Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any way to control which hosts are permitted to connect to the cleanup daemon over TCP?

Our '' contains:

2526      inet  n       -       -       -       0       cleanup

This is necessary because we have a cluster of SMTP servers running custom code, and they can all inject mail to the centralized postfix server via the cleanup daemon.

However, we want to allow only our authorized servers to connect to the cleanup daemon. The current configuration allows any host to connect to port 2526.

Clearly we can use iptables to restrict access, but is there a way to do this within postfix itself?

share|improve this question
up vote 4 down vote accepted

As far as I can tell the cleanup daemon does not have any auth controls. You could try to write a non-smtp milter, but the functionality is pretty limited and I'm not sure it would even help.

The better option might be to expose qmqpd instead. It should pipe things directly into cleanup, but allows you to do simple controls. qmqpd_authorized_clients would be the way to handle it there. I'd suspect you'd need to rewrite some code if you go this route.

share|improve this answer
Thanks. That was pretty much the conclusion I had come to as well. And welcome to Serverfault and the StackExchange network! – Flimzy Jun 4 '12 at 16:05
heh, no problem and always good to get a second pair of eyes. – Ramin Jun 5 '12 at 16:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.