1

I want to prevent spoofing so I found this postfix option:

smtpd_sender_login_maps (default: empty)

    Optional lookup table with the SASL login names that own the sender (MAIL FROM) addresses.
    ...

Then I found this answer: https://serverfault.com/a/710235/371610 that says how to use a regex so that in setups with multiple virtual domains and many users there's no need to edit the table to add or remove:

/etc/postfix/login_map:

/^(.*)$/   ${1}

/etc/postfix/main.cf:

smtpd_sender_login_maps=pcre:/etc/postfix/login_maps
smtpd_relay_restrictions = permit_mynetworks,
    reject_sender_login_mismatch,
    permit_sasl_authenticated,
    reject_unauth_destination

Same error with:

smtpd_sender_login_maps=pcre:/etc/postfix/login_maps
smtpd_sender_restrictions = reject_unknown_sender_domain,
    reject_sender_login_mismatch

The problem is that with that regex incoming mails (from hotmail or gmail for example) are being rejected with the error:

NOQUEUE: reject: RCPT from mail-oln040092064102.outbound.protection.outlook.com[40.92.64.102]: 553 5.7.1 [email protected]: Sender address rejected: not logged in; [email protected] [email protected] proto=ESMTP helo=<EUR01-DB5-obe.outbound.protection.outlook.com>

Is there any way to do this without having to write a table mapping each email to itself:

[email protected]    [email protected]
[email protected]   [email protected]
etc...

Or would it be better to use sql, and then selecting two times the column that has the complete email address? What do you think? I'm about to migrate the virtual domains/users to sql.


EDIT

I have moved reject_sender_login_mismatch as suggested:

smtpd_sender_login_maps=pcre:/etc/postfix/login_maps
smtpd_sender_restrictions = reject_unknown_sender_domain,
    reject_sender_login_mismatch

smtpd_relay_restrictions = permit_mynetworks,
    permit_sasl_authenticated,
    reject_unauth_destination

But I'm still getting the same Sender address rejected: not logged in; error.

This is my config:

# postconf -n                                                                                                                                                                                                               
alias_database = $alias_maps                                                                                                                                                                                                                 
alias_maps = hash:/etc/postfix/aliases                                                                                                                                                                                                       
broken_sasl_auth_clients = no                                                                                                                                                                                                                
command_directory = /usr/bin                                                                                                                                                                                                                 
compatibility_level = 2                                                                                                                                                                                                                      
daemon_directory = /usr/lib/postfix/bin                                                                                                                                                                                                      
data_directory = /var/lib/postfix                                                                                                                                                                                                            
debug_peer_level = 2                                                                                                                                                                                                                         
debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5                                                                                                                
disable_vrfy_command = yes                                                                                                                                                                                                                   
home_mailbox = Maildir/                                                                                                                                                                                                                      
html_directory = no                                                                                                                                                                                                                          
inet_protocols = ipv4                                                                                                                                                                                                                        
mail_owner = postfix                                                                                                                                                                                                                         
mailbox_size_limit = 0                                                                                                                                                                                                                       
mailq_path = /usr/bin/mailq                                                                                                                                                                                                                  
manpage_directory = /usr/share/man                                                                                                                                                                        
meta_directory = /etc/postfix                                                                                                                                                                                                                
milter_default_action = accept                                                                                                                                                                                                               
mydestination = localhost                                                                                                                                                                                                                    
myhostname = mail.domain.com                                                                                                                                               
mynetworks_style = host                                                                                                                                                                                                                      
newaliases_path = /usr/bin/newaliases
non_smtpd_milters = $smtpd_milters
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix
sample_directory = /etc/postfix
sendmail_path = /usr/bin/sendmail
setgid_group = postdrop
shlib_directory = /usr/lib/postfix
smtp_tls_exclude_ciphers = aNULL:eNULL:MEDIUM:LOW:EXPORT:EXP:3DES:DSS:RC4:SEED:ECDSA:MD5:PSK
smtp_tls_loglevel = 1
smtp_tls_mandatory_ciphers = HIGH
smtp_tls_mandatory_protocols = !SSLv2:!SSLv3:!TLSv1
smtp_tls_protocols = !SSLv2:!SSLv3
smtp_tls_security_level = may
smtp_use_tls = yes
smtpd_enforce_tls = yes
smtpd_helo_restrictions = reject_unknown_helo_hostname
smtpd_milters = unix:/run/opendkim/opendkim.sock
smtpd_recipient_limit = 100
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_rbl_client zen.spamhaus.org, permit
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
smtpd_sasl_local_domain = $myhostname
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noplaintext, noanonymous
smtpd_sasl_type = dovecot
smtpd_sender_login_maps = hash:/etc/postfix/login_maps
smtpd_sender_restrictions = reject_unknown_sender_domain, reject_sender_login_mismatch
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /etc/letsencrypt/live/domain.com/fullchain.pem
smtpd_tls_eecdh_grade = ultra
smtpd_tls_exclude_ciphers = aNULL:eNULL:MEDIUM:LOW:EXPORT:EXP:3DES:DSS:RC4:SEED:ECDSA:MD5:PSK
smtpd_tls_key_file = /etc/letsencrypt/live/domain/privkey.pem
smtpd_tls_loglevel = 1
smtpd_tls_mandatory_ciphers = HIGH
smtpd_tls_mandatory_protocols = !SSLv2:!SSLv3:!TLSv1
smtpd_tls_protocols = !SSLv2:!SSLv3
smtpd_tls_received_header = yes
smtpd_tls_security_level = may
smtpd_use_tls = yes
tls_high_cipherlist = EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA
tls_preempt_cipherlist = yes
tls_random_source = dev:/dev/urandom
tls_ssl_options = NO_COMPRESSION
unknown_local_recipient_reject_code = 550
virtual_alias_maps = hash:/etc/postfix/virtual
virtual_gid_maps = static:73
virtual_mailbox_base = /var/mail/vhosts
virtual_mailbox_domains = domain.com another.com yetanother.com
virtual_mailbox_limit = 0
virtual_mailbox_maps = hash:/etc/postfix/vmailbox
virtual_minimum_uid = 50
virtual_uid_maps = static:73

And /etc/postfix/login_maps:

[email protected]    [email protected]
[email protected]   [email protected]
etc...

This way it's working, no matter where I place reject_sender_login_mismatch. And again, no matter where I place it, if I use a regex I'm getting the error. So right now is inside smtpd_sender_restrictions, shouldn't only target outgoing (virtual domains only) mail instead of incoming too?

1
  • Maybe it is just a typo: you write pcre:/etc/postfix/login_maps but the file’s path you mention is /etc/postfix/login_map.
    – ominug
    Oct 7, 2019 at 15:22

1 Answer 1

1

Just because the option sounds right, doesn't mean that you can use it for the intended purpose.

There's a difference between smtpd_relay_restrictions and smtpd_sender_restrictions for which the reject_sender_login_mismatch restriction was meant. External users don't login to your server to send mails to you, so it does not make sense to check if there is a mismatch.

The check is to prevent a logged in user A from changing the envelope address to something other than what he or she is allowed in the smtpd_sender_login_maps. The check does not prevent your users from spoofing (e.g. A could still pretend to be anybody like another user B by sending a message with a different from: header field).

Check out Does postfix reject spoofed senders? for further pointers on this topic.

6
  • What is the difference between the "envelope address" and the "from field"? Isn't that what postfix is supposed to check with that option? User [email protected] is allowed to send mail as [email protected], isn't that what the option checks? But you're right about the first thing, I just moved it to smtpd_sender_restrictions. So if I use that same regex now should it work? Incoming mail from outside shouldn't be checked against that option? Because I think I already tried it and got the error.
    – Chazy Chaz
    Sep 12, 2017 at 15:30
  • I just did as you suggested, but it's still giving the same error.
    – Chazy Chaz
    Sep 12, 2017 at 16:01
  • can you provide your full configuration? did it work before you added this restriction? would it work without it? also: have you restarted the postfix service after changing the configuration?
    – stefan0xC
    Sep 12, 2017 at 23:26
  • and regarding the difference see the "some background" part of this excellent answer: security.stackexchange.com/a/30741
    – stefan0xC
    Sep 12, 2017 at 23:47
  • Sure, I'll edit to add the output of postconf -n. If I change the option from pcre to hash and the file from regex to a list mapping each email to itself, then yes it works, but that's why I opened the question, I'd like not to have to edit the file each time I need to add or delete. But I'm strongly considering moving to SQL and then easily select the same column two times. That way I only would need to edit from one place, the same works for postfix, dovecot and opendkim, no need to have multiple files for the same content.
    – Chazy Chaz
    Sep 13, 2017 at 9:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .