_FSIZE against limit 10240000 by
(postdrop:8606) uid/euid:0/0 gid/egid:0/105, parent (sendmail:8605)
uid/euid:0/0 gid/egid:0/0
Jan 8 04:02:01 fw kernel: grsec: more alerts, logging disabled for 10
seconds

On Fri, 09 Jan 2004 10:37:50 -0800, Nobody wrote:

> My network has one Linux (Mandrake 9.2) server and a few workstations
> running various OSes. The LAN is 192.168.0.x and the connection to
> the Internet is through ADSL (currently dialing from one of the
> Windows workstations and sharing through WinGate).
>
> I installed postfix on the Linux server and configured it to receive
> mail from outside to local recipients, plus allow local users to
> send to the outside world, or at least I thought that is what I was
> doing.
>
> During a test run, I was discovered by a spammer who started relaying
> junk mail through me.
>
> I checked and rechecked my configuration, read the fine manual, searched
> the mailing list archives, and used an open relay test, and still,
> things don't behave as I expect.
>
> In essence, I want local Linux users to be able to send anything, so
> I defined this (domain and host name changed to protect the not-so-
> innocent):
> mydomain = johnj.homeip.net
> myhostname = fw.johnj.homeip.net
> mynetworks = 192.168.0.0/24, 127.0.0.0/24
> smtpd_client_restrictions = permit_mynetworks
>
> and I want outsiders to only be able to send to local Linux users,
> so I defined this:
> smtpd_recipient_restrictions = reject_unauth_pipelining,
> permit_mynetworks, reject
>
> Can anyone point to to my error?
>
> ==== my postfix configuration:
> $ postconf -n
> alias_database = hash:/etc/postfix/aliases
> alias_maps = hash:/etc/postfix/aliases
> bounce_size_limit = 5000
> command_directory = /usr/sbin
> config_directory = /etc/postfix
> daemon_directory = /usr/lib/postfix
> debug_peer_level = 2
> default_destination_concurrency_limit = 6
> default_destination_recipient_limit = 30
> default_process_limit = 30
> delay_warning_time = 3
> deliver_lock_delay = 2s
> disable_vrfy_command = yes
> fork_delay = 2s
> in_flow_delay = 10s
> initial_destination_concurrency = 4
> luser_relay = johnj
> mail_spool_directory = /var/spool/mail
> mailbox_command = /usr/bin/procmail -Y -a $DOMAIN
> mailq_path = /usr/bin/mailq.postfix
> manpage_directory = /usr/share/man
> mydestination = $myhostname, localhost.$mydomain, $mydomain
> mydomain = johnj.homeip.net
> myhostname = fw.johnj.homeip.net
> mynetworks = 192.168.0.0/24, 127.0.0.0/24
> mynetworks_style = host
> myorigin = $mydomain
> newaliases_path = /usr/bin/newaliases.postfix
> qmgr_message_active_limit = 10000
> readme_directory = /usr/share/doc/postfix-2.0.13/README_FILES
> sample_directory = /usr/share/doc/postfix-2.0.13/samples
> sendmail_path = /usr/sbin/sendmail.postfix
> setgid_group = postdrop
> smtp_destination_concurrency_limit = 6
> smtpd_client_restrictions = permit_mynetworks
> smtpd_error_sleep_time = 2s
> smtpd_hard_error_limit = 5
> smtpd_recipient_limit = 30
> smtpd_recipient_restrictions = reject_unauth_pipelining,
> permit_mynetworks, reject
> smtpd_soft_error_limit = 2
> unknown_local_recipient_reject_code = 450
>
>
> ==== open relay test results:
> $ telnet relay-test.mail-abuse.org
> Trying 168.61.4.13...
> Connected to relay-test.mail-abuse.org (168.61.4.13).
> Escape character is '^]'.
> Connecting to ***.***.***.*** ...
> <<< 220 fw.johnj.homeip.net ESMTP Postfix
> >>> HELO cygnus.mail-abuse.org
> <<< 250 fw.johnj.homeip.net
> :Relay test: #Quote test
> >>> mail from: <spamtest@DSL***-***-***-***.bb.netvision.net.il>
> <<< 250 Ok
> >>> rcpt to: <"nobody@mail-abuse.org">
> <<< 250 Ok
> >>> rset
> <<< 250 Ok
> :Relay test: #Test 1
> >>> mail from: <nobody@mail-abuse.org>
> <<< 250 Ok
> >>> rcpt to: <nobody@mail-abuse.org>
> <<< 250 Ok
> >>> QUIT
> <<< 221 Bye
> Tested host banner: 220 fw.johnj.homeip.net ESMTP Postfix
> System appeared to accept 1 relay attempts
> Connection closed by foreign host.
>
>
> Can this me related to another postfix problem I've been having?
> My log is filled with lines like the following, and I have no clue
> how to fix this:
>
> Jan 8 04:02:01 fw kernel: grsec: attempted resource overstep by
> requesting 3608952648 for RLIMIT_FSIZE against limit 10240000 by
> (postdrop:8606) uid/euid:0/0 gid/egid:0/105, parent (sendmail:8605)
> uid/euid:0/0 gid/egid:0/0
> Jan 8 04:02:01 fw kernel: grsec: more alerts, logging disabled for 10
> seconds

I not too sure, but try removing 127.0.0.1/24 from
mynetworks = 192.168.0.0/24, 127.0.0.0/24

I don't have it in my configuration, and everything works fine.

--
/ maxx
/ ----@------------
/ maxxware.com

> I not too sure, but try removing 127.0.0.1/24 from
> mynetworks = 192.168.0.0/24, 127.0.0.0/24
>
> I don't have it in my configuration, and everything works fine.
You want to deny relaying mails from localhost?

maxx wrote:

> I not too sure, but try removing 127.0.0.1/24 from
> mynetworks = 192.168.0.0/24, 127.0.0.0/24
>
> I don't have it in my configuration, and everything works fine.

This doesn't make much sense, but I tried it anyway. It didn't help.
Relaying still works for the whole world, even with
mynetworks = 192.168.0.0/24

I also thought being behind a NAT could have something to do with
it so I added this:
proxy_interfaces = 192.168.0.4

to be extra sure, I stoopped postfix and restarted it completely
for each test.

The problem is still there. My postfix is an open relay and I can't
open my firewall before I resolve this... :(

>
> Can this me related to another postfix problem I've been having?
> My log is filled with lines like the following, and I have no clue
> how to fix this:
>
> Jan 8 04:02:01 fw kernel: grsec: attempted resource overstep by
> requesting 3608952648 for RLIMIT_FSIZE against limit 10240000 by
> (postdrop:8606) uid/euid:0/0 gid/egid:0/105, parent (sendmail:8605)
> uid/euid:0/0 gid/egid:0/0
> Jan 8 04:02:01 fw kernel: grsec: more alerts, logging disabled for 10
> seconds

Can it be a bug of your postfix?
What version?