Category:Installation/Postfix Restriction

'Protecting internal email distribution lists'

We want to implement an internal email distribution list. Something like teamblk@blkhospital.com.

Postfix can implement per-address access controls. What follows is based on the SMTP client IP address, and therefore is subject to IP spoofing.

vim /etc/postfix/main.cf

smtpd_recipient_restrictions = check_recipient_access hash:/etc/postfix/conf/protected_recipients

check_recipient_access hash:/etc/postfix/conf/protected_recipients

permitted_senders_list = check_sender_access hash:/etc/postfix/conf/permitted_senders, reject

smtpd_restriction_classes = permitted_senders_list

Save this file

vim /etc/postfix/conf/protected_recipients

tetragroup@blkhospital.com permitted_senders_list

teamblk@blkhospital.com permitted_senders_list

Save this file

vim /etc/postfix/conf/permitted_senders

tetra_test@blkhospital.com OK

sanjay.mehta@blkhospital.com OK

bhoovanpawar@blkhospital.com OK

ritu.verma@blkhospital.com OK

mybuddyhr@blkhospital.com OK

ceo@blkhospital.com OK

praneetkumar@blkhospital.com OK

nareshkapoor@blkhospital.com OK

blk@blkhospital.com OK

mradul.kaushik@blkhospital.com OK

ritachoudhrie@blkhospital.com OK

dhruvchoudhrie@blkhospital.com OK

prashantsingh@blkhospital.com OK

keshav.gupta@blkhospital.com OK

Save this file

postmap /etc/postfix/conf/protected_recipients

postmap /etc/postfix/conf/protected_recipients

postfix reload

Getting past this scheme is relatively easy, because all one has to do is to spoof the SMTP sender address.

If the internal list is a low-volume one, perhaps it makes more sense to make it moderated.