Postfix send mail as other user

rubyweb

1/10/24, 8:46 PM

i need to set well my Postfix server. I realized that it is possible to send mails by changing the sender label in my client. Mail was arrived with other sender!!!

how can I configure it to avoid this sending with the name of another?

Thanks.

365

1 + 0

postfix

Score:4

Server

Esa Jokinen

1/11/24, 5:00 AM

The smtpd_sender_restrictions has reject_sender_login_mismatch:

reject_sender_login_mismatch

As of Postfix 2.1, this is an alias for "reject_authenticated_sender_login_mismatch, reject_unauthenticated_sender_login_mismatch".

reject_authenticated_sender_login_mismatch

Reject the request when the client is authenticated with SASL, but either the MAIL FROM address is not listed in $smtpd_sender_login_maps, or the SASL login name is not an owner for that address.

This prevents an authenticated client from using a MAIL FROM address that they do not explicitly own. This feature is available in Postfix version 2.1 and later.

reject_unauthenticated_sender_login_mismatch

Reject the request when SASL is enabled, the MAIL FROM address is listed in $smtpd_sender_login_maps, but the client is not authenticated with SASL.

With SASL enabled, this prevents an unauthenticated client from using any MAIL FROM address that is listed in $smtpd_sender_login_maps. This feature is available in Postfix version 2.1 and later.

If you are using virtual_alias_maps to deliver the mail, the smtpd_sender_login_maps has the same format; the same file can be used for both, updating the allowed addresses at the same time you add addresses for delivery.

Say you are using SMTPS on port 465 for submission, you can add these directives under it in master.cf:

smtps     inet  n       -       -       -       -       smtpd
  -o smtpd_sender_login_maps=hash:/etc/postfix/virtual
  -o smtpd_sender_restrictions=reject_sender_login_mismatch

The /etc/postfix/virtual has the addresses with the corresponding users:

# address                username
[email protected]   joe
[email protected]   jane

As it is a hash: Berkeley DB, remember sudo postmap /etc/postfix/virtual after modifications.

+ 3

Nikita Kipriyanov

1/11/24, 5:32 AM

This all is true, but you only could lock *envelope from* address like this. The "from" address that you see in the mail user agent comes from the email MIME header, and it needs not to be the same as envelope address, so it still could be faked. (I am sure you know, but whoever asked this question or found it may not know this detail yet.)

Esa Jokinen

1/11/24, 7:25 AM

@NikitaKipriyanov: That's true, but this is practically quite effective for two reasons. 1) The scenario was users changing the sender address on their email client. Typically the clients won't allow configuring envelope sender separately. 2) While an advanced user could abuse this, the actual sender would still be visible as the envelope sender (`Return-Path`).

rubyweb

1/11/24, 8:51 PM

Thanks. i will try it as soon as possible

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Postfix send mail as other user

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.