littleboboy | olicel a écrit a écrit :
salut,
J'utilise postfix comme serveur SMTP. Ca marche bien.
Mais j'aimerais pouvoir atouriser ou non l'envoi d'un mail vers un autre domaine que mon domaine interne.
Explication :
Si un gars(non autorisé) essai d'envoyer un mail vers un autre domaine que le mien, je voudrais que son mail ne parte pas, et qu'il recoive un mail lui explicant que son mail n'est pas partis car il n'a pas les autorisation suffissante...
Je voudrais donc créer une liste d'utilisateur autoriser a envoyter des mail vers internet et restreindre tous les autres.
Est-ce que le fichier Access de postfix peut m'aider la dedans.
Si non alors comment faire?
si oui, des exemple plize..
|
Bon j'ai relu le thread 
A la base tu vas rejetter en relaying tous les mails qui ne sont pas autorises .
Une solution pour que quelqu'un puisse se servir de ton smtp comme relay est donc de l'autoriser
Pour ce faire tu peux soit passer par l'option SMTP auth
soit te servir du pop avant check
[g]Relaying mail for mobile users [/g]
I have Postfix setup on a machine but I'd like to have a select group of Internet users be able to relay mail through it. I'd either like to base the relaying on IP address (e.g., a 256-block for dynamic IP people) or on hostname (whatever.dialup.isp.com)
The most preferable way is to have users submit mail via some authenticated protocol instead of plain old SMTP.
The next best way is to use plain old SMTP and to authenticate the user first, for example, with a "please login via POP before using SMTP" scheme. In that case, some software maintains a Postfix-compatible access table with client IP address information. In order to make this work you need Postfix version 19991231 or later.
/etc/postfix/main.cf:
smtpd_recipient_restrictions =
permit_mynetworks
check_client_access hash:/etc/postfix/client_access
check_relay_domains
/etc/postfix/client_access:
4.3.2.1 OK
5.4.3.2 987654321
Specify dbm instead of hash if your system uses dbm files instead of db files. To find out what map types Postfix supports, use the command postconf -m.
N.B. Some non-Postfix software such as DRAC uses btree files instead of hash files. In that case, you will have to adjust the above check_client_access restriction accordingly.
A less preferable way is based on client IP address (for example, a 256-block) or DNS hostname (for example, whatever.pop.isp.com). This scheme does not authenticate the user. If you use IP/DNS-based relay access control, pray that no customer with that same ISP points their spam software at your machine, or else you may end up on internet-wide black lists.
The least preferable way is based on the sender address. It is trivially easy to spoof by anyone who ever received mail from your site. If you use sender address access control, pray that no spammer ever finds out the address of your users.
/etc/postfix/main.cf:
smtpd_recipient_restrictions =
permit_mynetworks
check_client_access hash:/etc/postfix/client_access
check_sender_access hash:/etc/postfix/sender_access
check_relay_domains
/etc/postfix/client_access:
11.22.33 OK
dialup.isp.com OK
/etc/postfix/sender_access:
joe@my.domain OK
blow@my.domain OK |
C'est tiré texto de la FAQ que je j'avais noté auparavant 
Tu peux meme a priori faire des restrictions en fonction des utilisateurs
Restricting what users can send mail to off-site destinations
How can I configure Postfix in a way that some users can send mail to the internet and other users not. The users with no access should receive a generic bounce message. Please don't discuss whether such access restrictions are necessary, it was not my decision.
Postfix has support for per-user restrictions. The restrictions are implemented by the SMTP server. Thus, users that violate the policy have their mail rejected by the SMTP server. Like this:
554 <user@remote>: Access denied
The implementation uses two lookup tables. One table defines what users are restricted in where they can send mail, and the other table defines what destinations are local. It is left as an exercise for the reader to change this into a scheme where only some users have permission to send mail to off-site destinations, and where most users are restricted.
The example assumes DB/DBM files, but this could also be done with LDAP or SQL.
/etc/postfix/main.cf:
smtpd_recipient_restrictions =
check_sender_access hash:/etc/postfix/restricted_senders
...other stuff...
smtpd_restriction_classes = local_only
local_only = check_recipient_access hash:/etc/postfix/local_domains, reject
/etc/postfix/restricted_senders:
foo@domain local_only
bar@domain local_only
/etc/postfix/local_domains:
this.domain OK matches this.domain and subdomains
that.domain OK matches that.domain and subdomains
Specify dbm instead of hash if your system uses dbm files instead of db files. To find out what map types Postfix supports, use the command postconf -m.
The smtpd_restriction_classes verbiage exists so that Postfix can open /etc/postfix/local_domains.db before entering a chroot jail, so it is only an artefact of implementation.
This scheme does not authenticate the user, therefore it can be bypassed in several ways:
By sending mail as someone else who does have permission to send mail to off-site destinations.
By sending mail as yourself via a less restrictive mail relay host. |
En revanche je vois pas comment celui qui voudrais mailer pourrais recevoir un mail explicatif concernant des droits insuffisants car il a l'erreur dans la conversation entre son client de messagerie & le smtp ..
--
En esperant avoir légérement fait avance le shim....ick
|
