diff --git a/mail/postfix/access.cf b/mail/postfix/access.cf
new file mode 100644
index 0000000..025ab71
--- /dev/null
+++ b/mail/postfix/access.cf
@@ -0,0 +1,2 @@
+dbpath = /data/mail/config/vmail.db
+query = SELECT action FROM access WHERE address = '%s'
diff --git a/mail/postfix/main.cf b/mail/postfix/main.cf
index 66b0ba0..4fc969c 100644
--- a/mail/postfix/main.cf
+++ b/mail/postfix/main.cf
@@ -38,3 +38,5 @@ smtpd_sender_login_maps = sqlite:/etc/postfix/login.cf, $virtual_alias_maps
 
 smtpd_milters = unix:private/opendkim
 non_smtpd_milters = $smtpd_milters
+
+smtpd_recipient_restrictions = check_recipient_access sqlite:/etc/postfix/access.cf
diff --git a/mail/schema.sql b/mail/schema.sql
index 7bc9222..007c022 100644
--- a/mail/schema.sql
+++ b/mail/schema.sql
@@ -4,3 +4,4 @@ create table mailbox (username varchar(255) not null primary key, password varch
 
 create table dkim (match varchar(255) not null primary key, key varchar(255) not null);
 create table dkim_key (key varchar(255) not null primary key, domain varchar(255) not null, selector varchar(255) not null, private_key varchar(65535) not null);
+create table access (address varchar(255) not null primary key, action varchar(255) not null);
diff --git a/misc/README.md b/misc/README.md
index e53c6fb..362fa36 100644
--- a/misc/README.md
+++ b/misc/README.md
@@ -18,8 +18,9 @@ sudo cp 99-no-wifi-on-ethernet /etc/NetworkManager/dispatcher.d
 sudo sed -i '$ a EXTRA_OPTS=-L 4' /etc/default/cron
 ```
 
-## Do not log cron sessions
+## Do not log sessions
 
 ```sh
-sudo sed -i '/pam_unix.so/ i session [success=1 default=ignore] pam_succeed_if.so service in cron quiet' /etc/pam.d/common-session-noninteractive
+sudo cp unix-no-session-log /usr/share/pam-configs
+sudo pam-auth-update # Select OK to update
 ```
diff --git a/misc/unix-no-session-log b/misc/unix-no-session-log
new file mode 100644
index 0000000..4320170
--- /dev/null
+++ b/misc/unix-no-session-log
@@ -0,0 +1,6 @@
+Name: Unix authentication - no session logging
+Default: yes
+Priority: 257
+Session-Type: Additional
+Session:
+	[success=1 default=ignore] pam_succeed_if.so service in cron:sudo quiet
diff --git a/ssh/README.md b/ssh/README.md
index aeb5763..c7f2de8 100644
--- a/ssh/README.md
+++ b/ssh/README.md
@@ -5,7 +5,9 @@ Switch to your main user with `su - adminuser` afterwards.
 
 ```sh
 sudo sed -i '$ a sshlogin:*:1001:65534::/home/sshlogin:/bin/sh' /etc/passwd
-sudo cp *.conf /etc/ssh/sshd_config.d
+sudo sed -i '$ a Match User *' /etc/ssh/sshd_config
+sudo sed -i '$ a Include /etc/ssh/sshd_config.d/*.user' /etc/ssh/sshd_config
+sudo cp *.conf *.user /etc/ssh/sshd_config.d
 
 sudo mkdir -p /home/sshlogin/.ssh
 sudo chown sshlogin:root /home/sshlogin/.ssh
@@ -13,3 +15,13 @@ sudo chown sshlogin:root /home/sshlogin/.ssh
 
 * Either create a password with `sudo passwd sshlogin` or
 * Add a key `sudo -u sshlogin editor /home/sshlogin/.ssh/authorized_keys`
+* Test config for user with `sudo sshd -T -C user=sshlogin`
+
+## Notes
+
+> Included files do not affect the match context of the file including them.
+
+https://bugzilla.mindrot.org/show_bug.cgi?id=2468#c26
+
+According to the tests, the above is possible:
+https://github.com/openssh/openssh-portable/blob/master/regress/servcfginclude.sh
diff --git a/ssh/user-backup.conf b/ssh/backup.user
similarity index 100%
rename from ssh/user-backup.conf
rename to ssh/backup.user
diff --git a/ssh/user-sshlogin.conf b/ssh/sshlogin.user
similarity index 100%
rename from ssh/user-sshlogin.conf
rename to ssh/sshlogin.user