Postfix - Is there a way to reject invalid authentication (even for mynetworks)?

Question

I got a working postfix/dovecot configuration running with the following rule for recipients rejection:

smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject

This works as intended (authorize authenticated users or users from mynetworks, reject others). However if a user coming from mynetworks fails to authenticate he is not rejected.

Is there such a rule as reject_invalid_sasl_auth? Something that would reject the user only if he entered an invalid authentication, but would allow users without authentication.

Otherwise, is there another way than restriction rules to achieve this kind of behavior (SASL option, custom policy)?

Answer 1

Since you only explicitly permit SASL authenticated users, if the user is not authenticated the next restriction in line is checked - which is mynetworks, which happens to match.

So, entirely due to your rule ordering non-auth clients are allowed from your trusted networks.

Instead, consider setting it up like this:

smtpd_client_restrictions = permit_sasl_authenticated, reject
smtpd_recipient_restrictions = permit_mynetworks, reject

NOTE that when you apply this to your external port 25 smtpd listener, this will cause you to not receive internet mail, ever.

Answer 2

I think the idea could be to run your MTA where you receive mail from other peers (other mail servers) on port 25. You run another smtpd process on port 587 to receive from authenticated users.

This way you can have standard rules like:

smtpd_recipient_restrictions =
  permit_mynetworks
  reject_unauth_destination

in your main.cf

OTOH you configure your port 587 the following way in master.cf like:

submission inet  n       -       -       -       -       smtpd
    -o smtpd_enforce_tls=yes
    -o smtpd_sasl_auth_enable=yes
    -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject

UPDATE

To reply to the comment. This does two things.

First if it receives connection on port 25 it will only accept from mynetworks it will never accept mail except what can be delivered local.

Second if it receives connection on port 587 it will accept mail only from authenticated clients.