A. Schulze:
> Hello,
>
> Abstract problem:
> allow a external third party to relay messages with
> one fixed envelope sender. Certificates must be used to allow relay
> permissions.
> Do I really need additional UserID+Passwords to limit to a specific
> envelope sender
> or could information from the ccert be used?
Would check_ccert_access do the job in a restriction class (a kludge
to pre-open Postfix access tables):
/etc/postfix/main.cf
# This part looks innocent enough.
smtpd_relay_restrictions =
...
check_ccert_access hash:/etc/postfix/ccert_access
reject_unauth_destination
...
# The real fun starts here.
restriction_classes = permit_sender_example
permit_sender_example =
check_sender_access hash:/etc/postfix/sender_example_access
/etc/postfix/ccert_access
fi:ng:er:pr:in:t permit_sender_example
/etc/postfix/sender_example_access:
[email protected] permit
This is an untested example. My brain hurts after typing this.
References: http://www/postfix.org/RESTRICTION_CLASS_README.html
Wietse
> My view so far:
> Using SASL authentication a SMTP client can be authorized to relay a message
> and / or use a specific envelope sender in the MAIL FROM command.
> Using TLS certificates a SMTP client can be also authorized to relay
> a message.
>
> The information ccert_subject and envelope sender is accessible
> for SMTP access policy delegation servers and for milters too. But I
> have to write a little
> small daemon what I like to avoid...
>
> Are there other options too?
>
> Andreas
>
>
