10

For reasons that make me want to hurt myself, an application I am required to support has the ability to send mail using a 'MAIL FROM' address of any domain. Because I am unable to lock down the application any further I want to have Postfix sanity check all mail that tries to leave my network destined for the rest of the world.

I only want mail that originates from within to be allowed out if it has a from address of 'example.com'. If mail that originates from within has a from address of 'someotherdomain.com' that mail should be blocked via Postfix.

To clarify, how do I configure Postfix to only allow mail, which originated within my local network, to be allowed out IF that mail has a FROM address of one of my domain names?

The only way I've figured out how to do this so far is as follows. But is there anything simpler?

/etc/postfix/main.cf:

smtpd_restriction_classes =
        external_sender_access
        internal_sender_access

# Intended for mail originating from outside our networks
external_sender_access =
        # Verify MAIL_FROM on incoming mail
        check_sender_access hash:/etc/postfix/external_sender_access
        # Allow all other incoming mail
        permit

# Intended for mail originating from within our networks
internal_sender_access =
        # Verify MAIL_FROM on outgoing mail
        check_sender_access hash:/etc/postfix/internal_sender_access
        # Block all other outbound mail
        reject

# Restrictions applied in the context of the MAIL FROM command.
smtpd_sender_restrictions =
        reject_non_fqdn_sender
        reject_unknown_sender_domain
        # Access rules for specific 'sender' data based upon client IP
        check_client_access cidr:/etc/postfix/network_sender_access
        permit

/etc/postfix/network_sender_access:

# Localhost
127.0.0.0/24        internal_sender_access

# Inside Networks
192.168.0.0/16      internal_sender_access

# Everything else
0.0.0.0/0           external_sender_access

/etc/postfix/internal_sender_access:

example.com OK
.example.com OK

/etc/postfix/external_sender_access:

example.com REJECT You're not from here!
.example.com REJECT You're not from here!

postconf -n output for this configuration:

alias_database = dbm:/etc/aliases
alias_maps = hash:/etc/aliases
biff = no
body_checks = pcre:/etc/postfix/body_checks
config_directory = /etc/postfix
content_filter = smtp-amavis:[127.0.0.1]:10024
disable_vrfy_command = yes
external_sender_access = check_sender_access hash:/etc/postfix/external_sender_access permit
header_checks = pcre:/etc/postfix/header_checks
home_mailbox = Maildir/
inet_protocols = ipv4,ipv6
internal_sender_access = check_sender_access hash:/etc/postfix/internal_sender_access reject
local_header_rewrite_clients = permit_inet_interfaces,permit_mynetworks
mailbox_command = /usr/bin/procmail -t
mailbox_size_limit = 0
manpage_directory = /usr/share/man
minimal_backoff_time = 1800s
mydestination = $myorigin, $myhostname, localhost.$mydomain, localhost
mynetworks = /etc/postfix/local_networks
queue_directory = /data/postfix
recipient_delimiter = +
smtp_generic_maps = pcre:/etc/postfix/generic
smtpd_banner = $myhostname ESMTP
smtpd_client_restrictions = permit_mynetworks check_client_access hash:/etc/postfix/client_access permit
smtpd_data_restrictions = reject_unauth_pipelining reject_multi_recipient_bounce permit
smtpd_delay_reject = yes
smtpd_helo_required = yes
smtpd_helo_restrictions = reject_invalid_helo_hostname reject_non_fqdn_helo_hostname permit_mynetworks check_client_access hash:/etc/postfix/client_access permit
smtpd_recipient_restrictions = permit_mynetworks check_client_access hash:/etc/postfix/rbl_override reject_rbl_client zen.spamhaus.org permit
smtpd_relay_restrictions = reject_non_fqdn_recipient reject_unknown_recipient_domain regexp:/etc/postfix/regexp_access permit_mynetworks reject_unauth_destination reject_unlisted_recipient check_policy_service inet:127.0.0.1:10023 permit
smtpd_restriction_classes = external_sender_access internal_sender_access
smtpd_sender_restrictions = reject_non_fqdn_sender reject_unknown_sender_domain check_client_access cidr:/etc/postfix/network_sender_access permit
strict_rfc821_envelopes = yes
virtual_alias_domains = example.com
virtual_alias_maps = hash:/etc/postfix/virtual.d/example.com

EDIT: Below is alternative configuration I tried using 'reject_unlisted_sender'.

When I try using this configuration, mail sent 'From: does_not_exist@example.com' bounces (as expected), but mail sent 'From: blah@not_my_domain.com' is allowed out without problem, which is exactly what I do not want.

# Restrictions applied in the context of the MAIL FROM command.
smtpd_sender_restrictions =
        reject_non_fqdn_sender
        reject_unknown_sender_domain
        check_client_access cidr:/etc/postfix/outgoing_senders
        # Access rules for specific 'sender' data
        check_sender_access hash:/etc/postfix/sender_access
        permit

/etc/postfix/outgoing_senders:
192.168.0.0/16  reject_unlisted_sender, permit

/etc/postfix/sender_access:

example.com REJECT You're not from here!
.example.com REJECT You're not from here!

postconf -n output for this configuration:

alias_database = dbm:/etc/aliases
alias_maps = hash:/etc/aliases
biff = no
body_checks = pcre:/etc/postfix/body_checks
config_directory = /etc/postfix
content_filter = smtp-amavis:[127.0.0.1]:10024
disable_vrfy_command = yes
header_checks = pcre:/etc/postfix/header_checks
home_mailbox = Maildir/
inet_protocols = ipv4,ipv6
local_header_rewrite_clients = permit_inet_interfaces,permit_mynetworks
mailbox_command = /usr/bin/procmail -t
mailbox_size_limit = 0
manpage_directory = /usr/share/man
minimal_backoff_time = 1800s
mydestination = $myorigin, $myhostname, localhost.$mydomain, localhost
mynetworks = /etc/postfix/local_networks
queue_directory = /data/postfix
recipient_delimiter = +
smtp_generic_maps = pcre:/etc/postfix/generic
smtpd_banner = $myhostname ESMTP
smtpd_client_restrictions = permit_mynetworks check_client_access hash:/etc/postfix/client_access permit
smtpd_data_restrictions = reject_unauth_pipelining reject_multi_recipient_bounce permit
smtpd_delay_reject = yes
smtpd_helo_required = yes
smtpd_helo_restrictions = reject_invalid_helo_hostname reject_non_fqdn_helo_hostname permit_mynetworks check_client_access hash:/etc/postfix/client_access permit
smtpd_recipient_restrictions = permit_mynetworks check_client_access hash:/etc/postfix/rbl_override reject_rbl_client zen.spamhaus.org permit
smtpd_relay_restrictions = reject_non_fqdn_recipient reject_unknown_recipient_domain regexp:/etc/postfix/regexp_access permit_mynetworks reject_unauth_destination reject_unlisted_recipient check_policy_service inet:127.0.0.1:10023 permit
smtpd_sender_restrictions = reject_non_fqdn_sender reject_unknown_sender_domain check_client_access cidr:/etc/postfix/outgoing_senders check_sender_access hash:/etc/postfix/sender_access permit
strict_rfc821_envelopes = yes
virtual_alias_domains = example.com
virtual_alias_maps = hash:/etc/postfix/virtual.d/example.com
masegaloeh
  • 18,236
  • 10
  • 57
  • 106
Chris Snyder
  • 113
  • 1
  • 1
  • 9
  • I've tried using 'reject_unlisted_sender' but that only seemed to do anything when the FROM domain was listed in my virtual_aliases tables. Any other domain was ignored and the mail was allowed out. – Chris Snyder Feb 03 '15 at 13:50
  • (1) Please provide the output of `postconf -n`. (2) Where you put `reject_unlisted_sender` in your restriction? – masegaloeh Feb 03 '15 at 14:04
  • To forcing both `external_sender_access` and `internal_sender_access`, yes you need smtpd_restriction_classes. For other method, see the [FAQ here](http://serverfault.com/a/664483/218590) – masegaloeh Feb 05 '15 at 00:54
  • Alternate configuration using `reject_unlisted_sender` and `postconf -n` output added. – Chris Snyder Feb 05 '15 at 14:07

2 Answers2

5

YES I think.

Create a new Postscript regular expression access file /etc/postfix/allowed_senders, for example:

/@microsoft.com$/ OK
/@bbc.co.uk$/ OK
/@abc.net.au$/ OK
// REJECT

Test it with e.g. postmap -q bill@microsoft.com regexp:/etc/postfix/allowed_senders.

Use it by adding the line

smtpd_sender_restrictions = check_sender_access regexp:/etc/postfix/allowed_senders

to /etc/postfix/main.cf.

That should do it. This is working for me, and on an old Postfix version from before the date of this question, so I don't think I'm relying on anything added since.

MikeBeaton
  • 173
  • 1
  • 5
  • You need to add postmap /etc/postfix/allowed_senders to make the .db file of course, but then it seems to work as of Postfix 3.1.0 Ubuntu 16.04LTS. Perfect, thanks. – Gnudiff Apr 21 '21 at 07:12
  • 1
    It's a `regexp:` lookup not a `hash:` lookup, so you don't need to use `postmap` to create a `.db` version in order for it to work. http://www.postfix.org/DATABASE_README.html#types – MikeBeaton Apr 21 '21 at 21:07
  • Here `check_sender_access` is the name of a supposedly preexisting file, right? Or is it some sort of a directive? – Sam Sirry Mar 07 '23 at 15:32
  • 1
    I see that `check_sender_access` is a special directive, as explained in the reference at: https://www.postfix.org/postconf.5.html – Sam Sirry Mar 07 '23 at 16:10
2

I can confirm that what you see in your postfix was intended behavior of reject_unlisted_sender. This documentation page clearly states 4 conditions when postfix rejected your email

  • The sender domain matches $mydestination, $inet_interfaces or $proxy_interfaces, but the sender is not listed in $local_recipient_maps, and $local_recipient_maps is not null.
  • The sender domain matches $virtual_alias_domains but the sender is not listed in $virtual_alias_maps.
  • The sender domain matches $virtual_mailbox_domains but the sender is not listed in $virtual_mailbox_maps, and $virtual_mailbox_maps is not null.
  • The sender domain matches $relay_domains but the sender is not listed in $relay_recipient_maps, and $relay_recipient_maps is not null.

When the sender address doesn't match any condition above, by default postfix will permit it.

Back to your original question: The only way I've figured out how to do this so far is as follows. But is there anything simpler?

NO, your only options is likely SMTPD restiction classes. For other solution, you can use any policy server addon such as postfwd, policyd and others.

masegaloeh
  • 18,236
  • 10
  • 57
  • 106