RestrictPostfixRecipients: Difference between revisions

No edit summary
(7 intermediate revisions by 3 users not shown)
Line 1: Line 1:
#REDIRECT [[Enabling_and_administering_the_Zimbra_milter]]
=Restrict Postfix Recipients=
* This will show how you can modify postfix to restrict who can send to certain addresses in your domain such as distribution lists like
* These changes will most likely not persist between upgrades! (UPDATE: Just updated to 4.0.4 and the only thing that was wiped out was the change to /opt/zimbra/conf/ Also, permissions on files created in /opt/zimbra/postfix/conf got changed.)
* This method can be spoofed by forging the MAIL FROM: header (so mail appears to originate from within the domain), so it isn't foolproof, but it works for basic needs.
* Per testing with ZCS (Open Source) v6.0.6: The method shown below will only work if the order of smtpd_recipient_restrictions is correct inside  Your check_recipient_access addition, needs to be before any permit line.  Recommended to place this at the beginning of the line per Postfix.Org's examples at [](placing at the first place in the line will prevent system resources from being used to perform other validation checks if the address simply isn't authorized to receive from the sender).
* Create a 'permitted senders' list (as user zimbra) - This is your list of domains and/or users who can email your protected email addresses:
vi /opt/zimbra/postfix/conf/permitted_senders
[paste in contents below editing as required]
localhost              OK            OK    OK  OK
* Create a 'protected recipients' list (as user zimbra) - This is your list of email addresses that may only receive email from 'permitted senders'
vi /opt/zimbra/postfix/conf/protected_recipients
[paste in contents below editing as required]        permitted_senders_list        permitted_senders_list
* Create a simple bash script to create postfix DB files (as user zimbra):
vi /opt/zimbra/postfix/conf/update_protected_recipients
[paste in contents below editing as required]
echo "rebuild permitted_senders..."
postmap /opt/zimbra/postfix/conf/permitted_senders
echo "rebuild protected_recipients..."
postmap /opt/zimbra/postfix/conf/protected_recipients
* Make new script executable, then run it
chmod 755 /opt/zimbra/postfix/conf/update_protected_recipients
* You should now see permitted_senders.db and protected_recipients.db in the directory
* Add necessary settings to /opt/zimbra/postfix/conf/
vi /opt/zimbra/postfix/conf/
[add these items to the file - note permitted_senders_list must match value in protected_recipients]
permitted_senders_list = check_sender_access hash:/opt/zimbra/postfix/conf/permitted_senders, reject
smtpd_restriction_classes = permitted_senders_list
  **Note this change to the won't survive upgrades. Be sure to save a copy of your file**
While in /opt/zimbra/postfix/conf/ You must also add the following snippet to smtpd_recipient_restrictions (first is preferred, otherwise anywhere before the last "permit", THE ORDER IN WHICH ITEMS APPEAR HERE IS IMPORTANT (if it appears after the "permit", mail will always be accepted for the restricted recipient):
smtpd_recipient_restrictions = check_recipient_access hash:/opt/zimbra/postfix/conf/protected_recipients, (rest of line here)
  **Footnote: reference [] for examples.
* Now add your new restriction to the '''top''' of
vi /opt/zimbra/conf/
[paste this into the '''first''' line of the file, above any other settings]
check_recipient_access hash:/opt/zimbra/postfix/conf/protected_recipients
* Reload postfix to activate settings:
postfix reload
Note 3 from talk: files ownership should be set to root:postfix before reloading postfix. This avoids annoying warning messages in logfile.
===Test it out===
* Test your settings via telnet:
Enter command:
telnet 25
You will see:
Connected to
Escape character is '^]'.
220 ESMTP Postfix
Enter command:
You will see:
Enter command:
You will see:
250 Ok
Enter command:
You will see:
554 <>: Recipient address rejected: Access denied
221 Bye
Connection closed by foreign host.
* That's it.  If you need to protect new distribution lists or emails, or add new senders, just edit and re-run the update script, then reload postfix.
'''To further tune sender/recipients, check this wiki.'''
=Additional Resources=
* [[Irfan-Notes#Further_Restricting_Postfix_Recipient]]
* [[Restrict_sending_to_certain_domains]]

Latest revision as of 16:44, 31 March 2015

Jump to: navigation, search