Postfix "mynetworks" for unauthenticated sending

[digerata]

We currently have an application on our grid that runs postfix as an SMTP server. All of our other applications use this for sending emails.

To avoid postfix running as an open relay, I've configured it to only accept authenticated users. This worked fine when we had only two applications on AppLogic. Now that we have grown with dozens of applications, creating accounts for each app is a PITA. And, if you can believe, we have a few apps that don't support authenticated SMTP and thus can't send email!

I've started to look into allowing applications access based on IP range. I added our grid's external IP's to the mynetworks option in postfix. I quickly learned that this doesn't actually work because every sender that connects to postfix has the IP address of our IN appliance: 10.40.46.1. And now I'm stumped.

Does anyone have any ideas how how to make this work?

Thanks!

-Mike

[PeterNic]

Mike,

Have you considered adding the IP addresses to the allowed_hosts property of the IN/INSSL gateway rather than the postfix mynetworks?

The drawback is that you have to restart the MTA application when you change the set of allowed IPs. Of course, if that becomes an issue, it would be quite simple to branch the IN gateway and have it access a volume or nfs/cifs-connected filesystems on which you put the latest and greatest IP set.

(we also use postfix for our mta and it works like a champ)

A lesser alternative is to use a private non-routable IP range between your applications.

Does this help?

Regards,
-- Peter

[digerata]

I hadn't considered doing it at the IN gateway instead. Is that the method you guys use for yours? (not quite clear from your comment) I'll try that method.

Thanks!

[PeterNic]

I hadn't considered doing it at the IN gateway instead.

That's the AppLogic way -- let each appliance deal with its own responsibilities :)

Is that the method you guys use for yours? (not quite clear from your comment)

Yes -- sorry, it was not clear from my post -- our MTA uses IP filtering provided by the IN gateway. (Actually, we use INSSLR so that we can run two MTAs - primary and backup on a single IP address with automatic failover and failback).

Let me know if this worked for you (it should).

Best,
-- Peter