> On Oct 3, 2017, at 8:54 AM, Ivars Strazdiņš <[email protected]> wrote: > > For example, if a message is sent to [email protected], then postfix does > LDAP lookup for mail attribute "[email protected]" and deliver to "uid" > result attribute “testuser". If LDAP lookup fails, then postfix attempts to > deliver to local user "testuser” mailbox anyway. > To say otherwise, LDAP lookup failure is not a fatal error and postfix still > attempts to deliver locally. > > Now I would like to change this and include a check for account validity > (and/or group membership). > Say, if account is disabled (LDAP attribute nsAccountLock=TRUE) and LDAP > lookup fails, then postfix should not attempt to deliver locally and reject > message instead. > Is it possible to achive this and keep current configuration relatively > intact? (i.e., keep local_transport=local:$myhostname) > I understand that I can change local_transport to "local_transport=virtual", > but this brings in many other changes.
See http://www.postfix.org/ADDRESS_CLASS_README.html http://www.postfix.org/postconf.5.html#local_recipient_maps Remove unix:passwd.byname from local_recipient_maps or otherwise ensure that it only matches the users you want to accept mail for. If all the users in question are listed in virtual_alias_maps (which is implicitly applicable to every address class), then use an essentially empty table for local_recipient_maps. With a sufficiently recent Postfix, you could use something like: local_recipient_maps = inline:{ postmaster=root } -- Viktor.
