Re: [Exim] Sending SMTP from remote computers

Αρχική Σελίδα
Delete this message
Reply to this message
Συντάκτης: Lionel Morrison
Ημερομηνία:  
Προς: Peter Bowyer
Υ/ο: Lionel Morrison, exim-users
Αντικείμενο: Re: [Exim] Sending SMTP from remote computers
> Lionel Morrison said:
>> Peter
>>
>> This is that I have specified for my hostlist
>>
>> hostlist relay_from_hosts = 127.0.0.1 : mail.hmsystems.net :
>> hmsystems.net : 68.218.227.190
>>
>> 68.218.227.190 (Dynamic IP) is my current NAT'ed IP address. When I
>> attemp
>> to send it give me 550 Relay not permitted. Do you have any further
>> suggestions?
>
> Provided you have the ACL configured correctly, that should work. Try
> testing with exim -bh. You did HUP the exim daemon after you made the
> change, didn't you?


Don't need to HUP the process as exim config is being loaded for each
message that it handles. Ok I know this is not the optimal method but it
saves me a headake or to while testing new configurations.

As for the ACL. I wouldn't know if it's configured correctly or not. All I
know is that it is the default ACL that comes with exim 4

As for the "exim -bh" this is what I get. Looks to me as though it passing
the tests though I'm not an expert. I see a lot of deny's during the test
but right at the end of the ACL test it says

>>> host in "127.0.0.1 : mail.hmsystems.net : hmsystems.net :

68.218.227.190"? yes (matched "68.218.227.190")
>>> host in "+relay_from_hosts"? yes (matched "+relay_from_hosts")
>>> accept: condition test succeeded


Which is matching my IP address.

Do you see anything wrong? BTW I've included the ACL further down

-----------------------

[root@neptune exim]# exim -bh 68.218.227.190

**** SMTP testing session as if from host 68.218.227.190
**** but without any ident (RFC 1413) callback.
**** This is not for real!

>>> host in host_lookup? yes (matched "*")
>>> looking up host name for 68.218.227.190
>>> IP address lookup yielded adsl-218-227-190.jax.bellsouth.net
>>> gethostbyname looked up these IP addresses:
>>> name=adsl-218-227-190.jax.bellsouth.net address=68.218.227.190
>>> checking addresses for adsl-218-227-190.jax.bellsouth.net
>>> 68.218.227.190 OK
>>> host in host_reject_connection? no (option unset)
>>> host in sender_unqualified_hosts? no (option unset)
>>> host in recipient_unqualified_hosts? no (option unset)
>>> host in helo_verify_hosts? no (option unset)
>>> host in helo_try_verify_hosts? no (option unset)
>>> host in helo_accept_junk_hosts? no (option unset)

220 neptune.hmsystems.net ESMTP Exim 4.30 Thu, 29 Jul 2004 11:20:43 -0400
mail from: lmorrison@???
250 OK
rcpt to: jonmorrison@???
>>> using ACL "acl_check_rcpt"
>>> processing "accept"
>>> check hosts = :
>>> host in ":"? no (end of list)
>>> accept: condition test failed
>>> processing "deny"
>>> check domains = +local_domains
>>> yahoo.co.uk in "@ : "? no (end of list)
>>> yahoo.co.uk in "+local_domains"? no (end of list)
>>> deny: condition test failed
>>> processing "deny"
>>> check domains = !+local_domains
>>> yahoo.co.uk in "@ : "? no (end of list)
>>> yahoo.co.uk in "!+local_domains"? yes (end of list)
>>> check local_parts = ^[./|] : ^.*[@%!] : ^.*/\\.\\./
>>> jonmorrison in "^[./|] : ^.*[@%!] : ^.*/\.\./"? no (end of list)
>>> deny: condition test failed
>>> processing "accept"
>>> check local_parts = postmaster
>>> jonmorrison in "postmaster"? no (end of list)
>>> accept: condition test failed
>>> processing "require"
>>> check verify = sender
>>> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
>>> routing lmorrison@???
>>> hmsystems.net in "@ : hmsystems.net"? yes (matched "hmsystems.net")
>>> hmsystems.net in "! +local_domains"? no (matched "! +local_domains")
>>> calling virtual_user router
>>> routed by virtual_user router
>>> ----------- end verify ------------
>>> require: condition test succeeded
>>> processing "accept"
>>> check domains = +local_domains
>>> yahoo.co.uk in "@ : "? no (end of list)
>>> yahoo.co.uk in "+local_domains"? no (end of list)
>>> accept: condition test failed
>>> processing "accept"
>>> check domains = +relay_to_domains
>>> yahoo.co.uk in ""? no (end of list)
>>> yahoo.co.uk in "+relay_to_domains"? no (end of list)
>>> accept: condition test failed
>>> processing "accept"
>>> check hosts = +relay_from_hosts
>>> gethostbyname looked up these IP addresses:
>>> name=hmsystems.net address=66.184.170.218
>>> gethostbyname looked up these IP addresses:
>>> name=hmsystems.net address=66.184.170.218
>>> host in "127.0.0.1 : mail.hmsystems.net : hmsystems.net :

68.218.227.190"? yes (matched "68.218.227.190")
>>> host in "+relay_from_hosts"? yes (matched "+relay_from_hosts")
>>> accept: condition test succeeded

250 Accepted
data
354 Enter message, ending with "." on a line by itself
Tes test etst
.
>>> host in ignore_fromline_hosts? no (option unset)

LOG: 1BqCiy-0000hg-Jh <= lmorrison@???
H=adsl-218-227-190.jax.bellsouth.net [68.218.227.190] P=smtp S=215
250 OK id=1BqCiy-0000hg-Jh

**** SMTP testing: that is not a real message id!

-------------------


######################################################################
#                       ACL CONFIGURATION                            #
#         Specifies access control lists for incoming SMTP mail      #
######################################################################


begin acl

# This access control list is used for every RCPT command in an incoming
# SMTP message. The tests are run in order until the address is either
# accepted or denied.

acl_check_rcpt:

# Accept if the source is local SMTP (i.e. not over TCP/IP). We do this by
# testing for an empty sending host field.

accept hosts = :

#############################################################################
# The following section of the ACL is concerned with local parts that
contain
# @ or % or ! or / or | or dots in unusual places.
#
# The characters other than dots are rarely found in genuine local
parts, but
# are often tried by people looking to circumvent relaying restrictions.
# Therefore, although they are valid in local parts, these rules lock them
# out, as a precaution.
#
# Empty components (two dots in a row) are not valid in RFC 2822, but Exim
# allows them because they have been encountered. (Consider local parts
# constructed as "firstinitial.secondinitial.familyname" when applied to
# someone like me, who has no second initial.) However, a local part
starting
# with a dot or containing /../ can cause trouble if it is used as part
of a
# file name (e.g. for a mailing list). This is also true for local parts
that
# contain slashes. A pipe symbol can also be troublesome if the local
part is
# incorporated unthinkingly into a shell command line.
#
# Two different rules are used. The first one is stricter, and is
applied to
# messages that are addressed to one of the local domains handled by this
# host. It blocks local parts that begin with a dot or contain @ % ! /
or |.
# If you have local accounts that include these characters, you will
have to
# modify this rule.

  deny    domains       = +local_domains
          local_parts   = ^[.] : ^.*[@%!/|]


# The second rule applies to all other domains, and is less strict. This
# allows your own users to send outgoing messages to sites that use slashes
# and vertical bars in their local parts. It blocks local parts that begin
# with a dot, slash, or vertical bar, but allows these characters within
the
# local part. However, the sequence /../ is barred. The use of @ % and ! is
# blocked, as before. The motivation here is to prevent your users (or
# your users' viruses) from mounting certain kinds of attack on remote
sites.

  deny    domains       = !+local_domains
          local_parts   = ^[./|] : ^.*[@%!] : ^.*/\\.\\./
  #############################################################################


# Accept mail to postmaster in any local domain, regardless of the source,
# and without verifying the sender.

  accept  local_parts   = postmaster
          domains       = +local_domains


# Deny unless the sender address can be verified.

  require verify        = sender


  #############################################################################
  # There are no checks on DNS "black" lists because the domains that contain
  # these lists are changing all the time. However, here are two examples of
  # how you could get Exim to perform a DNS black list lookup at this point.
  # The first one denies, while the second just warns.
  #
  # deny    message       = rejected because $sender_host_address is in a
black list at $dnslist_domain\n$dnslist_text
  #         dnslists      = black.list.example
  #
  # warn    message       = X-Warning: $sender_host_address is in a black
list at $dnslist_domain
  #         log_message   = found in $dnslist_domain
  #         dnslists      = black.list.example
  #############################################################################


# Accept if the address is in a local domain, but only if the recipient can
# be verified. Otherwise deny. The "endpass" line is the border between
# passing on to the next ACL statement (if tests above it fail) or denying
# access (if tests below it fail).

  accept  domains       = +local_domains
          endpass
          verify        = recipient


# Accept if the address is in a domain for which we are relaying, but
again,
# only if the recipient can be verified.

  accept  domains       = +relay_to_domains
          endpass
          verify        = recipient


# If control reaches this point, the domain is neither in +local_domains
# nor in +relay_to_domains.

# Accept if the message comes from one of the hosts for which we are an
# outgoing relay. Recipient verification is omitted here, because in many
# cases the clients are dumb MUAs that don't cope well with SMTP error
# responses. If you are actually relaying out from MTAs, you should
probably
# add recipient verification here.

  accept  hosts         = +relay_from_hosts


# Accept if the message arrived over an authenticated connection, from
# any host. Again, these messages are usually from MUAs, so recipient
# verification is omitted.

accept authenticated = *

# Reaching the end of the ACL causes a "deny", but we might as well give
# an explicit message.

  deny    message       = relay not permitted




>
> (Please keep discussion on the mailing list - private advice tends towards
> consultancy... thanks)


Sorry forgot all about the 'reply all'

>
> Peter
>
>