Dotaz: postfix sasl vyjimka - ipbased

[MartinH]

Dobreho dne,

resim nasledujici preblem: mam postfix zalozeny na SASL auth, pri odesilani je defaultne politika nastavena tak, ze je SASL vyzadovan, chtel bych vsak mit udelane IP vyjimky - idealne nahravane z file, kde toto vyzadovano nebude. Zkousel jsem jiz snad vse:

smtpd_sasl_exceptions_networks = xxx.xxx.xxx.xxx - nefunguje
smtpd_sasl_exceptions_networks = hash://etc/postfix/access_ip - nefunguje

vzdy to hodi relay access denied:

Apr 29 11:25:44 postolka postfix/smtpd[2080]: connect from havlasm.xxx.cz[zzz.zzz.zzz.zzz] Apr 29 11:25:44 postolka postfix/smtpd[2080]: NOQUEUE: reject: RCPT from havlasm.xxx.cz[zzz.zzz.zzz.zzz]: 554 5.7.1 Relay access denied; from=xxxx

zde je dle meho podstatna cast conf:

-main.cf

mynetworks              = 127.0.0.0/8 [::1]/128
inet_interfaces         = all

myhostname              = postolka.xxxx
myorigin                = postolka.xxxx
mydestination           = postolka.xxxx, localhost, hash:/etc/postfix/transport

virtual_alias_maps      = hash:/etc/postfix/virtual
alias_maps              = hash:/etc/postfix/aliases
alias_database          = hash:/etc/postfix/aliases
transport_maps          = hash:/etc/postfix/transport


smtpd_recipient_restrictions=
    permit_mynetworks,
    permit_sasl_authenticated,
    reject_unauth_pipelining,
    reject_invalid_hostname,
    reject_non_fqdn_sender,
    reject_unknown_sender_domain,
    reject_unknown_recipient_domain
    reject_unauth_destination,
    reject_rbl_client sbl-xbl.spamhaus.org,
    reject_rbl_client bl.spamcop.net,
    reject_non_fqdn_recipient

smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = $myhostname
smtpd_sasl_exceptions_networks = xxx.xxx.xxx.xxx
#smtpd_sasl_exceptions_networks = hash://etc/postfix/access_ip
broken_sasl_auth_clients = yes

-master.cf

submission inet n       -       -       -       -       smtpd
  -o syslog_name=postfix/secured_TTLS
  -o smtpd_tls_wrappermode=no
  -o smtpd_tls_security_level=may
  -o smtpd_sasl_auth_enable=yes
  -o milter_macro_daemon_name=ORIGINATING
  -o smtpd_sasl_type=dovecot
  -o smtpd_sasl_path=private/auth

---

---

Odpovědi

[Kriegel]

podle manualu smtpd_sasl_exceptions_networks znamena pouze to, ze temto vyjimkam bude existence AUTH extension zaprena...

pokus chces nejake vyjimky per IP, tak si udelej zvlast look-up table pro jednotlive hosty a zaintegruj to do smtpd_recipient_restrictions

treba

smtpd_recipient_restrictions=
    permit_mynetworks,
    permit_sasl_authenticated,
    check_recipient_access hash:/etc/postfix/sasl_exceptions,
    ... 

[Max]

Já to řešil přes mynetworks, který jde také definovat jako hash file ...
Zdar Max