3

I have an email server running Postfix that generally works great. I'm trying to use this server as the SMTP server for outgoing mail in a CRM/Marketing platform installation. I've entered the authentication credentials and it works fine. However, I can only use the mailbox that I'm authenticating with as the "from" address. If I try to use a different address (on the same domain) in a campaign, it fails to send and results in this error:

This message was undeliverable after 3 attempts due to the following reason: Error Message: Response from Server 220 server.com 250-server.com 250-PIPELINING 250-SIZE 26214400 250-ETRN 250-STARTTLS 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 DSN 220 2.0.0 Ready to start TLS 250-server.com 250-PIPELINING 250-SIZE 26214400 250-ETRN 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 DSN 334 VXNlcm5hbWU6 334 UGFzc3dvcmQ6 235 2.7.0 Authentication successful 250 2.1.0 Ok 553 5.7.1 : Sender address rejected: not owned by user [email protected] 250 2.0.0 Ok .

Is there a way to configure Postfix to allow me to send from any address on this one particular domain after authenticating with one account? Can I assign addresses to this user I'm authenticating with? I don't want to open this up on other domains, just this one particular domain I'm using for this CRM.

Thanks!

--

Here's what postconf -n gives me:

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
bounce_queue_lifetime = 1d
broken_sasl_auth_clients = yes
config_directory = /etc/postfix
disable_vrfy_command = yes
html_directory = /usr/share/doc/postfix/html
inet_interfaces = all
inet_protocols = all
mailbox_size_limit = 0
maximal_backoff_time = 1800s
maximal_queue_lifetime = 1d
message_size_limit = 26214400
milter_default_action = accept
milter_protocol = 6
minimal_backoff_time = 300s
mydestination = mail1.mydomain.com, localhost.mydomain.com, localhost
myhostname = mail1.mydomain.com
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
myorigin = /etc/mailname
postscreen_access_list = permit_mynetworks, cidr:/etc/postfix/postscreen_access.cidr
postscreen_bare_newline_enable = no
postscreen_blacklist_action = drop
postscreen_cache_cleanup_interval = 24h
postscreen_cache_map = proxy:btree:$data_directory/postscreen_cache
postscreen_dnsbl_action = enforce
postscreen_dnsbl_sites = b.barracudacentral.org=127.0.0.2*7 dnsbl.inps.de=127.0.0.2*7 bl.mailspike.net=127.0.0.2*5 bl.mailspike.net=127.0.0.[10;11;12]*4 dnsbl.sorbs.net=127.0.0.10*8 dnsbl.sorbs.net=127.0.0.5*6 dnsbl.sorbs.net=127.0.0.7*3 dnsbl.sorbs.net=127.0.0.8*2 dnsbl.sorbs.net=127.0.0.6*2 dnsbl.sorbs.net=127.0.0.9*2 zen.spamhaus.org=127.0.0.[10;11]*8 zen.spamhaus.org=127.0.0.[4..7]*6 zen.spamhaus.org=127.0.0.3*4 zen.spamhaus.org=127.0.0.2*3 hostkarma.junkemailfilter.com=127.0.0.2*3 hostkarma.junkemailfilter.com=127.0.0.4*1 hostkarma.junkemailfilter.com=127.0.1.2*1 wl.mailspike.net=127.0.0.[18;19;20]*-2 hostkarma.junkemailfilter.com=127.0.0.1*-2
postscreen_dnsbl_threshold = 8
postscreen_dnsbl_ttl = 5m
postscreen_greet_action = enforce
postscreen_greet_banner = $smtpd_banner
postscreen_greet_ttl = 2d
postscreen_greet_wait = 3s
postscreen_non_smtp_command_enable = no
postscreen_pipelining_enable = no
proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $smtpd_sender_login_maps
queue_run_delay = 300s
readme_directory = /usr/share/doc/postfix
recipient_delimiter = +
relay_domains = proxy:mysql:/etc/postfix/sql/mysql_virtual_mxdomain_maps.cf
relay_recipient_maps = proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_maps.cf
relayhost =
smtp_header_checks = pcre:/etc/postfix/mailcow_anonymize_headers.pcre
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
smtp_tls_cert_file = /etc/ssl/mail/mail.crt
smtp_tls_key_file = /etc/ssl/mail/mail.key
smtp_tls_loglevel = 1
smtp_tls_security_level = may
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_banner = $myhostname
smtpd_data_restrictions = reject_unauth_pipelining, permit
smtpd_delay_reject = yes
smtpd_error_sleep_time = 10s
smtpd_hard_error_limit = ${stress?1}${stress:5}
smtpd_helo_required = yes
smtpd_proxy_timeout = 600s
smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_invalid_helo_hostname, reject_unknown_reverse_client_hostname, reject_unknown_client_hostname, reject_non_fqdn_helo_hostname, reject_unauth_destination, reject_rbl_client zen.spamhaus.org, reject_rbl_client bl.spamcop.net, reject_rbl_client cbl.abuseat.org, reject_rbl_client b.barracudacentral.org
smtpd_restriction_classes = z1_greylisting
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
smtpd_sasl_path = private/auth_dovecot
smtpd_sasl_type = dovecot
smtpd_sender_login_maps = proxy:mysql:/etc/postfix/sql/mysql_virtual_sender_acl.cf, proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_maps.cf
smtpd_sender_restrictions = reject_authenticated_sender_login_mismatch, permit_mynetworks, reject_sender_login_mismatch, permit_sasl_authenticated, reject_unlisted_sender, reject_unknown_sender_domain
smtpd_soft_error_limit = 3
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /etc/ssl/mail/mail.crt
smtpd_tls_dh1024_param_file = /etc/ssl/mail/dhparams.pem
smtpd_tls_eecdh_grade = strong
smtpd_tls_exclude_ciphers = ECDHE-RSA-RC4-SHA
smtpd_tls_key_file = /etc/ssl/mail/mail.key
smtpd_tls_loglevel = 1
smtpd_tls_mandatory_ciphers = high
smtpd_tls_mandatory_exclude_ciphers = ECDHE-RSA-RC4-SHA
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
smtpd_tls_security_level = may
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
tls_high_cipherlist = EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA
virtual_alias_maps = proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_maps.cf, proxy:mysql:/etc/postfix/sql/mysql_virtual_spamalias_maps.cf, proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_domain_maps.cf, proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_domain_catchall_maps.cf
virtual_gid_maps = static:5000
virtual_mailbox_base = /var/vmail/
virtual_mailbox_domains = proxy:mysql:/etc/postfix/sql/mysql_virtual_domains_maps.cf
virtual_mailbox_maps = proxy:mysql:/etc/postfix/sql/mysql_virtual_mailbox_maps.cf, proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_domain_mailbox_maps.cf
virtual_minimum_uid = 104
virtual_transport = lmtp:unix:private/dovecot-lmtp
virtual_uid_maps = static:5000
z1_greylisting = permit_dnswl_client list.dnswl.org, check_policy_service inet:127.0.0.1:10023

Here's what mysql_virtual_sender_acl.cf:

# mysql_virtual_sender_acl.cf
user = mailcow
password = password
hosts = localhost
dbname = mailcow
query = SELECT logged_in_as FROM sender_acl WHERE send_as='%s'
#expansion_limit = 100

And in mysql_virtual_alias_maps.cf:

# mysql_virtual_alias_maps.cf
user = mailcow
password = password
hosts = localhost
dbname = mailcow
query = SELECT goto FROM alias WHERE address='%s' AND active = '1'
#expansion_limit = 100
Improve this question
1
  • yes, you can. But it seems that someone already has configured such restriction. Because by default postfix doesn't apply such restriction. Could you add output of the 'postconf -n' to the question?
    – ALex_hha
    Feb 25, 2016 at 19:57

2 Answers 2

Reset to default
3

You can use reject_authenticated_sender_login_mismatch

Make users for test

# saslpasswd2 -c -u example.net user1
# saslpasswd2 -c -u example.com user2

# sasldblistusers2
[email protected]: userPassword
[email protected]: userPassword

Do some basic tests. As you can see without reject_authenticated_sender_login_mismatch user can use in MAIL FROM whatever he want

# echo "Hello world" | swaks -s 127.0.0.1 --from [email protected] --to [email protected] --h-Subject "Test" --auth PLAIN --auth-user user1 --auth-password 1234567 --body -
=== Trying 127.0.0.1:25...
=== Connected to 127.0.0.1.
<-  220 mail.example.net ESMTP Postfix
 -> EHLO svn.example.net
<-  250-mail.example.net
<-  250-PIPELINING
<-  250-SIZE 10240000
<-  250-VRFY
<-  250-ETRN
<-  250-AUTH LOGIN PLAIN
<-  250-ENHANCEDSTATUSCODES
<-  250-8BITMIME
<-  250 DSN
 -> AUTH PLAIN AHVzZXIxADEyMzQ1Njc=
<-  235 2.7.0 Authentication successful
 -> MAIL FROM:<[email protected]>
<-  250 2.1.0 Ok
 -> RCPT TO:<[email protected]>
<-  250 2.1.5 Ok
 -> DATA
<-  354 End data with <CR><LF>.<CR><LF>
 -> Date: Thu, 25 Feb 2016 20:53:45 +0000
 -> To: [email protected]
 -> From: [email protected]
 -> Subject: Test
 -> X-Mailer: swaks v20130209.0 jetmore.org/john/code/swaks/
 ->
 -> Hello world
 ->
 ->
 -> .
<-  250 2.0.0 Ok: queued as E1D3D406CC
 -> QUIT
<-  221 2.0.0 Bye
=== Connection closed with remote host.

# grep E1D3D406CC /var/log/maillog
Feb 25 20:53:45 svn postfix/smtpd[56996]: E1D3D406CC: client=localhost[127.0.0.1], sasl_method=PLAIN, [email protected]
Feb 25 20:53:45 svn postfix/cleanup[56999]: E1D3D406CC: message-id=<[email protected]>
Feb 25 20:53:45 svn postfix/qmgr[56990]: E1D3D406CC: from=<[email protected]>, size=416, nrcpt=1 (queue active)
Feb 25 20:53:45 svn postfix/local[57000]: E1D3D406CC: to=<[email protected]>, relay=local, delay=0.03, delays=0.02/0/0/0.01, dsn=2.0.0, status=sent (delivered to mailbox)
Feb 25 20:53:45 svn postfix/qmgr[56990]: E1D3D406CC: removed

# echo "Hello world" | swaks -s 127.0.0.1 --from [email protected] --to [email protected] --h-Subject "Test" --auth PLAIN --auth-user user1 --auth-password 1234567 --body -
=== Trying 127.0.0.1:25...
=== Connected to 127.0.0.1.
<-  220 mail.example.net ESMTP Postfix
 -> EHLO svn.example.net
<-  250-mail.example.net
<-  250-PIPELINING
<-  250-SIZE 10240000
<-  250-VRFY
<-  250-ETRN
<-  250-AUTH LOGIN PLAIN
<-  250-ENHANCEDSTATUSCODES
<-  250-8BITMIME
<-  250 DSN
 -> AUTH PLAIN AHVzZXIxADEyMzQ1Njc=
<-  235 2.7.0 Authentication successful
 -> MAIL FROM:<[email protected]>
<-  250 2.1.0 Ok
 -> RCPT TO:<[email protected]>
<-  250 2.1.5 Ok
 -> DATA
<-  354 End data with <CR><LF>.<CR><LF>
 -> Date: Thu, 25 Feb 2016 20:55:13 +0000
 -> To: [email protected]
 -> From: [email protected]
 -> Subject: Test
 -> X-Mailer: swaks v20130209.0 jetmore.org/john/code/swaks/
 ->
 -> Hello world
 ->
 ->
 -> .
<-  250 2.0.0 Ok: queued as 94CBF4076C
 -> QUIT
<-  221 2.0.0 Bye
=== Connection closed with remote host.

# grep 94CBF4076C /var/log/maillog
Feb 25 20:55:13 svn postfix/smtpd[56996]: 94CBF4076C: client=localhost[127.0.0.1], sasl_method=PLAIN, [email protected]
Feb 25 20:55:13 svn postfix/cleanup[56999]: 94CBF4076C: message-id=<[email protected]>
Feb 25 20:55:13 svn postfix/qmgr[56990]: 94CBF4076C: from=<[email protected]>, size=424, nrcpt=1 (queue active)
Feb 25 20:55:13 svn postfix/local[57000]: 94CBF4076C: to=<[email protected]>, relay=local, delay=0.01, delays=0.01/0/0/0, dsn=2.0.0, status=sent (delivered to mailbox)
Feb 25 20:55:13 svn postfix/qmgr[56990]: 94CBF4076C: removed

But after we have added the following lines

# /etc/postfix/main.cf

smtpd_sender_login_maps = hash:/etc/postfix/sender_logins_maps
smtpd_sender_restrictions = reject_authenticated_sender_login_mismatch

Do not forget to create map and restart the postfix

# postmap /etc/postfix/sender_logins_maps
# service postfix restart

# cat /etc/postfix/sender_logins_maps
[email protected] [email protected]
[email protected] [email protected]
[email protected] [email protected]

User can't use anymore whatever he wants

# echo "Hello world" | swaks -s 127.0.0.1 --from [email protected] --to [email protected] --h-Subject "Test" --auth PLAIN --auth-user user1 --auth-password 1234567 --body -
=== Trying 127.0.0.1:25...
=== Connected to 127.0.0.1.
<-  220 mail.example.net ESMTP Postfix
 -> EHLO svn.example.net
<-  250-mail.example.net
<-  250-PIPELINING
<-  250-SIZE 10240000
<-  250-VRFY
<-  250-ETRN
<-  250-AUTH LOGIN PLAIN
<-  250-ENHANCEDSTATUSCODES
<-  250-8BITMIME
<-  250 DSN
 -> AUTH PLAIN AHVzZXIxADEyMzQ1Njc=
<-  235 2.7.0 Authentication successful
 -> MAIL FROM:<[email protected]>
<-  250 2.1.0 Ok
 -> RCPT TO:<[email protected]>
<** 553 5.7.1 <[email protected]>: Sender address rejected: not owned by user user1
 -> QUIT
<-  221 2.0.0 Bye
=== Connection closed with remote host.

But with the settings above [email protected] can use in MAIL FROM only: [email protected], [email protected] and [email protected]

# echo "Hello world" | swaks -s 127.0.0.1 --from [email protected] --to [email protected] --h-Subject "Test" --auth PLAIN --auth-user [email protected] --auth-password 1234567 --body -
=== Trying 127.0.0.1:25...
=== Connected to 127.0.0.1.
<-  220 mail.example.net ESMTP Postfix
 -> EHLO svn.example.net
<-  250-mail.example.net
<-  250-PIPELINING
<-  250-SIZE 10240000
<-  250-VRFY
<-  250-ETRN
<-  250-AUTH LOGIN PLAIN
<-  250-ENHANCEDSTATUSCODES
<-  250-8BITMIME
<-  250 DSN
 -> AUTH PLAIN AHVzZXIxQGV4YW1wbGUubmV0ADEyMzQ1Njc=
<-  235 2.7.0 Authentication successful
 -> MAIL FROM:<[email protected]>
<-  250 2.1.0 Ok
 -> RCPT TO:<[email protected]>
<-  250 2.1.5 Ok
 -> DATA
<-  354 End data with <CR><LF>.<CR><LF>
 -> Date: Thu, 25 Feb 2016 23:03:07 +0000
 -> To: [email protected]
 -> From: [email protected]
 -> Subject: Test
 -> X-Mailer: swaks v20130209.0 jetmore.org/john/code/swaks/
 ->
 -> Hello world
 ->
 ->
 -> .
<-  250 2.0.0 Ok: queued as 9FE524068A
 -> QUIT
<-  221 2.0.0 Bye
=== Connection closed with remote host.

# grep 9FE524068A /var/log/maillog
Feb 25 23:03:07 svn postfix/smtpd[19097]: 9FE524068A: client=localhost[127.0.0.1], sasl_method=PLAIN, [email protected]
Feb 25 23:03:07 svn postfix/cleanup[19100]: 9FE524068A: message-id=<[email protected]>
Feb 25 23:03:07 svn postfix/qmgr[19092]: 9FE524068A: from=<[email protected]>, size=419, nrcpt=1 (queue active)
Feb 25 23:03:07 svn postfix/local[19101]: 9FE524068A: to=<[email protected]>, relay=local, delay=0.01, delays=0.01/0/0/0, dsn=2.0.0, status=sent (delivered to mailbox)
Feb 25 23:03:07 svn postfix/qmgr[19092]: 9FE524068A: removed

P.S. a little trick

if don't add any line for some specific user in the /etc/postfix/sender_logins_maps - he will receive an emails but won't send.

I can't seem to run saslauthd. It says command not found. Is that a separate utility? EDIT: Sorry I meant to say testsaslauthd. Neither work

It's just a test. So to quick setup test environment I have choose sasldb. Because I don't have time to setup and configure MySQL. You are using MySQL to store all information about users. And your restrictions described here

smtpd_sender_login_maps = 
 proxy:mysql:/etc/postfix/sql/mysql_virtual_sender_acl.cf
 proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_maps.cf

You should add contents of the mysql_virtual_sender_acl.cf/mysql_virtual_alias_maps.cf (without password of course) to the question

Is there a way to configure Postfix to allow me to send from any address on this one particular domain after authenticating with one account?

in the /etc/postfix/sender_logins_maps you should have something like the following

@example.net [email protected]

Modify smtpd_sender_login_maps

smtpd_sender_login_maps = 
 hash:/etc/postfix/sender_logins_maps,
 proxy:mysql:/etc/postfix/sql/mysql_virtual_sender_acl.cf, 
 proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_maps.cf

The file /etc/postfix/sender_logins_maps should contain only one line

@example.net [email protected]

where @example.net - "one particular domain", [email protected] - "authenticating with one account". It must be sasl_username!

sasl_method=PLAIN, [email protected]

Don't forget to create map and restart the postfix.

Improve this answer
9
  • I can't seem to run saslauthd. It says command not found. Is that a separate utility? EDIT: Sorry I meant to say testsaslauthd. Neither work.
    – Nick
    Feb 25, 2016 at 22:13
  • Ok, I added the mysql .cf file contents to the question. The hash map doesn't seem to be working.
    – Nick
    Feb 26, 2016 at 0:14
  • I have updated the answer
    – ALex_hha
    Feb 26, 2016 at 0:52
  • Thanks. When I add hash:/etc/postfix/sender_logins_maps, and put the line in that file as you mentioned, I stop being able to receive mail. I see this line in /var/log/mail.err Feb 25 20:02:31 mail1 postfix/smtpd[10538]: error: open database /etc/postfix/sender_logins_maps.db: No such file or directory Does it have to be a .db file?
    – Nick
    Feb 26, 2016 at 3:09
  • What if I just remove reject_sender_login_mismatch from the smtpd_recipient_restrictions settings? Will that cause any security issues?
    – Nick
    Feb 26, 2016 at 3:11
4

It seems that you've set reject_sender_login_mismatch

You can use smtpd_sender_login_maps to configure which users are allowed to send from specific senders or domains.

The postfix documentation states an example here (see Envelope sender address authorization).

Update 1:

Here's an example for a smtpd_sender_login_maps (hashmap). This relies on the lookup order of postfix when matching against maps. Iterations are as follows

  1. [email protected]
  2. @server.com

Therefore you need to inject a hashmap that whitelists accounts for the domain This would be like

@server.com [email protected]

This simply states that the second lookup postfix will do (first one is exact match with [email protected]) will hit on the hashmap. Important If there are additional maps (taken from comment there are maps in mysql) that hits on the first place, a decision has already (been made first match) and no second lookup is performed.

In order to grant "send as any @server.com" permission to the account [email protected] either mysql has to list it on the allowed owners of the account (aside of the actual account) or mysql has explicitly not to list this account (so that the second lookup iteration hits the hashmap).

Don't forget to postmap the hashmap after modifying the contents (cd to the dir of the file and postmap the file)

Improve this answer
5
  • I see this line in main.cf smtpd_sender_login_maps = proxy:mysql:/etc/postfix/sql/mysql_virtual_sender_acl.cf, proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_maps.cf but if I add another line there like hash:/etc/postfix/controlled_envelope_senders, it seems to not let me send email at all.
    – Nick
    Feb 25, 2016 at 22:12
  • if you want to have the map to match first, you've to place if before the other checks (which are omitted for matches on this map!). what are the contents of the new map?
    – Daniel Nachtrub
    Feb 25, 2016 at 22:30
  • I just have two lines, each with @domain.com [email protected] on each line. Is that the correct format? It looked right from the documentation.
    – Nick
    Feb 25, 2016 at 22:46
  • I moved the smtpd_sender_login_maps = line above the sender restrictions and restarted Postfix. Didn't seem to help. If I try using an address that doesn't exist I get a temporary lookup error. If I try using an address that does exist (but isn't the one I'm authenticating with) I get the "not owned by user" error. I would like to send from any address on this domain regardless of it it exists at all, is an alias, or is a mailbox.
    – Nick
    Feb 25, 2016 at 22:56
  • If you would like to eliminate all restrictions, remove reject_authenticated_sender_login_mismatch from the config. but this affects all users (and means that any authenticated user can send from any address). granting rights for only specific users requires the loginmaps to list the users as authorized (with respect of the lookup order). another option would be to add an additional listener (master.cf) and override the restrictions only for this listener - so you create some sort of less restricted access to postfix via a seperate port
    – Daniel Nachtrub
    Feb 27, 2016 at 13:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .