From 6e39bad3fbe75b88fca4c2e2aad8eb51af14b1be Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Wed, 31 May 2017 21:42:32 +0200
Subject: Don't let authenticated client use arbitrary sender addresses.

The following policy is now implemented:

    * users can use their SASL login name as sender address;
    * alias and/or list owners can use the address as envelope sender;
    * domain postmasters can use arbitrary sender addresses under their
      domains;
    * domain owners can use arbitrary sender addresses under their domains,
      unless it is also an existing account name;
    * for known domains without owner or postmasters, other sender addresses
      are not allowed; and
    * arbitrary sender addresses under unknown domains are allowed.
---
 roles/MSA/tasks/main.yml | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

(limited to 'roles/MSA/tasks/main.yml')

diff --git a/roles/MSA/tasks/main.yml b/roles/MSA/tasks/main.yml
index 6eff2cf..00c205d 100644
--- a/roles/MSA/tasks/main.yml
+++ b/roles/MSA/tasks/main.yml
@@ -4,6 +4,28 @@
     - postfix
     - postfix-pcre
 
+- name: Copy Postfix sender login socketmap
+  copy: src=usr/local/bin/postfix-sender-login.pl
+        dest=/usr/local/bin/postfix-sender-login.pl
+        owner=root group=staff
+        mode=0755
+
+- name: Copy Postfix sender login socketmap systemd unit files
+  copy: src=etc/systemd/system/{{ item }}
+        dest=/etc/systemd/system/{{ item }}
+        owner=root group=root
+        mode=0644
+  with_items:
+    - postfix-sender-login.service
+    - postfix-sender-login.socket
+  notify:
+    - systemctl daemon-reload
+
+- meta: flush_handlers
+
+- name: Enable Postfix sender login socketmap
+  service: name=postfix-sender-login.socket state=started enabled=yes
+
 - name: Configure Postfix
   template: src=etc/postfix/{{ item }}.j2
             dest=/etc/postfix-{{ postfix_instance[inst].name }}/{{ item }}
-- 
cgit v1.2.3