I want to allow PHP apps to send mail but under very restricted conditions.

And I don't want to allow sendmail-like command for PHP apps (I'm using chrooted PHP and it's too much headache), thus I disabled mail() function in PHP.

What options do I have to strictly allow/monitor PHP apps sending via my postfix?

  • HELO name can be spoofed
  • IP can be spoofed and it's not explicitly linked to a PHP app user

AUTH? Should I also require smtpd_sender_restrictions=reject_sender_login_mismatch ?

I already have a smtpd on port 587 running which uses smtpd_sasl_type=dovecot but I don't suppose a PHP app would ever have an account on Dovecot IMAP server - I suppose most PHP apps would send mail as 'noreply@'. Should I create another instance of submission in /etc/postfix/master.cf ?

  • Why use another instance of submission? You could just make a mail account that a PHP app could log in to. – Michael Hampton Jan 30 at 3:55
  • I'm authenticating against IMAP right now. I don't see it makes sense to authenticate against IMAP for an account which will never be used for delivery - ie. never used for anything else then just authentication. – Jiri B Jan 30 at 9:23

Yes, you have to enable and force AUTH when sending. Create one email address per domain. Then tell the developers/webmaster that they have to use the given user+pass when sending ( and hopefully their PHP app supports SMTP with auth ). You have to disable unauthenticated mail relay from localhost ( in postfix ). And perhaps allow ( in firewall) outgoing smtp traffic only from postfix . Then maybe ratelimit the mails.

  • Thank you. I'm using OpenBSD so I did put this rule into my /etc/pf.conf to block connections on loopback interface for PHP users who have UID higher than 2000: block return log (all, user, to pflog1) quick on lo0 proto tcp from any to any port = 25 user > 2000. I was also trying to isolate PHP completely via rdomain but no success yet. – Jiri B Jan 31 at 22:36
  • I'm not familiar with OpenBSD&pf, but are you sure you need to block on loopback? And not on ethernet? – Sandor Marton Jan 31 at 23:03
  • I want PHP app talks to postfix running locally and thus it would reach loopback. I also block outgoing traffic to any port 25 for uid > 2000. – Jiri B Jan 31 at 23:04
  • I suggested to block outgoing non postfix smtp traffic, because a compromised PHP site can behave as MTA, and send the mails/spam directly to remote mail servers ( like yahoo/gmail etc ), skipping postfix restrictions. But if you are doing it, then its good :) – Sandor Marton Jan 31 at 23:08
  • Another think to consider would be postfix authorized_submit_users - postfix.org/postconf.5.html#authorized_submit_users. It's probably not clever idea to have PHP mail() available globally but anyway... (On OpenBSD as PHP is chrooted by default, mail() won't work and femail-chroot package forwards mail via PHP mail() over network... Thus another issue - $mynetworks :) – Jiri B Feb 1 at 0:59

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.