OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: hold all relayed mail by default

From: Noel Jones (njonesmegan.vbhcs.org)
Date: Mon Mar 09 2009 - 07:43:21 CDT


Costin Guşă wrote:
> Hello,
> I'm using postfix postfix-2.3.3-2 x86 configured for a single domain.
> Clients are allowed to relay only after they have performed SMTP AUTH
> or if they connect from $mynetworks. (postconf -n posted at
> http://pastebin.ca/1356405)
>
> I'd like to mimic M$ Exchange "recall" behaviour for emails sent by
> relay-allowed clients.
>
> To accomplish this, I thought of putting all relayed mail into the
> 'hold' queue by default, then with a cron script to release it
> periodically (ex. "ls -lt" and "postsuper -r <maild older than N
> minutes>"), and manually use 'postsuper -d' after instructing users to
> call the helpdesk if they want to 'recall' a message they sent.
>
> First thing that comes into mind after reading "man 5 access" is to
> modify the "smtpd_sender_restrictions" section in main.cf:
>
> [...]
> smtpd_sender_restrictions =
> check_sender_access hash:/etc/postfix/check_sender_access_hash
> reject_non_fqdn_sender
> reject_unknown_sender_domain
>
> ...and in check_sender_access_hash to put:
> mynetworks.subnet HOLD
> mydomain.tld HOLD
>
> What do you think about the above approach? Would there be better alternatives?
> Has anyone implemented similar setups? Would the above approach catch
> all relayed mail ? Would a "pcre:" table perform better than "hash:"
> for this particular purpose ?
>

I don't think this is a good idea at all.

Folks by now somewhat expect mail being near real time, and
will think your system is broken if it takes an hour or more
to deliver anything.

I think the recall feature is rather bogus anyway; you can't
recall anything sent to a non-exchange site and you can't tell
the recipient to unread something they already looked at. One
could argue that features that work part of the time are
broken by design.

But yes, your proposed design would do what you describe.

   -- Noel Jones