Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

In Postfix, how to disallow a local user to send emails, say joe@mail.example.com, to anywhere?

I wrote a sender_access file with the following lines

# cat sender_access
joe REJECT
joe@mail.example.com REJECT

And loaded as a hash postmap hash:sender_access, then I added in main.cf the row

smtpd_sender_restrictions = check_sender_access hash:/etc/postfix/sender_access

and finally I restarted postfix. But the user still writes into the active queue. Maybe there is some other option interference in the conf.

This is my postconf -n:

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
allow_percent_hack = no
append_dot_mydomain = no
biff = no
broken_sasl_auth_clients = yes
config_directory = /etc/postfix
home_mailbox = Maildir/
inet_interfaces = all
mailbox_command = /usr/bin/procmail-wrapper -o -a $DOMAIN -d $LOGNAME
mailbox_size_limit = 0
mydestination = mail.example.com, localhost.neencloud.it, , localhost, mail.example.com
myhostname = mail.example.com
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
myorigin = /etc/mailname
readme_directory = no
recipient_delimiter = +
relayhost =
sender_bcc_maps = hash:/etc/postfix/bcc
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated reject_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sender_restrictions = check_sender_access hash:/etc/postfix/sender_access
smtpd_tls_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file = /etc/ssl/private/ssl-cert-snakeoil.key
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_use_tls = yes
virtual_alias_maps = hash:/etc/postfix/virtual

This is part of mail.log:

Aug 12 15:59:09 ne538 postfix/qmgr[31440]: 4601E7AD8EE7: from=<joe@mail.example.com>, size=115624, nrcpt=1 (queue active)
Aug 12 15:59:09 ne538 postfix/pickup[16329]: 70E627AD8EE8: uid=1051 from=<joe>
Aug 12 15:59:09 ne538 postfix/cleanup[16320]: 70E627AD8EE8: message-id=<20130812135909.70E627AD8EE8@mail.example.com>
Aug 12 15:59:09 ne538 postfix/error[16339]: 4601E7AD8EE7: to=<mailaddress@yahoo.com>, relay=none, delay=0.45, delays=0.32/0/0/0.13, dsn=4.7.0, status=deferred (delivery temporarily suspended: host mta5.am0.yahoodns.net[63.250.192.45] refused to talk to me: 421 4.7.0 [TS01] Messages from 85.159.145.207 temporarily deferred due to user complaints - 4.16.55.1; see http://postmaster.yahoo.com/421-ts01.html)
Aug 12 15:59:09 ne538 postfix/qmgr[31440]: 70E627AD8EE8: from=<joe@mail.example.com>, size=115630, nrcpt=1 (queue active)
Aug 12 15:59:09 ne538 postfix/pickup[16329]: 91B8A7AD8EE9: uid=1051 from=<joe>
Aug 12 15:59:09 ne538 postfix/cleanup[16210]: 91B8A7AD8EE9: message-id=<20130812135909.91B8A7AD8EE9@mail.example.com>
Aug 12 15:59:09 ne538 postfix/smtp[7647]: 73BCC7AD8EE0: host mta6.am0.yahoodns.net[98.138.112.35] refused to talk to me: 421 4.7.0 [TS01] Messages from 85.159.145.207 temporarily deferred due to user complaints - 4.16.55.1; see http://postmaster.yahoo.com/421-ts01.html
Aug 12 15:59:09 ne538 postfix/error[16335]: 70E627AD8EE8: to=<anothermailaddress@yahoo.com>, relay=none, delay=0.52, delays=0.3/0/0/0.22, dsn=4.7.0, status=deferred (delivery temporarily suspended: host mta5.am0.yahoodns.net[63.250.192.45] refused to talk to me: 421 4.7.0 [TS01] Messages from 85.159.145.207 temporarily deferred due to user complaints - 4.16.55.1; see http://postmaster.yahoo.com/421-ts01.html)
Aug 12 15:59:09 ne538 postfix/qmgr[31440]: 91B8A7AD8EE9: from=<joe@mail.example.com>, size=115625, nrcpt=1 (queue active)
Aug 12 15:59:09 ne538 postfix/pickup[16329]: C6C807AD8EEA: uid=1051 from=<joe>
Aug 12 15:59:09 ne538 postfix/cleanup[16320]: C6C807AD8EEA: message-id=<20130812135909.C6C807AD8EEA@mail.example.com>
Aug 12 15:59:09 ne538 postfix/smtp[7647]: 73BCC7AD8EE0: host mta5.am0.yahoodns.net[66.196.118.37] refused to talk to me: 421 4.7.0 [TS01] Messages from 85.159.145.207 temporarily deferred due to user complaints - 4.16.55.1; see http://postmaster.yahoo.com/421-ts01.html
share|improve this question
    
where is mail log with successful delivering? output of the postconf -n would be more preferred –  ALex_hha Aug 12 '13 at 13:51
    
Mail From: Headers are trivially spoofable, and using them as a method of control is asking for problems.. if you do SASL logins, a program like policyd will give you much better control. –  NickW Aug 12 '13 at 13:58
    
Yes nice point but joe is a local user. Do I need to configure SPF on this server even to stop him? –  fsoppelsa Aug 12 '13 at 14:05
    
local users mean smtp restrictions, not smtpd. –  NickW Aug 12 '13 at 14:07
    
Mmh so where should I work on? –  fsoppelsa Aug 12 '13 at 14:16

2 Answers 2

up vote 4 down vote accepted

If you are looking to allow certain users access to local mail submission, the parameter you need to use is authorized_submit_users, the only issue is that it is a whitelist, hopefully you don't have lots of local users who need to send email. If you have postfix 2.4+ you can use a format like this: authorized_submit_users = !joe, static:all
which is joe no, everyone else yes.

share|improve this answer
    
This worked and stopped the chaos. Thank you. –  fsoppelsa Aug 12 '13 at 15:02
    
Glad to have been of assistance :) –  NickW Aug 12 '13 at 15:07
    
As for completeness, I allowed the other users to send by writing the following directive: authorized_submit_users = !joe, static:anyone –  fsoppelsa Aug 13 '13 at 14:07

I believe this article will give you the required information: http://www.postfix.org/RESTRICTION_CLASS_README.html

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.