According to Getting selective with SMTP access restriction lists in Postfix SMTP relay and access control documentation:
Postfix allows you to specify lists of access restrictions for each stage of the SMTP conversation. Individual restrictions are described in the postconf(5) manual page.
It would indeed be possible to limit the IP addresses earlier in smtpd_client_restrictions and then require SASL authentication later in smtpd_sender_restrictions. Please notice that the first matching reject* or permit* is used, so if you need to reject unknown sender domains and non FQDN sender, you must place those before the permit_sasl_authenticated.
Restrictions are applied in the order as specified; the first restriction that matches wins.
Example configuration matching your desired behaviour:
smtpd_client_restrictions =
permit_mynetworks,
reject
smtpd_sender_restrictions =
reject_non_fqdn_sender,
reject_unknown_sender_domain,
permit_sasl_authenticated,
reject
Furthermore, you could even limit which addresses the users could use based on their login with smtpd_sender_login_maps.
smtpd_sender_login_maps = hash:/etc/postfix/sender_login_maps
smtpd_client_restrictions =
permit_mynetworks,
reject
smtpd_sender_restrictions =
reject_sender_login_mismatch,
permit_sasl_authenticated,
reject
Here, the reject_non_fqdn_sender & reject_unknown_sender_domain from the previous example are rather pointless as you would not have such domains in your /etc/postfix/sender_login_maps, e.g.,
# Personal addresses
[email protected] joe
[email protected] jane
# Shared addresses
[email protected] joe
[email protected] jane
As always, remember to run postmap /etc/postfix/sender_login_maps as you are using the hash: i.e. Berkeley DB database lookup table type.
