Extensions for the Postfix policyd service. Allow exceptions for the number of messages and the number of recipients.

2026-07-02 20:38:19 +02:00
parent 3b4ba60bb7
commit 7223219b08
7 changed files with 76 additions and 28 deletions
@@ -2991,6 +2991,14 @@ copy_plain_files_postfwd:
    src_path: mailserver/etc/postfix/postfwd.bl-recipient-exeeds-msg-size-20mb
    dest_path:  /etc/postfix/postfwd.bl-recipient-exeeds-msg-size-20mb

+  - name: postfwd.high-rate-number-messages
+    src_path: mailserver/etc/postfix/postfwd.high-rate-number-messages
+    dest_path:  /etc/postfix/postfwd.high-rate-number-messages
+
+  - name: postfwd.high-rate-number-recipients
+    src_path: mailserver/etc/postfix/postfwd.high-rate-number-recipients
+    dest_path:  /etc/postfix/postfwd.high-rate-number-recipients
+
  - name: postfwd.wl-hosts
    src_path: mailserver/etc/postfix/postfwd.wl-hosts
    dest_path: /etc/postfix/postfwd.wl-hosts
@@ -0,0 +1,19 @@
+# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
+
+# ---
+# SASL Users are allowed to send up to 500 messages per hour
+#
+#    This file is called with '=='. This means perl regexp is NOT possible
+#
+#
+# example:
+#
+#     # give sasl usernames here
+#     # 
+#     ckubu@oopen.de
+#
+# ---
+
+# give sasl usernames here
+application@cadus.org
+
@@ -1,22 +0,0 @@
-# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
-
-# ---
-# Trusted hosts whitelisted by postfwd
-#
-#    This file is called with '=~'. This means perl regexp is possible
-#
-#
-# To increase performance use ^ and/or $ in regular expressions
-#
-# Example:
-#
-#  # all hosts of domain 'oopen.de'
-#  \.oopen\.de$
-#
-#  # host a.mx.oopen.de
-#  ^a\.mx\.oopen\.de$
-#
-# ---
-
-# give truested hostnames here
-
@@ -172,12 +172,26 @@ id=BLOCK_MSG_RCPT
 	 recipient_count=90
    action=REJECT Too many recipients, please reduce to less than 90 or consider using a mailing list. Error: BLOCK_MSG_RCPT

+# Higher rate limit for users in exception list
+id=RATE_MSG_EXCEPTION
+    &&INCOMING
+    &&SASL_AUTH
+    sasl_username==file:/etc/postfix/postfwd.high-rate-number-messages
+    action=rate($$sasl_username/500/3600/450 4.7.1 Number messages per hour exceeded. Error:RATE_MSG_EXCEPTION)
+
 # Block users sending more than 50 messages/hour
 id=RATE_MSG
    &&INCOMING
    &&SASL_AUTH
    action=rate($$sasl_username/50/3600/450 4.7.1 Number messages per hour exceeded. Error:RATE_MSG)

+# Higher recipient rate limit for specific users from file
+id=RATE_RCPT_HIGH
+    &&INCOMING
+    &&SASL_AUTH
+    sasl_username==file:/etc/postfix/postfwd.rate-msg-exceptions
+    action=rcpt($$sasl_username/1000/3600/450 4.7.1 Number recipients per hour exceeded. Error:RATE_RCPT_HIGH)
+
 # Block users sending more than 250 recipients total/hour
 id=RATE_RCPT
    &&INCOMING
@@ -0,0 +1,18 @@
+# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
+
+# ---
+# SASL Users are allowed to send up to 500 messages per hour
+#
+#    This file is called with '=='. This means perl regexp is NOT possible
+#
+#
+# example:
+#
+#     # give sasl usernames here
+#     # 
+#     ckubu@oopen.de
+#
+# ---
+
+# give sasl usernames here
+
@@ -0,0 +1,17 @@
+# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
+
+# ---
+# SASL Users are allowed to send up to 1000 recipients per hour
+#
+#    This file is called with '=='. This means perl regexp is NOT possible
+#
+# example:
+#
+#     # give sasl usernames here
+#     # 
+#     ckubu@oopen.de
+#
+# ---
+
+# give sasl usernames here
+
@@ -20,9 +20,3 @@

 # give truested hostnames here

-# host b.mx.oopen.de
-^b\.mx\.oopen\.de$
-
-# host d.mx.oopen.de
-^d\.mx\.oopen\.de$
-