Email filtering dependent on the MTA

[bnaessen]

This is maybe an exotic question (or maybe totally irrelevant).

Currently, we use Redmine as a project management system and Zimbra as our mail server. We want to enable users to update Redmine issues by sending an email. Redmine makes this possible by providing a Ruby script which can run on your mail server. You need to set up Zimbra such that when you forward an email to the "Redmine user" (which is the Redmine server) that it also provides a key (shared with Redmine) for security reasons. Of course, also the project and the issue number needs to be given. This is explained in : Redmine - RedmineReceivingEmails - Redmine

I still fear email spoofing though. It is still possible that people send an email to the Redmine server (through our Zimbra MTA) to spam our Redmine server. Is there a possibility to filter out emails going to a certain destination (being the "Redmine user") such that only emails are accepted from clients that are directly connected to the Zimbra MTA and those that are coming from other MTA's are discarded ?

I'm sorry if I miss the point, but I'm not an expert in these things ...

Thanks in advance !

[LMStone]

After looking things over briefly I'd say the easiest setup for you would be to configure Redmine as documented to do IMAP with the Zimbra server.

To prevent spammers flooding your Redmine server, you might wish to use a fairly cryptic mailbox on Zimbra for Redmine, comparable to the way Zimbra sets up the spam and ham accounts. For example: "redmine.projectinputviaemail.222blahblahblah@your domain.com".

In this way, (keep the mailbox visible in the GAL), users can start typing "redmine" when composing and let auto-complete do the rest of the work, but spammers will have a hard time guessing at that account.

Plus, all the configuration work will be on the Redmine server, so nothing will have to be redone after a Zimbra version upgrade.

Hope that helps,
Mark

[fcash]

You can also configure postfix to deny incoming messages to that address. Thus, only internal SMTP connections will be able to send messages to that account.

Have a look into all the *_restrictions options that postfix supports.