Hi,

I'm running Ubuntu 10.04 LTS with Postfix/Dovecot and ISPConfig3.

I have 3 domains co-hosted on my VPS each with their respective email accounts.
I've noticed that it is possible for me to send an email using an account from one of these domains to an account on one of the other domains without having to supply the right password. This is a potential problem as it is highly likely that the owners of these 2 domains are not the same. It is also true that the two owners probably aren't aware they share the same server, but I'm not banking on that for my security.

While I've been able to prevent mail destined for other servers going out without proper authentication, I can't seem to stop local mail from being delivered locally.
I want local mail to ONLY be delivered when the user has supplied their password correctly.

For some reason, almost everything on this subject I'm finding through google etc is attempting to do other things with local mail, usually with local mail not working.

Is there a way of doing this through configuration of Postfix or Dovecot? Or, do I need another package to handle this?

Best regards,
Nap

Look into using /etc/aliases that might be more of what you are looking for.

thn Grim, I will do that.

Please check whats the value of smtpd_recipient_restiction value . If mynetwork include local network then this could be the issue

Whats output on

postconf -n|grep mynetw

If mynetwork mentioned in following

smtpd_client_restrictions
smtpd_recipient_restrictions
smtpd_sender_restrictions

And mynetwork include local network then its advisable to remove mynetwork from these variables

Thanks