Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a simple postfix installation on RedHat that's been running fine for years and uses TLS/saslauthd/PAM to allow users to authenticate to relay mail from the external network. All users are local linux accounts, so the saslauthd method using PAM has worked well in general.

There are several local accounts that are not used for login by users and have the shell set to /sbin/nologin, but these accounts are still exposed via SMTP via saslauthd. I have not found any obvious method for providing a list of accounts to saslauthd that should be denied authentication. Basically, I'm looking for a way to whitelist or blacklist user accounts so that they are always denied SMTP relay permission. I don't want all existing local accounts to be allowed to relay mail, only those that I choose. Is there a convenient way to do this without a major change to my current authentication chain?

share|improve this question

One way would be to use pam_listfile and make it deny users listed in some text file you provide to it.

share|improve this answer

Its a hack but you could use envelope sender authorization, Then use reject_sender_login_mismatch to block the users who are not authorized.

share|improve this answer

I doubt exclusion of given SASL users is natively possible in Postfix. You can however create a custom Postfix policy service that permits and denies access based on whatever criteria you choose. I have created the pfxpold framework as a basis for this, but pfxpold needs a customized Perl class and may be too heavyweight for your application. Nevertheless, trivial policy checks on low-utilization systems can be broken down to a few lines of shell script.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.