Re: 20031001 relaying (without AUTH) despite tcp.cdb with LOCALHOST only

[Sylvain Boily]

Sylvain Boily wrote:

Chris Shenton wrote:

I've been working with qmail-ldap-20031001 and have gotten SMTP AUTH
and TLS to work like I want, mostly.  Allow but don't require AUTH, if
client does AUTH require TLS to hide password.
I want to allow SMTP AUTH connections to relay but now allow relaying
by un-AUTH connections.  I don't see anything in QLDAPNEWS or
QLDAPINSTALL indicating whether AUTH'ed connections automatically set
RELAYCLIENT to allow relaying. Pointers?
So I'm testing with cleartext, non-AUTH sessions and seeing mail get
relayed.  I'm not seeing why it's allowing the relay.
Here's my startup service/smtpd/run file (patterned after the
"qmail-conf" quite of tools), after setting PATH:
 exec 2>&1 \
 envdir ./env \
 sh -c '
     case "$REMOTENAME" in h) H=;; p) H=p;; *) H=H;; esac
     case "$REMOTEINFO" in r) R=;; [0-9]*) R="t$REMOTEINFO";; *) 
R=R;; esac
     exec \
     envuidgid qmaild \
     softlimit ${DATALIMIT+"-d$DATALIMIT"} \
     tcpserver \
         -vDU"$H$R" \
         ${LOCALNAME+"-l$LOCALNAME"} \
         ${BACKLOG+"-b$BACKLOG"} \
         ${CONCURRENCY+"-c$CONCURRENCY"} \
         -xtcp.cdb \
         -- "${IP-0}" "${PORT-25}" \
     qmail-smtpd \
     auth_smtp \
     /bin/true
 '

So tcpserver's told to use tcp.cdb; the flat file from which the CDB
is generated has:
127.0.0.1:allow,RELAYCLIENT=""
:allow
The last line being a default so not really needed; RELAYCLIENT isn't
set there so non-localhost should not relay.
Qmail control files:

locals: fester.SAIC.hq.nasa.gov
me:     Fester.SAIC.HQ.NASA.Gov
There is no "rcpthosts" file.

(I use different goofy text cases so I can tell where various prompts
and logs come from)
When I test from another machine (not Fester) it lets me relay:

 [EMAIL PROTECTED](262> telnet fester 25
 Trying 198.116.138.140...
 Connected to fester.saic.hq.nasa.gov.
 Escape character is '^]'.
 220 Fester.SAIC.HQ.NASA.Gov ESMTP  helo AndPleaseStopRelaying
 250 Fester.SAIC.HQ.NASA.Gov  mail from: 
[EMAIL PROTECTED]
 250 ok
 rcpt to: [EMAIL PROTECTED]
 250 ok
 data
 354 go ahead punk, make my day
 Subject: you should not be relaying.
 Date: yes please
 From: chris
 .
 250 ok 1067976868 qp 7963 by Fester.SAIC.HQ.NASA.Gov
 quit
 221 Fester.SAIC.HQ.NASA.Gov  Connection closed by foreign host.

And the smtp and qmail logs show it is in fact relaying (timestamps 
removed):

 info msg 140672: bytes 439 from 
<[EMAIL PROTECTED]> qp 7963 uid 65\
026
 starting delivery 24: msg 140672 to remote 
[EMAIL PROTECTED]
 status: local 0/10 remote 1/20
 delivery 24: success: 
198.116.138.106_accepted_message./Remote_host_said:_250_ok_1067977497_qp_27168/ 



What am I missing so it doesn't relay?

Once I fix that, what doe I need to do to automagically allow SMTP
AUTH clients to relay?
Many thanks.
 

Hi,

sorry but where can we activate smtp auth ? When i'm using the patch 
from lifewithqmail i having option in makefile.
I've test 20031101 and auth smtp is not activate. Auth login said 
unimplemented.
Thanks.

Sylvain

Oh, i look into qmail-smtpd.c and i've found my response ;-).
My tcp.smtp look like that  now :
127.:allow,RELAYCLIENT="",SMTPAUTH=""
:allow,SMTPAUTH=""
why this change ?

Sylvain.