3

I have an email server running Postfix that generally works great. I'm trying to use this server as the SMTP server for outgoing mail in a CRM/Marketing platform installation. I've entered the authentication credentials and it works fine. However, I can only use the mailbox that I'm authenticating with as the "from" address. If I try to use a different address (on the same domain) in a campaign, it fails to send and results in this error:

This message was undeliverable after 3 attempts due to the following reason: Error Message: Response from Server 220 server.com 250-server.com 250-PIPELINING 250-SIZE 26214400 250-ETRN 250-STARTTLS 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 DSN 220 2.0.0 Ready to start TLS 250-server.com 250-PIPELINING 250-SIZE 26214400 250-ETRN 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 DSN 334 VXNlcm5hbWU6 334 UGFzc3dvcmQ6 235 2.7.0 Authentication successful 250 2.1.0 Ok 553 5.7.1 : Sender address rejected: not owned by user info@server.com 250 2.0.0 Ok .

Is there a way to configure Postfix to allow me to send from any address on this one particular domain after authenticating with one account? Can I assign addresses to this user I'm authenticating with? I don't want to open this up on other domains, just this one particular domain I'm using for this CRM.

Thanks!

--

Here's what postconf -n gives me:

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
bounce_queue_lifetime = 1d
broken_sasl_auth_clients = yes
config_directory = /etc/postfix
disable_vrfy_command = yes
html_directory = /usr/share/doc/postfix/html
inet_interfaces = all
inet_protocols = all
mailbox_size_limit = 0
maximal_backoff_time = 1800s
maximal_queue_lifetime = 1d
message_size_limit = 26214400
milter_default_action = accept
milter_protocol = 6
minimal_backoff_time = 300s
mydestination = mail1.mydomain.com, localhost.mydomain.com, localhost
myhostname = mail1.mydomain.com
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
myorigin = /etc/mailname
postscreen_access_list = permit_mynetworks, cidr:/etc/postfix/postscreen_access.cidr
postscreen_bare_newline_enable = no
postscreen_blacklist_action = drop
postscreen_cache_cleanup_interval = 24h
postscreen_cache_map = proxy:btree:$data_directory/postscreen_cache
postscreen_dnsbl_action = enforce
postscreen_dnsbl_sites = b.barracudacentral.org=127.0.0.2*7 dnsbl.inps.de=127.0.0.2*7 bl.mailspike.net=127.0.0.2*5 bl.mailspike.net=127.0.0.[10;11;12]*4 dnsbl.sorbs.net=127.0.0.10*8 dnsbl.sorbs.net=127.0.0.5*6 dnsbl.sorbs.net=127.0.0.7*3 dnsbl.sorbs.net=127.0.0.8*2 dnsbl.sorbs.net=127.0.0.6*2 dnsbl.sorbs.net=127.0.0.9*2 zen.spamhaus.org=127.0.0.[10;11]*8 zen.spamhaus.org=127.0.0.[4..7]*6 zen.spamhaus.org=127.0.0.3*4 zen.spamhaus.org=127.0.0.2*3 hostkarma.junkemailfilter.com=127.0.0.2*3 hostkarma.junkemailfilter.com=127.0.0.4*1 hostkarma.junkemailfilter.com=127.0.1.2*1 wl.mailspike.net=127.0.0.[18;19;20]*-2 hostkarma.junkemailfilter.com=127.0.0.1*-2
postscreen_dnsbl_threshold = 8
postscreen_dnsbl_ttl = 5m
postscreen_greet_action = enforce
postscreen_greet_banner = $smtpd_banner
postscreen_greet_ttl = 2d
postscreen_greet_wait = 3s
postscreen_non_smtp_command_enable = no
postscreen_pipelining_enable = no
proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $smtpd_sender_login_maps
queue_run_delay = 300s
readme_directory = /usr/share/doc/postfix
recipient_delimiter = +
relay_domains = proxy:mysql:/etc/postfix/sql/mysql_virtual_mxdomain_maps.cf
relay_recipient_maps = proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_maps.cf
relayhost =
smtp_header_checks = pcre:/etc/postfix/mailcow_anonymize_headers.pcre
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
smtp_tls_cert_file = /etc/ssl/mail/mail.crt
smtp_tls_key_file = /etc/ssl/mail/mail.key
smtp_tls_loglevel = 1
smtp_tls_security_level = may
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_banner = $myhostname
smtpd_data_restrictions = reject_unauth_pipelining, permit
smtpd_delay_reject = yes
smtpd_error_sleep_time = 10s
smtpd_hard_error_limit = ${stress?1}${stress:5}
smtpd_helo_required = yes
smtpd_proxy_timeout = 600s
smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_invalid_helo_hostname, reject_unknown_reverse_client_hostname, reject_unknown_client_hostname, reject_non_fqdn_helo_hostname, reject_unauth_destination, reject_rbl_client zen.spamhaus.org, reject_rbl_client bl.spamcop.net, reject_rbl_client cbl.abuseat.org, reject_rbl_client b.barracudacentral.org
smtpd_restriction_classes = z1_greylisting
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
smtpd_sasl_path = private/auth_dovecot
smtpd_sasl_type = dovecot
smtpd_sender_login_maps = proxy:mysql:/etc/postfix/sql/mysql_virtual_sender_acl.cf, proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_maps.cf
smtpd_sender_restrictions = reject_authenticated_sender_login_mismatch, permit_mynetworks, reject_sender_login_mismatch, permit_sasl_authenticated, reject_unlisted_sender, reject_unknown_sender_domain
smtpd_soft_error_limit = 3
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /etc/ssl/mail/mail.crt
smtpd_tls_dh1024_param_file = /etc/ssl/mail/dhparams.pem
smtpd_tls_eecdh_grade = strong
smtpd_tls_exclude_ciphers = ECDHE-RSA-RC4-SHA
smtpd_tls_key_file = /etc/ssl/mail/mail.key
smtpd_tls_loglevel = 1
smtpd_tls_mandatory_ciphers = high
smtpd_tls_mandatory_exclude_ciphers = ECDHE-RSA-RC4-SHA
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
smtpd_tls_security_level = may
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
tls_high_cipherlist = EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA
virtual_alias_maps = proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_maps.cf, proxy:mysql:/etc/postfix/sql/mysql_virtual_spamalias_maps.cf, proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_domain_maps.cf, proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_domain_catchall_maps.cf
virtual_gid_maps = static:5000
virtual_mailbox_base = /var/vmail/
virtual_mailbox_domains = proxy:mysql:/etc/postfix/sql/mysql_virtual_domains_maps.cf
virtual_mailbox_maps = proxy:mysql:/etc/postfix/sql/mysql_virtual_mailbox_maps.cf, proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_domain_mailbox_maps.cf
virtual_minimum_uid = 104
virtual_transport = lmtp:unix:private/dovecot-lmtp
virtual_uid_maps = static:5000
z1_greylisting = permit_dnswl_client list.dnswl.org, check_policy_service inet:127.0.0.1:10023

Here's what mysql_virtual_sender_acl.cf:

# mysql_virtual_sender_acl.cf
user = mailcow
password = password
hosts = localhost
dbname = mailcow
query = SELECT logged_in_as FROM sender_acl WHERE send_as='%s'
#expansion_limit = 100

And in mysql_virtual_alias_maps.cf:

# mysql_virtual_alias_maps.cf
user = mailcow
password = password
hosts = localhost
dbname = mailcow
query = SELECT goto FROM alias WHERE address='%s' AND active = '1'
#expansion_limit = 100
  • yes, you can. But it seems that someone already has configured such restriction. Because by default postfix doesn't apply such restriction. Could you add output of the 'postconf -n' to the question? – ALex_hha Feb 25 '16 at 19:57
3

You can use reject_authenticated_sender_login_mismatch

Make users for test

# saslpasswd2 -c -u example.net user1
# saslpasswd2 -c -u example.com user2

# sasldblistusers2
user2@example.com: userPassword
user1@example.net: userPassword

Do some basic tests. As you can see without reject_authenticated_sender_login_mismatch user can use in MAIL FROM whatever he want

# echo "Hello world" | swaks -s 127.0.0.1 --from user1@example.net --to user2@example.com --h-Subject "Test" --auth PLAIN --auth-user user1 --auth-password 1234567 --body -
=== Trying 127.0.0.1:25...
=== Connected to 127.0.0.1.
<-  220 mail.example.net ESMTP Postfix
 -> EHLO svn.example.net
<-  250-mail.example.net
<-  250-PIPELINING
<-  250-SIZE 10240000
<-  250-VRFY
<-  250-ETRN
<-  250-AUTH LOGIN PLAIN
<-  250-ENHANCEDSTATUSCODES
<-  250-8BITMIME
<-  250 DSN
 -> AUTH PLAIN AHVzZXIxADEyMzQ1Njc=
<-  235 2.7.0 Authentication successful
 -> MAIL FROM:<user1@example.net>
<-  250 2.1.0 Ok
 -> RCPT TO:<user2@example.com>
<-  250 2.1.5 Ok
 -> DATA
<-  354 End data with <CR><LF>.<CR><LF>
 -> Date: Thu, 25 Feb 2016 20:53:45 +0000
 -> To: user2@example.com
 -> From: user1@example.net
 -> Subject: Test
 -> X-Mailer: swaks v20130209.0 jetmore.org/john/code/swaks/
 ->
 -> Hello world
 ->
 ->
 -> .
<-  250 2.0.0 Ok: queued as E1D3D406CC
 -> QUIT
<-  221 2.0.0 Bye
=== Connection closed with remote host.

# grep E1D3D406CC /var/log/maillog
Feb 25 20:53:45 svn postfix/smtpd[56996]: E1D3D406CC: client=localhost[127.0.0.1], sasl_method=PLAIN, sasl_username=user1@example.net
Feb 25 20:53:45 svn postfix/cleanup[56999]: E1D3D406CC: message-id=<20160225205345.E1D3D406CC@mail.example.net>
Feb 25 20:53:45 svn postfix/qmgr[56990]: E1D3D406CC: from=<user1@example.net>, size=416, nrcpt=1 (queue active)
Feb 25 20:53:45 svn postfix/local[57000]: E1D3D406CC: to=<user2@example.com>, relay=local, delay=0.03, delays=0.02/0/0/0.01, dsn=2.0.0, status=sent (delivered to mailbox)
Feb 25 20:53:45 svn postfix/qmgr[56990]: E1D3D406CC: removed

# echo "Hello world" | swaks -s 127.0.0.1 --from non_exist-reply@example.net --to user2@example.com --h-Subject "Test" --auth PLAIN --auth-user user1 --auth-password 1234567 --body -
=== Trying 127.0.0.1:25...
=== Connected to 127.0.0.1.
<-  220 mail.example.net ESMTP Postfix
 -> EHLO svn.example.net
<-  250-mail.example.net
<-  250-PIPELINING
<-  250-SIZE 10240000
<-  250-VRFY
<-  250-ETRN
<-  250-AUTH LOGIN PLAIN
<-  250-ENHANCEDSTATUSCODES
<-  250-8BITMIME
<-  250 DSN
 -> AUTH PLAIN AHVzZXIxADEyMzQ1Njc=
<-  235 2.7.0 Authentication successful
 -> MAIL FROM:<non_exist_user@example.net>
<-  250 2.1.0 Ok
 -> RCPT TO:<user2@example.com>
<-  250 2.1.5 Ok
 -> DATA
<-  354 End data with <CR><LF>.<CR><LF>
 -> Date: Thu, 25 Feb 2016 20:55:13 +0000
 -> To: user2@example.com
 -> From: non_exist_user@example.net
 -> Subject: Test
 -> X-Mailer: swaks v20130209.0 jetmore.org/john/code/swaks/
 ->
 -> Hello world
 ->
 ->
 -> .
<-  250 2.0.0 Ok: queued as 94CBF4076C
 -> QUIT
<-  221 2.0.0 Bye
=== Connection closed with remote host.

# grep 94CBF4076C /var/log/maillog
Feb 25 20:55:13 svn postfix/smtpd[56996]: 94CBF4076C: client=localhost[127.0.0.1], sasl_method=PLAIN, sasl_username=user1@example.net
Feb 25 20:55:13 svn postfix/cleanup[56999]: 94CBF4076C: message-id=<20160225205513.94CBF4076C@mail.example.net>
Feb 25 20:55:13 svn postfix/qmgr[56990]: 94CBF4076C: from=<non_exist_user@example.net>, size=424, nrcpt=1 (queue active)
Feb 25 20:55:13 svn postfix/local[57000]: 94CBF4076C: to=<user2@example.com>, relay=local, delay=0.01, delays=0.01/0/0/0, dsn=2.0.0, status=sent (delivered to mailbox)
Feb 25 20:55:13 svn postfix/qmgr[56990]: 94CBF4076C: removed

But after we have added the following lines

# /etc/postfix/main.cf

smtpd_sender_login_maps = hash:/etc/postfix/sender_logins_maps
smtpd_sender_restrictions = reject_authenticated_sender_login_mismatch

Do not forget to create map and restart the postfix

# postmap /etc/postfix/sender_logins_maps
# service postfix restart

# cat /etc/postfix/sender_logins_maps
user1@example.net user1@example.net
info@example.net user1@example.net
no-reply@example.net user1@example.net

User can't use anymore whatever he wants

# echo "Hello world" | swaks -s 127.0.0.1 --from non_exit_user@example.net --to user2@example.com --h-Subject "Test" --auth PLAIN --auth-user user1 --auth-password 1234567 --body -
=== Trying 127.0.0.1:25...
=== Connected to 127.0.0.1.
<-  220 mail.example.net ESMTP Postfix
 -> EHLO svn.example.net
<-  250-mail.example.net
<-  250-PIPELINING
<-  250-SIZE 10240000
<-  250-VRFY
<-  250-ETRN
<-  250-AUTH LOGIN PLAIN
<-  250-ENHANCEDSTATUSCODES
<-  250-8BITMIME
<-  250 DSN
 -> AUTH PLAIN AHVzZXIxADEyMzQ1Njc=
<-  235 2.7.0 Authentication successful
 -> MAIL FROM:<non_exit_user@example.net>
<-  250 2.1.0 Ok
 -> RCPT TO:<user2@example.com>
<** 553 5.7.1 <non_exit_user@example.net>: Sender address rejected: not owned by user user1
 -> QUIT
<-  221 2.0.0 Bye
=== Connection closed with remote host.

But with the settings above user1@example.net can use in MAIL FROM only: user1@example.net, info@example.net and no-reply@example.net

# echo "Hello world" | swaks -s 127.0.0.1 --from no-reply@example.net --to user2@example.com --h-Subject "Test" --auth PLAIN --auth-user user1@example.net --auth-password 1234567 --body -
=== Trying 127.0.0.1:25...
=== Connected to 127.0.0.1.
<-  220 mail.example.net ESMTP Postfix
 -> EHLO svn.example.net
<-  250-mail.example.net
<-  250-PIPELINING
<-  250-SIZE 10240000
<-  250-VRFY
<-  250-ETRN
<-  250-AUTH LOGIN PLAIN
<-  250-ENHANCEDSTATUSCODES
<-  250-8BITMIME
<-  250 DSN
 -> AUTH PLAIN AHVzZXIxQGV4YW1wbGUubmV0ADEyMzQ1Njc=
<-  235 2.7.0 Authentication successful
 -> MAIL FROM:<no-reply@example.net>
<-  250 2.1.0 Ok
 -> RCPT TO:<user2@example.com>
<-  250 2.1.5 Ok
 -> DATA
<-  354 End data with <CR><LF>.<CR><LF>
 -> Date: Thu, 25 Feb 2016 23:03:07 +0000
 -> To: user2@example.com
 -> From: no-reply@example.net
 -> Subject: Test
 -> X-Mailer: swaks v20130209.0 jetmore.org/john/code/swaks/
 ->
 -> Hello world
 ->
 ->
 -> .
<-  250 2.0.0 Ok: queued as 9FE524068A
 -> QUIT
<-  221 2.0.0 Bye
=== Connection closed with remote host.

# grep 9FE524068A /var/log/maillog
Feb 25 23:03:07 svn postfix/smtpd[19097]: 9FE524068A: client=localhost[127.0.0.1], sasl_method=PLAIN, sasl_username=user1@example.net
Feb 25 23:03:07 svn postfix/cleanup[19100]: 9FE524068A: message-id=<20160225230307.9FE524068A@mail.example.net>
Feb 25 23:03:07 svn postfix/qmgr[19092]: 9FE524068A: from=<no-reply@example.net>, size=419, nrcpt=1 (queue active)
Feb 25 23:03:07 svn postfix/local[19101]: 9FE524068A: to=<user2@example.com>, relay=local, delay=0.01, delays=0.01/0/0/0, dsn=2.0.0, status=sent (delivered to mailbox)
Feb 25 23:03:07 svn postfix/qmgr[19092]: 9FE524068A: removed

P.S. a little trick

if don't add any line for some specific user in the /etc/postfix/sender_logins_maps - he will receive an emails but won't send.

I can't seem to run saslauthd. It says command not found. Is that a separate utility? EDIT: Sorry I meant to say testsaslauthd. Neither work

It's just a test. So to quick setup test environment I have choose sasldb. Because I don't have time to setup and configure MySQL. You are using MySQL to store all information about users. And your restrictions described here

smtpd_sender_login_maps = 
 proxy:mysql:/etc/postfix/sql/mysql_virtual_sender_acl.cf
 proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_maps.cf

You should add contents of the mysql_virtual_sender_acl.cf/mysql_virtual_alias_maps.cf (without password of course) to the question

Is there a way to configure Postfix to allow me to send from any address on this one particular domain after authenticating with one account?

in the /etc/postfix/sender_logins_maps you should have something like the following

@example.net user1@example.net

Modify smtpd_sender_login_maps

smtpd_sender_login_maps = 
 hash:/etc/postfix/sender_logins_maps,
 proxy:mysql:/etc/postfix/sql/mysql_virtual_sender_acl.cf, 
 proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_maps.cf

The file /etc/postfix/sender_logins_maps should contain only one line

@example.net user1@example.net

where @example.net - "one particular domain", user1@example.net - "authenticating with one account". It must be sasl_username!

sasl_method=PLAIN, sasl_username=user1@example.net

Don't forget to create map and restart the postfix.

  • I can't seem to run saslauthd. It says command not found. Is that a separate utility? EDIT: Sorry I meant to say testsaslauthd. Neither work. – Nick Thompson Feb 25 '16 at 22:13
  • Ok, I added the mysql .cf file contents to the question. The hash map doesn't seem to be working. – Nick Thompson Feb 26 '16 at 0:14
  • I have updated the answer – ALex_hha Feb 26 '16 at 0:52
  • Thanks. When I add hash:/etc/postfix/sender_logins_maps, and put the line in that file as you mentioned, I stop being able to receive mail. I see this line in /var/log/mail.err Feb 25 20:02:31 mail1 postfix/smtpd[10538]: error: open database /etc/postfix/sender_logins_maps.db: No such file or directory Does it have to be a .db file? – Nick Thompson Feb 26 '16 at 3:09
  • What if I just remove reject_sender_login_mismatch from the smtpd_recipient_restrictions settings? Will that cause any security issues? – Nick Thompson Feb 26 '16 at 3:11
4

It seems that you've set reject_sender_login_mismatch

You can use smtpd_sender_login_maps to configure which users are allowed to send from specific senders or domains.

The postfix documentation states an example here (see Envelope sender address authorization).

Update 1:

Here's an example for a smtpd_sender_login_maps (hashmap). This relies on the lookup order of postfix when matching against maps. Iterations are as follows

  1. sender@server.com
  2. @server.com

Therefore you need to inject a hashmap that whitelists accounts for the domain This would be like

@server.com info@server.de

This simply states that the second lookup postfix will do (first one is exact match with sender@server.com) will hit on the hashmap. Important If there are additional maps (taken from comment there are maps in mysql) that hits on the first place, a decision has already (been made first match) and no second lookup is performed.

In order to grant "send as any @server.com" permission to the account info@server.com either mysql has to list it on the allowed owners of the account (aside of the actual account) or mysql has explicitly not to list this account (so that the second lookup iteration hits the hashmap).

Don't forget to postmap the hashmap after modifying the contents (cd to the dir of the file and postmap the file)

  • I see this line in main.cf smtpd_sender_login_maps = proxy:mysql:/etc/postfix/sql/mysql_virtual_sender_acl.cf, proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_maps.cf but if I add another line there like hash:/etc/postfix/controlled_envelope_senders, it seems to not let me send email at all. – Nick Thompson Feb 25 '16 at 22:12
  • if you want to have the map to match first, you've to place if before the other checks (which are omitted for matches on this map!). what are the contents of the new map? – Daniel Nachtrub Feb 25 '16 at 22:30
  • I just have two lines, each with @domain.com info@domain.com on each line. Is that the correct format? It looked right from the documentation. – Nick Thompson Feb 25 '16 at 22:46
  • I moved the smtpd_sender_login_maps = line above the sender restrictions and restarted Postfix. Didn't seem to help. If I try using an address that doesn't exist I get a temporary lookup error. If I try using an address that does exist (but isn't the one I'm authenticating with) I get the "not owned by user" error. I would like to send from any address on this domain regardless of it it exists at all, is an alias, or is a mailbox. – Nick Thompson Feb 25 '16 at 22:56
  • If you would like to eliminate all restrictions, remove reject_authenticated_sender_login_mismatch from the config. but this affects all users (and means that any authenticated user can send from any address). granting rights for only specific users requires the loginmaps to list the users as authorized (with respect of the lookup order). another option would be to add an additional listener (master.cf) and override the restrictions only for this listener - so you create some sort of less restricted access to postfix via a seperate port – Daniel Nachtrub Feb 27 '16 at 13:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.