2

I recently noticed when I add an alias to a Gmail account they ask me for a remote SMTP server, username and password. Then, whenever I try to send an email using that alias it gets relayed by Gmail to the provided SMTP server.

Is there a way I can accomplish this setup on a Postfix install?

To clarify, on my server there's a virtual user person@exemple.com (with the aliases: external.person@xpto.com and external.other@corpx.com) if he sends an email:

  • With a from address of person@exemple.com => server will do the default delivery;
  • With a from address of external.person@xpto.com => server will relay email using smtp.xpto.com (with proper credentials);
  • With a from address of external.other@corpx.com => server will relay email using smtp.corpx.com (with proper credentials);

Ideally it would be nice If I could have a MySQL table with the external alises (for every virtual user) containing the external SMTP server domain, port, username and password. => This way I could setup a small web interface so my users could all their own external alises...

Thank you.

  • If I read your project correctly, your target is to store your users passwords so as to access their external accounts. – dan Apr 15 '16 at 7:10
  • This is already done. Check the answer bellow. – TCB13 Apr 15 '16 at 16:16
  • Right. Then this is a storage of passwords in clear within /etc/postfix/sender_credentials.cf. As such, this is a major risk. – dan Apr 15 '16 at 17:22
  • Any suggestions on how to encrypt the passwords and keep the functionality? – TCB13 Apr 16 '16 at 11:12
2

I guess you can achieve this by tuning the sender_dependent_default_transport_maps or sender_dependent_relayhost_maps Postfix parameters. For example:

# /etc/postfix/main.cf
sender_dependent_default_transport_maps = hash:/etc/postfix/sender_maps.cf
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sender_credentials.cf
smtp_sasl_tls_security_options = noanonymous
smtp_sender_dependent_authentication = yes
smtp_tls_security_level = may

# /etc/postfix/sender_maps.cf
external.person@xpto.com smtp:[smtp.xpto.com]:587
external.other@corpx.com smtp:[smtp.corpx.com]

# /etc/postfix/sender_credentials.cf
external.person@xpto.com xptouser:xptopassword
external.other@corpx.com corpxuser:corpxpassword

This example uses static hash tables. If your Postfix installation supports mysql_table(5), you can use MySQL queries instead.

I am unable to test this solution now. I hope it works.

| improve this answer | |
  • I tried sender_dependent_default_transport_maps and it seems to work (after adding smtp_sasl_security_options = noanonymous to the config). However there's a strange behavior happening: After the external alias is added to sender_* if I try to send an email from the external server/address to postfix it gets bounced with: SMTP error from remote mail server after RCPT TO:<person@exemple.com>: 553 5.7.1 <external.person@xpto.com>: Sender address rejected: not logged in any ideias? Ty. – TCB13 Apr 2 '16 at 13:25
  • Your Postfix installation tried to send messages to smtp.xpto.com without authentication credentials. I wonder if the credential lookup succeeds in your configuration. Please, try postmap -q 'external.person@xpto.com' 'hash:/etc/postfix/sender_credentials.cf' and check if credentials are returned correctly. For troubleshooting purposes, please set soft_bounce = yes and debug_peer_list = .xpto.com in your main.cf also. – Anderson Medeiros Gomes Apr 2 '16 at 13:54
  • 1
    Thank you for the feedback. I will add smtp_sasl_tls_security_options to my answer instead. smtp_sasl_security_options = noplaintext, noanonymous is the default setting and removing noplaintext option is OK for encrypted SMTP sessions only. – Anderson Medeiros Gomes Apr 2 '16 at 13:54
  • 1
    If you use reject_sender_login_mismatch restriction, Postfix will check smtpd_sender_login_maps for all incoming mail. I suggest you to use reject_authenticated_sender_login_mismatch instead. – Anderson Medeiros Gomes Apr 2 '16 at 14:10
  • 1
    I would not remove the braces in $sender_dependent_relayhost_maps. If you specify a $relayhost without them, Postfix will make MX lookups instead of connecting directly to the intended server. – Anderson Medeiros Gomes Apr 2 '16 at 15:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.