How to restrict all but 1 inbox, to only be able to email that inbox

SomeNerdWithFreeTime

I have tried to search the forums, used all search engines I could think of, and tried my luck with the statistically empowered (LLMs) but I haven’t yet found a solution which works completely - or I might just be an idiot overseeing the obvious.

I am trying to setup rules, such that a special privileged user: “admin@mymail.com” is able to send/receive emails from all internal and external addresses - while all other *@mymail addresses can only send/receive mails from admin@mymail.com.

Some examples:
admin@mydomain.com -> any ✅
user1@mydomain.com -> user2@mydomain.com ⛔
user1@mydomain.com -> admin@mydomain.com ✅
someone@else.com -> user1@mydomain.com ⛔
someone@else.com -> admin@mydomain.com ✅

I could not find the correct settings in the admin interface (if they exist).

I’ve tried making my own postmap unsuccessfully, and creating a pair of recipient_restrictions.pcre and sender_restrictions.pcre, was only partially successful.

The closest I have gotten, was with the pcre file: I restricted all users to only be able to email the admin - but that included the admin itself, so it could not reply to the received email, nor could it email an external inbox.

Anyone know of a setting page I’ve missed, or am able to scold me on my incorrect use of pcre files - have knowledge of a fancy policy creation plugin of some kind that enables this behavior?

I don’t need complete solutions (though they would of course be appreciated as well), but would love if someone could point me in the right direction - because I’ve gotten myself rather lost.

esackbauer

I don’t really see why you want to be able to send as any user which would e.g. violate GDPR in EU countries.
You could ask the user to have him give you the rights to share his inbox with your admin mailbox with SOGo. That would be the proper way with his consent.
However gathering incoming mails would be possible via a BCC map, where each mail lands in your admin mailbox.
Those are configured in the Mailcow Admin UI, E-Mail - Configuration - Address rewriting

SomeNerdWithFreeTime

Sorry, I might not have been entirely clear: I do not wish for the admin to be able to presume the identity of the other users, but I am rather trying to create an email server, for support purposes, where an individual is given access to an email which they can only use to communicate with the admin.

However the admin should not be restricted in a similar way, in case it needs to contact a customer email which is not from the same mail server

ETNyx

Hi there, what are you trying is get some kind of strictly internal messaging system? Maybe some kind of closed messaging system / forum / chat would be more suitable for this?

Update: after your post than some kind of ticketing / helpdesk system ?

SomeNerdWithFreeTime

That is very likely the case - and I will look into doing that, as well.
But while I know that this is not the primary use case of mailcow - or any mail server, really, I believe it must be possible to “MacGyver” such functionality out of a mailcow server.

ETNyx

Well yes it should be doable,…

You will need to modify smtpd_recipient_restrictions add check_sender_access to own map this map will contain list of senders

admin@example.com  OK #if admin is sending something than it's OK he can message to all
@example.com  SENDER_RULE #all others need to be check further

now you need to specify SENDER_RULE so something like

smtpd_restriction_classes = SENDER_RULE

SENDER_RULE =
    check_recipient_access hash:/etc/postfix/sender.rule.map, # Map for recipients
    reject

sender.rule.map

admin@example.com   OK #You can send only to admin, next step in SENDER_RULE is reject

compile, restart and test (written from top of mine head)

Update: But nice ticketing / helpdesk system will be more useful for users and admin, that’s why those system are made for,…

SomeNerdWithFreeTime

Thanks for the input on this.
I ended up creating a global_sieve_before script from the admin interface, which effectively solved the “issue”.

If anyone in the future for some reason would want to go down this route, the script is as follows:
# global_sieve_before script
# global_sieve_before -> user sieve_before (mailcow UI) -> user sieve_after (mailcow UI) -> global_sieve_after

require [“mailbox”, “fileinto”];
require “envelope”;
require “reject”;

if anyof ( envelope :is “from” “test@mymail.com”,
envelope :is “to” “test@mymail.com” ) {
keep;
stop;
}

if envelope :matches “to” “*@mymail.com” {
reject “554 Delivery denied: Of mymail.com addresses, only: test@mymail.com is a valid recipient.”;
stop;
}

if header :contains [“Chat-Version”] [""] {
if mailboxexists “DeltaChat” {
fileinto “DeltaChat”;
} else {
fileinto :create “DeltaChat”;
}
stop;
}