[pfx] Re: implementing some kind of dovecot/imap user@domain based sending restriction to @domain recipients only

[Florian Piekert via Postfix-users]

Hello Viktor,

I found the solution by using in main.cf the

smtpd_relay_restrictions = permit_mynetworks,
                            check_sender_access    
btree:$meta_directory/restricted_senders,
                            permit_sasl_authenticated,
                            reject_unauth_destination
directive. Works now.

This is too fragile, you're liable to create an open relay, if any of
the sender checks return "OK" based on the sender address alone.

I'd instead recommend putting these in

     smtpd_sender_restrictions

which don't imply relay permissions, and rather implement the particular
from/to access rules intended.

Thanks for pointing out this security hole I set up! I wasn't even aware yet of 
smtpd_sender_restrictions directive... So I moved the access check there, as in

smtpd_sender_restrictions = check_sender_access   
btree:$meta_directory/restricted_senders

And this, too, works fine.

Thanks again to all.

Florian


_______________________________________________
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org