Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to set up postfix to allow relaying under a limited set of conditions:

  • The destination domain is one of a pre-defined list
    -or-
  • The client successfully logs in

Here's the relevant bits o' config:

smtpd_sasl_auth_enable=yes
relay_domains=example.com
smtpd_recipient_restrictions=permit_auth_destination,reject_unauth_destination
smtpd_client_restrictions=permit_sasl_authenticated,reject

The problem is that it requires that BOTH restrictions be satisfied, rather than either-or. Which is to say, it only allows relaying if the client is authenticated AND the recipient domain is @example.com.

Instead, I need it to allow relaying if either one of the requirements is satisfied. How do I do this without resorting to running SMTP on two separate ports with different rules?

Note:
The context is an outbound-use-only (bound to 127.0.0.1) MTA on a shared web server which all site owners are allowed to relay mail to one of the "owned" domains (not server-local, though), and for which a limited set of "trusted" site owners are allowed to relay mail without restriction provided they have a valid SMTP login.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

And of course I figure it out 6 minutes after posting the question.

You can put permit_sasl_authenticated in your smtpd_recipient_restrictions setting and remove the smtpd_client_restrictions altogether.

smtpd_sasl_auth_enable=yes
relay_domains=example.com
smtpd_recipient_restrictions=permit_auth_destination,
     permit_sasl_authenticated,reject_unauth_destination

The fact that this option is not documented in http://www.postfix.org/postconf.5.html#smtpd_recipient_restrictions has proved to be a source of not an insignificant amount of frustration in this case.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.