Hello,
I have a Postfix instance running as e-mail relay for authenticated
client submission(s). I have some restrictions in place to enforce some
requirements:
0- Everybody must authenticate
1- Some authorized SASL login names can send mail from other addresses
2- Who receives mail with an alias can also send as that alias
3- Everyone can send mail with an address matching their SASL login name
These requirements are satisfied with the following configuration:
submission inet n - n - - smtpd
-o syslog_name=postfix/submission
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_tls_auth_only=yes
-o local_header_rewrite_clients=static:all
-o smtpd_reject_unlisted_recipient=no
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
-o
smtpd_sender_restrictions=reject_non_fqdn_sender,reject_authenticated_sender_login_mismatch
-o
smtpd_sender_login_maps=lmdb:/etc/postfix/login_maps,lmdb:/etc/postfix/virtual,pcre:/etc/postfix/login_maps_address
-o milter_macro_daemon_name=ORIGINATING
0- smtpd_client_restrictions=permit_sasl_authenticated,reject
1,2,3 -
smtpd_sender_restrictions=reject_non_fqdn_sender,reject_authenticated_sender_login_mismatch
... and the maps:
1- lmdb:/etc/postfix/login_maps
2- lmdb:/etc/postfix/virtual
3- pcre:/etc/postfix/login_maps_address
$ cat /etc/postfix/login_maps_address
# E-Mail Address # SASL Username
/^(.*)$/ $1
Now, it does work. But by reading the man 5 postconf I have the feeling
that reject_authenticated_sender_login_mismatch should already match the
SASL login name to the MAIL FROM: address implicitly:
but either the MAIL FROM address is not listed in
$smtpd_sender_login_maps
<https://www.postfix.org/postconf.5.html#smtpd_sender_login_maps>, or
the SASL login name is not an owner for that address.
... but if I then remove the pcre:/etc/postfix/login_maps_address I get
this error when trying to send e-mail from the address owner:
NOQUEUE: reject: RCPT from unknown[2001:67c:d68:13::e]: 553 5.7.1
<[email protected]>: Sender address rejected: not owned by
user [email protected]; from=<[email protected]>
to=<redacted> proto=ESMTP helo=<[IPV6:2001:67c:d68:13::e]>
... how is so? What I'm doing wrong?
Thank you,
Luca
_______________________________________________
Postfix-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
