I've a postfix email server running and everything was fine... well until someone decided to impersonate other users. The current situation is:
email@example.com send email with a faked
fromheader saying it is
At the faked emails headers I can see this:
From: User2 <firstname.lastname@example.org>
(Authenticated sender: email@example.com)
Clearly the user is using it's legit email address / password to authenticate on the server and then sets the
From header to the user he wants to impersonate.
I've tested this myself and it works. However, if I change the domain to some domain not on the virtual domains table the email client says the server refused the email.
Is there a way I can make sure
firstname.lastname@example.org is only able to send emails with
from header matching his email and not someone else on virtual domains table? -- Give an error like it happens when the domain is not listed.
smtpd restrictions are:
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, reject_unauth_pipelining, reject_unknown_sender_domain, reject_unknown_recipient_domain smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_invalid_hostname, reject_rbl_client zen.spamhaus.org, reject_rbl_client bl.spamcop.net, reject_rbl_client cbl.abuseat.org smtpd_sender_restrictions = permit_mynetworks, reject_unknown_address, reject_unknown_sender_domain, reject_non_fqdn_sender
Note: On the server there is plus addressing (ex.
user1+something@ mydomain.dev will deliver emails to
email@example.com) and also a virtual alias maps. For someone posting a solution to the problem above can you make sure the user is still able to "impersonate" is own emails based on plus-addressing or aliases. I need then to be able to send from
firstname.lastname@example.org (only if they belong to them).