> Lionel Morrison said:
>> Peter
>>
>> This is that I have specified for my hostlist
>>
>> hostlist relay_from_hosts = 127.0.0.1 : mail.hmsystems.net :
>> hmsystems.net : 68.218.227.190
>>
>> 68.218.227.190 (Dynamic IP) is my current NAT'ed IP address. When I
>> attemp
>> to send it give me 550 Relay not permitted. Do you have any further
>> suggestions?
>
> Provided you have the ACL configured correctly, that should work. Try
> testing with exim -bh. You did HUP the exim daemon after you made the
> change, didn't you?
Don't need to HUP the process as exim config is being loaded for each
message that it handles. Ok I know this is not the optimal method but it
saves me a headake or to while testing new configurations.
As for the ACL. I wouldn't know if it's configured correctly or not. All I
know is that it is the default ACL that comes with exim 4
As for the "exim -bh" this is what I get. Looks to me as though it passing
the tests though I'm not an expert. I see a lot of deny's during the test
but right at the end of the ACL test it says
>>> host in "127.0.0.1 : mail.hmsystems.net : hmsystems.net :
68.218.227.190"? yes (matched "68.218.227.190")
>>> host in "+relay_from_hosts"? yes (matched "+relay_from_hosts")
>>> accept: condition test succeeded
Which is matching my IP address.
Do you see anything wrong? BTW I've included the ACL further down
-----------------------
[root@neptune exim]# exim -bh 68.218.227.190
**** SMTP testing session as if from host 68.218.227.190
**** but without any ident (RFC 1413) callback.
**** This is not for real!
>>> host in host_lookup? yes (matched "*")
>>> looking up host name for 68.218.227.190
>>> IP address lookup yielded adsl-218-227-190.jax.bellsouth.net
>>> gethostbyname looked up these IP addresses:
>>> name=adsl-218-227-190.jax.bellsouth.net address=68.218.227.190
>>> checking addresses for adsl-218-227-190.jax.bellsouth.net
>>> 68.218.227.190 OK
>>> host in host_reject_connection? no (option unset)
>>> host in sender_unqualified_hosts? no (option unset)
>>> host in recipient_unqualified_hosts? no (option unset)
>>> host in helo_verify_hosts? no (option unset)
>>> host in helo_try_verify_hosts? no (option unset)
>>> host in helo_accept_junk_hosts? no (option unset)
220 neptune.hmsystems.net ESMTP Exim 4.30 Thu, 29 Jul 2004 11:20:43 -0400
mail from: lmorrison@???
250 OK
rcpt to: jonmorrison@???
>>> using ACL "acl_check_rcpt"
>>> processing "accept"
>>> check hosts = :
>>> host in ":"? no (end of list)
>>> accept: condition test failed
>>> processing "deny"
>>> check domains = +local_domains
>>> yahoo.co.uk in "@ : "? no (end of list)
>>> yahoo.co.uk in "+local_domains"? no (end of list)
>>> deny: condition test failed
>>> processing "deny"
>>> check domains = !+local_domains
>>> yahoo.co.uk in "@ : "? no (end of list)
>>> yahoo.co.uk in "!+local_domains"? yes (end of list)
>>> check local_parts = ^[./|] : ^.*[@%!] : ^.*/\\.\\./
>>> jonmorrison in "^[./|] : ^.*[@%!] : ^.*/\.\./"? no (end of list)
>>> deny: condition test failed
>>> processing "accept"
>>> check local_parts = postmaster
>>> jonmorrison in "postmaster"? no (end of list)
>>> accept: condition test failed
>>> processing "require"
>>> check verify = sender
>>> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
>>> routing lmorrison@???
>>> hmsystems.net in "@ : hmsystems.net"? yes (matched "hmsystems.net")
>>> hmsystems.net in "! +local_domains"? no (matched "! +local_domains")
>>> calling virtual_user router
>>> routed by virtual_user router
>>> ----------- end verify ------------
>>> require: condition test succeeded
>>> processing "accept"
>>> check domains = +local_domains
>>> yahoo.co.uk in "@ : "? no (end of list)
>>> yahoo.co.uk in "+local_domains"? no (end of list)
>>> accept: condition test failed
>>> processing "accept"
>>> check domains = +relay_to_domains
>>> yahoo.co.uk in ""? no (end of list)
>>> yahoo.co.uk in "+relay_to_domains"? no (end of list)
>>> accept: condition test failed
>>> processing "accept"
>>> check hosts = +relay_from_hosts
>>> gethostbyname looked up these IP addresses:
>>> name=hmsystems.net address=66.184.170.218
>>> gethostbyname looked up these IP addresses:
>>> name=hmsystems.net address=66.184.170.218
>>> host in "127.0.0.1 : mail.hmsystems.net : hmsystems.net :
68.218.227.190"? yes (matched "68.218.227.190")
>>> host in "+relay_from_hosts"? yes (matched "+relay_from_hosts")
>>> accept: condition test succeeded
250 Accepted
data
354 Enter message, ending with "." on a line by itself
Tes test etst
.
>>> host in ignore_fromline_hosts? no (option unset)
LOG: 1BqCiy-0000hg-Jh <= lmorrison@???
H=adsl-218-227-190.jax.bellsouth.net [68.218.227.190] P=smtp S=215
250 OK id=1BqCiy-0000hg-Jh
**** SMTP testing: that is not a real message id!
-------------------
######################################################################
# ACL CONFIGURATION #
# Specifies access control lists for incoming SMTP mail #
######################################################################
begin acl
# This access control list is used for every RCPT command in an incoming
# SMTP message. The tests are run in order until the address is either
# accepted or denied.
acl_check_rcpt:
# Accept if the source is local SMTP (i.e. not over TCP/IP). We do this by
# testing for an empty sending host field.
accept hosts = :
#############################################################################
# The following section of the ACL is concerned with local parts that
contain
# @ or % or ! or / or | or dots in unusual places.
#
# The characters other than dots are rarely found in genuine local
parts, but
# are often tried by people looking to circumvent relaying restrictions.
# Therefore, although they are valid in local parts, these rules lock them
# out, as a precaution.
#
# Empty components (two dots in a row) are not valid in RFC 2822, but Exim
# allows them because they have been encountered. (Consider local parts
# constructed as "firstinitial.secondinitial.familyname" when applied to
# someone like me, who has no second initial.) However, a local part
starting
# with a dot or containing /../ can cause trouble if it is used as part
of a
# file name (e.g. for a mailing list). This is also true for local parts
that
# contain slashes. A pipe symbol can also be troublesome if the local
part is
# incorporated unthinkingly into a shell command line.
#
# Two different rules are used. The first one is stricter, and is
applied to
# messages that are addressed to one of the local domains handled by this
# host. It blocks local parts that begin with a dot or contain @ % ! /
or |.
# If you have local accounts that include these characters, you will
have to
# modify this rule.
deny domains = +local_domains
local_parts = ^[.] : ^.*[@%!/|]
# The second rule applies to all other domains, and is less strict. This
# allows your own users to send outgoing messages to sites that use slashes
# and vertical bars in their local parts. It blocks local parts that begin
# with a dot, slash, or vertical bar, but allows these characters within
the
# local part. However, the sequence /../ is barred. The use of @ % and ! is
# blocked, as before. The motivation here is to prevent your users (or
# your users' viruses) from mounting certain kinds of attack on remote
sites.
deny domains = !+local_domains
local_parts = ^[./|] : ^.*[@%!] : ^.*/\\.\\./
#############################################################################
# Accept mail to postmaster in any local domain, regardless of the source,
# and without verifying the sender.
accept local_parts = postmaster
domains = +local_domains
# Deny unless the sender address can be verified.
require verify = sender
#############################################################################
# There are no checks on DNS "black" lists because the domains that contain
# these lists are changing all the time. However, here are two examples of
# how you could get Exim to perform a DNS black list lookup at this point.
# The first one denies, while the second just warns.
#
# deny message = rejected because $sender_host_address is in a
black list at $dnslist_domain\n$dnslist_text
# dnslists = black.list.example
#
# warn message = X-Warning: $sender_host_address is in a black
list at $dnslist_domain
# log_message = found in $dnslist_domain
# dnslists = black.list.example
#############################################################################
# Accept if the address is in a local domain, but only if the recipient can
# be verified. Otherwise deny. The "endpass" line is the border between
# passing on to the next ACL statement (if tests above it fail) or denying
# access (if tests below it fail).
accept domains = +local_domains
endpass
verify = recipient
# Accept if the address is in a domain for which we are relaying, but
again,
# only if the recipient can be verified.
accept domains = +relay_to_domains
endpass
verify = recipient
# If control reaches this point, the domain is neither in +local_domains
# nor in +relay_to_domains.
# Accept if the message comes from one of the hosts for which we are an
# outgoing relay. Recipient verification is omitted here, because in many
# cases the clients are dumb MUAs that don't cope well with SMTP error
# responses. If you are actually relaying out from MTAs, you should
probably
# add recipient verification here.
accept hosts = +relay_from_hosts
# Accept if the message arrived over an authenticated connection, from
# any host. Again, these messages are usually from MUAs, so recipient
# verification is omitted.
accept authenticated = *
# Reaching the end of the ACL causes a "deny", but we might as well give
# an explicit message.
deny message = relay not permitted
>
> (Please keep discussion on the mailing list - private advice tends towards
> consultancy... thanks)
Sorry forgot all about the 'reply all'
>
> Peter
>
>
