Hello, Also, I should be wary about using negates (!) on rules. I understand you know the use of postmap <http://www.postfix.org/postmap.1.html> command. I suggest using both notations (with ! and without ! before the cidr ip ranges) and using postmap extensively to test the real behaviour of the rules after applying it to production...
Best regards, --- Fernando Maciel Souto Maior On Tue, Sep 2, 2014 at 11:33 AM, Lubomir Majersky <[email protected]> wrote: > Thanks, for reply. Yes, I use port 587, but I can not disable AUTH on port > 25... I also have a unruly users... > > > Lubo M. > -- > ~~~~~~~~~~~~~~~~~~~~ > http://LuMaX.acom.sk > ~~~~~~~~~~~~~~~~~~~~ > > Dňa 2. 9. 2014 16:15 Noel Jones wrote / napísal(a): > > On 9/2/2014 9:01 AM, Lubomir Majersky wrote: >> >>> Thanks, I overlooked. So if I understand it, this should be: >>> >>> smtpd_sasl_exceptions_networks = cidr: /path/to/file.CIDR >>> >> >> no space between map:file >> >> = cidr:/path/to/file.cidr >> >> >> >>> and the 'file.CIDR' contains: >>> >>> ! 195.98.0.0/19 OK >>> ! 195.98.128.0/19 OK >>> ! ... OK >>> ! ... OK >>> ! 212.26.160.0/19 OK >>> 0.0.0.0/0 REJECT >>> >>> Is that so? >>> >> >> Yes, that should work. >> >> Ideally, you should get your users to use the submission port 587 >> rather than port 25. Then you can disable AUTH on port 25, and use >> your firewall to restrict access to the submission port 587. >> >> Also consider using a policy service such as postfwd to rate-limit >> your users. That will limit the damage when an account is compromised. >> http://www.postfix.org/SMTPD_POLICY_README.html >> http://postfwd.org/ >> >> >> -- Noel Jones >> >>
