There're some addons in postfix web site, search 'pop-before-smtp' in this page:
http://www.postfix.com/addon.html

And does this tutorial help:
http://www.arschkrebs.de/postfix/postfi … p_en.shtml

Maybe you can hack pop-before-smtp.pl to query virtual users from MYSQL, but i'm not familiar with perl programming language and didn't test this before. Sorry

smtpd_sender_login_maps is where smtpauth all occurs?

I am drowning.

Jerry

If you disable mysql:/etc/postfix/mysql_sender_login_maps.cf

smtpauth and pop before smtp owrk.

What are we missing without mysql:/etc/postfix/mysql_sender_login_maps.cf?

Jerry

The real issue is around
reject_sender_login_mismatch (http://www.postfix.org/uce.html#reject_ … n_mismatch)
The way I read it and the way it works for me at least is, if you have both set, you in effect enforce smtpauth

Problem solved for the most part.

Thank you for your responses.

Jerry

My understanding of this is as follows;

In the link above
quote
reject_sender_login_mismatch
    Reject the request when $smtpd_sender_owner_maps specifies an owner for the MAIL FROM address, but the client is not (SASL) logged in as that MAIL FROM address owner; or when the client is (SASL) logged in, but the client login name doesn't own the MAIL FROM address according to $smtpd_sender_login_maps.
/quote

This refers to smtpd_sender_owner_maps, the way I read this is if I am not SASL logged in postfix will refuse the mail when smtpd_sender_login_maps = mysql:/etc/postfix/mysql_sender_login_maps.cf is defined.

I first had a consultant look at it, he disabled smtpd_sender_login_maps = mysql:/etc/postfix/mysql_sender_login_maps.cf then I read some more and if both are set I believe you enforce smtpauth with the sending email address being required to match the auth address 100%.

In addition, if you have a user that is johndoe@domain.com and they try to send email from their office using your isp mail server and their sender email address is johndoe@work-domain.com, if reject_sender_login_mismatch is set, the mail will not be accepted.

In a very strict environment this is acceptable, in the real user non-corporate world it is too strict.

Jery

I think that since it is not sasl or smtpauth the result will be denied sending mail for pop-auth users.
ref. http://www.postfix.org/uce.html#reject_ … n_mismatch
I may try it when the system slows down or on a test system later.

Thank you very much for the discussions here.

Jerry

Hi,

I'm trying to implement pop-before-smtp in our server. I've followed the procedure mentioned here. But got stuck up in pop-before-smtp $pat pattern. The dovecot log format is like this:

2011.05.13-14:54:58, test@xyz.com, 180.234.47.11, pop3
2011.05.13-14:57:26, test@xyz.com, 180.234.47.12, pop3
2011.05.13-14:57:54, www@somedomain.com, 66.22.22.124, imap
2011.05.13-14:57:55, www@somedomain.com, 66.22.22.124, imap
2011.05.13-15:03:08, www@somedomain.com, 66.22.22.124, pop3

Pop-before-smtp script by default offer the following pattern for Dovecot. But it's not working for me

Code:
# For Dovecot POP3/IMAP when using syslog.
$pat = '^[LOGTIME] \S+ (?:dovecot: )?(?:imap|pop3)-login: ' .
    'Login: .*? (?:\[|rip=)[:f]*(\d+\.\d+\.\d+\.\d+)[],]';
$out_pat = '^[LOGTIME] \S+ (?:dovecot: )?(?:imap|pop3)-login: ' .
    'Disconnected.*? (?:\[|rip=)[:f]*(\d+\.\d+\.\d+\.\d+)[],]';

# For Dovecot POP3/IMAP when it does its own logging.
$logtime_pat = '(\d\d\d\d-\d+-\d+ \d+:\d+:\d+)';
$pat = '^dovecot: [LOGTIME] Info: (?:imap|pop3)-login: ' .
    'Login: .+? rip=[:f]*(\d+\.\d+\.\d+\.\d+),';
$out_pat = '^dovecot: [LOGTIME] Info: (?:imap|pop3)-login: ' .
    'Disconnected.*? rip=[:f]*(\d+\.\d+\.\d+\.\d+),';

# For older Dovecot POP3/IMAP when it does its own logging.
$pat = '^(?:imap|pop3)-login: [LOGTIME] Info: ' .
    'Login: \S+ \[[:f]*(\d+\.\d+\.\d+\.\d+)\]';
$out_pat = '^(?:imap|pop3)-login: [LOGTIME] Info: ' .
    'Disconnected.*? \[[:f]*(\d+\.\d+\.\d+\.\d+)\]';

Pop-before-smtp needs to read the IP from the log by regex.

Thanks for you help in advance.