I've been working with qmail-ldap-20031001 and have gotten SMTP AUTH
and TLS to work like I want, mostly. Allow but don't require AUTH, if
client does AUTH require TLS to hide password.
I want to allow SMTP AUTH connections to relay but now allow relaying
by un-AUTH connections. I don't see anything in QLDAPNEWS or
QLDAPINSTALL indicating whether AUTH'ed connections automatically set
RELAYCLIENT to allow relaying. Pointers?
So I'm testing with cleartext, non-AUTH sessions and seeing mail get
relayed. I'm not seeing why it's allowing the relay.
Here's my startup service/smtpd/run file (patterned after the
"qmail-conf" quite of tools), after setting PATH:
exec 2>&1 \
envdir ./env \
sh -c '
case "$REMOTENAME" in h) H=;; p) H=p;; *) H=H;; esac
case "$REMOTEINFO" in r) R=;; [0-9]*) R="t$REMOTEINFO";; *) R=R;; esac
exec \
envuidgid qmaild \
softlimit ${DATALIMIT+"-d$DATALIMIT"} \
tcpserver \
-vDU"$H$R" \
${LOCALNAME+"-l$LOCALNAME"} \
${BACKLOG+"-b$BACKLOG"} \
${CONCURRENCY+"-c$CONCURRENCY"} \
-xtcp.cdb \
-- "${IP-0}" "${PORT-25}" \
qmail-smtpd \
auth_smtp \
/bin/true
'
So tcpserver's told to use tcp.cdb; the flat file from which the CDB
is generated has:
127.0.0.1:allow,RELAYCLIENT=""
:allow
The last line being a default so not really needed; RELAYCLIENT isn't
set there so non-localhost should not relay.
Qmail control files:
locals: fester.SAIC.hq.nasa.gov
me: Fester.SAIC.HQ.NASA.Gov
There is no "rcpthosts" file.
(I use different goofy text cases so I can tell where various prompts
and logs come from)
When I test from another machine (not Fester) it lets me relay:
[EMAIL PROTECTED](262> telnet fester 25
Trying 198.116.138.140...
Connected to fester.saic.hq.nasa.gov.
Escape character is '^]'.
220 Fester.SAIC.HQ.NASA.Gov ESMTP
helo AndPleaseStopRelaying
250 Fester.SAIC.HQ.NASA.Gov
mail from: [EMAIL PROTECTED]
250 ok
rcpt to: [EMAIL PROTECTED]
250 ok
data
354 go ahead punk, make my day
Subject: you should not be relaying.
Date: yes please
From: chris
.
250 ok 1067976868 qp 7963 by Fester.SAIC.HQ.NASA.Gov
quit
221 Fester.SAIC.HQ.NASA.Gov
Connection closed by foreign host.
And the smtp and qmail logs show it is in fact relaying (timestamps removed):
info msg 140672: bytes 439 from <[EMAIL PROTECTED]> qp 7963 uid 65\
026
starting delivery 24: msg 140672 to remote [EMAIL PROTECTED]
status: local 0/10 remote 1/20
delivery 24: success:
198.116.138.106_accepted_message./Remote_host_said:_250_ok_1067977497_qp_27168/
What am I missing so it doesn't relay?
Once I fix that, what doe I need to do to automagically allow SMTP
AUTH clients to relay?
Many thanks.
