RESTRICTION_CLASS_README.html revision 1.1.1.1.4.2
1 1.1.1.1.4.2 matt <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" 2 1.1.1.1.4.2 matt "http://www.w3.org/TR/html4/loose.dtd"> 3 1.1.1.1.4.2 matt 4 1.1.1.1.4.2 matt <html> 5 1.1.1.1.4.2 matt 6 1.1.1.1.4.2 matt <head> 7 1.1.1.1.4.2 matt 8 1.1.1.1.4.2 matt <title>Postfix Per-Client/User/etc. Access Control</title> 9 1.1.1.1.4.2 matt 10 1.1.1.1.4.2 matt <meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> 11 1.1.1.1.4.2 matt 12 1.1.1.1.4.2 matt </head> 13 1.1.1.1.4.2 matt 14 1.1.1.1.4.2 matt <body> 15 1.1.1.1.4.2 matt 16 1.1.1.1.4.2 matt <h1><img src="postfix-logo.jpg" width="203" height="98" ALT="">Postfix 17 1.1.1.1.4.2 matt Per-Client/User/etc. Access Control</h1> 18 1.1.1.1.4.2 matt 19 1.1.1.1.4.2 matt <hr> 20 1.1.1.1.4.2 matt 21 1.1.1.1.4.2 matt <h2>Postfix restriction classes</h2> 22 1.1.1.1.4.2 matt 23 1.1.1.1.4.2 matt <p> The Postfix SMTP server supports access restrictions such as 24 1.1.1.1.4.2 matt <a href="postconf.5.html#reject_rbl_client">reject_rbl_client</a> or <a href="postconf.5.html#reject_unknown_client_hostname">reject_unknown_client_hostname</a> on the right-hand side 25 1.1.1.1.4.2 matt of SMTP server <a href="access.5.html">access(5)</a> tables. This allows you to implement 26 1.1.1.1.4.2 matt different junk mail restrictions for different clients or users. 27 1.1.1.1.4.2 matt </p> 28 1.1.1.1.4.2 matt 29 1.1.1.1.4.2 matt <p> Having to specify lists of access restrictions for every 30 1.1.1.1.4.2 matt recipient becomes tedious quickly. Postfix restriction classes 31 1.1.1.1.4.2 matt allow you to give easy-to-remember names to groups of UCE restrictions 32 1.1.1.1.4.2 matt (such as "permissive", "restrictive", and so on). </p> 33 1.1.1.1.4.2 matt 34 1.1.1.1.4.2 matt <p> The real reason for the existence of Postfix restriction classes 35 1.1.1.1.4.2 matt is more mundane: you can't specify a lookup table on the right-hand 36 1.1.1.1.4.2 matt side of a Postfix access table. This is because Postfix needs to 37 1.1.1.1.4.2 matt open lookup tables ahead of time, but the reader probably does not 38 1.1.1.1.4.2 matt care about these low-level details. </p> 39 1.1.1.1.4.2 matt 40 1.1.1.1.4.2 matt <p> Example: </p> 41 1.1.1.1.4.2 matt 42 1.1.1.1.4.2 matt <blockquote> 43 1.1.1.1.4.2 matt <pre> 44 1.1.1.1.4.2 matt /etc/postfix/<a href="postconf.5.html">main.cf</a>: 45 1.1.1.1.4.2 matt <a href="postconf.5.html#smtpd_restriction_classes">smtpd_restriction_classes</a> = restrictive, permissive 46 1.1.1.1.4.2 matt # With Postfix < 2.3 specify <a href="postconf.5.html#reject_unknown_client_hostname">reject_unknown_client</a>. 47 1.1.1.1.4.2 matt restrictive = <a href="postconf.5.html#reject_unknown_sender_domain">reject_unknown_sender_domain</a> <a href="postconf.5.html#reject_unknown_client_hostname">reject_unknown_client_hostname</a> ... 48 1.1.1.1.4.2 matt permissive = permit 49 1.1.1.1.4.2 matt 50 1.1.1.1.4.2 matt <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> = 51 1.1.1.1.4.2 matt <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a> 52 1.1.1.1.4.2 matt <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a> 53 1.1.1.1.4.2 matt <a href="postconf.5.html#check_recipient_access">check_recipient_access</a> hash:/etc/postfix/recipient_access 54 1.1.1.1.4.2 matt 55 1.1.1.1.4.2 matt /etc/postfix/recipient_access: 56 1.1.1.1.4.2 matt joe (a] my.domain permissive 57 1.1.1.1.4.2 matt jane (a] my.domain restrictive 58 1.1.1.1.4.2 matt </pre> 59 1.1.1.1.4.2 matt </blockquote> 60 1.1.1.1.4.2 matt 61 1.1.1.1.4.2 matt <p> With this in place, you can use "restrictive" or "permissive" 62 1.1.1.1.4.2 matt on the right-hand side of your per-client, helo, sender, or recipient 63 1.1.1.1.4.2 matt SMTPD access tables. </p> 64 1.1.1.1.4.2 matt 65 1.1.1.1.4.2 matt <p> The remainder of this document gives examples of how Postfix 66 1.1.1.1.4.2 matt access restriction classes can be used to: </p> 67 1.1.1.1.4.2 matt 68 1.1.1.1.4.2 matt <ul> 69 1.1.1.1.4.2 matt 70 1.1.1.1.4.2 matt <li> <a href="#internal"> Shield an internal mailing list from 71 1.1.1.1.4.2 matt outside posters</a>, 72 1.1.1.1.4.2 matt 73 1.1.1.1.4.2 matt <li> <a href="#external"> Prevent external access by internal 74 1.1.1.1.4.2 matt senders</a>. 75 1.1.1.1.4.2 matt 76 1.1.1.1.4.2 matt </ul> 77 1.1.1.1.4.2 matt 78 1.1.1.1.4.2 matt <p> These questions come up frequently, and the examples hopefully 79 1.1.1.1.4.2 matt make clear that Postfix restriction classes aren't really the right 80 1.1.1.1.4.2 matt solution. They should be used for what they were designed to do, 81 1.1.1.1.4.2 matt different junk mail restrictions for different clients or users. 82 1.1.1.1.4.2 matt </p> 83 1.1.1.1.4.2 matt 84 1.1.1.1.4.2 matt <h2><a name="internal">Protecting internal email distribution 85 1.1.1.1.4.2 matt lists</a></h2> 86 1.1.1.1.4.2 matt 87 1.1.1.1.4.2 matt <blockquote> 88 1.1.1.1.4.2 matt 89 1.1.1.1.4.2 matt <p> We want to implement an internal email distribution list. 90 1.1.1.1.4.2 matt Something like all (a] our.domain.com, which aliases to all employees. 91 1.1.1.1.4.2 matt My first thought was to use the aliases map, but that would lead 92 1.1.1.1.4.2 matt to "all" being accessible from the "outside", and this is not 93 1.1.1.1.4.2 matt desired... :-) </p> 94 1.1.1.1.4.2 matt 95 1.1.1.1.4.2 matt </blockquote> 96 1.1.1.1.4.2 matt 97 1.1.1.1.4.2 matt <p> Postfix can implement per-address access controls. What follows 98 1.1.1.1.4.2 matt is based on the SMTP client IP address, and therefore is subject 99 1.1.1.1.4.2 matt to IP spoofing. </p> 100 1.1.1.1.4.2 matt 101 1.1.1.1.4.2 matt <blockquote> 102 1.1.1.1.4.2 matt <pre> 103 1.1.1.1.4.2 matt /etc/postfix/<a href="postconf.5.html">main.cf</a>: 104 1.1.1.1.4.2 matt <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> = 105 1.1.1.1.4.2 matt <a href="postconf.5.html#check_recipient_access">check_recipient_access</a> hash:/etc/postfix/access 106 1.1.1.1.4.2 matt <i>...the usual stuff...</i> 107 1.1.1.1.4.2 matt 108 1.1.1.1.4.2 matt /etc/postfix/access: 109 1.1.1.1.4.2 matt all (a] my.domain <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>,reject 110 1.1.1.1.4.2 matt all (a] my.hostname <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>,reject 111 1.1.1.1.4.2 matt </pre> 112 1.1.1.1.4.2 matt </blockquote> 113 1.1.1.1.4.2 matt 114 1.1.1.1.4.2 matt <p> Specify <b>dbm</b> instead of <b>hash</b> if your system uses 115 1.1.1.1.4.2 matt <b>dbm</b> files instead of <b>db</b> files. To find out what map 116 1.1.1.1.4.2 matt types Postfix supports, use the command <b>postconf -m</b>. </p> 117 1.1.1.1.4.2 matt 118 1.1.1.1.4.2 matt <p> Now, that would be sufficient when your machine receives all 119 1.1.1.1.4.2 matt Internet mail directly from the Internet. That's unlikely if your 120 1.1.1.1.4.2 matt network is a bit larger than an office. For example, your backup 121 1.1.1.1.4.2 matt MX hosts would "launder" the client IP address of mail from the 122 1.1.1.1.4.2 matt outside so it would appear to come from a trusted machine. </p> 123 1.1.1.1.4.2 matt 124 1.1.1.1.4.2 matt <p> In the general case you need two lookup tables: one table that 125 1.1.1.1.4.2 matt lists destinations that need to be protected, and one table that 126 1.1.1.1.4.2 matt lists domains that are allowed to send to the protected destinations. 127 1.1.1.1.4.2 matt </p> 128 1.1.1.1.4.2 matt 129 1.1.1.1.4.2 matt <p> What follows is based on the sender SMTP envelope address, and 130 1.1.1.1.4.2 matt therefore is subject to SMTP sender spoofing. </p> 131 1.1.1.1.4.2 matt 132 1.1.1.1.4.2 matt <blockquote> 133 1.1.1.1.4.2 matt <pre> 134 1.1.1.1.4.2 matt /etc/postfix/<a href="postconf.5.html">main.cf</a>: 135 1.1.1.1.4.2 matt <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> = 136 1.1.1.1.4.2 matt <a href="postconf.5.html#check_recipient_access">check_recipient_access</a> hash:/etc/postfix/protected_destinations 137 1.1.1.1.4.2 matt <i>...the usual stuff...</i> 138 1.1.1.1.4.2 matt 139 1.1.1.1.4.2 matt <a href="postconf.5.html#smtpd_restriction_classes">smtpd_restriction_classes</a> = insiders_only 140 1.1.1.1.4.2 matt insiders_only = <a href="postconf.5.html#check_sender_access">check_sender_access</a> hash:/etc/postfix/insiders, reject 141 1.1.1.1.4.2 matt 142 1.1.1.1.4.2 matt /etc/postfix/protected_destinations: 143 1.1.1.1.4.2 matt all (a] my.domain insiders_only 144 1.1.1.1.4.2 matt all (a] my.hostname insiders_only 145 1.1.1.1.4.2 matt 146 1.1.1.1.4.2 matt /etc/postfix/insiders: 147 1.1.1.1.4.2 matt my.domain OK <i>matches my.domain and subdomains</i> 148 1.1.1.1.4.2 matt another.domain OK <i>matches another.domain and subdomains</i> 149 1.1.1.1.4.2 matt </pre> 150 1.1.1.1.4.2 matt </blockquote> 151 1.1.1.1.4.2 matt 152 1.1.1.1.4.2 matt <p> Getting past this scheme is relatively easy, because all one 153 1.1.1.1.4.2 matt has to do is to spoof the SMTP sender address. </p> 154 1.1.1.1.4.2 matt 155 1.1.1.1.4.2 matt <p> If the internal list is a low-volume one, perhaps it makes more 156 1.1.1.1.4.2 matt sense to make it moderated. </p> 157 1.1.1.1.4.2 matt 158 1.1.1.1.4.2 matt <h2><a name="external">Restricting what users can send mail to 159 1.1.1.1.4.2 matt off-site destinations</a></h2> 160 1.1.1.1.4.2 matt 161 1.1.1.1.4.2 matt <blockquote> 162 1.1.1.1.4.2 matt 163 1.1.1.1.4.2 matt <p> How can I configure Postfix in a way that some users can send 164 1.1.1.1.4.2 matt mail to the internet and other users not. The users with no access 165 1.1.1.1.4.2 matt should receive a generic bounce message. Please don't discuss 166 1.1.1.1.4.2 matt whether such access restrictions are necessary, it was not my 167 1.1.1.1.4.2 matt decision. </p> 168 1.1.1.1.4.2 matt 169 1.1.1.1.4.2 matt </blockquote> 170 1.1.1.1.4.2 matt 171 1.1.1.1.4.2 matt <p> Postfix has support for per-user restrictions. The restrictions 172 1.1.1.1.4.2 matt are implemented by the SMTP server. Thus, users that violate the 173 1.1.1.1.4.2 matt policy have their mail rejected by the SMTP server. Like this: 174 1.1.1.1.4.2 matt </p> 175 1.1.1.1.4.2 matt 176 1.1.1.1.4.2 matt <blockquote> 177 1.1.1.1.4.2 matt <pre> 178 1.1.1.1.4.2 matt 554 <user@remote>: Access denied 179 1.1.1.1.4.2 matt </pre> 180 1.1.1.1.4.2 matt </blockquote> 181 1.1.1.1.4.2 matt 182 1.1.1.1.4.2 matt <p> The implementation uses two lookup tables. One table defines 183 1.1.1.1.4.2 matt what users are restricted in where they can send mail, and the 184 1.1.1.1.4.2 matt other table defines what destinations are local. It is left as an 185 1.1.1.1.4.2 matt exercise for the reader to change this into a scheme where only 186 1.1.1.1.4.2 matt some users have permission to send mail to off-site destinations, 187 1.1.1.1.4.2 matt and where most users are restricted. </p> 188 1.1.1.1.4.2 matt 189 1.1.1.1.4.2 matt <p> The example assumes DB/DBM files, but this could also be done 190 1.1.1.1.4.2 matt with LDAP or SQL. </p> 191 1.1.1.1.4.2 matt 192 1.1.1.1.4.2 matt <blockquote> 193 1.1.1.1.4.2 matt <pre> 194 1.1.1.1.4.2 matt /etc/postfix/<a href="postconf.5.html">main.cf</a>: 195 1.1.1.1.4.2 matt <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> = 196 1.1.1.1.4.2 matt <a href="postconf.5.html#check_sender_access">check_sender_access</a> hash:/etc/postfix/restricted_senders 197 1.1.1.1.4.2 matt <i>...other stuff...</i> 198 1.1.1.1.4.2 matt 199 1.1.1.1.4.2 matt <a href="postconf.5.html#smtpd_restriction_classes">smtpd_restriction_classes</a> = local_only 200 1.1.1.1.4.2 matt local_only = 201 1.1.1.1.4.2 matt <a href="postconf.5.html#check_recipient_access">check_recipient_access</a> hash:/etc/postfix/local_domains, reject 202 1.1.1.1.4.2 matt 203 1.1.1.1.4.2 matt /etc/postfix/restricted_senders: 204 1.1.1.1.4.2 matt foo@domain local_only 205 1.1.1.1.4.2 matt bar@domain local_only 206 1.1.1.1.4.2 matt 207 1.1.1.1.4.2 matt /etc/postfix/local_domains: 208 1.1.1.1.4.2 matt this.domain OK <i>matches this.domain and subdomains</i> 209 1.1.1.1.4.2 matt that.domain OK <i>matches that.domain and subdomains</i> 210 1.1.1.1.4.2 matt </pre> 211 1.1.1.1.4.2 matt </blockquote> 212 1.1.1.1.4.2 matt 213 1.1.1.1.4.2 matt <p> Specify <b>dbm</b> instead of <b>hash</b> if your system uses 214 1.1.1.1.4.2 matt <b>dbm</b> files instead of <b>db</b> files. To find out what map 215 1.1.1.1.4.2 matt types Postfix supports, use the command <b>postconf -m</b>. </p> 216 1.1.1.1.4.2 matt 217 1.1.1.1.4.2 matt <p> Note: this scheme does not authenticate the user, and therefore it can be 218 1.1.1.1.4.2 matt bypassed in several ways: </p> 219 1.1.1.1.4.2 matt 220 1.1.1.1.4.2 matt <ul> 221 1.1.1.1.4.2 matt 222 1.1.1.1.4.2 matt <li> <p> By sending mail via a less restrictive mail 223 1.1.1.1.4.2 matt <a href="postconf.5.html#relayhost">relay host</a>. </p> 224 1.1.1.1.4.2 matt 225 1.1.1.1.4.2 matt <li> <p> By sending mail as someone else who does have permission 226 1.1.1.1.4.2 matt to send mail to off-site destinations. </p> 227 1.1.1.1.4.2 matt 228 1.1.1.1.4.2 matt </ul> 229 1.1.1.1.4.2 matt 230 1.1.1.1.4.2 matt </body> 231 1.1.1.1.4.2 matt 232 1.1.1.1.4.2 matt </html> 233
Indexes created Sun Jun 28 00:24:58 UTC 2026