On Tue, Sep 2, 2014 at 11:47 AM, Viktor Dukhovni <[email protected]
> wrote:
> On Tue, Sep 02, 2014 at 09:15:32AM -0500, Noel Jones wrote:
>
> > > and the 'file.CIDR' contains:
> > >
> > > ! 195.98.0.0/19 OK
> > > ! 195.98.128.0/19 OK
> > > ! ... OK
> > > ! ... OK
> > > ! 212.26.160.0/19 OK
> > > 0.0.0.0/0 REJECT
> > >
> > > Is that so?
> >
> > Yes, that should work.
>
> No, that's invalid. The cidr_table(5) documentation does not
> include support for negation. To specify a table of excluded
> addresses:
>
> main.cf:
> smtpd_sasl_exceptions_networks =
> # Don't exclude these
> !cidr:${config_directory}/allow-sasl.cidr,
> # Exclude the rest
> 0.0.0.0/0
>
> allow-sasl.cidr:
> 192.0.2.0/24 permit_sasl_authenticated
> 10.0.0.0/8 permit_sasl_authenticated
> 172.16.0.0/12 permit_sasl_authenticated
> 192.168.0.0/16 permit_sasl_authenticated
> ...
>
> The form of the RHS of allow-sasl.cidr is deliberate, instead
> of disallowing authentication, one can allow all addresses to
> authenticate, but use allow-sasl.cidr as an access(5) table
> to allow relaying from only certain SASL clients:
>
> # Postfix 2.10 or later, ocnsider: smtpd_relay_restrictions
> smtpd_recipient_restrictions =
> permit_mynetworks,
> check_client_access cidr:${config_directory}/allow-sasl.cidr,
> reject_unauth_destination,
> ... UCE restrictions ...
>
> --
> Viktor.
>
Hello,
I just realize I am using gmail default for sending responses for the list.
I apologize to everybody for that, and I will be cautions in writing BELOW
the text, instead of ABOVE it.
Also, I would like to emphasize what Victor just show above:
smtpd_sasl_exceptions_networks is abouth which networks will NOT offered
AUTH support, so if you want to offer it, you should exclude it from
smtpd_sasl_exceptions_networks with what Victor showed above (a negation
for the entire list of allowed networks, followed by 0.0.0.0).
Best regards,
Fernando Maciel Souto Maior
