Restricting SASL Accounts' IP Addresses on Postfix in Ubuntu 22.04
In this article, we will explore the concepts of SMTP, SASL, Postfix, and IP address restrictions for specific SASL accounts. We will provide a detailed, step-by-step guide on how to restrict access for selected accounts on a Postfix mail server running on Ubuntu 22.04.
Table of Contents
Postfix and SASL
Postfix is a popular open-source mail transfer agent (MTA) that handles email routing on a mail server. Simple Authentication and Security Layer (SASL) is a framework used for adding authentication support and encryption capabilities to various network protocols. In this case, Postfix uses SASL to support authenticated SMTP.
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = $myhostname
IP Address Restrictions
Postfix features IP address restrictions and access control mechanisms. We can leverage these features to restrict SASL accounts so that they can only send emails from specific IP addresses. Implementing IP address restrictions involves using Postfix's access tables and SMTPD policies.
Restricting SASL Accounts
To restrict a couple of accounts, you can use the smtpd_client_restrictions and smtpd_sender_restrictions parameters. Create a file called restricted_sasl_clients in the /etc/postfix/ directory. Add the allowed SASL accounts and their respective IP addresses:
[email protected] 192.168.1.100/32
[email protected] 192.168.1.101/32
Then, add the following line to the main.cf configuration file:
smtpd_client_restrictions = check_client_access regexp:/etc/postfix/restricted_sasl_clients
To further restrict the accepted sender addresses, add the following lines to the main.cf configuration file:
smtpd_sender_restrictions =
check_sender_access hash:/etc/postfix/restricted_sasl_clients
Run these commands to apply the changes:
sudo postmap /etc/postfix/restricted_sasl_clients
sudo systemctl restart postfix
- Understanding Postfix and SASL
- Utilizing IP Address Restrictions
- Restricting SASL Accounts Based on IP Address