Home / server / Questions / 710974
Accepted
ychaouche
Asked: 2015-08-06 01:24:48 +0800 CST

In postfix, how to deny a specific email address from sending e-mail but still allow receiving?

  • 772

The closest thing I tried was to add reject_unlisted_sender to main.conf but that also disables receiving any email to that mailbox. I want only deny sending but still allow receiving.

EDIT

Here's output of postfinger.

If that really isn't what you want @UsersUser, here's output of requested commands

email

1 Answers

  1. Best Answer

    As @masegaloeh suggested, here's what I did :

    In main.cf

    smtpd_sender_restrictions = check_sender_access mysql:/etc/postfix/mysql-virtual_sender.cf

    This tells postfix to perform the check_sender_access restriction on every sender before mail is sent. mysql:/etc/postfix/mysql-virtual_sender.cf contains the necessary SQL query to perform the check. If the result of the query is "REJECT" then postfix will deny sending the mail from that sender. So what we want is to create a database, add an access table, and for every sender we want to ban we'll insert a line with a "REJECT" value. To lift the ban, we update that value to "PERMIT". The other possible value is "DEFER". (see postfix documentation)

    I am administering a server that was apparently configured using ISPConfig, so I already found a database, table and configuration file ready. I just inserted a new row.

    In /etc/postfix/mysql-virtual_sender.cf

    root@messagerie-test[10.10.10.26]/home/serveur # cat /etc/postfix/mysql-virtual_sender.cf
user = ispconfig
password = xxx
dbname = dbispconfig
table        = mail_access
select_field = access
where_field  = source
additional_conditions = and type = 'sender' and active = 'y' and server_id = 1
hosts = 127.0.0.1
root@messagerie-test[10.10.10.26]/home/serveur #

    This gives postfix the necessary information to perform the query. The database is dbispconfig, the table to query is mail_access, and the field to query, the one that will be holding the "REJECT" value is "access". Postfix will provide the sender's email and it will be matched against the "source" field (the WHERE clause).

    In the dbispconfig.mail_access table, here's what I have added

    mysql> INSERT INTO mail_access (sys_userid,sys_groupid,sys_perm_user,sys_perm_group,server_id,source,access,type,active) VALUES (1,2,'ruid','ruid',1,'[email protected]','REJECT','sender','y');
Query OK, 1 row affected (0.04 sec)

mysql> select * from mail_access;
+-----------+------------+-------------+---------------+----------------+----------------+-----------+---------------------------+--------+--------+--------+
| access_id | sys_userid | sys_groupid | sys_perm_user | sys_perm_group | sys_perm_other | server_id | source                    | access | type   | active |
+-----------+------------+-------------+---------------+----------------+----------------+-----------+---------------------------+--------+--------+--------+
|         1 |          1 |           2 | ruid          | ruid           |                |         1 | [email protected] | REJECT | sender | y      |
+-----------+------------+-------------+---------------+----------------+----------------+-----------+---------------------------+--------+--------+--------+
1 row in set (0.00 sec)

mysql>

    The values for the other fields (other than access) were borrowed from other tables, they are specific to ISPConfig and have nothing to do with postfix. The important fields here are really source, access, type and active. These fields are in the /etc/posftix/mysql-virtual_sender.cf configuration file that we instructed postfix to use with check_sender_access.

    • 1