[opensuse] Postfix/dovecot - allow relay from phone - How?? - openSUSE Users

[opensuse] Postfix/dovecot - allow relay from phone - How??

David C. Rankin

6 Oct 2011 6 Oct '11

23:02

Sandy, All, I'm having fits getting postfix and dovecot to allow relay of mail from my phone. I've followed the auth_tls howto's carefully and I'm still stumped. What I've got for configuration is : smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, check_client_access hash:/etc/postfix/client_access, reject_unauth_destination smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth smtpd_sasl_auth_enable = yes broken_sasl_auth_clients = yes #smtpd_sasl_security_options = noanonymous smtpd_sasl_security_options = noanonymous, noplaintext smtpd_sasl_tls_security_options = noanonymous smtpd_tls_auth_only = yes For dovecot I have: auth_mechanisms = plain login passdb { driver = pam } passdb { driver = pam } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } ssl_cert = http://www.spamhaus.org/query/bl?ip=166.205.10.236; from= to= proto=ESMTP helo=<[10.16.59.185]> Oct 3 16:27:28 nirvana postfix/smtpd[16604]: disconnect from unknown[166.205.10.236] From TLS my server knows it's me (i.e. from=) and it is killing the relay. That's where I'm stuck. Anybody else got this ironed out?? Sandy, where am I messing up? -- David C. Rankin, J.D.,P.E. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Show replies by date

Wolfgang Rosenauer

7 Oct 7 Oct

06:01

Hi, Am 07.10.2011 01:02, schrieb David C. Rankin:

...

The error I get is basically:

Oct 3 16:27:27 nirvana postfix/smtpd[16604]: connect from unknown[166.205.10.236] Oct 3 16:27:28 nirvana postfix/smtpd[16604]: NOQUEUE: reject: RCPT from unknown[166.205.10.236]: 554 5.7.1 Service unavailable; Client host [166.205.10.236] blocked using zen.spamhaus.org; http://www.spamhaus.org/query/bl?ip=166.205.10.236; from= to= proto=ESMTP helo=<[10.16.59.185]> Oct 3 16:27:28 nirvana postfix/smtpd[16604]: disconnect from unknown[166.205.10.236]

From TLS my server knows it's me (i.e. from=) and it is killing the relay. That's where I'm stuck. Anybody else got this ironed out??

Not sure if your configuration is correct so far but the spamhaus reject is configured in some other smtpd_*_restrictions. Likely in smtpd_client_restrictions what's evaluated before the recipient restrictions. Since you haven't posted the other restriction setting I can only guess that you need to add permit_sasl_authenticated before the reject_rbl_client zen.spamhaus.org. Wolfgang -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Per Jessen

06:40

Wolfgang Rosenauer wrote:

...

Hi,

Am 07.10.2011 01:02, schrieb David C. Rankin:

...
The error I get is basically:

Oct 3 16:27:27 nirvana postfix/smtpd[16604]: connect from unknown[166.205.10.236] Oct 3 16:27:28 nirvana postfix/smtpd[16604]: NOQUEUE: reject: RCPT from unknown[166.205.10.236]: 554 5.7.1 Service unavailable; Client host [166.205.10.236] blocked using zen.spamhaus.org; http://www.spamhaus.org/query/bl?ip=166.205.10.236; from= to= proto=ESMTP helo=<[10.16.59.185]> Oct 3 16:27:28 nirvana postfix/smtpd[16604]: disconnect from unknown[166.205.10.236]

From TLS my server knows it's me (i.e. from=) and it is killing the relay. That's where I'm stuck. Anybody else got this ironed out??

Not sure if your configuration is correct so far but the spamhaus reject is configured in some other smtpd_*_restrictions. Likely in smtpd_client_restrictions what's evaluated before the recipient restrictions. Since you haven't posted the other restriction setting I can only guess that you need to add permit_sasl_authenticated before the reject_rbl_client zen.spamhaus.org.

That would work, but why even bother with an rbl check for this kind of traffic? Set up a separate smtpd on port 587. -- Per Jessen, Zürich (9.7°C) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

David C. Rankin

16:13

On 10/07/2011 01:40 AM, Per Jessen wrote:

...

That would work, but why even bother with an rbl check for this kind of traffic? Set up a separate smtpd on port 587.

Wolfgang, Per - Thank you! I'll have time Sunday to give it a go. -- David C. Rankin, J.D.,P.E. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

David C. Rankin

24 Oct 24 Oct

19:22

On 10/07/2011 01:40 AM, Per Jessen wrote:

...

Wolfgang Rosenauer wrote:

...
Hi,

Am 07.10.2011 01:02, schrieb David C. Rankin:

...
The error I get is basically:

Oct 3 16:27:27 nirvana postfix/smtpd[16604]: connect from unknown[166.205.10.236] Oct 3 16:27:28 nirvana postfix/smtpd[16604]: NOQUEUE: reject: RCPT from unknown[166.205.10.236]: 554 5.7.1 Service unavailable; Client host [166.205.10.236] blocked using zen.spamhaus.org; http://www.spamhaus.org/query/bl?ip=166.205.10.236; from= to= proto=ESMTP helo=<[10.16.59.185]> Oct 3 16:27:28 nirvana postfix/smtpd[16604]: disconnect from unknown[166.205.10.236]

From TLS my server knows it's me (i.e. from=) and it is killing the relay. That's where I'm stuck. Anybody else got this ironed out??

Not sure if your configuration is correct so far but the spamhaus reject is configured in some other smtpd_*_restrictions. Likely in smtpd_client_restrictions what's evaluated before the recipient restrictions. Since you haven't posted the other restriction setting I can only guess that you need to add permit_sasl_authenticated before the reject_rbl_client zen.spamhaus.org.

That would work, but why even bother with an rbl check for this kind of traffic? Set up a separate smtpd on port 587.

Per, Wolfgang, All.. I'm just getting back to this issue. I am trying to get the idea of having the iphone submit on port 587 sorted out if that is what I need to do to be able to relay across my server when not connected to the LAN. Are you talking about enabling a second port with: smtp inet n - n - - smtpd 587 inet n - n - - smtpd in master.cf as referenced in: http://www.howtoforge.com/forums/archive/index.php/t-4788.html I have seen two different references. One giving the suggestion above, and the other simply uncommenting the 'submission' line in master.cf to enable submission on port 587. What I don't want to do is mess up my port 25 normal operations. That's the part I don't have sorted yet. The "what do I need to do to enable relay from the phone (on whatever port) and not mess up the normal server operations for the rest of the mail?" Why the second port anyway? Can't I just configure postfix to authenticate me from my phone and just send using port 25? There may very well be valid reason that configuring on port 587 is better and the way to go, but that's what I'm trying to figure out... I've tried adding the permit_sasl_authenticated before the rbl check, but I'm still blocked from sending from the phone. It has been a long time since I've been back through my postfix config. Currently this server functions as the mail server for its domain and as a backup mail server for my office. Current config is: [14:04 nirvana:/home/david] # postconf -n alias_database = $alias_maps alias_maps = hash:/etc/postfix/aliases broken_sasl_auth_clients = yes command_directory = /usr/sbin config_directory = /etc/postfix daemon_directory = /usr/lib/postfix data_directory = /var/lib/postfix debug_peer_level = 2 html_directory = no inet_interfaces = all mail_owner = postfix mail_spool_directory = /var/spool/mail mailbox_command = /usr/bin/procmail -a "$EXTENSION" mailbox_size_limit = 102400000 mailq_path = /usr/bin/mailq manpage_directory = /usr/share/man message_size_limit = 20480000 mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain myhostname = nirvana.3111skyline.com mynetworks_style = subnet myorigin = $mydomain newaliases_path = /usr/bin/newaliases proxy_interfaces = 66.76.63.120 queue_directory = /var/spool/postfix readme_directory = no relay_domains = rlfpllc.com, rbpllc.com, rankinfirm.com, rankinlawfirm.com, drrankin.com sample_directory = /etc/postfix/sample sendmail_path = /usr/sbin/sendmail setgid_group = postdrop smtpd_client_restrictions = permit_sasl_authenticated, reject_rbl_client zen.spamhaus.org, reject_unknown_client smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks, reject_invalid_hostname, reject_non_fqdn_hostname smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, check_client_access hash:/etc/postfix/client_access, reject_unauth_destination smtpd_sasl_auth_enable = yes smtpd_sasl_path = private/auth smtpd_sasl_security_options = noanonymous, noplaintext smtpd_sasl_tls_security_options = noanonymous smtpd_sasl_type = dovecot smtpd_tls_auth_only = yes unknown_local_recipient_reject_code = 550 All the normal mail server operation work fine, so the question of the day is what do I need to do to be able to send email from my phone across my server? Any links that you have used would be appreciated. One stumbling block is there are many, many conflicting posts since 2007 on the topic, so finding good information has been a challenge. A quick go-by of changes to main.cf and master.cf would be great. I'd love to see a working configuration :) -- David C. Rankin, J.D.,P.E. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Lew Wolfgang

19:46

On 10/24/2011 12:22 PM, David C. Rankin wrote:

...

What I don't want to do is mess up my port 25 normal operations. That's the part I don't have sorted yet. The "what do I need to do to enable relay from the phone (on whatever port) and not mess up the normal server operations for the rest of the mail?"

Why the second port anyway? Can't I just configure postfix to authenticate me from my phone and just send using port 25? There may very well be valid reason that configuring on port 587 is better and the way to go, but that's what I'm trying to figure out...

Hi David, A couple of factors are at play here. (I hope I get this right) First, you have to authenticate yourself to your mail server if you want to relay mail. If you allow anonymous connections, spammers will have their way with your server. But, sending usernames and passwords in the clear over port 25 is also a risk, so you need to wrap your authentication dialog with SSL/TLS. Two ports? The issue here is that many ISP's block outgoing port 25 to force you to use their own SMTP servers. Outgoing port 587 is usually open, allowing you to connect to your server via an encrypted connection. Port 25 remains open allowing your server to continue to accept mail for local accounts as usual. There are other ways to do the authentication bit. I've used pop-before-smtp in the past, which is a bit clunky, but it works. This method blocks SMTP relaying until a successful authentication dialog is negotiated via pop or imap. The sending IP address is then opened for relaying for a defined period of time. This assumes that people will check their incoming mail before trying to send. Regards, Lew -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

David C. Rankin

20:44

On 10/24/2011 02:46 PM, Lew Wolfgang wrote:

...

Hi David,

A couple of factors are at play here. (I hope I get this right)

First, you have to authenticate yourself to your mail server if you want to relay mail. If you allow anonymous connections, spammers will have their way with your server. But, sending usernames and passwords in the clear over port 25 is also a risk, so you need to wrap your authentication dialog with SSL/TLS.

Alright, that explains the port 587 need. Done (master.cf): submission inet n - n - - smtpd -o smtpd_tls_security_level=encrypt -o smtpd_sasl_auth_enable=yes -o smtpd_client_restrictions=permit_sasl_authenticated,reject -o milter_macro_daemon_name=ORIGINATING

...

Two ports? The issue here is that many ISP's block outgoing port 25 to force you to use their own SMTP servers. Outgoing port 587 is usually open, allowing you to connect to your server via an encrypted connection. Port 25 remains open allowing your server to continue to accept mail for local accounts as usual.

All good on port 25 - I have all services through my ISP open (it's a business account ... and they stick it to you for it :)

...

There are other ways to do the authentication bit. I've used pop-before-smtp in the past, which is a bit clunky, but it works.

OK, I've looked at popbsmpt on sourceforge. I guess that is the way to go. What I don't get is I can relay just fine from one computer to the next using my domains: smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, check_client_access hash:/etc/postfix/client_access, reject_unauth_destination ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ So, I was hoping to do something similar with the phone.

...

This method blocks SMTP relaying until a successful authentication dialog is negotiated via pop or imap. The sending IP address is then opened for relaying for a defined period of time. This assumes that people will check their incoming mail before trying to send.

Regards, Lew

I've dorked with this for a while and I'm still stumbling along. When sending over 3G with Wifi turned off on the phone, I get errors similar to: Oct 24 14:37:34 nirvana postfix/smtpd[17198]: warning: 166.137.9.141: hostname mobile-166-137-009-141.mycingular.net verification failed: Name or service not known Oct 24 14:37:34 nirvana postfix/smtpd[17198]: connect from unknown[166.137.9.141] Oct 24 14:37:35 nirvana postfix/smtpd[17198]: NOQUEUE: reject: RCPT from unknown[166.137.9.141]: 554 5.7.1 Service unavailable; Client host [166.137.9.141] blocked using zen.spamhaus.org; http://www.spamhaus.org/query/bl?ip=166.137.9.141; from= to= proto=ESMTP helo=<[10.62.20.220]> Oct 24 14:37:35 nirvana postfix/smtpd[17198]: disconnect from unknown[166.137.9.141] spamhaus killed this message so I nuked the rbl check: #smtpd_client_restrictions = permit_sasl_authenticated, reject_rbl_client zen.spamhaus.org, reject_unknown_client smtpd_client_restrictions = permit_sasl_authenticated, reject_unknown_client then the error became: Oct 24 15:06:34 nirvana postfix/smtpd[17830]: NOQUEUE: reject: RCPT from unknown[166.137.9.141]: 450 4.7.1 Client host rejected: cannot find your hostname, [166.137.9.141]; from= to= proto=ESMTP helo=<[10.62.20.220]> then I just kicked postfix really hard and broke it! Oct 24 15:13:17 nirvana postfix/smtpd[18332]: fatal: parameter "smtpd_recipient_restrictions": specify at least one working instance of: check_relay_domains, reject_unauth_destination, reject, defer or defer_if_permit So I decided to go back to the drawing board and read a bit more... Surely there is a good howto on this somewhere.... Thanks again and if you have any other thoughts, let me know. -- David C. Rankin, J.D.,P.E. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

David C. Rankin

21:13

On 10/24/2011 03:44 PM, David C. Rankin wrote:

...

On 10/24/2011 02:46 PM, Lew Wolfgang wrote:

...
Hi David,

A couple of factors are at play here. (I hope I get this right)

First, you have to authenticate yourself to your mail server if you want to relay mail. If you allow anonymous connections, spammers will have their way with your server. But, sending usernames and passwords in the clear over port 25 is also a risk, so you need to wrap your authentication dialog with SSL/TLS.

Alright, that explains the port 587 need. Done (master.cf):

submission inet n - n - - smtpd -o smtpd_tls_security_level=encrypt -o smtpd_sasl_auth_enable=yes -o smtpd_client_restrictions=permit_sasl_authenticated,reject -o milter_macro_daemon_name=ORIGINATING

OK, I'm getting warmer, it looks like I have TLS cert problems. I'll go try and fix the certs and see how I make out. I should have more time tomorrow. We will do a write up once I get this sorted. (right now it is simply a forrest-for-the-trees issue. Any and all help welcome :) Thanks Lew... -- David C. Rankin, J.D.,P.E. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Per Jessen

25 Oct 25 Oct

06:01

David C. Rankin wrote:

...

Alright, that explains the port 587 need. Done (master.cf):

submission inet n - n - - smtpd -o smtpd_tls_security_level=encrypt -o smtpd_sasl_auth_enable=yes -o smtpd_client_restrictions=permit_sasl_authenticated,reject

Additionally I have: -o smtpd_sasl_security_options=noanonymous -o smtpd_etrn_restrictions=reject When you're using TLS, plaintext auth is fine. I'm not sure exactly what smtpd_etrn_restrictions=reject does, I think I picked that up in the postfix documentation.

...

...
There are other ways to do the authentication bit. I've used pop-before-smtp in the past, which is a bit clunky, but it works.

OK, I've looked at popbsmpt on sourceforge. I guess that is the way to go.

No real reason to - the setup above should work just fine.

...

What I don't get is I can relay just fine from one computer to the next using my domains:

smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, check_client_access hash:/etc/postfix/client_access, reject_unauth_destination ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

So, I was hoping to do something similar with the phone.

Your computers are presumably inside "mynetworks", whereas your phone is presumably not. With an external entity outside your control, I know of no better way than sasl+tls.

...

I've dorked with this for a while and I'm still stumbling along. When sending over 3G with Wifi turned off on the phone, I get errors similar to:

Oct 24 14:37:34 nirvana postfix/smtpd[17198]: warning: 166.137.9.141: hostname mobile-166-137-009-141.mycingular.net verification failed: Name or service not known

Not a real problem. It is due "mobile-166-137-009-141.mycingular.net" not being mapped to "166.137.9.141". Poor DNS setup on your providers side.

...

Oct 24 14:37:34 nirvana postfix/smtpd[17198]: connect from unknown[166.137.9.141] Oct 24 14:37:35 nirvana postfix/smtpd[17198]: NOQUEUE: reject: RCPT from unknown[166.137.9.141]: 554 5.7.1 Service unavailable; Client host [166.137.9.141] blocked using zen.spamhaus.org; http://www.spamhaus.org/query/bl?ip=166.137.9.141; from= to= proto=ESMTP helo=<[10.62.20.220]> Oct 24 14:37:35 nirvana postfix/smtpd[17198]: disconnect from unknown[166.137.9.141]

So your rbl restriction kicked in instead of the permit_sasl_authenticated - I don't see any evidence of authentication having happened?

...

spamhaus killed this message so I nuked the rbl check:

#smtpd_client_restrictions = permit_sasl_authenticated, #reject_rbl_client zen.spamhaus.org, reject_unknown_client smtpd_client_restrictions = permit_sasl_authenticated, reject_unknown_client

then the error became:

Oct 24 15:06:34 nirvana postfix/smtpd[17830]: NOQUEUE: reject: RCPT from unknown[166.137.9.141]: 450 4.7.1 Client host rejected: cannot find your hostname, [166.137.9.141]; from= to= proto=ESMTP helo=<[10.62.20.220]>

This is due to 'reject_unknown_client'.

...

So I decided to go back to the drawing board and read a bit more... Surely there is a good howto on this somewhere....

There is plenty out there - the plain postfix documentation and HOWTOs are all pretty good, and there is also http://www.postfix-book.com/

...

Thanks again and if you have any other thoughts, let me know.

I suspect a problem in authentication. If you were to turn on debugging you'd see exactly what is happening. -- Per Jessen, Zürich (7.9°C) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Per Jessen

24 Oct 24 Oct

21:38

David C. Rankin wrote:

...

Per, Wolfgang, All..

I'm just getting back to this issue. I am trying to get the idea of having the iphone submit on port 587 sorted out if that is what I need to do to be able to relay across my server when not connected to the LAN. Are you talking about enabling a second port with:

smtp inet n - n - - smtpd 587 inet n - n - - smtpd

in master.cf as referenced in:

http://www.howtoforge.com/forums/archive/index.php/t-4788.html

I have seen two different references. One giving the suggestion above, and the other simply uncommenting the 'submission' line in master.cf to enable submission on port 587.

Whether you write 'submission' or '587', it's the same thing.

...

What I don't want to do is mess up my port 25 normal operations.

Right, and adding a daemon to accept mail on port 587 won't affect that.

...

That's the part I don't have sorted yet. The "what do I need to do to enable relay from the phone (on whatever port) and not mess up the normal server operations for the rest of the mail?"

Add an smtpd listening on port 587 (or any other port you fancy), and add the various requirements you need (TLS, authentication, whatever).

...

Why the second port anyway?

Generally because port 587 is used for that purpose, but more because you want different criteria for this kind of traffic.

...

Can't I just configure postfix to authenticate me from my phone and just send using port 25?

No. If you say "authentication required" on the smtpd that services port 25, it'll apply to all traffic, not just to your phone. If you open your mailserver to everyone, well ...

...

There may very well be valid reason that configuring on port 587 is better and the way to go, but that's what I'm trying to figure out...

The key thing is that you want different criteria for the two different kinds of traffic (mails from your phone, mails from other mailservers).

...

I've tried adding the permit_sasl_authenticated before the rbl check, but I'm still blocked from sending from the phone.

And your phone did authenticate? Check that you have line like this: postfix2/smtpd[8832]: 4DFA0556E0: client=yourclient, sasl_method=LOGIN, sasl_username=<youruserid> [snip]

...

smtpd_client_restrictions = permit_sasl_authenticated, reject_rbl_client zen.spamhaus.org, reject_unknown_client [snip] smtpd_sasl_auth_enable = yes smtpd_sasl_path = private/auth smtpd_sasl_security_options = noanonymous, noplaintext smtpd_sasl_tls_security_options = noanonymous smtpd_sasl_type = dovecot smtpd_tls_auth_only = yes unknown_local_recipient_reject_code = 550

All the normal mail server operation work fine, so the question of the day is what do I need to do to be able to send email from my phone across my server?

Which error messages are you currently seeing?

...

Any links that you have used would be appreciated.

http://www.postfix.org/documentation.html :-)

...

A quick go-by of changes to main.cf and master.cf would be great. I'd love to see a working configuration :)

Sure, I'll send you a copy off-line. -- Per Jessen, Zürich (9.1°C) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Per Jessen

7 Oct 7 Oct

06:38

David C. Rankin wrote:

...

The error I get is basically:

Oct 3 16:26:46 nirvana dovecot: imap-login: Login: user=<david>, method=PLAIN, rip=166.205.10.236, lip=192.168.6.17, mpid=16601, TLS Oct 3 16:27:27 nirvana postfix/smtpd[16604]: warning: 166.205.10.236: hostname mobile-166-205-010-236.mycingular.net verification failed: Name or service not known Oct 3 16:27:27 nirvana postfix/smtpd[16604]: connect from unknown[166.205.10.236] Oct 3 16:27:28 nirvana postfix/smtpd[16604]: NOQUEUE: reject: RCPT from unknown[166.205.10.236]: 554 5.7.1 Service unavailable; Client host [166.205.10.236] blocked using zen.spamhaus.org; http://www.spamhaus.org/query/bl?ip=166.205.10.236; from= to= proto=ESMTP helo=<[10.16.59.185]> Oct 3 16:27:28 nirvana postfix/smtpd[16604]: disconnect from unknown[166.205.10.236]

From TLS my server knows it's me (i.e. from=) and it is killing the relay. That's where I'm stuck. Anybody else got this ironed out??

I do it for customers all the time - looks like you've got an rbl check somewhere though. Just remove that. -- Per Jessen, Zürich (9.5°C) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

4568

Age (days ago)

4587

Last active (days ago)

List overview

Download

10 comments

4 participants

participants (4)

David C. Rankin
Lew Wolfgang
Per Jessen
Wolfgang Rosenauer

[opensuse] Postfix/dovecot - allow relay from phone - How??

tags

participants (4)