OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: Force authentication for own domains

From: mouss (moussml.netoyen.net)
Date: Sat Mar 07 2009 - 12:45:43 CST


Magnus Bäck a écrit :
> On Saturday, March 07, 2009 at 13:40 CET,
> "Francisco M. Marzoa Alonso" <franmarzoa.com> wrote:
>
>> I've a postfix server wich uses SASL + Mysql for authentication, my
>> own domains are mostly listed in a mysql table on that database. Its
>> working fine enough, but I want to made it a bit more restrictrive. At
>> current time its behaviour about sending mail is as folows:
>>
>> FROM external domains TO my own domains -> accept
>> FROM my own domains TO my own domains -> accept
>> FROM my own domains TO external domains -> requires authentication
>> FROM external domains TO external domains -> reject
>>
>> What I want to do is that it also requires authentication when sending
>> from my own domains TO my own domains. What is the best way to do that?
>
> main.cf:
> smtpd_sender_restrictions = check_sender_access hash:/path/to/file
>
> /path/to/file:
> example.com permit_sasl_authenticated, reject
>

most examples you'll see here use hash. you can use whatever db type.
you can use 'postmap -q' to test your map.

in this particular case, you can create a Access_Sender table, and use
something like

query = select action from Access_Sender where '%s' = email;

this will allow you to define actions per sender (full address or domain).