From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from pigeon.gentoo.org ([208.92.234.80] helo=lists.gentoo.org) by finch.gentoo.org with esmtp (Exim 4.60) (envelope-from ) id 1OJspI-0006Ln-4h for garchives@archives.gentoo.org; Wed, 02 Jun 2010 18:38:04 +0000 Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 06100E084B; Wed, 2 Jun 2010 18:37:39 +0000 (UTC) Received: from blingymail-a1.g.dreamhost.com (caibbdcaaaaf.dreamhost.com [208.113.200.5]) by pigeon.gentoo.org (Postfix) with ESMTP id DA72FE084B for ; Wed, 2 Jun 2010 18:37:38 +0000 (UTC) Received: from [192.168.1.110] (smtp.media-brokers.com [70.43.81.99]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by blingymail-a1.g.dreamhost.com (Postfix) with ESMTP id 0998C904AC for ; Wed, 2 Jun 2010 11:37:36 -0700 (PDT) Message-ID: <4C06A4EE.9060107@libertytrek.org> Date: Wed, 02 Jun 2010 14:37:34 -0400 From: Tanstaafl User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.19) Gecko/20081209 Lightning/0.9 Thunderbird/2.0.0.19 Mnenhy/0.7.6.666 Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-user@lists.gentoo.org Reply-to: gentoo-user@lists.gentoo.org MIME-Version: 1.0 To: gentoo-user@lists.gentoo.org Subject: Re: [gentoo-user] Postfix question about auth and blocklists... References: <4BFD32C5.9050306@shic.co.uk> <1274902364.11900.92.camel@bvargo2.homeip.net> In-Reply-To: <1274902364.11900.92.camel@bvargo2.homeip.net> X-Enigmail-Version: 1.0.1 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Archives-Salt: 48192bc9-c15f-4bbd-9bbd-e21787471bcf X-Archives-Hash: 1ff99ed2ec09ba53ab5b51cc4335dc4d On 2010-05-26 3:32 PM, Brandon Vargo wrote: > On Wed, 2010-05-26 at 15:40 +0100, Steve wrote: >> On a gentoo mailserver, I'm running Postfix 2.6.5 - and, having followed >> some howto or other, quite a long time ago, I have this section at the >> end of my main.cf: >> The problem arises elsewhere... where I'm not connected to my local >> (W)LAN (i.e. where I'm not in "permit_mynetworks") - where the >> phone reports: Whether or not your client is in mynetwroks is irrelevant, if you are sasl_authenticating. >> The server returned the following error message: >> >> 554 5.7.1 Service unavailable; Client host 149.254.48.170 blocked using >> sbl-xbl.spamhouse.org; http://www.spamhous.org/query/bl?ip=149.254.48.170 >> -- >> >> The block comes as no surprise as 149.254.48.170 isn't exclusively under >> my control Irrelevant... >> So... the questions: >> >> * How can I alter the configuration to process email from blocked >> locations if and only if the client authenticates? >> * How can I verify that SMTP auth has been done (when connecting from my >> LAN) - it would be a disaster if I inadvertently created an open relay. >> (I don't think I have - but better safe than sorry, etc.) >> >> Thanks in advance for any replies... > You want to split your rules between smtpd_recipient_restrictions, > smtpd_sender_restrictions, and smtpd_client_restrictions. Absolutely not necessary. In most cases - as long as the default (yes) for smtpd_delay_reject hasn't been changed - it is perfectly fine to have all restrictions under smtpd_recipient_restrictions - and in fact it is desirable because it is easier to maintain. The problem is that you are *not* sasl_authenticating - if you were, then you would not have hit that restriction. We need two things - output of postconf -n on your server, and a log snippet of a rejected send attempt. Also, contents of master.cf - are you using port 25, or the submission port (587)? You should always use the submission port if you aren't now. Charles