Postfix: prevent users from changing the real e-mail address

Question

My postfix e-mail server is finally working well.

Now, I need to prevent users from forging their e-mail addresses in the client programs in the "from" field in the header, because a user can send email as other user with that, and a unexperienced user can think that is real.

If a user is experienced, he can inspect the email headers and know what is happening, but is there a way to block this behaviour?

Answer 1

Have a look at the smtpd_sender_restrictions and smtpd_sender_login_maps settings. The former can prevent malformed from addresses, while the latter can force the sender address to match the login name.

# Prevent malformed senders
smtpd_sender_restrictions =
    reject_non_fqdn_sender       # Ensure correct mail addresses
    reject_unknown_sender_domain # Ensure sender address is from an existing domain
    reject_authenticated_sender_login_mismatch # Check if the user is 
                                 # allowed to use this sender address

# Maps used to stop sender address forgeries.
smtpd_sender_login_maps = pcre:/etc/postfix/login_maps.pcre

The contents of login_maps.pcre could be

# Use this regex if your users are local users, i.e. if the login name
# is just the username, not a full mail address.
# Note that literal dots have to be backslash escaped (`\.`) to avoid
# interpretation of these dots as regex wildcard.
/^([^@+]*)(\+[^@]*)?@example\.com$/ ${1}

# If one doesn't care about subaddresses, this could be simplified to
/^(.*)@example\.com/ ${1}

# This is appropriate if you have virtual users who login with their
# full mail address as their username.  Local addresses won't work, though
/^(.*)$/    ${1}

The above config assumes that postfix was compiled with support for PCRE. On Ubuntu/Debian, this requires the postfix-pcre package to be installed.

Note that this will only work if nobody but authenticated users can send mail. If you allow mail from unauthenticated users, the above method won't help and will fail. Make sure to read Rui F Ribeiro's answer if that's the case.

Answer 2

While SMTP forging cannot be prevented, and the underlying protocol was not designed with security in mind, you can minimise in postfix the effects of email forging by your internal users.

You can configure your postfix and clients to be mandatory to authenticate to send email via port 587 with authentication.

That does not however prevent them from sending email, however, it makes the life of spam malware more difficult (but not impossible).

As for gmail, they have lots of the customisations to the code, or even their own proprietary email server. Back when I managed an ISP, I collected and wrote extensions to QMail that did not allow it to forward emails that were not from our domain, and also only accepting existing authenticated users in the FROM field (e.g. double checking the FROM with the user doing the authentication)

To relay email only for authenticated users in postfix, make sure you have in the file /etc/postfix/main.cf at the beginning of the smtpd_recipient_restrictions directive the following two options:

smtpd_recipient_restrictions = permit_sasl_authenticated, reject_unauth_destination

For more details, please check the official documentation at Postfix SMTP relay and access control

Answer 3

When sending mails via SMTP, the sender mail address appears at two different positions: in the SMTP-MAIL FROM request, and in the From mail header field. Some MUAs only show the value of the From mail header field.

Prevent forged envelope MAIL FROM addresses

For preventing users authenticated via SMTP from forging sender addresses, the option reject_authenticated_sender_login_mismatch in /etc/postfix/main.cf can be used. Then, smtpd_sender_login_maps should be adapted as well:

smtpd_sender_restrictions =
  ...
  reject_authenticated_sender_login_mismatch,
  ...
smtpd_sender_login_maps = pcre:/etc/postfix/maps/smtpd_sender_login_map.pcre

The contents of /etc/postfix/maps/smtpd_sender_login_map.pcre should then be according to tarleb’s answer:

• Use this regex if your users are local users, i.e. if the login name is just the username, not a full mail address. Note that literal dots have to be backslash escaped (\.) to avoid interpretation of these dots as regex wildcard:

  /^([^@+]*)(\+[^@]*)?@example\.com$/ ${1}

• If one doesn't care about subaddresses, this could be simplified to:

  /^(.*)@example\.com/ ${1}

• This is appropriate if you have virtual users who login with their full mail address as their username. Local addresses won't work, though:

  /^(.*)$/ ${1}

The above config assumes that postfix was compiled with support for PCRE. On Ubuntu/Debian, this requires the postfix-pcre package to be installed.

The sendmail command will still allow local users to choose an arbitrary from address when sending, which is problematic with hacked user accounts. The easiest solution to this problem is probably to restrict the usage of the sendmail command in Postfix’ main.cf, e.g.:

authorized_submit_users = root

Prevent forged From mail header addresses

Postfix does not seem to provide some easy solution to this by itself. However, it can be accomplished with a milter.

For Rspamd, you can create/extend the configuration file /etc/rspamd.local.lua by the following code:

local logger = require 'rspamd_logger'

rspamd_config:register_symbol({
  name = 'FROM_HEADER_MISMATCH',
  callback = function(task)
    local user = task:get_user()
    if not user then
      return 0
    end
    for index, smtp_sender in pairs(task:get_from(1)) do
      if smtp_sender.addr ~= user then
        logger.infox('invalid SMTP sender: %1', smtp_sender.addr)
        return 1
      end
    end
    for index, mime_sender in pairs(task:get_from(2)) do
      if mime_sender.addr ~= user then
        logger.infox('invalid MIME sender: %1', mime_sender.addr)
        return 1
      end
    end
    return 0
  end,
  score = 16,
  description = 'sender address in at least one mail header ' ..
    'differs from the sender address in the envelope'
})

This will mark mail with multiple from addresses as spam and cause rejection of the message by Postfix. It prevents forged From headers only if the envelope headers cannot be forged (see first part of the answer).

Alternatively, the milter vrfydmn is also able to replace the address in the From mail header by the SMTP MAIL FROM address.