<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=koi8-r">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-weight: 400;" class="elementToProof">Thanks for the reply, postfix + dovecot sasl configured and working properly.
My question is about "adding dovecot authentication when sending emails via submission_host".</span>
<div><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-weight: 400;"><br>
</span></div>
<div class="elementToProof"><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-weight: 400;">Let's say we have dovecot + sieve plugin container.</span></div>
<div><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-weight: 400;">Dovecot configured to use remote SMTP submission host to send messages:</span></div>
<div class="elementToProof"><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-weight: 400;">submission_host = postfix.example.com:587</span></div>
<div class="elementToProof"><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-weight: 400;"><br>
</span></div>
<div><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-weight: 400;">User foo@example.com has the following sieve script:</span></div>
<div><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-weight: 400;">require ["fileinto", "copy", "vacation", "date", "relational"] ;</span></div>
<div><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-weight: 400;">redirect :copy "bar@example.com";</span></div>
<div><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-weight: 400;">keep;</span></div>
<div><br>
</div>
<div class="elementToProof"><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-weight: 400;">baz@example.com sending email to foo@example.com</span></div>
<div><br>
</div>
<div><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-weight: 400;">dovecot lmtp log:</span></div>
<div><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-weight: 400;">lmtp(foo@example.com)<7670><QTsrNZjdxmP2HQAAaVGrHw>: Info: sieve: msgid=<63fce409f26b1a67785a475a00034a05@mail.example.com>:
redirect action: failed to redirect message to <bar@example.com>: smtp(postfix.example.com:587): RCPT TO failed: 554 5.7.1 <bar@example.com>: Recipient address rejected: Access denied (permanent failure)</span></div>
<div><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-weight: 400;">lmtp(foo@example.com)<7670><QTsrNZjdxmP2HQAAaVGrHw>: Info: sieve: msgid=<63fce409f26b1a67785a475a00034a05@mail.example.com>:
stored mail into mailbox 'INBOX'</span></div>
<div><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-weight: 400;">lmtp(foo@example.com)<7670><QTsrNZjdxmP2HQAAaVGrHw>: Info: sieve: Execution of script /var/dovecot/example.com/foo/foo.sieve
failed, but implicit keep was successful (user logfile /var/dovecot/example.com/foo/foo.sieve.log may reveal additional details)</span></div>
<div><br>
</div>
<div><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-weight: 400;">sieve.log</span></div>
<div><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-weight: 400;">error: msgid=<63fce409f26b1a67785a475a00034a05@mail.example.com>: redirect action: failed to
redirect message to <bar@example.com>: smtp(postfix.example.com:587): RCPT TO failed: 554 5.7.1 <bar@example.com>: Recipient address rejected: Access denied (permanent failure).</span></div>
<div><br>
</div>
<div><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-weight: 400;">postfix log:</span></div>
<div><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-weight: 400;">NOQUEUE: reject: RCPT from unknown[10.0.1.4]: 554 5.7.1 <bar@example.com>: Recipient address
rejected: Access denied; from=<baz@example.com> to=<bar@example.com></span></div>
<div><br>
</div>
<div><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-weight: 400;">redirect :copy action failed, its expected behavior, dovecot do not auth when sending email
via submisson_host.</span></div>
<div><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-weight: 400;">If there is setting like</span></div>
<div><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-weight: 400;">submission_host_master_user = master@example.com</span></div>
<div><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-weight: 400;">submission_host_master_password = masterpass</span></div>
<div class="elementToProof"><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-weight: 400;">to do authentication as master user in postfix who can send email as
any user...</span></div>
<div><br class="ContentPasted1">
</div>
<div class="elementToProof"><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"><br>
</span></div>
<div id="appendonsend"></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>От:</b> dovecot <dovecot-bounces@dovecot.org> от имени dovecot@ptld.com <dovecot@ptld.com><br>
<b>Отправлено:</b> 17 января 2023 г. 18:25<br>
<b>Кому:</b> dovecot@dovecot.org <dovecot@dovecot.org><br>
<b>Тема:</b> Re: submission_host auth</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText elementToProof">> When using dovecot container with sieve plugin there is no sendmail to use for sending email for sieve redirect action for example. We can use submission_host instead
<a href="https://doc.dovecot.org/settings/core/#core_setting-submission_host" data-auth="NotApplicable">
https://doc.dovecot.org/settings/core/#core_setting-submission_host</a> but there is no way to specify credentials for auth in remote MTA. Submission_relay_* settings e.g. submission_relay_master_user relate to dovecot submission service. Using something like
permit_mynetworks in remote MTA is not acceptable for security reasons.<br>
> <br>
> Is it possible to add authorization in the remote MTA using submission_host?<br>
<br>
<br>
You start the auth service in dovecot, then tell the MTA to use it.<br>
For example, if you use postfix this explains how:<br>
<br>
<a href="https://doc.dovecot.org/configuration_manual/howto/postfix_and_dovecot_sasl/" data-auth="NotApplicable">
https://doc.dovecot.org/configuration_manual/howto/postfix_and_dovecot_sasl/</a><br>
</div>
</span></font></div>
</body>
</html>