spoofing - postfix check the From address field matches the authenticated username or other valid aliases in LDAP -

we have internet facing mx server whereby users authenticate outgoing connection submit emails via port 587. mx server routes incoming mail our domain internal postfix smtp server delivers mail local imap servers.

the internal postfix smtp server users ldap alias_maps = ldap:/etc/postfix/ldap-aliases.cf, lookup imap server users mailbox resides on.

there postfix option... reject_sender_login_mismatch can mapped... smtpd_sender_login_maps = ldap:/etc/postfix/smtpd_sender_login.cf

however - following error

jul 4 11:23:26 smtp-1.domain1.com postfix/smtpd[31530]: warning: restriction `reject_authenticated_sender_login_mismatch' ignored: no sasl support

no users authenticate internal postfix smtp server - route emails mx server. believe reason see warning "no sasl support" because postfix doesn't handle authentication it's taken care of mx server.

postconf -n

alias_database = hash:/etc/aliases alias_maps = ldap:/etc/postfix/ldap-aliases.cf, hash:/etc/aliases command_directory = /usr/sbin config_directory = /etc/postfix daemon_directory = /usr/libexec/postfix data_directory = /var/lib/postfix debug_peer_level = 2 html_directory = no inet_interfaces = inet_protocols = ipv4 mail_owner = postfix mailq_path = /usr/bin/mailq.postfix manpage_directory = /usr/share/man message_size_limit = 51200000 mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain,  mx3.$mydomain, mx1.$mydomain, mx2.$mydomain mydomain = domain1.com myhostname = smtp-1.domain1.com mynetworks = xxx.xxx.192.0/21, xxx.62.52.0/22, 10.0.0.0/8, xxx.16.0.0/12, xxx.168.0.0/16 myorigin = $mydomain newaliases_path = /usr/bin/newaliases.postfix queue_directory = /var/spool/postfix readme_directory = /usr/share/doc/postfix-2.6.6/readme_files sample_directory = /usr/share/doc/postfix-2.6.6/samples sendmail_path = /usr/sbin/sendmail.postfix setgid_group = postdrop smtpd_sender_login_maps = ldap:/etc/postfix/ldap-senders.cf smtpd_sender_restrictions = reject_authenticated_sender_login_mismatch unknown_local_recipient_reject_code = 550 

---

however, different config "smtpd_sender_restrictions = reject_unverified_sender"

if "envelope field" contains invalid forged address following logged - great stop unknown email address being forged - doesn't if it's forged known email address.

noqueue: reject: rcpt mx.domain1.com[xxx.xxx.192.130]: 450 4.1.7 : sender address rejected: unverified address: unknown user: "hejem"; from= to= proto=esmtp helo=

-bash-4.1$ postconf -n alias_database = hash:/etc/aliases alias_maps = ldap:/etc/postfix/ldap-aliases.cf, hash:/etc/aliases command_directory = /usr/sbin config_directory = /etc/postfix daemon_directory = /usr/libexec/postfix data_directory = /var/lib/postfix debug_peer_level = 2 html_directory = no inet_interfaces = inet_protocols = ipv4 mail_owner = postfix mailq_path = /usr/bin/mailq.postfix manpage_directory = /usr/share/man message_size_limit = 51200000 mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain,        mx3.$mydomain, mx1.$mydomain, mx2.$mydomain mydomain = domain1.com myhostname = smtp-1.domain1.com mynetworks = xxx.xxx.xxx.0/21, xxx.xxx.xxx.0/22, xxx.0.0.0/xxx, xxx.xxx.0.0/12, xxx.xxx.0.0/16 myorigin = $mydomain newaliases_path = /usr/bin/newaliases.postfix queue_directory = /var/spool/postfix readme_directory = /usr/share/doc/postfix-2.6.6/readme_files sample_directory = /usr/share/doc/postfix-2.6.6/samples sendmail_path = /usr/sbin/sendmail.postfix setgid_group = postdrop smtpd_sender_restrictions = reject_unverified_sender" 

what want achieve local internal postfix check "envelope field" ensure it's not been spoofed knowing sending user's username , looking it's assigned "from" aliases in ldap if doesn't match i.e. they're spoofing reject mail.

any advice how implement check in postfix?

thanks

firstly, not considered practice activate reject_unverified_sender in postfix services. if want prevent mails being sent non-existing addresses in domain, should prefer reject_unlisted_sender.

you can not sure of spoofing of existing mail addresses without activating authentication (sasl) mechanism on postfix service. thus, prevent spoofing of existing addresses:

• make sure smtpd_sender_login_maps configured.
• activate sasl authentication on postfix
• configure reject_authenticated_sender_login_mismatch or reject_sender_login_mismatch depending on preference.

further reading (from postfix sasl documentation)

envelope sender address authorization

by default smtp client may specify envelope sender address in mail command. because postfix smtp server knows remote smtp client hostname , ip address, not user controls remote smtp client.

this changes moment smtp client uses sasl authentication. now, postfix smtp server knows sender is. given table of envelope sender addresses , sasl login names, postfix smtp server can decide if sasl authenticated client allowed use particular envelope sender address:

/etc/postfix/main.cf: smtpd_sender_login_maps = hash:/etc/postfix/controlled_envelope_senders

smtpd_recipient_restrictions =     ...     reject_sender_login_mismatch     permit_sasl_authenticated