RT 3.0, postfix, wrong outgoing address

Curtis_Rempel · April 3, 2003, 2:59am

I’m testing my new install of RT 3.0 and having a problem with the
outgoing email address.

Instead of it coming from rt@mydomain.com, it is addressed from
apache@mydomain.com

I’ve got the following in my /opt/rt3/etc/RT_SiteConfig.pm file:

Set($CorrespondAddress , ‘rt@mydomain.com’);
Set($CommentAddress , ‘rt-comment@mydomain.com’);

and have restarted httpd but the logs still show that the email going
out after creating a ticket is from apache@mydomain.com

I’ve read the FAQ and searched the archives, but I’m not entirely sure
what is causing this. I am using sendmailpipe as the mail command.

I suppose I could put in a postfix rewrite rule for apache to be rt
instead, but then what about rt-comment? (or is simply mapping apache to
rt sufficient?)

I would have thought that the above two Set commands would do the
trick. What else am I missing?

Thanks,

Curtis

Jorn_Hass · April 3, 2003, 6:52am

This behavior is actually correct. What you see in the maillog file, is the
“envelope” sender, and not the “from:” that you see in the email itself.
When you view the message at the receiving side, it shows up as
rt@.

I think this is actually a security feature of postfix, to always reflect
the correct local sender (the user running apache in this case), rather than
try and take it out of the email itself.

As I do not want people to see this envelope sender, I have used the
sender_canonical function of Postfix, to rewrite all from
httpd@. to rt@, which then makes it look better in the
envelope. This has the side effect that it will also send failures bounces
back to rt@ (unless failures-to has been set) which might not be
what you want, so you might want to rewrite to something other than rt.

I can see that RT sets the reply-to correctly, so unless you have an
absolute braindead mailprogram, there shouldn’t be any problems.

I do see that it does not set “Errors-To:”, which is maybe something that is
needed to prevent the above side effect of failure messages. Any thoughts?

I hope this helps.
Regards, Jörn Hass
Senior Systems Engineer, Infrastructure.
Internet Solutions
Tel: +27 (11) 575 1000
Fax: +27 (11) 388 3362
E-mail: jorn.hass@is.co.za
WWW: http://www.is.co.za http://www.is.co.za-----Original Message-----
From: Curtis Rempel [mailto:curtis@telus.net]
Sent: 03 April 2003 04:59 AM
To: rt-users@lists.fsck.com
Subject: [rt-users] RT 3.0, postfix, wrong outgoing address
[snip to save space]

I suppose I could put in a postfix rewrite rule for apache to be rt instead,
but then what about rt-comment? (or is simply mapping apache to rt
sufficient?)

I would have thought that the above two Set commands would do the trick.
What else am I missing?

Thanks,

Curtis

"This e-mail may contain confidential information and may be legally
privileged and is intended only for the person to whom it is addressed. If
you are not the intended recipient, you are notified that you may not use,
distribute or copy this document in any manner whatsoever. Kindly also
notify the sender immediately by telephone, and delete the e-mail. When
addressed to clients of the company from where this e-mail originates ("the
sending company “) any opinion or advice contained in this e-mail is subject
to the terms and conditions expressed in any applicable terms of business or
client engagement letter . The sending company does not accept liability for
any damage, loss or expense arising from this e-mail and/or from the
accessing of any files attached to this e-mail.”

Kirill_Miazine1 · April 3, 2003, 7:02am

Curtis Rempel wrote:

I’m testing my new install of RT 3.0 and having a problem with the
outgoing email address.

Instead of it coming from rt@mydomain.com, it is addressed from
apache@mydomain.com

I’ve got the following in my /opt/rt3/etc/RT_SiteConfig.pm file:

Set($CorrespondAddress , ‘rt@mydomain.com’);
Set($CommentAddress , ‘rt-comment@mydomain.com’);

and have restarted httpd but the logs still show that the email going
out after creating a ticket is from apache@mydomain.com

I’ve read the FAQ and searched the archives, but I’m not entirely sure
what is causing this. I am using sendmailpipe as the mail command.

I suppose I could put in a postfix rewrite rule for apache to be rt
instead, but then what about rt-comment? (or is simply mapping apache to
rt sufficient?)

I would have thought that the above two Set commands would do the
trick. What else am I missing?

It is in the archives.

You are missing the ‘-f sender’ option when calling sendmail. -f sets
the envelope sender. The envelope sender address is apache@mydomain.com,
the address in From: should be correct, no?

You need to modify you sendmail is called in the following files:

lib/RT/Action/SendEmail.pm (line 181):

 if ( $RT::MailCommand eq 'sendmailpipe' ) {

   my $From = $MIMEObj->head->get('From') =~

     /([\w.-]+\@[a-z0-9][a-z0-9.-]*\.[a-z]+)/i ? "-f '$1'" : undef;
   eval {

       open( MAIL, "|$RT::SendmailPath $From $RT::SendmailArguments" );

       open( MAIL, "|$RT::SendmailPath $RT::SendmailArguments" );
       print MAIL $MIMEObj->as_string;
       close(MAIL);
     };

lib/RT/Interface/Email.pm (line 196):

 if ($RT::MailCommand eq 'sendmailpipe') {

```
   my $From = $args{'From'} =~
```

     /([\w.-]+\@[a-z0-9][a-z0-9.-]*\.[a-z]+)/i ? "-f '$1'" : undef;

   open (MAIL, "|$RT::SendmailPath $From $RT::SendmailArguments") || return(0);

   open (MAIL, "|$RT::SendmailPath $RT::SendmailArguments") || return(0);
   print MAIL $entity->as_string;
   close(MAIL);

}

Kirill Miazine, Stud. Jur.
Faculty of Law, University of Oslo

Kirill_Miazine1 · April 3, 2003, 7:06am

Jorn Hass wrote:

This behavior is actually correct. What you see in the maillog file, is the
“envelope” sender, and not the “from:” that you see in the email itself.
When you view the message at the receiving side, it shows up as
rt@.

I think this is actually a security feature of postfix, to always reflect
the correct local sender (the user running apache in this case), rather than
try and take it out of the email itself.

No. It is not security related at all. Postfix imposes to restrictions
(compared to Exim where you have to allow use of -f explicitly) on who
can use -f to set the envelope sender.

As I do not want people to see this envelope sender, I have used the
sender_canonical function of Postfix, to rewrite all from
httpd@. to rt@, which then makes it look better in the
envelope. This has the side effect that it will also send failures bounces
back to rt@ (unless failures-to has been set) which might not be
what you want, so you might want to rewrite to something other than rt.

That’s a hack.

Kirill Miazine, Stud. Jur.
Faculty of Law, University of Oslo

Curtis_Rempel · April 3, 2003, 2:44pm

This behavior is actually correct. What you see in the maillog file,
is the “envelope” sender, and not the “from:” that you see in the
email itself.

When you view the message at the receiving side, it shows up as
rt@<wherever>.

 

I think this is actually a security feature of postfix, to always
reflect the correct local sender (the user running apache in this
case), rather than try and take it out of the email itself.

 

As I do not want people to see this envelope sender, I have used the
sender_canonical function of Postfix, to rewrite all from
httpd@<host>.<domain> to rt@<domain>, which then makes it look
better in the envelope. This has the side effect that it will also
send failures bounces back to rt@<domain> (unless failures-to has
been set) which might not be what you want, so you might want to
rewrite to something other than rt.

 

I can see that RT sets the reply-to correctly, so unless you have an
absolute braindead mailprogram, there shouldn't be any problems.

 

I do see that it does not set "Errors-To:", which is maybe something
that is needed to prevent the above side effect of failure messages.
Any thoughts?

 

I hope this helps.

Regards, Jörn Hass
Senior Systems Engineer, Infrastructure.
Internet Solutions
Tel:            +27 (11) 575 1000
Fax:            +27 (11) 388 3362
E-mail:         jorn.hass@is.co.za
WWW:            http://www.is.co.za

Thanks for the info. What appears to have been happening is this: all
email is sent/received from an external ISP - I use fetchmail to
populate the mailboxes on the local machine from the ISP. In addition,
the local machine is configured to use the ISP for outgoing SMTP.
Therein was the problem: the ISP validates outgoing email with my domain
and was complaining that apache@mydomain.com was not a valid address.
The fix was to add a bogus email address, apache@mydomain.com, at my ISP
via my account configuration utilities. Once this bogus account was in
place, the ISP was able to validate the outgoing RT email and as you
suggested, the From: lines are indeed correct - it was the Sender line
(apache@mydomain.com) that was tripping on the ISP email validation
logic.

Curtis-----Original Message-----
From: Curtis Rempel [mailto:curtis@telus.net]
Sent: 03 April 2003 04:59 AM
To: rt-users@lists.fsck.com
Subject: [rt-users] RT 3.0, postfix, wrong outgoing address

[snip to save space]


I suppose I could put in a postfix rewrite rule for apache to be rt
instead, but then what about rt-comment? (or is simply mapping
apache to rt sufficient?) 

I would have thought that the above two Set commands would do the
trick.  What else am I missing? 

Thanks, 

Curtis

Vivek_Khera · April 3, 2003, 3:11pm

“CR” == Curtis Rempel curtis@telus.net writes:

CR> I do see that it does not set “Errors-To:”, which is maybe something
CR> that is needed to prevent the above side effect of failure messages.
CR> Any thoughts?

This is a deprecated header, but some older systems still use it. I
guess it is of use. The only people who see the smtp sender are
people unfortunate enough to be forced to use outlook or outlook
express. dumbest programs I ever encountered…