On Mon, Jul 07, 2014 at 04:59:32PM -0400, Wietse Venema wrote:
> Would check_ccert_access do the job in a restriction class (a kludge
> to pre-open Postfix access tables):
There is a simpler way:
http://www.postfix.org/postconf.5.html#permit_tls_clientcerts
http://www.postfix.org/postconf.5.html#relay_clientcerts
http://www.postfix.org/postconf.5.html#smtpd_tls_fingerprint_digest
main.cf:
indexed = ${default_database_type}:${config_directory}/
relay_clientcerts = ${indexed}relay-certs
smtpd_tls_fingerprint_digest = sha1
smtpd_recipient_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
check_sender_access ${indexed}sender-tls-relay
reject_unauth_destination
sender-tls-relay:
[email protected] permit_tls_clientcerts
relay-certs:
da:39:a3:ee:5e:6b:4b:0d:32:55:bf:ef:95:60:18:90:af:d8:07:09
OK relay client
The down-side if that when listing multiple sender addresses and
multiple client cert digests any authorized client can send from
any authorized address (clients can "impersonate" each other).
If there is only one client and one sender address there is no
impersonation risk. For more precise control, a policy service
can consider multiple transaction features simultaneously.
--
Viktor.
