Re: Problems with Postfix configuration / check_relay_domains and reject_rbl_client Charles Marcus wrote:
> On 2/26/2008, Damian Rivas (uljwsv@cht.com.ar) wrote:
>> Yes, you have to include the "permit_mynetworks" command,
> 
> No you don't - I don't allow unauthenticated access to my server. I have:
> 
> smtpd_recipient_restrictions = permit_sasl_authenticated, 
> check_client_access cidr:/etc/postfix/allow_relay.cidr, 
> reject_unauth_destination,  reject
> 
> My server is not directly internet facing, though, so I can get away 
> with this (allow_relay.cidr has ip blocks of our outsourced anti-spam 
> service, so only accepts mail from them).
> 
>> You are supposed to trust your own networks.
> 
> Heh... I don't trust anyone...
> 
Your config says otherwise: you trust your anti-spam provider and give him the 
ability to use your system to relay. Explicitely: why don't you rename the 
allowed_relay (just look at the name!) to client_whitelist and move it behind 
reject_unauth_destination?

If you have clients in that table that should be able to relay separate them 
in two access queries before and behind reject_unauth_destination.


-- 
Sandy

List replies only please!
Please address PMs to: news-reply2 (@) japantest (.) homelinux (.) com


