Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We want to grant some specific servers of our network to send mails without authentification. I know that check_sender_access and check_recipient_access both can test sender (MAIL FROM) or recipient (RCPT TO). To prevent heavy usage of smtp_restriction_classes I'm looking for a way to do such a lookup at once. I.e.

# /etc/postfix/check_noauth_servers
root@bi-server     jack@example.com
root@bi-server     jack@example.org
user@reporting     jack@example.org

Is there a solution or access restriction that can do such a lookup?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

You seem to be asking two unrelated questions.

The first,

We want to grant some specific servers of our network to send mails without authentification.

Is easily solved by placing a check_client_access in front of permit_sasl_authenticated:

smtpd_recipient_restrictions = check_client_access hash:/etc/postfix/no-auth, permit_sasl_authenticated, reject_unauth_destination

and in /etc/postfix/no-auth:

your.server.name.or.ip    OK
  • The second part of the question, however, seems to be talking about both sender and recipient access maps, at the same time.

This is precisely what smtpd_restriction_classes are for:

smtpd_restriction_classes = noauth
noauth = check_recipient_access hash:/etc/postfix/allowed_recipients
smtpd_recipient_restrictions = permit_sasl_authenticated, check_sender_access hash:/etc/postfix/allowed_senders, reject_unauth_destination

and in /etc/postfix/allowed_senders:

allowed_sender1@example.com  noauth
allowed_sender2@example.net  noauth

and in /etc/postfix/allowed_recipients:

allowed_recipient1@example.com  OK
allowed_recipient2@example.org  OK

In which order you apply the access checks is up to you.

If you need more complex rules (that combine senders and recipients in one check, for example) look into postfwd, the Postfix FireWall Daemon.

This allows complex rules a la iptables, applied as a policy server (check_policy_service); the advantage of a policy service is that it has access to all pre-DATA parameters (client, helo , sender, recipient) at once.

share|improve this answer
    
Yes, that's exactly, what I have so for. But there are some of that servers, that need to be restricted, so that each server can use only its own sender address and is restricted in using recipients. So I have to use a dozen restriction classes and that's the point I want to optimize/minimize (whatever) –  rabudde Aug 28 '12 at 10:52
    
Ah, that is different. For simple sender-recipient pairing, look into postfwd - the postfix firewall daemon. –  adaptr Aug 28 '12 at 11:02
    
Yeah! Really great. As I see (and I think so) there is no way to do this in postfix directly without usage of dozens of classes. So postfwd is exactly what I'm looking for. Extend you answer, so I can accept it. –  rabudde Aug 28 '12 at 11:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.