Home / server / Questions / 961747
Accepted
glts
Asked: 2019-04-06 10:50:08 +0800 CST

Redirect local mail addressed to root, but don’t accept mail at [email protected]

  • 772

On my Postfix mail server, I would like to redirect local mail sent to root to my virtual mailbox [email protected]. At the same time, I do not want to receive any outside mail at [email protected]. Is such a configuration at all possible?

My motivation is to receive notifications generated by services like Cron conveniently in my inbox at [email protected]. Such notifications usually get sent to user root. I have been able to set up the redirection as desired:

  1. Daemon sends mail to root.
  2. Postfix appends $myorigin (append_at_myorigin = yes, must not be changed).
  3. [email protected] is looked up and mapped through virtual_alias_maps.
  4. Mail is delivered to mailbox [email protected].

However, with this setup anyone can send mail to [email protected]. I’d rather not have this address as a public alias of [email protected]. The behaviour I would like to have:

/etc/postfix/main.cf:

myhostname = mail.my.org
mydomain = my.org
myorigin = /etc/mailname
mydestination = localhost
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
smtpd_sasl_auth_enable = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/dovecot-auth
smtpd_sender_login_maps = $virtual_alias_maps
virtual_transport = lmtp:unix:private/dovecot-lmtp
virtual_mailbox_domains = my.org
virtual_mailbox_maps = hash:/etc/postfix/vmailbox
virtual_alias_maps = hash:/etc/postfix/virtual
alias_maps = hash:/etc/aliases

/etc/mailname:

my.org

/etc/postfix/vmailbox:

[email protected]         [email protected]
[email protected] [email protected]

/etc/postfix/virtual:

[email protected]         [email protected]
[email protected]        [email protected]
[email protected]       [email protected]
[email protected] [email protected]

/etc/aliases:

postmaster: [email protected]
root: [email protected]
postfix

1 Answers

  1. Best Answer

    This can be implemented by adding additional recipient restrictions that reject mail to the address [email protected]. Recipient restrictions are checked after the relay restrictions.

    /etc/postfix/main.cf:

    # Relay restrictions are unchanged.
smtpd_relay_restrictions =
  permit_mynetworks
  permit_sasl_authenticated
  reject_unauth_destination

# New: disallow sending mail to root from outside this host.
smtpd_recipient_restrictions =
  permit_mynetworks
  check_recipient_access hash:/etc/postfix/access

    The check_recipient_access database contains just an entry for the root address. Don’t forget to run postmap on the file.

    /etc/postfix/access:

    [email protected] REJECT

    permit_mynetworks is evaluated before check_recipient_access, so mail sent locally by Cron etc. still gets through. For recipients not in the database the access check doesn’t apply, they fall through to the default ‘permit’ result.

    • 0