On 2007-02-01 20:39:39 +0100, Hans Salvisberg wrote: > Peter J. Holzer wrote: > >Since the greylisting module can get the dbdir from a variety of sources > >it probably should check and untaint it itself. My variant does this: > > I looked at your doc at > http://www.hjp.at/projekte/qpsmtpd/denysoft_greylist/ > and I like your modifications, but > -- where do you get the location of the database from and
You can specify the file name (not the directory name) with the "db"
parameter in the plugin file.
Otherwise it looks for a "db_dir" config and uses
"/denysoft_greylist.dbm" within that directory. If that doesn't exist
either "/denysoft_greylist.dbm" within the config directory is used.
Looks like this is missing from the POD - I'll add it.
> -- what's the name and format of your whitelist?
Whitelisting is skipped if
* $ENV{RELAYCLIENT} is set (that's outdated - should be changed to use
the relayclient() method)
* per_recipient greylisting is set and the user hasn't enabled
greylisting (via transaction note recipient_options).
* A connection note client_options->{denysoft_greylist}{skip} exists or
a transaction note sender_options->{denysoft_greylist}{skip} exists.
The client_options connection note is set by the client_options plugin.
The config file (also named client_options) looks like this:
62.225.35.170: check_rfc2821_strict_colon_param/skip=1
62.72.108.248: denysoft_greylist/skip=1
62.72.116.58: denysoft_greylist/skip=1
62.99.159.78: denysoft_greylist/skip=1
64.125.133.202: denysoft_greylist/skip=1
64.233.170.192/28: denysoft_greylist/skip=1
66.218.66.64/26: denysoft_greylist/skip=1
66.28.250.19: denysoft_greylist/skip=1
80.110.228.110: denysoft_greylist/skip=1
81.223.132.220: require_resolvable_client/skip=1
143.130.16.50: denysoft_greylist/skip=1
143.130.16.51: denysoft_greylist/skip=1, relay_client=1
143.130.16.52: denysoft_greylist/skip=1, relay_client=1
[...]
As you can see, CIDR notation (e.g., 66.218.66.64/26) is permitted so
you can whitelist large server farms (66.218.66.64/26 is Yahoo groups,
IIRC) in a single line. The options are comma-separated and the /
separates the levels in a hash of hashes. so the client_options note for
143.130.16.52 gets set to
{
denysoft_greylist => { skip => 1 },
relay_client => 1
}.
There is currently no plugin which sets sender_options: I added it for
completeness but never had a reason to whitelist based on the envelope
from. It's too generally easy to forge, IMHO (but see the recent
discussion of greenlists).
> Your description on the web page seems to indicate that your whitelist
> mechanism does not use "whitelist_soft", yet the description inside the
> file mentions only "whitelist_soft".
I'll remove the reference to "whitelist_soft", that's at least outdated
(I don't remember if my version ever supported it). The client_options
transaction note is documented, but may be easy to overlook (especially
if one looks for "whitelist").
hp
--
_ | Peter J. Holzer | I know I'd be respectful of a pirate
|_|_) | Sysadmin WSR | with an emu on his shoulder.
| | | [EMAIL PROTECTED] |
__/ | http://www.hjp.at/ | -- Sam in "Freefall"
signature.asc
Description: Digital signature
