courier-auth-postfix allows administrators to restrict relaying only to those users that successfully accessed their mailbox either with pop3 or imap (that successfully authenticated against courier-imap or courier-pop3, aka pop-before-smtp).
It was meant for those internet providers that do not want to leave their smtp server as ``open-relay'' but do not want to use smtp user authentication and do not want to set restrictions based on IP addresses.
courier-auth-postfix is provided as a patch for postfix, but, strictly speaking, it is not a real patch. It is a standalone module that is provided as a patch just to simplify the task of compiling it. Postfix nor courier would be modified by this patch and it would be possible to compile everything independently. However, no support is provided in this manual (not too hard anyway -- good luck). From courier point of view, you will end up with an additional authentication module that can be used exactly like any other authentication module (help will be provided in the following sections).
In order to optimize the usage of some kind of databases and in order to provide additional features, courier-auth-postfix supports ``optimizers''. An optimizer is just a small module compiled in courier-auth-postfix able to handle requests more efficiently. Actually, the only optimizer provided adds complete support for MySql (a delete query is much faster than scanning all records).
Once compiled, in order to use courier-authpostfix, you need to modify just a couple of lines in main.cf and in courier configuration files (mainly pop3d and imapd).
You can find the latest version of this document and the mentioned software at http://www.commedia.it/ccontavalli/. If you have troubles/suggestions/corrections feel free to mail me at <ccontavalli at commedia.it>.
When a user logs in to check his emails on pop3 or imap his IP address and login time is added to a postfix-style database using the same libraries as used by postfix (for example, you can have a mysql:/etc/postfix/mysql.conf database). Postfix is then instructed to allow relaying only to those hosts inserted into that database.
Every once in a while, a cron job takes care of removing expired entries from the database and the removed host must authenticate again before being able to relay new emails.
courier-auth-postfix is able to use both the dict or the map interface of postfix (look to postfix documentation). However, many dict or map modules are only able to read databases and thus cannot be used with courier-auth-postfix. At the time of writing, none of the LDAP or MySql modules support write operations.
There are also some known problems with hash or btree tables, since there are issues with locking and related to the creation of the databases (you should create the database by hand before using courier-auth-postfix, either with postmap or any other tool).
Right now, I've used this module in production environments only making use of optimizers (optimizers can increase speed, add supports for different kind of databases or supply missing functionalities in the dict modules).
The interface with other databases has just been tested for ``correctness'' and not for ``usability''. In practice, courier-auth-postfix should be able to write to any database postmap is able to write to without problems as long as postfix does not have any trouble in handling a database currently being modified (postfix should correctly take care of locking).
I suggest you test the database you want to use before actually using it (help will be provided in the following sections). Any feedback would be appreciated and I'll be happy to eventually add your own optimizers or suggestions. Just mail me at <ccontavalli at commedia.it>.
Watch out! Right now courier-authpostfix should be considered beta-quality software. Althought I've been using the mysql optimizer on a production system, bugs may exist, even in the debian packages that haven't been deeply tested!