1

I have a simple postfix installation on RedHat that's been running fine for years and uses TLS/saslauthd/PAM to allow users to authenticate to relay mail from the external network. All users are local linux accounts, so the saslauthd method using PAM has worked well in general.

There are several local accounts that are not used for login by users and have the shell set to /sbin/nologin, but these accounts are still exposed via SMTP via saslauthd. I have not found any obvious method for providing a list of accounts to saslauthd that should be denied authentication. Basically, I'm looking for a way to whitelist or blacklist user accounts so that they are always denied SMTP relay permission. I don't want all existing local accounts to be allowed to relay mail, only those that I choose. Is there a convenient way to do this without a major change to my current authentication chain?

Improve this question
1
  • A better alternative may sometimes be to specify your SMTP AUTH users completely separately: postfix.org/SASL_README.html#auxprop_sasldb . This should result in no logins other than what you specify, though these would not be linked to your system's logins at all, but rather completely separate.
    – MikeBeaton
    Nov 5, 2020 at 19:15

3 Answers 3

Reset to default
1

One way would be to use pam_listfile and make it deny users listed in some text file you provide to it.

Improve this answer
0

Its a hack but you could use envelope sender authorization, http://www.postfix.org/SASL_README.html#server_sasl_authz Then use reject_sender_login_mismatch to block the users who are not authorized.

Improve this answer
0

I doubt exclusion of given SASL users is natively possible in Postfix. You can however create a custom Postfix policy service that permits and denies access based on whatever criteria you choose. I have created the pfxpold framework as a basis for this, but pfxpold needs a customized Perl class and may be too heavyweight for your application. Nevertheless, trivial policy checks on low-utilization systems can be broken down to a few lines of shell script.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .