0

I have configured Policyd v2 (cluebringer) to apply quota on msg count for SASL and non-SASL users. It is easy in policyd [1]. However I don't know how to configure postfix (2.7.1). Right now I have this (non important rules removed):

smtpd_recipient_restrictions    =
    check_policy_service inet:127.0.0.1:10031,
    permit_sasl_authenticated,
    permit_mynetworks,
    reject_unauth_destination,
    reject_rbl_client zen.spamhaus.org,

check_policy_service must be before permit_sasl_authentificated to be able to check on SASL users (because permit_sasl_authentificated returns OK and no other permissions are checked after it).

But having it here means, that it would count every incoming email attempt in quota - regardless if it will be accepted by postfix or not (because greylist/blacklist and reject_unauth_destination are after check_policy_service). So all rejected spam would count on recipient users' quota.

How is it possible to have policyd be invoked for both SASL incoming email and for non-SASL email which is accepted for server?

1]: http://lists.policyd.org/pipermail/users_lists.policyd.org/2012-October/004002.html

3
  • Why cant you add all reject restrictions first, followed by check_policy_service followed by permit clauses?
    – clement
    Jul 9, 2014 at 10:59
  • 1
    For example reject_unauth_destination (rejects all mail for which postfix is not final destination) must be after permit_sasl_authenticated otherwise SASL auth would not work.
    – Marki555
    Jul 9, 2014 at 11:49
  • I suggest you to upgrade postfix to version 2.10. This version has feature smtpd_relay_restriction to separate permit_sasl and check policy
    – masegaloeh
    Jul 9, 2014 at 13:44

1 Answer 1

1

In case of Postfix version 2.10 or newer, you can try to solved those problem by using smtpd_relay_restriction feature. Snippet from postfix documentation explains how to use them properly.

Relay policy is specified under smtpd_relay_restrictions, and the spam blocking policy under smtpd_recipient_restrictions.

Then your configuration should like this

smtpd_relay_restriction = 
    permit_mynetworks,
    permit_sasl_authenticated,
    reject_unauth_destination

smtpd_recipient_restrictions =
    reject_rbl_client zen.spamhaus.org,
    check_policy_service inet:127.0.0.1:10031
2
  • Will this call policyd before rejecting email by spamhaus? I want to avoid that. I just want to invoke policyd only for otherwise accepted emails (SASL or non-SASL), so that I can enforce quotas on them.
    – Marki555
    Jul 16, 2014 at 19:58
  • In that case, just reorder to smtpd_recipient_restrictions = reject_rbl_client zen.spamhaus.org, check_policy_service inet:127.0.0.1:10031 `
    – masegaloeh
    Jul 16, 2014 at 20:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .