Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have installed psad on my Ubuntu 13 system and I've set it up to send emails (I have postfix installed as mail server with a smtp relay to Mandrill's servers) to some email address, but it seems like what it sends it's not compliant with mandrill's filters.

This would be an API call that reaches mandrill:

{
    "from_email": null,
    "from_name": null,
    "send_at": null,
    "async": false,
    "raw_message": "Received: from pulsr.io (unknown [95.85.35.223])\n\t(Authenticated sender: MY_MANDRILL_API_KEY@gmail.com)\n\tby ip-10-75-135-250 (Postfix) with ESMTPSA id C030E3C0CF4\n\tfor <rolandjitsu@gmail.com>; Mon, 14 Apr 2014 15:10:27 +0000 (UTC)\nReceived: by pulsr.io (Postfix, from userid 0)\n\tid 7E42B61753; Mon, 14 Apr 2014 11:10:27 -0400 (EDT)\nSubject: [psad-status] firewall setup warning on pulsr!\nTo: <rolandjitsu@gmail.com>\nX-Mailer: mail (GNU Mailutils 2.99.98)\nMessage-Id: <20140414151027.7E42B61753@pulsr.io>\nDate: Mon, 14 Apr 2014 11:10:27 -0400 (EDT)\nFrom: root@pulsr (root)\n\n[-] You may just need to add a default logging rule to the /sbin/ip6tables\n    'filter' 'INPUT' chain on pulsr.  For more information,\n    see the file \"FW_HELP\" in the psad sources directory or visit:\n\n    http://www.cipherdyne.org/psad/docs/fwconfig.html\n",
    "ip_pool": null,
    "to": [
        "rolandjitsu@gmail.com"
    ],
    "return_path_domain": null,
    "key": "MY_MANDRILL_API_KEY"
}

And they would respond with:

[
    {
        "email": "rolandjitsu@gmail.com",
        "status": "rejected",
        "_id": "a8c60b80ad3745e48398516bea7ca768",
        "reject_reason": "invalid-sender"
    }
]

It must be something with the raw_message string, since other emails that succeed have the same null values on the properties, but with a different raw_message.

An example of working email would be:

{
    "async": false,
    "send_at": null,
    "ip_pool": null,
    "from_name": null,
    "to": [
        "rolandjitsu@gmail.com"
    ],
    "return_path_domain": null,
    "raw_message": "Received: from pulsr.io (unknown [95.85.35.223])\n\t(Authenticated sender: MY_MANDRILL_API_KEY@gmail.com)\n\tby ip-10-33-35-82 (Postfix) with ESMTPSA id 894FE2031D\n\tfor <rolandjitsu@gmail.com>; Mon, 14 Apr 2014 12:52:04 +0000 (UTC)\nReceived: by pulsr.io (Postfix, from userid 0)\n\tid 51038608D5; Mon, 14 Apr 2014 08:52:04 -0400 (EDT)\nFrom: Pulsr <root@pulsr.io>\nSubject: RKHunter\nTo: <rolandjitsu@gmail.com>\nX-Mailer: mail (GNU Mailutils 2.99.98)\nMessage-Id: <20140414125204.51038608D5@pulsr.io>\nDate: Mon, 14 Apr 2014 08:52:04 -0400 (EDT)\n\nPlease inspect this machine, because it may be infected.",
    "from_email": null,
    "key": "MY_MANDRILL_API_KEY"
}

With the response:

[
    {
        "email": "rolandjitsu@gmail.com",
        "status": "sent",
        "_id": "ab8df939be544023a8afb77be5a1e7a8",
        "reject_reason": null
    }
]

I've been trying for two days now to figure out what is going on but I have no clue. A little help would be great, if anyone encountered the same issue before (maybe with Google's SMTP as relay).

EDIT: My Postfix /etc/postfix/main.conf file:

# RFC requirement
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)

# Local user mail notification off
biff = yes

# appending .domain is the MUA's job.
append_dot_mydomain = no

readme_directory = no

# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination

# Hostname
myhostname = pulsr.io

# Domain
mydomain = pulsr.io

#virtual_alias_maps = hash:/etc/postfix/virtual
#virtual_alias_domains = /etc/postfix/vhosts.txt

alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases

mydestination = pulsr localhost.pulsr.io localhost
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +

inet_interfaces = all
inet_protocols = all

# Mandrill
relayhost = [smtp.mandrillapp.com]
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_CAfile = /etc/postfix/cacert.pem
smtp_use_tls = yes

# Add Missing Headers
always_add_missing_headers = yes
share|improve this question

2 Answers 2

Mandrill requires that your From email address have a fully qualified domain. So, root@mydomain.com is accepted, but root@myhost or just root without a domain is not. You might be able to have postfix automatically fix your mail by changing the myhostname or myorigin main.cf values to include your full domain.

share|improve this answer
    
I've tried something like that before with Postfix, I'll try it again –  rolandjitsu Apr 14 at 16:18
    
I have just tried that without luck. I'll post my config file too, perhaps I'm doing it wrong. –  rolandjitsu Apr 14 at 16:35
up vote 0 down vote accepted

I have fixed it by changing my machine hostname to a valid FQDN hostname inside /etc/hostname.

Before:

pulsr

Now:

pulsr.io

It seems like postfix was not responsible at all for that, psad or the mta that psad uses is using the hostname of the machine. I would have expected to be handled by postfix at all times.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.