<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
Alain Spineux wrote:
<blockquote
cite="mid:71fe4e760712040447w4a0b5830hc3e90ad46240acf2@mail.gmail.com"
type="cite">
<pre wrap="">On Dec 4, 2007 11:57 AM, Fabio Pietrosanti <a class="moz-txt-link-rfc2396E" href="mailto:lists@infosecurity.ch"><lists@infosecurity.ch></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Can someone briefly explain the goal of the kolab policy server?
Which are the policy that it apply?
I would like to evaluate if those "policy enforcement" can be done
directly with postfix's feature instead of using a policyserver.
</pre>
</blockquote>
<pre wrap=""><!---->
It check if the authenticated match the sender of the email and if
the user can send an email to some distribution list.
</pre>
</blockquote>
mmm regarding the matching of authorized sender for a specific
authenticated user we can use the standard postfix feature:<br>
<br>
smtpd_sender_restrictions= reject_sender_login_mismatch <br>
smtpd_sender_login_maps = (with an ldap lookup)<br>
<br>
<b>reject_sender_login_mismatch<br>
</b>Reject the request when $smtpd_sender_login_maps specifies an owner
for
the MAIL FROM address, but the client is not (SASL) logged in as that
MAIL FROM address owner; or when the client is (SASL) logged in, but
the client login name doesn't own the MAIL FROM address according to
$smtpd_sender_login_maps.<br>
<br>
<b>smtpd_sender_login_maps<br>
</b>Optional lookup table with the SASL login names that own sender
(MAIL FROM) addresses.<br>
<br>
Specify zero or more "type:table" lookup tables. With lookups from
indexed files such as DB or DBM, or from networked tables such as NIS,
LDAP or SQL, the following search operations are done with a sender
address of user@domain:<br>
<br>
1) user@domain<br>
This table lookup is always done and has the highest precedence.<br>
2) user<br>
This table lookup is done only when the domain part of the sender
address matches $myorigin, $mydestination, $inet_interfaces or
$proxy_interfaces.<br>
3) @domain<br>
This table lookup is done last and has the lowest precedence.<br>
<br>
<br>
<br>
Which are the rules for the distribution list authorization or not?<br>
We could use the smtpd_sender_restrictions to match this kind of
condition.<br>
<br>
I would be happy to provide all the configurations useful to use
built-in postfix features instead of custom code.<br>
<br>
<blockquote
cite="mid:71fe4e760712040447w4a0b5830hc3e90ad46240acf2@mail.gmail.com"
type="cite">
<pre wrap="">And probably soon, if not already, limit the recipient's domains for some user.
</pre>
</blockquote>
Any more info on that side?<br>
</body>
</html>