[Solved] restricting users to sending emails locally or externally

@Md. Shariful Islam

@rahul_1 

Hi,

I have modified some configuration. Could you please try again now?

Make sure to check this command output:

carbonio prov gs $(hostname -f)  zimbraMtaSmtpdSenderRestrictions

regards,

Hi,

When I try to run the setup again its shows an error 

zextras@mail:~$ carbonio prov ms mail.xyz.in +zimbraMtaSmtpdSenderRestrictions "check_sender_access lmdb:/opt/zextras/common/conf/restricted_senders"
ERROR: account.INVALID_ATTR_VALUE (invalid attr value: invalid attr value - unable to modify attributes: ldap host=mail.xyz.in:389: attribute 'zimbraMtaSmtpdSenderRestrictions' cannot have multiple values)
zextras@mail:~$

I have tried this command ____zmprov ms mail.xyz.in zimbraMtaSmtpdSenderRestrictions "check_sender_access lmdb:/opt/zextras/common/conf/restricted_senders"

instead of carbonio prov ms mail.xyz.in +zimbraMtaSmtpdSenderRestrictions "check_sender_access,

now sending external emails are blocked to all users allowed and not allowed both 

how to fix and allow some users to send external emails 

@rahul_1 

Hi,

This particular attribute could only have single value (Cardinality - single/multi), so when ever you use any attribute take a look at it's description which would give you many insights to avoid errors/issues:

root@mail:~# su - zextras -c "carbonio prov desc -a zimbraMtaSmtpdSenderRestrictions"
zimbraMtaSmtpdSenderRestrictions
    Value for postconf smtpd_sender_restrictions

               type : string
              value :
           callback :
          immutable : false
        cardinality : single
         requiredIn :
         optionalIn : globalConfig,server
              flags : serverInherited
           defaults : reject_sender_login_mismatch
                min :
                max :
                 id : 1590
    requiresRestart :
              since : 8.5.0
    deprecatedSince :

root@mail:~#

For your convenience, This is the short summary of the entire process, crosscheck each step and, I believe you would be able to find the issue and fix:

Note: Any typo in the configuration file would affect email transaction and flows.

cat /opt/zextras/conf/zmconfigd/smtpd_sender_restrictions.cf
##Add this line op top of the file
%%contains VAR:zimbraMtaSmtpdSenderRestrictions check_sender_access lmdb:/opt/zextras/common/conf/restricted_senders%%

#Execute this
su - zextras -c 'carbonio prov ms $(hostname -f) +zimbraMtaSmtpdSenderRestrictions "check_sender_access lmdb:/opt/zextras/common/conf/restricted_senders"'

#Check status
su - zextras -c "carbonio prov gs $(hostname -f) zimbraMtaSmtpdSenderRestrictions"

#This should be the output
zimbraMtaSmtpdSenderRestrictions: check_sender_access lmdb:/opt/zextras/common/conf/restricted_senders

cat /opt/zextras/conf/zmconfigd.cf
#Edit this file to add following lines just before the line of RESTART mta in - SECTION mta DEPENDS amavis

POSTCONF    smtpd_restriction_classes  local_only
POSTCONF    local_only  FILE  postfix_check_recipient_access.cf


cat /opt/zextras/conf/postfix_check_recipient_access.cf
#Add this line
check_recipient_access lmdb:/opt/zextras/common/conf/local_domains, reject

#Create prompt for this
cat /opt/zextras/common/conf/restricted_senders
user1@example.com    local_only
user2@example.com    local_only

#Create prompt for this
cat /opt/zextras/common/conf/local_domains

example.com    OK
internal.com   OK

#Execute this
chown zextras:zextras /opt/zextras/conf/postfix_check_recipient_access.cf
chmod 644 /opt/zextras/conf/postfix_check_recipient_access.cf
chown :zextras /opt/zextras/common/conf/restricted_senders
chmod 775 /opt/zextras/common/conf/restricted_senders
chown :zextras /opt/zextras/common/conf/local_domains
chmod 775 /opt/zextras/common/conf/local_domains

#postmap this
su - zextras -c "postmap /opt/zextras/common/conf/restricted_senders"
su - zextras -c "postmap /opt/zextras/common/conf/local_domains"

#Restart zmmtactl
su - zextras -c "zmmtactl restart"

Regards,

Hi Shariful,

After following all the steps the issue is fixed 

Thank you so much for your prompt response