Preventing From: address spoofing

[jchristgit]

Currently services can send e-mails as users, and vice versa. Users can also
send e-mails as other users.

We should validate that the user sending an e-mail owns the address (can also be
an alias) before being able to send.

Most likely, we can use Postfix's smtpd_sender_login_maps for this.

[jb3]

To handle this, we need to:

• Handle a user sending from their own account (joe@pydis.wtf)
• Handle a user sending from a domain alias (joe@owlcorp.uk)
• Handle a user sending as a group they are a member of (devops@pydis.wtf)
• Allow services to send as any @int.pydis.wtf address OR a granted address (e.g. fredrick@pydis.wtf)

[jb3]

smtpd_sender_login_maps does not actually help us here, it explicitly does not stop From: address spoofing.

From the documentation:

Note: to enforce that the From: header address matches the envelope sender (MAIL FROM) address, use an external filter such as a Milter, for the submission or submissions (formerly called smtps ) services. For example: https://github.com/magcks/milterfrom.

What we can maybe do is use https://github.com/mvonbuelow/milterfrom which compares the envelope with the From: header, but again we do need to confirm that this still works with alias sending (I don't know off the top of my head if sending only changes the From: or does MAIL FROM vary as well?)