I am trying to setup some simple username-based restrictions on what local users can send on a local Solaris 10 server. In this case, I want to allow emails by all other users, but reject any attempt for user "local_usr" to send any email from this server. But so far, I can't make the below configurations/commands work. This postfix server relays to another close-by relayserver which forwards the msg to an external server. If possible, I would prefer to reject on the local email server before it hits the relay. If at all possible, I would also like an error condition/status in the smtp client, but thats not a huge problem.
I have provided as much diagnostic config and log data that I can imagine, but I am more than happy to provide more, can anyone see what I am missing? Thanks-in-advance ###Here are some of the relevant main.cf settings that I think would apply: root@myTestServer(/etc/opt/csw/postfix)% postconf | egrep "mynetworks|smtpd_sender_restrictions|relayhost =" address_verify_relayhost = $relayhost debug_peer_list = 127.0.0.1,myTestServer mynetworks = 172.20.158.0/26, 172.20.204.0/24, 172.19.5.0/25, 172.19.21.0/24, 127.0.0.0/8 mynetworks_style = subnet parent_domain_matches_subdomains = debug_peer_list,fast_flush_domains,mynetworks,permit_mx_backup_networks,qmqpd_authorized_clients,relay_domains,smtpd_access_maps postscreen_access_list = permit_mynetworks proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $sender_bcc_maps $recipient_bcc_maps $smtp_generic_maps $lmtp_generic_maps relayhost = [mail.myDomain.com] smtpd_client_event_limit_exceptions = ${smtpd_client_connection_limit_exceptions:$mynetworks} smtpd_recipient_restrictions = permit_mynetworks, reject_unauth_destination smtpd_sender_restrictions = check_sender_access hash:/etc/opt/csw/postfix/sender_access root@myTestServer(/etc/opt/csw/postfix)% ##Here is what my sender_access file has in it root@myTestServer(/etc/opt/csw/postfix)% more /etc/opt/csw/postfix/sender_access local_usr@ REJECT local_...@mydomain.com REJECT #Here is the command I ran to get the HASHED sender_access file created: postmap hash:sender_access #Timestamps of files proves the postmap command did something: -rw-r--r-- 1 root root 43 May 24 11:12 sender_access -rw-r--r-- 1 root root 49152 May 24 11:12 sender_access.db #Here is the local IP address of my server: 172.19.5.25 #Here are some modifications (in diff format) to master.cf to get more logging: 11c11 < smtp inet n - n - - smtpd --- > smtp inet n - n - - smtpd -v 40c40 < smtp unix - - n - - smtp --- > smtp unix - - n - - smtp -v #Here is the local SMTP Client command I ran to generate an email as the "local_usr" user: local_usr@myTestServer(~)% echo "test" | mutt -s "reject test 17" -- externalu...@example.com #SYSLOG file: May 24 11:41:51 myTestServer postfix/postfix-script[10277]: [ID 197553 mail.info] starting the Postfix mail system May 24 11:41:51 myTestServer postfix/master[10278]: [ID 197553 mail.info] daemon started -- version 2.8.6, configuration /etc/opt/csw/postfix May 24 11:41:59 myTestServer postfix/pickup[10279]: [ID 197553 mail.info] C41391CD00: uid=34001 from= May 24 11:41:59 myTestServer postfix/cleanup[10410]: [ID 197553 mail.info] C41391CD00: message-id=<20120524154159.ga10...@mytestserver.mydomain.com> May 24 11:41:59 myTestServer postfix/qmgr[10280]: [ID 197553 mail.info] C41391CD00: from=, size=490, nrcpt=1 (queue active) May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] name_mask: ipv4 May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] inet_addr_local: configured 2 IPv4 addresses May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] process generation: 5 (5) May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] match_string: debug_peer_list ~? debug_peer_list May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] match_string: fast_flush_domains ~? debug_peer_list May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] match_string: fast_flush_domains ~? fast_flush_domains May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] name_mask: canonical May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] name_mask: virtual May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] name_mask: dns May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] name_mask: native May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] host name lookup methods: dns native May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] auto_clnt_create: transport=local endpoint=private/scache May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] connection established May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] master_notify: status 0 May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] deliver_request_initial: send initial status May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] send attr status = 0 May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] smtp socket: wanted attribute: flags May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute name: flags May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute value: 3 May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] smtp socket: wanted attribute: queue_name May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute name: queue_name May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute value: active May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] smtp socket: wanted attribute: queue_id May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute name: queue_id May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute value: C41391CD00 May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] smtp socket: wanted attribute: offset May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute name: offset May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute value: 241 May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] smtp socket: wanted attribute: size May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute name: size May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute value: 490 May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] smtp socket: wanted attribute: nexthop May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute name: nexthop May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute value: [mail.myDomain.com] May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] smtp socket: wanted attribute: encoding May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute name: encoding May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute value: (end) May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] smtp socket: wanted attribute: sender May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute name: sender May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute value: local_...@mydomain.com May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] smtp socket: wanted attribute: envelope_id May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute name: envelope_id May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute value: (end) May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] smtp socket: wanted attribute: ret_flags May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute name: ret_flags May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute value: 0 May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] smtp socket: wanted attribute: time May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute name: time May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute value: T75WxwALvedPvlbHAAy+AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA= May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] smtp socket: wanted attribute: log_client_name May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute name: log_client_name May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute value: (end) May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] smtp socket: wanted attribute: log_client_address May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute name: log_client_address May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute value: (end) May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] smtp socket: wanted attribute: log_client_port May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute name: log_client_port May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute value: (end) May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] smtp socket: wanted attribute: log_protocol_name May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute name: log_protocol_name May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute value: (end) May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] smtp socket: wanted attribute: log_helo_name May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute name: log_helo_name May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute value: (end) May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] smtp socket: wanted attribute: sasl_method May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute name: sasl_method May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute value: (end) May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] smtp socket: wanted attribute: sasl_username May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute name: sasl_username May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute value: (end) May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] smtp socket: wanted attribute: sasl_sender May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute name: sasl_sender May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute value: (end) May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] smtp socket: wanted attribute: log_ident May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute name: log_ident May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute value: (end) May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] smtp socket: wanted attribute: rewrite_context May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute name: rewrite_context May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute value: local May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] smtp socket: wanted attribute: recipient_count May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute name: recipient_count May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute value: 1 May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] smtp socket: wanted attribute: (list terminator) May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute name: (end) May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] smtp socket: wanted attribute: original_recipient May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute name: original_recipient May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute value: externalu...@example.com May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] smtp socket: wanted attribute: recipient May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute name: recipient May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute value: externalu...@example.com May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] smtp socket: wanted attribute: offset May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute name: offset May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute value: 222 May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] smtp socket: wanted attribute: dsn_orig_rcpt May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute name: dsn_orig_rcpt May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute value: (end) May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] smtp socket: wanted attribute: notify_flags May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute name: notify_flags May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute value: 0 May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] smtp socket: wanted attribute: (list terminator) May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] input attribute name: (end) May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] deliver_request_get: file active/C41391CD00 May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] deliver_message: from local_...@mydomain.com May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] smtp_parse_destination: [mail.myDomain.com] smtp May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] connecting to mail.myDomain.com port 25 May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] smtp_addr_one: host mail.myDomain.com May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] lookup mail.myDomain.com type A flags 0 May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] dns_query: mail.myDomain.com (A): OK May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] dns_get_answer: type A for mail.myDomain.com May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] smtp_find_self: not found May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] begin mail.myDomain.com address list May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] pref 0 host mail.myDomain.com/172.19.21.5 May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] end mail.myDomain.com address list May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] smtp_connect_addr: trying: mail.myDomain.com[172.19.21.5] port 25... May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] vstream_tweak_tcp: TCP_MAXSEG 1380 May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] global TLS level: none May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] match_hostname: mail.myDomain.com ~? 127.0.0.1 May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] match_hostaddr: 172.19.21.5 ~? 127.0.0.1 May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] match_hostname: mail.myDomain.com ~? myTestServer May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] match_hostaddr: 172.19.21.5 ~? myTestServer May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] match_list_match: mail.myDomain.com: no match May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] match_list_match: 172.19.21.5: no match May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] < mail.myDomain.com[172.19.21.5]:25: 220 ************************************ May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] name_mask: disable_esmtp May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] name_mask: delay_dotcrlf May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] C41391CD00: enabling PIX workarounds: disable_esmtp delay_dotcrlf for mail.myDomain.com[172.19.21.5]:25 May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info]> mail.myDomain.com[172.19.21.5]:25: HELO myTestServer.myDomain.com May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] < mail.myDomain.com[172.19.21.5]:25: 250 mail.myDomain.com May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] server features: 0x31000 size 0 May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] > mail.myDomain.com[172.19.21.5]:25: MAIL FROM: May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] < mail.myDomain.com[172.19.21.5]:25: 250 2.1.0 Ok May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] > mail.myDomain.com[172.19.21.5]:25: RCPT TO: May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] < mail.myDomain.com[172.19.21.5]:25: 250 2.1.5 Ok May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info]> mail.myDomain.com[172.19.21.5]:25: DATA May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] < mail.myDomain.com[172.19.21.5]:25: 354 End data with . May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] header_token: text / plain May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info]> mail.myDomain.com[172.19.21.5]:25: . May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] < mail.myDomain.com[172.19.21.5]:25: 250 2.0.0 Ok: queued as F1B043A66E May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] C41391CD00: to=, relay=mail.myDomain.com[172.19.21.5]:25, delay=0.22, delays=0.07/0.03/0.08/0.05, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as F1B043A66E) May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info]> mail.myDomain.com[172.19.21.5]:25: QUIT May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] name_mask: resource May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] name_mask: software May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] deliver_request_final: send: "" 0 May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] send attr status = May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] send attr diag_type = May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] send attr diag_text = May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] send attr mta_type = May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] send attr mta_mname = May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] send attr action = May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] send attr reason = May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] send attr status = 0 May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] master_notify: status 1 May 24 11:41:59 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] connection closed May 24 11:41:59 myTestServer postfix/qmgr[10280]: [ID 197553 mail.info] C41391CD00: removed May 24 11:43:39 myTestServer postfix/smtp[10413]: [ID 197553 mail.info] idle timeout -- exiting