Exim4 relay not permitted

[DrunkenFreak]

Hey,
hab bei mir exim4 mit vexim laufen. Die Benutzer werden über MySQL erstellt und verwaltet. Jetzt ist der Server neugestartet worden (ist nen vserver) und exim nimmt keine mails mehr an. Ich erhalte beim Senden einer mail an exim von gmx eine Fehlermail in der steht:


Hi. This is the qmail-send program at mail.gmx.net.
I'm afraid I wasn't able to deliver your message to the following addresses.
This is a permanent error; I've given up. Sorry it didn't work out.

<user@domain.org>:
213.131.241.43_does_not_like_recipient./Remote_host_said:_550_relay_not_permitted/Giving_up_on_213.131.241.43./

--- Below this line is a copy of the message.

Return-Path: <bla@gmx.de>
Received: (qmail invoked by alias); 12 Nov 2005 18:16:01 -0000
Received: from dyndsl.xxxxx.ewe-ip-backbone.de (EHLO [192.168.178.20]) [85.16.0.181]
by mail.gmx.net (mp035) with SMTP; 12 Nov 2005 19:16:01 +0100
X-Authenticated: #14053946
Message-ID: <43763162.4020808@gmx.de>
Date: Sat, 12 Nov 2005 19:16:02 +0100
From: "bla@gmx.de" <bla@gmx.de>
User-Agent: Mozilla Thunderbird 1.0.7 (X11/20051110)
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: user@domain.org
Subject: bla
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Y-GMX-Trusted: 0

Die mail ist reproduzierbar von jedem Host aus außer vom localhost des Systems. Ich vermute den Fehler in der exim4.conf. Allerdings hab ich sie schon neu gemacht (wieder nach www.debianhowto.de).

Hat noch jemand eine Idee dazu?

so long

[Roger Wilco]

Vermutlich stimmt der Query in VIRTUAL_DOMAINS bzw. in der Domainliste local_domains nicht. Schau dazu mal in deine Logfiles oder gehe den SMTP-Dialog mit `exim -bh 213.165.64.100` durch.

[DrunkenFreak]

Er holt sich die Daten richtig aus MySQL raus. Jedenfalls stimmen die beiden Zeilen wohl.


VIRTUAL_DOMAINS = SELECT DISTINCT domain FROM domains WHERE type = 'local' AND enabled = '1' AND domain = '${quote_mysql:$domain}'
RELAY_DOMAINS = SELECT DISTINCT domain FROM domains WHERE type = 'relay' AND domain = '${quote_mysql:$domain}'
ALIAS_DOMAINS = SELECT DISTINCT alias FROM domainalias WHERE alias = '${quote_mysql:$domain}'

und
domainlist local_domains = @ : ${lookup mysql{VIRTUAL_DOMAINS}} : ${lookup mysql{ALIAS_DOMAINS}}
domainlist relay_to_domains = ${lookup mysql{RELAY_DOMAINS}}
hostlist relay_from_hosts = localhost

Die passende Domain ist in dem Feld drin, das oben gesucht wird. Die Ausgabe von exim4 -bh 213.165.64.100 ist:


**** SMTP testing session as if from host 213.165.64.100
**** but without any ident (RFC 1413) callback.
**** This is not for real!

>>> host in hosts_connection_nolog? no (option unset)
>>> host in host_lookup? yes (matched "*")
>>> looking up host name for 213.165.64.100
>>> IP address lookup yielded mx0.gmx.de
>>> alias mx0.gmx.net
>>> gethostbyname2 looked up these IP addresses:
>>> name=mx0.gmx.de address=213.165.64.100
>>> checking addresses for mx0.gmx.de
>>> 213.165.64.100 OK
>>> gethostbyname2 looked up these IP addresses:
>>> name=mx0.gmx.net address=213.165.64.100
>>> checking addresses for mx0.gmx.net
>>> 213.165.64.100 OK
>>> host in host_reject_connection? no (option unset)
>>> host in sender_unqualified_hosts? no (option unset)
>>> host in recipient_unqualified_hosts? no (option unset)
>>> host in helo_verify_hosts? no (option unset)
>>> host in helo_try_verify_hosts? no (option unset)
>>> host in helo_accept_junk_hosts? no (option unset
220 domain.org ESMTP Exim 4.50 Sun, 13 Nov 2005 12:14:09 +0100

Konnte den Fehler immer noch nicht finden.

so long

[Roger Wilco]

Die passende Domain ist in dem Feld drin, das oben gesucht wird. Die Ausgabe von exim4 -bh 213.165.64.100 ist: [...]
Das Ding ist interaktiv. Du solltest dann den SMTP-Dialog mal händisch durchgehen.

Hier mal ein Beispiel von meinem Exim:

**** SMTP testing session as if from host 213.165.64.100
**** but without any ident (RFC 1413) callback.
**** This is not for real!

>>> host in hosts_connection_nolog? no (option unset)
>>> host in host_lookup? yes (matched "*")
>>> looking up host name for 213.165.64.100
>>> IP address lookup yielded mx0.gmx.de
>>> alias mx0.gmx.net
>>> gethostbyname2 looked up these IP addresses:
>>> name=mx0.gmx.de address=213.165.64.100
>>> checking addresses for mx0.gmx.de
>>> 213.165.64.100 OK
>>> gethostbyname2 looked up these IP addresses:
>>> name=mx0.gmx.net address=213.165.64.100
>>> checking addresses for mx0.gmx.net
>>> 213.165.64.100 OK
>>> host in host_reject_connection? no (option unset)
>>> host in sender_unqualified_hosts? no (option unset)
>>> host in recipient_unqualified_hosts? no (option unset)
>>> host in helo_verify_hosts? no (option unset)
>>> host in helo_try_verify_hosts? no (option unset)
>>> host in helo_accept_junk_hosts? no (option unset)
220 example.org ESMTP Exim 4.54 Sun, 13 Nov 2005 13:22:42 +0100
ehlo there
>>> using ACL "acl_check_helo"
>>> processing "accept"
>>> check hosts = :
>>> host in ":"? no (end of list)
>>> accept: condition test failed
>>> processing "accept"
>>> check hosts = +relay_from_hosts
>>> gethostbyname2 looked up these IP addresses:
>>> name=localhost address=127.0.0.1
>>> host in "localhost"? no (end of list)
>>> host in "+relay_from_hosts"? no (end of list)
>>> accept: condition test failed
>>> processing "drop"
>>> check condition = ${if match{$sender_helo_name}{123.123.123.123}{yes}{no} }
>>> = no
>>> drop: condition test failed
>>> processing "drop"
>>> check condition = ${if match{$sender_helo_name}{^[0-9]\.[0-9]\.[0-9]\.[0-9]}{yes}{no} }
>>> = no
>>> drop: condition test failed
>>> processing "accept"
>>> accept: condition test succeeded
>>> host in pipelining_advertise_hosts? yes (matched "*")
>>> host in auth_advertise_hosts? yes (matched "*")
>>> host in tls_advertise_hosts? yes (matched "*")
250-example.org Hello mx0.gmx.de [213.165.64.100]
250-SIZE 52428800
250-PIPELINING
250-AUTH PLAIN LOGIN CRAM-MD5
250-STARTTLS
250 HELP
mail from:bla@gmx.de
250 OK
rcpt to:benutzername@example.org
>>> using ACL "acl_check_rcpt"
>>> processing "accept"
>>> check hosts = :
>>> host in ":"? no (end of list)
>>> accept: condition test failed
>>> processing "deny"
>>> check sender_domains = +local_domains
>>> gmx.de in "@ : example.org : "? no (end of list)
>>> gmx.de in "+local_domains"? no (end of list)
>>> deny: condition test failed
>>> processing "accept"
>>> check domains = +local_domains
>>> example.org in "@ : example.org : "? yes (matched "@")
>>> example.org in "+local_domains"? yes (matched "+local_domains")
>>> check verify = recipient/callout=random,5s
>>> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
>>> routing benutzername@example.org
>>> example.org in "@ : example.org : "? yes (matched "@")
>>> example.org in "! +local_domains"? no (matched "! +local_domains")
>>> calling system_aliases router
>>> system_aliases router declined for benutzername@example.org
>>> calling virtual_domains router
>>> virtual_domains router declined for benutzername@example.org
>>> calling virtual_domain_alias router
>>> virtual_domain_alias router declined for benutzername@example.org
>>> example.org in "@ : example.org : "? yes (matched "@")
>>> example.org in "+local_domains"? yes (matched "+local_domains")
>>> calling cyrus_domains router
>>> routed by cyrus_domains router
>>> local host found for non-MX address
>>> fully qualified name = localhost
>>> gethostbyname2 looked up these IP addresses:
>>> name=localhost address=127.0.0.1
>>> Attempting full verification using callout
>>> ... callout omitted by default when host testing
>>> (Use -bhc if you want the callouts to happen.)
>>> ----------- end verify ------------
>>> accept: condition test succeeded
250 Accepted
quit

**** SMTP testing: that is not a real message id!

221 example.org closing connection
"ehlo there", "mail from", "rcpt to" und "quit" sind dabei die Eingaben, die du selbst tätigen mußt.

[DrunkenFreak]

Damit ist schon mal klar, dass MySQL schuld ist. Bei rcpt to:user@domain.org kommt:


>>> check domains = +local_domains
LOG: failed to expand "@ : ${lookup mysql{SELECT DISTINCT domain FROM domains WHERE type = 'local' AND enabled = '1' AND domain = '${quote_mysql:$domain}'}} : ${lookup mysql{SELECT DISTINCT alias FROM domainalias WHERE alias = '${quote_mysql:$domain}'}}" while checking a list: lookup of "SELECT DISTINCT domain FROM domains WHERE type = 'local' AND enabled = '1' AND domain = 'domain.org'" gave DEFER: MYSQL connection failed: Can't connect to local MySQL server through socket '/var/run/mysqld/mysql.sock' (2)
>>> domain.org in "+local_domains"? lookup deferred for +local_domains
>>> accept: condition test deferred
451 Temporary local problem - please try later
LOG: H=mx0.gmx.net (there) [213.165.64.100] F=<bla@gmx.de> temporarily rejected RCPT user@domain.org: MYSQL connection failed: Can't connect to local MySQL server through socket '/var/run/mysqld/mysql.sock' (2)



$ ls -l /var/run/mysqld/mysqld.sock

srwxrwxrwx 1 mysql mysql 0 2005-11-12 14:15 /var/run/mysqld/mysqld.sock

Also der Socket existiert wohl aber er kann darauf nicht verbinden. Nur da haperts dann bei mir.

so long

Edit: Wahrscheinlich Fehler gefunden. Das 'd' bei mysqld.sock fehlte in der exim4.conf. Hab es nicht bemerkt wegen autocompletion

Edit2: Naja das interaktive Ding funktioniert nun. Leider kann ich immer noch keine Emails empfangen oder senden. Fehler ist der gleiche wie oben

[Roger Wilco]

Edit2: Naja das interaktive Ding funktioniert nun. Leider kann ich immer noch keine Emails empfangen oder senden. Fehler ist der gleiche wie oben
Hast du Exim nach der Änderung der Konfiguration auch neu gestartet? Wenn die Fake-Session funktioniert, sollte es auch mit dem normalen Daemon funktionieren.

[DrunkenFreak]

Whoops...
Hab da was beim Test vertauscht. Mit rcpt to:user@domain.org (also die domain des Servers) klappte es natürlich. Mit rcpt to:bla@gmx.de klappte es nicht. Immer noch realy not permitted:


mail from:user@domain.org
250 OK
rcpt to:bla@gmx.de
>>> using ACL "acl_check_rcpt"
>>> processing "accept"
>>> check hosts = :
>>> host in ":"? no (end of list)
>>> accept: condition test failed
>>> processing "deny"
>>> check local_parts = ^.*[@%!/|] : ^\\.
>>> bla in "^.*[@%!/|] : ^\."? no (end of list)
>>> deny: condition test failed
>>> processing "accept"
>>> check local_parts = postmaster
>>> bla in "postmaster"? no (end of list)
>>> accept: condition test failed
>>> processing "accept"
>>> check domains = +local_domains
>>> gmx.de in "@ : : "? no (end of list)
>>> gmx.de in "+local_domains"? no (end of list)
>>> accept: condition test failed
>>> processing "accept"
>>> check domains = +relay_to_domains
>>> gmx.de in ""? no (end of list)
>>> gmx.de in "+relay_to_domains"? no (end of list)
>>> accept: condition test failed
>>> processing "accept"
>>> check hosts = +relay_from_hosts
>>> host in "+relay_from_hosts"? no (end of list)
>>> accept: condition test failed
>>> processing "accept"
>>> check authenticated = *
>>> accept: condition test failed
>>> processing "deny"
>>> deny: condition test succeeded
550 relay not permitted
LOG: H=mx0.gmx.de (there) [213.165.64.100] F=<user@domain.org> rejected RCPT bl
a@gmx.de: relay not permitted


so long

[Roger Wilco]

Mit rcpt to:bla@gmx.de klappte es nicht. Immer noch realy not permitted
Das soll auch so sein, sonst hättest du ein offenes Relay am Netz. Probiers mal, nachdem du dich mit SMTP-Auth an deinem Exim angemeldet hast. :rolleyes:

[DrunkenFreak]

Das sollte auch ne Spamschleuder werden *rausred* :ugly:

Aber smtp-Auth ist doch nur für das versenden zuständig oder?
Ich kann ja auch keine Emails empfangen. Es kommt dann bei Sender der Fehler zurück, dass relay not permitted ist (war grad zu Faul ums grammatisch richtig ins deutsche zu übersetzen). Da muss ja wohl irgendwas immer noch nicht richtig stimmen. Mails von localhost aus zu senden klappt ja auch und was anderes ist das exim -bh .... doch auch nicht oder?

so long