1

I'd like to extend my configuration of postfix to be able to receive mail for my domian.

Currently, I've set up postfix as a smarthost which accepts mail after authentication and forwards it, dependent on the sender, to different servers (like gmail). That works well so far. I'd like to extend the configuration such that mail for my domain (mydomain.com) is accepted, too, but without the need for authentication (Everybody should be allow to send mail to users on that domain). The smarthost capability should remain. Postfix should hence take these 2 tasks:

  1. Act as a smarthost and forward mail with arbitrary receipients after sucessful client authentication
  2. Receive mail from arbitrary senders without authentication buth with receipient on local domain

The current configuration (main.cf) is appended below. I think what I need to do is to change parameters of 'smtpd_client_restrictions' and 'smtpd_receipient_restrictions', but I'm not sure about that. If someone could confirm this, that already would help me a lot.


main.cf:

    [...]
    myhostname = mydomain.com
    mynetworks = 127.0.0.0/8
    mydestination = mydomain.com localhost localhost.mydomain.com
    canonical_maps = regexp:/etc/postfix/canonical-redirect
    home_mailbox = Mail/

    # POSTFIX SERVER AUTHENTICATION
    smtpd_sasl_auth_enable = yes
    smtpd_sasl_security_options = noplaintext, noanonymous
    smtpd_sasl_type = dovecot
    smtpd_sasl_path = private/auth
    smtpd_client_restrictions = permit_sasl_authenticated, reject
    smtpd_recipient_restrictions = permit_sasl_authenticated, reject
    smtpd_tls_security_level = encrypt

    # SENDER DEPENDENT RELAYs
    # relays
    smtp_sender_dependent_authentication = yes
    sender_dependent_relayhost_maps = hash:/etc/postfix/sender_relay
    # auth
    smtp_sasl_auth_enable = yes
    smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
    smtp_sasl_mechanism_filter = GSSAPI, DIGEST-MD5, CRAM-MD5, login, plain
    smtp_tls_security_level = encrypt
    smtp_sasl_security_options = noplaintext, noanonymous
    smtp_sasl_tls_security_options = noplaintext, noanonymous

    #TLS
    smtpd_tls_cert_file=/etc/ssl/cert.pem
    smtpd_tls_key_file=/etc/ssl/cert.key
    [...]

  • Edit: According to the comment of NickW, I modified the permissions to

    smtpd_client_restrictions = 
    smtpd_recipient_restrictions = permit_sasl_authenticated, reject_unknown_recipient_domain, permit
    

For my understanding, this rule would first allow all mail from authenticated users, deny mail for recipients which aren't on mydomain and finally permit these mails. Is this correct so far?

However, postfix then complains about 'fatal parameter "smtpd_recipient_restrictions": specify at least one working instance of: check_relay_domains, reject_unauth_destination, reject, defer or defer_if_permit'. If I put a 'reject' AFTER the 'permit', postfix shows only a warning ('restriction 'reject' after 'permit' is ignored'), but the error isn't showing up...

5
  • Do you get any errors when you try and send mail to users @mydomain.com?
    – NickW
    Aug 4, 2014 at 16:49
  • If I send mail to that host (e.g., [email protected]), I get an 'Undelivered Mail Returned to Sender' with 554: Client host rejected: Access denied (in reply to RCPT TO command). On the system, /var/log/mail.log says 'Client host rejected: Access denied'.
    – user236012
    Aug 4, 2014 at 16:55
  • 1
    Yeah, there's no need to have permit_sasl_authenticated in both client and recipient, try smtpd_recipient_restrictions = reject_unknown_sender_domain as a start..
    – NickW
    Aug 4, 2014 at 17:00
  • did you mean smtp_recipient_restrictions = reject_unknown_RECIPIENT_domain?
    – user236012
    Aug 4, 2014 at 19:18
  • Possibly, wrote it in a hurry yesterday evening :)
    – NickW
    Aug 5, 2014 at 8:30

2 Answers 2

1

Because you've set mydomain.com in mydestination, then you can put permit_auth_destination in your restricition.

smtpd_recipient_restrictions = permit_sasl_authenticated, permit_auth_destination, reject

As NickW say, smtpd_client_restrictions was redundant. You can delete that line.

0

I'm posting this as answer as like to keep the monospace formatting with the comments, this is my current setup for my domain.

# === Incoming mail restriction ================================================

#smtpd_client_restrictions    =
#                               check_client_access hash:/etc/postfix/access

smtpd_recipient_restrictions =
# Whitelisting or blacklisting:
#                                check_recipient_access proxy:mysql:/etc/postfix/mysql-virtual_recipient.cf,
# Mails from our users:
                                permit_mynetworks,
# Greylist
                                check_policy_service unix:private/postgray,
# Everyone should play by the rules:
                                reject_non_fqdn_recipient,
                                reject_non_fqdn_sender,
                                reject_unknown_recipient_domain,
                                reject_unknown_sender_domain,
                                reject_unauth_pipelining,
# Allow authenticated users / 587 TLS/465 SSL
                                permit_sasl_authenticated,
# This will block mails from domains with no reverse DNS record. Will affect both spam and ham mails, but mostly spam.
#                                reject_unknown_reverse_client_hostname,

# Instead of reject_unknown_reverse_client_hostname you can also use reject_unknown_client_hostname, which is an even harder rule. 
# Reject ugly HELO/EHLO-hostnames (could also affect regular mails):
#                                reject_non_fqdn_hostname,
#                                reject_invalid_helo_hostname,
# Reject everything you're not responsible for:
                                reject_unauth_destination,
# Only take mails for existing accounts:
                                reject_unverified_recipient,
# DNS lookups are "expensive", therefore should be at bottom
#                                reject_rbl_client zen.spamhaus.org

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .