Re: Problems with Postfix configuration / check_relay_domains and reject_rbl_client Charles Marcus wrote:
> Sandy Drobic, on 2/26/2008 12:10 PM, said the following:
>> Charles Marcus wrote:
>>> On 2/26/2008, Damian Rivas (uljwsv@cht.com.ar) wrote:
>>>> Yes, you have to include the "permit_mynetworks" command,
>
>>> No you don't - I don't allow unauthenticated access to my server. I 
>>> have:
>>>
>>> smtpd_recipient_restrictions = permit_sasl_authenticated, 
>>> check_client_access cidr:/etc/postfix/allow_relay.cidr, 
>>> reject_unauth_destination, reject
>>>
>>> My server is not directly internet facing, though, so I can get
>>> away with this (allow_relay.cidr has ip blocks of our outsourced
>>> anti-spam service, so only accepts mail from them).
>
>>>> You are supposed to trust your own networks.
>
>>> Heh... I don't trust anyone...
>
>> Your config says otherwise: you trust your anti-spam provider and
>> give him the ability to use your system to relay. Explicitely: why
>> don't you rename the allowed_relay (just look at the name!) to
>> client_whitelist and move it behind reject_unauth_destination?
>
> Hmmm... actually, I guess I named that file badly... the CIDR table
> returns 'permit_auth_destination' for each of their IP blocks, so they
> aren't actually relaying through us, just delivering 'our' mail... ;)
>
> I just renamed it to 'allowed_clients.cidr'...

Instead of that, move the check to after reject_unauth_destination and 
return OK.

smtpd_recipient_restrictions =
    permit_sasl_authenticated
    reject_unauth_destination
    check_client_access cidr:/path/to/client_acl
    ...


== client_acl
# whiletlisted clients
10.1.2.0/24      OK
..

# blacklisted clients
192.0.2.0/24   REJECT blah blah


you can even integrate dnswl in this file.
>
>> If you have clients in that table that should be able to relay
>> separate them in two access queries before and behind
>> reject_unauth_destination.
>
> Right... but I don't... thanks for pointing out the bad choice of 
> names though...
>


