Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have this smtp restriction in postfix configuration file:

smtpd_sender_restrictions = permit_sasl_authenticated, check_policy_service inet:127.0.0.1:10031,permit_mynetworks, warn_if_reject reject_non_fqdn_sender, reject_unauth_pipelining, reject_authenticated_sender_login_mismatch, reject_unknown_sender_domain

to my knowledge, if permit_sasl_authenticated says that specific user is authenticated, then rest of restrictions are not checked.?

What if i want to make sure that "permit_sasl_authenticated" and "check_policy_service inet:127.0.0.1:10031", if they both say yes, Only then the email should be passed otherwise no? actually i am trying to setup cluebringer, but getting problem that it is saying "Sender address rejected", even after the sender is authenticated properly from SASL.

Here is my postconf -n output:

append_dot_mydomain = no
biff = no
broken_sasl_auth_clients = yes
config_directory = /etc/postfix
disable_vrfy_command = yes
inet_interfaces = 91.91.98.67, localhost
mailbox_command = procmail -a "$EXTENSION"
mailbox_size_limit = 0
mydestination = mauth.fdomain.co.uk, localhost
myhostname = mauth.fdomain.co.uk
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
myorigin = /etc/mailname
readme_directory = no
recipient_delimiter = +
relay_domains = mysql:/etc/postfix/relaydomains.cf
relayhost =
smtp_bind_address = 91.91.9.7
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = mysql:/etc/postfix/authsmtp.conf
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_banner = $myhostname Freezone Internet ESMTP
smtpd_client_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_rbl_client sbl.spamhaus.org, reject_rbl_client blackholes.easynet.nl, reject_rbl_client bl.spamcop.net
smtpd_data_restrictions = permit_sasl_authenticated, reject_unauth_pipelining
smtpd_delay_reject = yes
smtpd_end_of_data_restrictions = check_policy_service inet:127.0.0.1:10031
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_sasl_authenticated, permit_mynetworks, warn_if_reject reject_non_fqdn_hostname, reject_invalid_hostname, permit
smtpd_recipient_restrictions = permit_sasl_authenticated, check_policy_service inet:127.0.0.1:10031, permit_mynetworks, reject_unauth_destination
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated
smtpd_sasl_auth_enable = yes
smtpd_sasl_local_domain =
smtpd_sasl_security_options = noanonymous
smtpd_sender_restrictions = permit_sasl_authenticated, check_policy_service inet:127.0.0.1:10031,permit_mynetworks, warn_if_reject reject_non_fqdn_sender, reject_unauth_pipelining, reject_authenticated_sender_login_mismatch, reject_unknown_sender_domain
smtpd_tls_CAfile = /etc/postfix/ssl/freezonewc.ca
smtpd_tls_auth_only = no
smtpd_tls_cert_file = /etc/postfix/ssl/freezonewc.crt
smtpd_tls_key_file = /etc/postfix/ssl/freezonewc.key
smtpd_tls_loglevel = 2
smtpd_tls_received_header = yes
smtpd_tls_security_level = may
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_tls_session_cache_timeout = 3600s
smtpd_use_tls = yes
transport_maps = mysql:/etc/postfix/transport.cf
unknown_local_recipient_reject_code = 450
share|improve this question

2 Answers 2

up vote 2 down vote accepted

To be honest, your restrictions are a bit of a mess right now. The postfix-users mailing list usually recommends to gather all restrictions under smtpd_recipient_restrictions or smtpd_relay_restrictions (Postfix 2.10 only). The reason for this is that it enhances readability and doesn't really make much of a difference with smtpd_delay_reject=yes.

Furthermore, a policy service should rarely reply with an accept/ok statement but rather with DUNNO. So in your case, first asking the policy service, giving it a chance to say REJECT and then checking SASL seems like a better way, unless your policy service does return OK in some cases.

Without knowing neither the exact nature of your policy service nor your requirements, I'd start out with something like this:

smtpd_relay_restrictions =
  # subject even authenticated users and trusted networks
  # to the policy check
  check_policy_service inet:127.0.0.1:10031
  permit_mynetworks
  reject_unknown_sender_domain
  permit_sasl_authenticated
  defer_unauth_destination

smtpd_recipient_restrictions =
  permit_mynetworks
  permit_sasl_authenticated
  # we exclude our networks and SASL authenticated users
  # from all further checks.
  # since I don't know if the policy service is relevant
  # for unauthenticated mail, I commented it out here
  # check_policy_service inet:127.0.0.1:10031
  warn_if_reject reject_non_fqdn_hostname
  warn_if_reject reject_non_fqdn_sender
  reject_invalid_hostname
  reject_unknown_sender_domain

smtpd_data_restrictions = reject_unauth_pipelining

See the comments in my configuration snippet for some caveats.

share|improve this answer

to my knowledge, if permit_sasl_authenticated says that specific user is authenticated, then rest of restrictions are not checked.?

you are right, but only in the current smtpd_xxx_restrictions

Just remove permit_sasl_authenticated from smtpd_sender_restrictions and move all verifications to the policy service

smtpd_sender_restrictions = check_policy_service inet:127.0.0.1:10031, ...

There would be available the following options

sasl_method
sasl_username
sasl_sender

These attributes would be empty in case of no SASL authentication. On the logical level it could be something like the following

if [ policy_service_return_code == OK && sasl_username not empty ]
   return OK
else
   return REJECT
share|improve this answer
    
didnt get you.. –  Farhan Sep 9 '13 at 12:41
    
what kind of policy service are you using? –  ALex_hha Sep 9 '13 at 18:40
    
Cluebringer policyd –  Farhan Sep 12 '13 at 11:15
    
Which one, v1 or v2? –  ALex_hha Sep 13 '13 at 7:22
    
its version v2.. –  Farhan Sep 13 '13 at 16:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.