Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to learn about running a mail server by running a mail server.

To be somewhat responsible and avoid being an open relay, I want Postfix to reject all mail that is not addressed to <valid user>@<hostname> OR (is from <valid user>@<hostname> AND the connection is coming from localhost). Will it do that by default or do I have to set some configuration?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

There are plenty of checks you can put in place inside main.cf which allow you to do exactly what you want. Some may be in place, others may not. For example Debian and Ubuntu often seem to have sensible defaults, whereas RHEL etc often do not.

In a canonical main.cf you would usually have mydestination to be a comma separated list of domain names allowed as destination domains. Furthermore you'd probably only allow accepting certain things such as relaying by setting mynetworks to a list of IP addresses and subnets (CIDR). And then, to put everything together based on (among other things) those two values you set smtpd_recipient_restrictions, e.g. here an excerpt:

smtpd_recipient_restrictions =
    permit_sasl_authenticated,
    reject_invalid_hostname,
    reject_non_fqdn_sender,
    reject_non_fqdn_recipient,
    reject_unknown_sender_domain,
    reject_unknown_recipient_domain,
    reject_unauth_pipelining,
    permit_mynetworks,
    reject_unauth_destination,
    ...

The order of the restrictions does matter. You can see how we already restrict taking in messages before we permit for mynetworks (permit_mynetworks).

You best course of action is likely to read the excellent documentation, e.g. here about the topic you seem most concerned about.

share|improve this answer
    
You might want to elaborate on those non-sensible defaults that RHEL has. As it stands this is some good advice for how to avoid creating an open relay by accident, but it needs a little more effort to directly address the question. –  Andrew B Mar 30 '13 at 17:32
    
You should also elaborate on those sensible defaults that Debian and Ubuntu supposedly have. Do you have any experience with any of them? –  Michael Hampton Mar 31 '13 at 3:47

Postfix should be correctly configured to not open relay, out of the box. You would have to explicitly change settings in order to make it an open relay.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.