Chris Shenton wrote:
>
> I've been working with qmail-ldap-20031001 and have gotten SMTP AUTH
> and TLS to work like I want, mostly. Allow but don't require AUTH, if
> client does AUTH require TLS to hide password.
Good.
> I want to allow SMTP AUTH connections to relay but now allow relaying
> by un-AUTH connections. I don't see anything in QLDAPNEWS or
> QLDAPINSTALL indicating whether AUTH'ed connections automatically set
> RELAYCLIENT to allow relaying. Pointers?
Upon successful authentication RELAYCLIENT is set internally in
qmail-smtpd.
> So I'm testing with cleartext, non-AUTH sessions and seeing mail get
> relayed. I'm not seeing why it's allowing the relay.
That is a bug we have inherited from DJB himself. When you don't have
any rcpthosts file it defaults to relaying (very stoopid!). Put a empty
rcpthosts file into control and it will go away.
Alternatively you can upgrade to qmail-ldap r20031101 which I have
just put on the website and fixes all these bugs. In addition it has
got a couple of new features as well. Among them is one for X.400
emulation... ;-)
--
Andre
> Here's my startup service/smtpd/run file (patterned after the
> "qmail-conf" quite of tools), after setting PATH:
>
> exec 2>&1 \
> envdir ./env \
> sh -c '
> case "$REMOTENAME" in h) H=;; p) H=p;; *) H=H;; esac
> case "$REMOTEINFO" in r) R=;; [0-9]*) R="t$REMOTEINFO";; *) R=R;; esac
> exec \
> envuidgid qmaild \
> softlimit ${DATALIMIT+"-d$DATALIMIT"} \
> tcpserver \
> -vDU"$H$R" \
> ${LOCALNAME+"-l$LOCALNAME"} \
> ${BACKLOG+"-b$BACKLOG"} \
> ${CONCURRENCY+"-c$CONCURRENCY"} \
> -xtcp.cdb \
> -- "${IP-0}" "${PORT-25}" \
> qmail-smtpd \
> auth_smtp \
> /bin/true
> '
>
> So tcpserver's told to use tcp.cdb; the flat file from which the CDB
> is generated has:
>
> 127.0.0.1:allow,RELAYCLIENT=""
> :allow
>
> The last line being a default so not really needed; RELAYCLIENT isn't
> set there so non-localhost should not relay.
>
> Qmail control files:
>
> locals: fester.SAIC.hq.nasa.gov
> me: Fester.SAIC.HQ.NASA.Gov
>
> There is no "rcpthosts" file.
>
> (I use different goofy text cases so I can tell where various prompts
> and logs come from)
>
> When I test from another machine (not Fester) it lets me relay:
>
> [EMAIL PROTECTED](262> telnet fester 25
> Trying 198.116.138.140...
> Connected to fester.saic.hq.nasa.gov.
> Escape character is '^]'.
> 220 Fester.SAIC.HQ.NASA.Gov ESMTP
> helo AndPleaseStopRelaying
> 250 Fester.SAIC.HQ.NASA.Gov
> mail from: [EMAIL PROTECTED]
> 250 ok
> rcpt to: [EMAIL PROTECTED]
> 250 ok
> data
> 354 go ahead punk, make my day
> Subject: you should not be relaying.
> Date: yes please
> From: chris
> .
> 250 ok 1067976868 qp 7963 by Fester.SAIC.HQ.NASA.Gov
> quit
> 221 Fester.SAIC.HQ.NASA.Gov
> Connection closed by foreign host.
>
> And the smtp and qmail logs show it is in fact relaying (timestamps removed):
>
> info msg 140672: bytes 439 from <[EMAIL PROTECTED]> qp 7963 uid 65\
> 026
> starting delivery 24: msg 140672 to remote [EMAIL PROTECTED]
> status: local 0/10 remote 1/20
> delivery 24: success:
> 198.116.138.106_accepted_message./Remote_host_said:_250_ok_1067977497_qp_27168/
>
>
> What am I missing so it doesn't relay?
>
> Once I fix that, what doe I need to do to automagically allow SMTP
> AUTH clients to relay?
>
> Many thanks.
