Restricting SASL Accounts by IP Addresses in Postfix on Ubuntu 22.04

You can restrict SASL authentication to specific IP addresses in Postfix on Ubuntu 22.04 by configuring the smtpd_client_restrictions parameter within your master.cf file. By adding a check against a custom hash table, you ensure that only authorized network ranges can utilize SMTP AUTH for sending mail, effectively locking down your ten allowed accounts from unauthorized access attempts while maintaining secure email delivery.

Understanding SASL Authentication Context

Before modifying configuration files, it is crucial to understand how Postfix handles authentication. Simple Authentication and Security Layer (SASL) allows users to authenticate themselves before sending emails. This process is typically handled by daemons like Dovecot or Cyrus. In a standard setup, if a user provides valid credentials, Postfix grants them permission to relay mail. However, this creates a security risk if those credentials are compromised, as attackers can send spam from any location. Restricting these accounts by IP address adds a layer of defense-in-depth. It ensures that even if a password is leaked, the attacker cannot use the account unless they are connecting from a pre-approved network. This is particularly important for small mail servers with limited accounts, where each credential holds significant value. The goal is not to block all external connections but to limit the *authentication* capability to trusted sources.

Creating the Access Control List

The first step involves creating a text file that maps IP addresses or subnets to their permission status. Create a new file named /etc/postfix/sasl_access. Inside this file, list the IP addresses or CIDR notation for your allowed networks. For example, if your office has the static IP 192.168.1.10, you would add that entry. You should also include your home IP if you send mail remotely. Each line should follow the format:

IP_ADDRESS OK

For IPv4, this might look like:

192.168.1.10 OK
10.0.0.5 OK

If you want to explicitly deny all other IPs later, you will need a catch-all rule. However, Postfix processes restrictions in order, so the order matters significantly. After editing the file, you must convert it into a database format that Postfix can read efficiently. Run the following command in your terminal:

sudo postmap /etc/postfix/sasl_access

This generates a sasl_access.db file in the same directory. Ensure that the permissions on both files are correct, typically readable by the postfix user. If you change the allowed IPs, remember to run postmap again after every modification.

Configuring Master.cf

The most common mistake is editing main.cf directly for this specific restriction. Instead, you must modify master.cf, which controls the services Postfix runs. Open /etc/postfix/master.cf with a text editor. Look for the submission service, which usually starts with submission inet n - - - - smtpd. This service handles client submissions on port 587. You need to add the -o smtpd_client_restrictions=check_client_access hash:/etc/postfix/sasl_access option to this service line. The section should look similar to this:

submission inet n       -       y       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=check_client_access hash:/etc/postfix/sasl_access
  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject

Notice the last two lines. The smtpd_sasl_auth_enable=yes line turns on authentication for this service. The critical addition is the smtpd_client_restrictions line. This tells Postfix to check the client's IP against your sasl_access database before allowing any further processing. If the IP is not listed or denied, the connection is refused immediately. Do not apply this restriction to the smtp service (port 25) intended for server-to-server communication, as other mail servers have dynamic IPs. This restriction is strictly for client submission. For more information on handling dynamic IP issues in general delivery contexts, see our guide on Handling Email Delivery with Dynamic IP Addresses on Ubuntu Server using Postfix.

Applying and Verifying Changes

After saving master.cf, reload the Postfix configuration to apply the changes without restarting the entire system. Use the following command:

sudo systemctl reload postfix

To verify that the restriction is working, attempt to connect to port 587 from an IP address that is NOT in your sasl_access file. You can use telnet or nc from a different machine. When you try to authenticate, the server should reject the connection or the authentication attempt with a 5xx error code indicating client rejection. Conversely, test from an allowed IP. The connection should succeed, and you should be able to send mail normally. If you encounter issues, check the /var/log/mail.log for detailed messages. Look for entries containing "reject" or "access" to see if Postfix is correctly evaluating the rules. It is also wise to review your overall server security. Restricting SASL is one part of a broader strategy. Consider implementing additional hardening measures, such as disabling unused kernel modules, as discussed in our article on Understanding Ubuntu 22.04 VPS Security.

Maintaining the Allowlist

As your needs change, you may need to add or remove IPs. Always edit the plain text sasl_access file, then re-run postmap, and finally reload Postfix. Never edit the .db file directly. If you manage multiple domains, ensure that this restriction applies uniformly if you want consistent security across all accounts. For scenarios where you need to adjust sender headers rather than client access, refer to our tutorial on Change Postfix Sender Envelope MAIL FROM Address To Match Return Path Header Email For Multiple Domains. This ensures your outbound mail looks professional while remaining secure.

Frequently Asked Questions

Can I allow specific IPs for some accounts but not others?

Postfix does not natively support per-account IP restrictions in the basic configuration. You would need to implement virtual alias maps or use a more complex policy daemon to achieve granular per-user control. For most small setups, applying the restriction globally to the submission service is sufficient and simpler to maintain.

What happens if my ISP assigns me a dynamic IP?

If your home IP changes frequently, you cannot rely on static IP whitelisting. Instead, consider using a VPN or a tunneling service to connect to your mail server. Alternatively, you can use strong passwords and enable two-factor authentication if your SASL backend supports it, reducing the reliance on IP-based security.

Does this affect server-to-server mail delivery?

No, because the restriction is applied only to the submission service (port 587). Standard SMTP traffic on port 25 remains unrestricted for incoming mail from other mail servers. This ensures that your server can still receive emails from the public internet while keeping outgoing authenticated mail secure.

How do I troubleshoot if legitimate users are blocked?

Check the /var/log/mail.log file for rejection messages. Look for lines containing "client=..." followed by "reject". Verify that the IP address reported in the log matches the one you added to sasl_access. Remember that if you are behind a NAT or proxy, the logged IP might be the gateway's IP, not the user's actual device IP.

Is it safe to leave the default reject rule out?

If you do not add a default REJECT rule to sasl_access, Postfix will proceed to the next restriction or allow the connection if no other rules match. It is best practice to add a final line like "REJECT" at the end of your sasl_access file to explicitly deny any IP not previously listed as OK.