[SOLVED]Install a Relay Mail Host on pfSense (postfix)

dotdash · Mar 23, 2010, 6:46 PM

Easy there, I think he already knows what he is doing is not approved of by all.
There are a few reasons to want an smtp agent on the firewall. Whether they are good reasons is open to debate. I would love to have the ability to email logs or alerts. You also might want to pass smtp traffic from the lan to a relay host, etc. In my opinion, postfix is overkill. There are much simpler (and limited, in a good way) options out there. I can't find my notes, but I would encourage you to look around for something small and secure that does only what you need it to. I remember finding a handful of promising programs from ports or in php.

rkelleyrtp · Mar 23, 2010, 7:31 PM

I have postfix installed and running on a few pfSense machines - mainly so I can get email alerts from monit. My postfix config file only allows connections from localhost.

I think I had to modify the /usr/local/etc/rc.d/postfix script to get it started properly. Here is what my startup script looks like:


#!/bin/sh
#
# $FreeBSD: ports/mail/postfix/files/postfix.sh.in,v 1.6 2007/02/21 05:00:56 rafan Exp $
#
# PROVIDE: postfix mail
# REQUIRE: LOGIN cleanvar
# KEYWORD: shutdown
#
# Add the following lines to /etc/rc.conf to enable postfix:
# postfix_enable (bool):        Set it to "YES" to enable postfix.
#                               Default is "NO".
# postfix_pidfile (path):       Set full path to master.pid.
#                               Default is "/var/spool/postfix/pid/master.pid".
# postfix_procname (command):   Set command that start master. Used to verify if
#                               postfix is running.
#                               Default is "/usr/local/libexec/postfix/master".
# postfix_flags (str):          Flags passed to postfix-script on startup.
#                               Default is "".
#

. /etc/rc.subr

name="postfix"
rcvar=${name}_enable

load_rc_config $name

: ${postfix_enable="YES"}
: ${postfix_pidfile="/var/spool/postfix/pid/master.pid"}
: ${postfix_procname="/usr/local/libexec/postfix/master"}
: ${postfix_flags=""}

start_cmd=${name}_start
stop_cmd=${name}_stop
extra_commands="reload"

pidfile=${postfix_pidfile}
procname=${postfix_procname}

postfix_start() {
        /usr/local/sbin/postfix ${postfix_flags} start
}

postfix_stop() {
        /usr/local/sbin/postfix ${postfix_flags} stop
}

run_rc_command "$1"

Let me know if you need more help.

rkelleyrtp · Mar 23, 2010, 7:34 PM

Forgot to add, here is a thread that describes what is necessary to lock down postfix to only listen to localhost:

http://www.unix.com/ip-networking/87068-configuring-postfix-receive-emails-only-localhost.html

jimp · Mar 23, 2010, 8:56 PM

You do not need a full blown MTA installed to send out e-mail. That is just dangerous and unnecessary.

Check out the code in 2.0 for sending e-mail notifications, it's a relatively small set of PHP code.

dpcma · Mar 23, 2010, 9:29 PM

Hello All,

And first of all many thanks for your answers.

Just to kill your curiousity, as ever, here is the key: "budget" and as easy as it was for kids… that´s the reason I have been required to install and configure a pfsense box, who has to be firewall, proxy, relay mail, and DNS forwarding for unknown hosts. Everybody has to point to a unique address for all services (default gateway, dns, relay etc...) No dhcp is permitted

I know that this is a special case and scared concerning security, and shouldn't be done in a firewall, but customer is customer

Thanks again, I will post if solution is reached with your help.

jimp · Mar 23, 2010, 9:33 PM

Why do you need to 'relay' mail for internal clients?

If you have an external e-mail server to which all mail must be sent, you can use NAT redirects (port forwards) to make that happen no matter what server they are trying to reach.

If you local postfix install is directly contacting other mail servers to send mail, then it's really not helping anyone. It may eventually end up on a blacklist – especially if it's a dynamic IP.

dpcma · Mar 23, 2010, 10:05 PM

rkelleyrtp, I checked my postfix file, and is the same as yours. Telneting the 25 port is unsuccessfull

I found nothing at var/spool/postfix/pid/ , no master.pid file found

How did you installed it? Did you use pkg_add -r ftp://ftp.freebsd.org….

Thanks

rkelleyrtp · Mar 23, 2010, 10:30 PM

Some questions:

What does, "ps aux" give you?
How are you trying to start postfix?
What does your postfix main.cf file have?
How are you trying to connect using telnet? From the local machine or from a machine on your LAN?

rkelleyrtp · Mar 23, 2010, 10:49 PM

@jimp:

You do not need a full blown MTA installed to send out e-mail. That is just dangerous and unnecessary.

Check out the code in 2.0 for sending e-mail notifications, it's a relatively small set of PHP code.

Hey Jim,

I searched high and low for a stripped-down MTA for pfSense 1.2.3-RELEASE and came up empty handed. A few threads on the forum had some ideas but no one ever came up with a good solution (only suggestions). This is why I installed Postfix. Do you have a good suggestion for 1.2.3?

jimp · Mar 23, 2010, 10:56 PM

My suggestion is that you don't use an MTA on pfSense at all under any circumstances :-)

If you want e-mail notifications, there are some PHP modules out there which can just send mail only, not receive.

rkelleyrtp · Mar 23, 2010, 10:59 PM

@jimp:

My suggestion is that you don't use an MTA on pfSense at all under any circumstances :-)

If you want e-mail notifications, there are some PHP modules out there which can just send mail only, not receive.

Cool, can you point me to such PHP modules I can install in 1.2.3-RELEASE? I would be more than happy to install them as I don't need the potential security risks of a full-blown MTA on my firewall. Essentially, I just need to be able to send email from the monit application installed on my firewall(s) to receive alerts, etc.

jimp · Mar 23, 2010, 11:20 PM

I don't know if there is a full-blown sendmail work-alike done in PHP, but someone could use the smtp.inc file from pfSense 2.0 and write a small front-end to it that takes the message and sends it where it needs to go:

http://redmine.pfsense.org/repositories/entry/pfsense/etc/inc/smtp.inc

The whole notification system had a lot of work done in 2.0

You see how the SMTP settings are done here:

http://redmine.pfsense.org/repositories/entry/pfsense/usr/local/www/system_advanced_notifications.php

Not sure how much of that would work on 1.2.3 since it only has PHP 4.x and pfSense 2.0 is on PHP 5.x

You may just have to google around for a PHP sendmail drop-in or work-alike and see what turns up.

Supermule · Mar 24, 2010, 7:59 AM

Sorry for my arrogant attitude…........:(

dpcma · Mar 24, 2010, 8:34 AM

What does, "ps aux" give you?

ps aux does not show anything relaled to postfix…

How are you trying to start postfix?

I made the following from the beginning

1.- pkg_add -r postfix.tbz from (ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-7-stable/Latest/postfix.tbz)
2.- edited /usr/local/etc/rc.d/postfix, just to change :${postfix_enable="YES"}
3.- cp /usr/local/etc/rc.d/postfix /usr/local/etc/rc.d/postfix.sh
4.- Added postfix_enable="YES" into /boot/loader.conf
5.- Reboot

What does your postfix main.cf file have?

I´ve got 2, but i didn´t changed anything yet in those files

/usr/local/etc/postfix/main.cf
/usr/local/etc/libexec/postfix/main.cf

How are you trying to connect using telnet? From the local machine or from a machine on your LAN?

From both (obviously using localhost from pfsense, and LAN interface ip from LAN)

Thanks a lot!!!

dpcma · Mar 24, 2010, 8:53 AM

If i try to stop / start postfix, this is the output


#postfix stop

postfix/postfix-scrcipt: stopping the Postfix mail system
sed: pid/master.pid: No such file or directory
usage: kill [-s signal_name] pid ...
	kill -l [exit_status]
	kill -signal_name pid ...
	kill -signal_number pid ...

/libexec/ld-elf.so.1: /usr/local/libexec/postfix/master: Undefined symbol "close from"
postfix/postfix-script: waiting for the Postfix mail system to terminate

/libexec/ld-elf.so.1: /usr/local/libexec/postfix/master: Undefined symbol "close from"
postfix/postfix-script: waiting for the Postfix mail system to terminate

/libexec/ld-elf.so.1: /usr/local/libexec/postfix/master: Undefined symbol "close from"
postfix/postfix-script: waiting for the Postfix mail system to terminate

/libexec/ld-elf.so.1: /usr/local/libexec/postfix/master: Undefined symbol "close from"
postfix/postfix-script: waiting for the Postfix mail system to terminate

/libexec/ld-elf.so.1: /usr/local/libexec/postfix/master: Undefined symbol "close from"
postfix/postfix-script: waiting for the Postfix mail system to terminate

/libexec/ld-elf.so.1: /usr/local/libexec/postfix/master: Undefined symbol "close from"
postfix/postfix-script: waiting for the Postfix mail system to terminate
postfix/postfix-script: warning: stopping the Postfix mail system with force
awk: can´t open file pid/master.pid
 source line number 1

# postfix start
postfix/postfix-script: fatal: the Postfix mail system is already running

#

dpcma · Mar 24, 2010, 12:25 PM

ok. News.

I installed a fresh postfix on pfSense Box for FreeBSD 7.2 (postfix-current-2.6.20090212,4.tbz)

PostFix is running now (at least 25 port is opened), and ps -aux shows 2 processes running for postfix (pickup and qmgr) but now I got the following message in system log:

postfix/smtpd: fatal open database /etc/aliases.db: No such file or directory

if I search for aliases i found

/etc/aliases (which is a link to mail/aliases) (/etc/mail/ is empty)
/usr/local/etc/postfix/dist/aliases
/usr/local/etc/postfix/aliases

Thanks

rkelleyrtp · Mar 24, 2010, 12:48 PM

Great, you are almost there!

To get the /etc/aliases.db file created, edit the /etc/aliases file and make any necessary changes. For me, I changed the "root: you" to "root: rkelley@abcxyz.com" then ran /usr/local/bin/newaliases to build the /etc/aliases.db file.

Also, getting the /usr/local/postfix/main.cf file tuned properly is very important! Here is what I have in mine:


undisclosed_recipients_header = To:rkelley@abcxyz.com
queue_directory = /var/spool/postfix
command_directory = /usr/local/sbin
daemon_directory = /usr/local/libexec/postfix
data_directory = /var/db/postfix
mail_owner = postfix
myorigin = <domain_name>unknown_local_recipient_reject_code = 550
mynetworks_style = host
relayhost = <pfsense_lan_ip>debug_peer_level = 2
debugger_command =
         PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
         ddd $daemon_directory/$process_name $process_id & sleep 5
sendmail_path = /usr/local/sbin/sendmail
newaliases_path = /usr/local/bin/newaliases
mailq_path = /usr/local/bin/mailq
setgid_group = maildrop
html_directory = no
manpage_directory = /usr/local/man
sample_directory = /usr/local/etc/postfix
readme_directory = no</pfsense_lan_ip></domain_name>

Make sure to put in the correct information for your relayhost, undisclosed_recipients_header, and myorigin. Once done, simply restart postfix and send yourself an email.

Let me know how you make out…

dpcma · Mar 24, 2010, 1:39 PM

Ok. Good News again.

Now I´ve got prompt from the mail server

I made the following

cp /usr/local/etc/postfix/aliases /etc/aliases.db

newaliases

postfix reload

I will keep you informed

dpcma · Mar 24, 2010, 3:36 PM

Ok. Finished.

My pfSense box is able to relay mail to another relay host. After a bit tailoring of main.cf

mynetworks_style=subnet
relaydomains = xyz.com
relayhost = ip.add.re.ss of LAN

Apart of your suggestions relayhost, undisclosed_recipients_header, and myorigin

Thank you very much for you help

rkelleyrtp · Mar 24, 2010, 3:41 PM

No problem, glad to help.

Now that you have installed Postfix , please make sure to lock down your firewall as much as possible…