wurzel/fruitbasket
9
1
Fork 0
Code Issues 5 Pull requests Packages Projects Releases Wiki Activity

Merge pull request #80 from fsr/sender-verification

Browse source 
verify mail senders
This commit is contained in:
Rouven Seifert 2024-01-24 17:33:30 +01:00 committed by GitHub
parent 93baff94f1 ffeb47cd5e
commit 69553c0645
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 12 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
modules/mail/default.nix
View file

@ -24,6 +24,11 @@ let
/^\s*X-Originating-IP/ IGNORE /^\s*X-Originating-IP/ IGNORE
/^\s*Mime-Version/ IGNORE /^\s*Mime-Version/ IGNORE
''; '';
# https://unix.stackexchange.com/questions/294300/postfix-prevent-users-from-changing-the-real-e-mail-address
login_maps = pkgs.writeText "login_maps.pcre" ''
# basic username => username@ifsr.de
/^([^@+]*)(\+[^@]*)?@ifsr\.de$/ ''${1}
'';
in in
{ {
sops.secrets."rspamd-password".owner = config.users.users.rspamd.name; sops.secrets."rspamd-password".owner = config.users.users.rspamd.name;
@ -119,6 +124,13 @@ in
smtpd_data_restrictions = [ smtpd_data_restrictions = [
"reject_unauth_pipelining" "reject_unauth_pipelining"
]; ];
smtpd_sender_restrictions = [
"reject_authenticated_sender_login_mismatch"
];
smtpd_sender_login_maps = [
"pcre:/etc/special-aliases.pcre"
"pcre:${login_maps}"
];
smtp_header_checks = "pcre:${header_cleanup}"; smtp_header_checks = "pcre:${header_cleanup}";
# smtpd_sender_login_maps = [ "ldap:${ldap-senders}" ]; # smtpd_sender_login_maps = [ "ldap:${ldap-senders}" ];
alias_maps = [ "hash:/etc/aliases" ]; alias_maps = [ "hash:/etc/aliases" ];