Category:Installation/Postfix Restriction: Difference between revisions

Protecting internal email distribution lists on Postfix ( Done at BLKHOSPITAL )

Implementation Done at BLK Hospital

We want to implement an internal email distribution list. Something like teamblk@blkhospital.com.

Postfix can implement per-address access controls. What follows is based on the SMTP client IP address, and therefore is subject to IP spoofing.

Installation

main.cf modifications

vim /etc/postfix/main.cf

smtpd_recipient_restrictions = check_recipient_access hash:/etc/postfix/conf/protected_recipients        
check_recipient_access hash:/etc/postfix/conf/protected_recipients
permitted_senders_list = check_sender_access hash:/etc/postfix/conf/permitted_senders, reject
smtpd_restriction_classes = permitted_senders_list

Save this file

Protected Recipients (Groups)

vim /etc/postfix/conf/protected_recipients

tetragroup@blkhospital.com      permitted_senders_list
teamblk@blkhospital.com         permitted_senders_list

Save this file

Permitted Senders

vim /etc/postfix/conf/permitted_senders

tetra_test@blkhospital.com      OK
sanjay.mehta@blkhospital.com    OK
bhoovanpawar@blkhospital.com    OK
ritu.verma@blkhospital.com      OK
mybuddyhr@blkhospital.com       OK
ceo@blkhospital.com             OK
praneetkumar@blkhospital.com    OK
nareshkapoor@blkhospital.com    OK
blk@blkhospital.com             OK
mradul.kaushik@blkhospital.com  OK
ritachoudhrie@blkhospital.com   OK
dhruvchoudhrie@blkhospital.com  OK
prashantsingh@blkhospital.com   OK
keshav.gupta@blkhospital.com    OK

Save this file

Final Steps

postmap /etc/postfix/conf/protected_recipients
postmap /etc/postfix/conf/protected_recipients
postfix reload

Getting past this scheme is relatively easy, because all one has to do is to spoof the SMTP sender address.

If the internal list is a low-volume one, perhaps it makes more sense to make it moderated.