Home / server / Questions / 818006
In Process
DrDamnit
Asked: 2016-12-01 16:07:21 +0800 CST

Block email to addresses that do not exist in postfix

  • 772

We have postfix setup as a gateway to filter and relay mail to our Exchange server. Without setting up LDAP, is there a way for me to define a list of valid addresses so postfix can reject everything that is to our domain, but not to a valid user or alias?

i.e., I want to specify a list of valid emails. If RCPT TO is to anything other than these emails, reject it. I plan on using fail2ban to firewall off these IPs for an hour as punishment for a directory harvest attack attempt.

postfix

1 Answers

  1. This ended up being remarkably simple.

    In a nutshell:

    1. Export a list of your email addresses from exchange using PowerShell.
    2. Clean that list up so it can be post mapped.
    3. Create a rule that verifies recipients against that list.

    Specifically: In Exchange EMS, run this command:

    Get-Mailbox -Resultsize Unlimited | Ft EmailAddresses

    If your email list is huge, then you might want to be a little less forgiving with this command and get yourself a CSV file. This worked for me because we only had around 50, and it was easy to pare this down using Sublime Text and regular expressions.

    Using this list, I removed everything from the list except the SMTP addresses, leaving one per line.

    Next, in Sublime, I added "OK" to each line after the addresss. Example:

    [email protected]  OK

    Then, I copied this to the Postfix server as /etc/postfix/access-inbound

    Then, I ran the following command:

    root@gateway:/etc/postfix/# postmap /etc/postfix/access-inbound

    This creates access-inbound.db in the directory it is run. (Note above! I did this in /etc/postfix).

    Now, all that's left, is to tell Postfix to verify senders using this file. I did this in smtpd_recipient_restrictions. Note, the directive below has a lot of stuff in there. I left the other configs in there for context. First, this config compares the sender to a whiltelist, and then executes a deliver action for that whitelisted sender. Then, it does all the other checks.

    Finally, at the bottom, you see:

    check_recipient_access hash:/etc/postfix/access-inbound,

    This tells postfix: "If the recipient is in this list, accept the mail". (Actually, it says: "if the recipient is in this list, do what the list says. But, in this case, all our valid emails have an "OK" response, so the former is easier to think about for n00b searchers).

    Finally, at the bottom, you see reject. This means: "If you have gotten to the bottom of all these checks, and NONE of the checks above gave you an "OK" to accept the mail, reject it.

    smtpd_recipient_restrictions = check_sender_access mysql:/etc/postfix/whitelist.cf,
    check_sender_access mysql:/etc/postfix/shortcircuit.cf,
    reject_unverified_recipient,
    reject_invalid_hostname,
    reject_unauth_pipelining,
    reject_unknown_recipient_domain,
    reject_unauth_destination,
    permit_mynetworks,
    permit_sasl_authenticated,
    check_recipient_access hash:/etc/postfix/access-inbound,
    reject
    • 0