In postfix, how can I allow only certain users to send mail as any other user?
I figured out how to modify the query in /etc/postfix/sender-login-maps.cf
to allow any user with "admin" privileges (as defined in the users.sqlite
table) to send email as any other user at the same domain:
SELECT permitted_senders
FROM (
SELECT permitted_senders
FROM (
SELECT permitted_senders, 0 AS priority
FROM aliases
WHERE source='%s'
AND permitted_senders IS NULL
UNION
SELECT email as permitted_senders, 2 AS priority
FROM users
WHERE email='%s'
)
ORDER BY priority LIMIT 1
)
UNION
SELECT email as permitted_senders
FROM users
WHERE privileges="admin"
AND SUBSTR(email, INSTR(email, '@') + 1) = SUBSTR('%s', INSTR('%s', '@') + 1);
So basically, if [email protected]
is set as an admin (which you can do in the user database, or through your account configuration interface), then [email protected]
will be allowed to send mail as [email protected]
, [email protected]
, etc. This seems like a reasonable policy to me.