Extensions for the Postfix policyd service. Allow exceptions for the number of messages and the number of recipients.

group_vars/all/main.yml

@@ -2991,6 +2991,14 @@ copy_plain_files_postfwd:
     src_path: mailserver/etc/postfix/postfwd.bl-recipient-exeeds-msg-size-20mb
     dest_path:  /etc/postfix/postfwd.bl-recipient-exeeds-msg-size-20mb
 
+  - name: postfwd.high-rate-number-messages
+    src_path: mailserver/etc/postfix/postfwd.high-rate-number-messages
+    dest_path:  /etc/postfix/postfwd.high-rate-number-messages
+
+  - name: postfwd.high-rate-number-recipients
+    src_path: mailserver/etc/postfix/postfwd.high-rate-number-recipients
+    dest_path:  /etc/postfix/postfwd.high-rate-number-recipients
+
   - name: postfwd.wl-hosts
     src_path: mailserver/etc/postfix/postfwd.wl-hosts
     dest_path: /etc/postfix/postfwd.wl-hosts

roles/common/files/mail.cadus/etc/postfix/postfwd.high-rate-number-messages

@@ -0,0 +1,19 @@
+# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
+
+# ---
+# SASL Users are allowed to send up to 500 messages per hour
+#
+#    This file is called with '=='. This means perl regexp is NOT possible
+#
+#
+# example:
+#
+#     # give sasl usernames here
+#     # 
+#     ckubu@oopen.de
+#
+# ---
+
+# give sasl usernames here
+application@cadus.org
+

roles/common/files/mail.cadus/etc/postfix/postfwd.wl-hosts

@@ -1,22 +0,0 @@
-# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
-
-# ---
-# Trusted hosts whitelisted by postfwd
-#
-#    This file is called with '=~'. This means perl regexp is possible
-#
-#
-# To increase performance use ^ and/or $ in regular expressions
-#
-# Example:
-#
-#  # all hosts of domain 'oopen.de'
-#  \.oopen\.de$
-#
-#  # host a.mx.oopen.de
-#  ^a\.mx\.oopen\.de$
-#
-# ---
-
-# give truested hostnames here
-

roles/common/files/mailserver/etc/postfix/postfwd.cf

@@ -172,12 +172,26 @@ id=BLOCK_MSG_RCPT
 	 recipient_count=90
     action=REJECT Too many recipients, please reduce to less than 90 or consider using a mailing list. Error: BLOCK_MSG_RCPT
 
+# Higher rate limit for users in exception list
+id=RATE_MSG_EXCEPTION
+    &&INCOMING
+    &&SASL_AUTH
+    sasl_username==file:/etc/postfix/postfwd.high-rate-number-messages
+    action=rate($$sasl_username/500/3600/450 4.7.1 Number messages per hour exceeded. Error:RATE_MSG_EXCEPTION)
+
 # Block users sending more than 50 messages/hour
 id=RATE_MSG
     &&INCOMING
     &&SASL_AUTH
     action=rate($$sasl_username/50/3600/450 4.7.1 Number messages per hour exceeded. Error:RATE_MSG)
 
+# Higher recipient rate limit for specific users from file
+id=RATE_RCPT_HIGH
+    &&INCOMING
+    &&SASL_AUTH
+    sasl_username==file:/etc/postfix/postfwd.rate-msg-exceptions
+    action=rcpt($$sasl_username/1000/3600/450 4.7.1 Number recipients per hour exceeded. Error:RATE_RCPT_HIGH)
+
 # Block users sending more than 250 recipients total/hour
 id=RATE_RCPT
     &&INCOMING

roles/common/files/mailserver/etc/postfix/postfwd.high-rate-number-messages

@@ -0,0 +1,18 @@
+# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
+
+# ---
+# SASL Users are allowed to send up to 500 messages per hour
+#
+#    This file is called with '=='. This means perl regexp is NOT possible
+#
+#
+# example:
+#
+#     # give sasl usernames here
+#     # 
+#     ckubu@oopen.de
+#
+# ---
+
+# give sasl usernames here
+

roles/common/files/mailserver/etc/postfix/postfwd.high-rate-number-recipients

@@ -0,0 +1,17 @@
+# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
+
+# ---
+# SASL Users are allowed to send up to 1000 recipients per hour
+#
+#    This file is called with '=='. This means perl regexp is NOT possible
+#
+# example:
+#
+#     # give sasl usernames here
+#     # 
+#     ckubu@oopen.de
+#
+# ---
+
+# give sasl usernames here
+

roles/common/files/mailserver/etc/postfix/postfwd.wl-hosts

@@ -20,9 +20,3 @@
 
 # give truested hostnames here
 
-# host b.mx.oopen.de
-^b\.mx\.oopen\.de$
-
-# host d.mx.oopen.de
-^d\.mx\.oopen\.de$
-