Postfix 发件人地址被拒绝/使用多个地址

Question 1

让用户进行测试

# saslpasswd2 -c -u example.net user1
# saslpasswd2 -c -u example.com user2

# sasldblistusers2
[email protected]: userPassword
[email protected]: userPassword

进行一些基本测试。如您所见，没有reject_authenticated_sender_login_mismatch的用户可以使用邮件来自无论他想要什么

# echo "Hello world" | swaks -s 127.0.0.1 --from [email protected] --to [email protected] --h-Subject "Test" --auth PLAIN --auth-user user1 --auth-password 1234567 --body -
=== Trying 127.0.0.1:25...
=== Connected to 127.0.0.1.
<-  220 mail.example.net ESMTP Postfix
 -> EHLO svn.example.net
<-  250-mail.example.net
<-  250-PIPELINING
<-  250-SIZE 10240000
<-  250-VRFY
<-  250-ETRN
<-  250-AUTH LOGIN PLAIN
<-  250-ENHANCEDSTATUSCODES
<-  250-8BITMIME
<-  250 DSN
 -> AUTH PLAIN AHVzZXIxADEyMzQ1Njc=
<-  235 2.7.0 Authentication successful
 -> MAIL FROM:<[email protected]>
<-  250 2.1.0 Ok
 -> RCPT TO:<[email protected]>
<-  250 2.1.5 Ok
 -> DATA
<-  354 End data with <CR><LF>.<CR><LF>
 -> Date: Thu, 25 Feb 2016 20:53:45 +0000
 -> To: [email protected]
 -> From: [email protected]
 -> Subject: Test
 -> X-Mailer: swaks v20130209.0 jetmore.org/john/code/swaks/
 ->
 -> Hello world
 ->
 ->
 -> .
<-  250 2.0.0 Ok: queued as E1D3D406CC
 -> QUIT
<-  221 2.0.0 Bye
=== Connection closed with remote host.

# grep E1D3D406CC /var/log/maillog
Feb 25 20:53:45 svn postfix/smtpd[56996]: E1D3D406CC: client=localhost[127.0.0.1], sasl_method=PLAIN, [email protected]
Feb 25 20:53:45 svn postfix/cleanup[56999]: E1D3D406CC: message-id=<[email protected]>
Feb 25 20:53:45 svn postfix/qmgr[56990]: E1D3D406CC: from=<[email protected]>, size=416, nrcpt=1 (queue active)
Feb 25 20:53:45 svn postfix/local[57000]: E1D3D406CC: to=<[email protected]>, relay=local, delay=0.03, delays=0.02/0/0/0.01, dsn=2.0.0, status=sent (delivered to mailbox)
Feb 25 20:53:45 svn postfix/qmgr[56990]: E1D3D406CC: removed

# echo "Hello world" | swaks -s 127.0.0.1 --from [email protected] --to [email protected] --h-Subject "Test" --auth PLAIN --auth-user user1 --auth-password 1234567 --body -
=== Trying 127.0.0.1:25...
=== Connected to 127.0.0.1.
<-  220 mail.example.net ESMTP Postfix
 -> EHLO svn.example.net
<-  250-mail.example.net
<-  250-PIPELINING
<-  250-SIZE 10240000
<-  250-VRFY
<-  250-ETRN
<-  250-AUTH LOGIN PLAIN
<-  250-ENHANCEDSTATUSCODES
<-  250-8BITMIME
<-  250 DSN
 -> AUTH PLAIN AHVzZXIxADEyMzQ1Njc=
<-  235 2.7.0 Authentication successful
 -> MAIL FROM:<[email protected]>
<-  250 2.1.0 Ok
 -> RCPT TO:<[email protected]>
<-  250 2.1.5 Ok
 -> DATA
<-  354 End data with <CR><LF>.<CR><LF>
 -> Date: Thu, 25 Feb 2016 20:55:13 +0000
 -> To: [email protected]
 -> From: [email protected]
 -> Subject: Test
 -> X-Mailer: swaks v20130209.0 jetmore.org/john/code/swaks/
 ->
 -> Hello world
 ->
 ->
 -> .
<-  250 2.0.0 Ok: queued as 94CBF4076C
 -> QUIT
<-  221 2.0.0 Bye
=== Connection closed with remote host.

# grep 94CBF4076C /var/log/maillog
Feb 25 20:55:13 svn postfix/smtpd[56996]: 94CBF4076C: client=localhost[127.0.0.1], sasl_method=PLAIN, [email protected]
Feb 25 20:55:13 svn postfix/cleanup[56999]: 94CBF4076C: message-id=<[email protected]>
Feb 25 20:55:13 svn postfix/qmgr[56990]: 94CBF4076C: from=<[email protected]>, size=424, nrcpt=1 (queue active)
Feb 25 20:55:13 svn postfix/local[57000]: 94CBF4076C: to=<[email protected]>, relay=local, delay=0.01, delays=0.01/0/0/0, dsn=2.0.0, status=sent (delivered to mailbox)
Feb 25 20:55:13 svn postfix/qmgr[56990]: 94CBF4076C: removed

但在我们添加了以下几行之后

# /etc/postfix/main.cf

smtpd_sender_login_maps = hash:/etc/postfix/sender_logins_maps
smtpd_sender_restrictions = reject_authenticated_sender_login_mismatch

不要忘记创建地图并重新启动 postfix

# postmap /etc/postfix/sender_logins_maps
# service postfix restart

# cat /etc/postfix/sender_logins_maps
[email protected] [email protected]
[email protected] [email protected]
[email protected] [email protected]

用户不能再使用他想要的任何东西

# echo "Hello world" | swaks -s 127.0.0.1 --from [email protected] --to [email protected] --h-Subject "Test" --auth PLAIN --auth-user user1 --auth-password 1234567 --body -
=== Trying 127.0.0.1:25...
=== Connected to 127.0.0.1.
<-  220 mail.example.net ESMTP Postfix
 -> EHLO svn.example.net
<-  250-mail.example.net
<-  250-PIPELINING
<-  250-SIZE 10240000
<-  250-VRFY
<-  250-ETRN
<-  250-AUTH LOGIN PLAIN
<-  250-ENHANCEDSTATUSCODES
<-  250-8BITMIME
<-  250 DSN
 -> AUTH PLAIN AHVzZXIxADEyMzQ1Njc=
<-  235 2.7.0 Authentication successful
 -> MAIL FROM:<[email protected]>
<-  250 2.1.0 Ok
 -> RCPT TO:<[email protected]>
<** 553 5.7.1 <[email protected]>: Sender address rejected: not owned by user user1
 -> QUIT
<-  221 2.0.0 Bye
=== Connection closed with remote host.

但使用上述设置[电子邮件保护]仅可以在 MAIL FROM 中使用：[电子邮件保护]，[电子邮件保护]和[电子邮件保护]

# echo "Hello world" | swaks -s 127.0.0.1 --from [email protected] --to [email protected] --h-Subject "Test" --auth PLAIN --auth-user [email protected] --auth-password 1234567 --body -
=== Trying 127.0.0.1:25...
=== Connected to 127.0.0.1.
<-  220 mail.example.net ESMTP Postfix
 -> EHLO svn.example.net
<-  250-mail.example.net
<-  250-PIPELINING
<-  250-SIZE 10240000
<-  250-VRFY
<-  250-ETRN
<-  250-AUTH LOGIN PLAIN
<-  250-ENHANCEDSTATUSCODES
<-  250-8BITMIME
<-  250 DSN
 -> AUTH PLAIN AHVzZXIxQGV4YW1wbGUubmV0ADEyMzQ1Njc=
<-  235 2.7.0 Authentication successful
 -> MAIL FROM:<[email protected]>
<-  250 2.1.0 Ok
 -> RCPT TO:<[email protected]>
<-  250 2.1.5 Ok
 -> DATA
<-  354 End data with <CR><LF>.<CR><LF>
 -> Date: Thu, 25 Feb 2016 23:03:07 +0000
 -> To: [email protected]
 -> From: [email protected]
 -> Subject: Test
 -> X-Mailer: swaks v20130209.0 jetmore.org/john/code/swaks/
 ->
 -> Hello world
 ->
 ->
 -> .
<-  250 2.0.0 Ok: queued as 9FE524068A
 -> QUIT
<-  221 2.0.0 Bye
=== Connection closed with remote host.

# grep 9FE524068A /var/log/maillog
Feb 25 23:03:07 svn postfix/smtpd[19097]: 9FE524068A: client=localhost[127.0.0.1], sasl_method=PLAIN, [email protected]
Feb 25 23:03:07 svn postfix/cleanup[19100]: 9FE524068A: message-id=<[email protected]>
Feb 25 23:03:07 svn postfix/qmgr[19092]: 9FE524068A: from=<[email protected]>, size=419, nrcpt=1 (queue active)
Feb 25 23:03:07 svn postfix/local[19101]: 9FE524068A: to=<[email protected]>, relay=local, delay=0.01, delays=0.01/0/0/0, dsn=2.0.0, status=sent (delivered to mailbox)
Feb 25 23:03:07 svn postfix/qmgr[19092]: 9FE524068A: removed

PS一个小技巧

如果没有在 /etc/postfix/sender_logins_maps 中为某些特定用户添加任何行 - 他将收到电子邮件但不会发送。

我似乎无法运行 saslauthd。它说找不到命令。这是一个单独的实用程序吗？编辑：抱歉，我的意思是说 testsaslauthd。两者都不起作用

这只是一个测试。因此，为了快速设置测试环境，我选择了 sasldb。因为我没有时间设置和配置 MySQL。您正在使用 MySQL 来存储有关用户的所有信息。您的限制在此处描述

smtpd_sender_login_maps = 
 proxy:mysql:/etc/postfix/sql/mysql_virtual_sender_acl.cf
 proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_maps.cf

您应该将 mysql_virtual_sender_acl.cf/mysql_virtual_alias_maps.cf 的内容（当然没有密码）添加到问题中

有没有办法配置 Postfix 以允许我通过一个帐户进行身份验证后从这个特定域上的任何地址发送？

在 /etc/postfix/sender_logins_maps 中你应该有类似以下内容

@example.net [email protected]

修改 smtpd_sender_login_maps

smtpd_sender_login_maps = 
 hash:/etc/postfix/sender_logins_maps,
 proxy:mysql:/etc/postfix/sql/mysql_virtual_sender_acl.cf, 
 proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_maps.cf

文件 /etc/postfix/sender_logins_maps 应该只包含一行

@example.net [email protected]

其中 @example.net - “一个特定的域名”， [电子邮件保护]- “使用一个帐户进行身份验证”。必须是 sasl_username！

sasl_method=PLAIN, [email protected]

不要忘记创建地图并重新启动 postfix。

Answer

您可以使用拒绝经过身份验证的发送者登录不匹配