Skip to content

Group Sender Restrictions

This guide demonstrates how to restrict senders to a group email using LDAP

How It Works

  • Postfix queries the group_restriction.cf map when a sender attempts to send an email to a group,
  • The map checks if an RCPT address is a part of the group_restriction policy
  • If the recipient is restricted, the group_restriction class is triggered
  • The restriction class checks the FROM address against the groups's rfc822sender attribute
  • Postfix returns OK if present; otherwise, the mail is rejected with a custom message

Configuring Group Restrictions

LDAP

Create a policy group and add restricted group ids. Add senders to rfc822sender attribute in group

cn=testgroup,ou=Group,dc=deeproot,dc=in
cn: testgroup
objectClass: top
objectClass: qmailUser
objectClass: qmailGroup
...
mail: testgroup@deeproot.in
rfc822member: user1@deeproot.in
rfc822member: user2@deeproot.in
...
rfc822sender: user1@deeproot.in

dn: cn=group_restriction,ou=policy,dc=deeproot,dc=in 
objectClass: top
objectClass: deepofixuser 
cn: group_restriction
restrictedGroup: testgroup@deeproot.in

Postfix configuration

Lookup tables

Create an LDAP table that queries allowed senders. If the sender is permitted, return 'OK'; otherwise, reject the mail.

server_host = 127.0.0.1:389
bind = yes
bind_dn = uid=deepofix,ou=admin,dc=deeproot,dc=in
bind_pw = bind_pass
search_base = ou=Group,dc=deeproot,dc=in
query_filter = (&(objectClass=qmailGroup)(rfc822sender=%s))
result_attribute = mail
result_format = OK

/*/ REJECT You are not allowed to send mails to this group

Restriction class

We are verifying whether a FROM address is allowed to send mails to a GROUP. The smtpd_recipient_restrictions evaluates whether a group is sender restricted. The smtpd_restriction_classes evaluates FROM address against the group_restriction class. The evaluation is conducted when a RCPT address(group) is part of the group_restrictions policy. Members will prompt the restriction class to verify whether given FROM address is allowed. The check returns "OK" for success, else reject the mail with a custom message.

# restriction classes
group_restriction = check_sender_access ldap:/etc/postfix/restrictions/group_senders.cf, check_recipient_access pcre:/etc/postfix/restriction/group_senders_reject.cf, reject

smtpd_restriction_classes = group_restriction

# Smtpd restrictions
smtpd_recipient_restrictions =  check_sender_access ldap:/etc/postfix/restrictions/group_restriction.cf,
  ...  # other restrictions

Restriction map

A policy group is used to determine which users should be restricted. This map checks if a email belongs to the group policy and applies the restriction accordingly.

server_host = 127.0.0.1:389
bind = yes
bind_dn = uid=deepofix,ou=admin,dc=deeproot,dc=in
bind_pw = bind_pass
search_base = ou=policy,dc=deeproot,dc=in
query_filter = (&(objectClass=deepofixUser)(cn=group_restriction)(restrictedGroup=%s))
result_attribute = cn

This setup ensures that only specified emails can send mails to those groups. All other senders will be rejected.