Extensions for the Postfix policyd service. Allow exceptions for the number of messages and the number of recipients.

2026-07-02 20:38:19 +02:00
parent 3b4ba60bb7
commit 7223219b08
7 changed files with 76 additions and 28 deletions
@@ -172,12 +172,26 @@ id=BLOCK_MSG_RCPT
 	 recipient_count=90
    action=REJECT Too many recipients, please reduce to less than 90 or consider using a mailing list. Error: BLOCK_MSG_RCPT

+# Higher rate limit for users in exception list
+id=RATE_MSG_EXCEPTION
+    &&INCOMING
+    &&SASL_AUTH
+    sasl_username==file:/etc/postfix/postfwd.high-rate-number-messages
+    action=rate($$sasl_username/500/3600/450 4.7.1 Number messages per hour exceeded. Error:RATE_MSG_EXCEPTION)
+
 # Block users sending more than 50 messages/hour
 id=RATE_MSG
    &&INCOMING
    &&SASL_AUTH
    action=rate($$sasl_username/50/3600/450 4.7.1 Number messages per hour exceeded. Error:RATE_MSG)

+# Higher recipient rate limit for specific users from file
+id=RATE_RCPT_HIGH
+    &&INCOMING
+    &&SASL_AUTH
+    sasl_username==file:/etc/postfix/postfwd.rate-msg-exceptions
+    action=rcpt($$sasl_username/1000/3600/450 4.7.1 Number recipients per hour exceeded. Error:RATE_RCPT_HIGH)
+
 # Block users sending more than 250 recipients total/hour
 id=RATE_RCPT
    &&INCOMING
@@ -0,0 +1,18 @@
+# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
+
+# ---
+# SASL Users are allowed to send up to 500 messages per hour
+#
+#    This file is called with '=='. This means perl regexp is NOT possible
+#
+#
+# example:
+#
+#     # give sasl usernames here
+#     # 
+#     ckubu@oopen.de
+#
+# ---
+
+# give sasl usernames here
+
@@ -0,0 +1,17 @@
+# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
+
+# ---
+# SASL Users are allowed to send up to 1000 recipients per hour
+#
+#    This file is called with '=='. This means perl regexp is NOT possible
+#
+# example:
+#
+#     # give sasl usernames here
+#     # 
+#     ckubu@oopen.de
+#
+# ---
+
+# give sasl usernames here
+
@@ -20,9 +20,3 @@

 # give truested hostnames here

-# host b.mx.oopen.de
-^b\.mx\.oopen\.de$
-
-# host d.mx.oopen.de
-^d\.mx\.oopen\.de$
-