OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Postfix Archives: Re: 2 SMTP Relays, depending on the From: add

Re: 2 SMTP Relays, depending on the From: address

Subject: Re: 2 SMTP Relays, depending on the From: address
From: Martin Schulze (joeyfinlandia.Infodrom.North.DE)
Date: Mon Jan 03 2000 - 18:14:08 CST

Craig Sanders wrote:
> On Tue, Jan 04, 2000 at 12:35:40AM +0100, Martin Schulze wrote:
> > > sorry, but it IS a brain-damaged implementation. relay control should be
> > > by IP address, not by domain name in the From: address. i.e. local IP
> >
> > What happens if you can't (or don't want) to afford more machines?
>
> huh? you don't need two machines to run two instances of postfix.
>
> in any case, the brain-damagedness that i'm referring to is not your
> setup/workaround. the stupidity is in using the From: domain for relay
> control.

How do you want to distinguish if:

 . You read mail locally on the mail host

 . You use the same MUA for both commercial and non-commercial mail

 . The MUA does not use an IP address for submitting mail but uses
   something like /usr/sbin/sendmail -t

> > I.e. finlandia.infodrom.north.de == finlandia.infodrom.org == stachel.de
> > kuolema.infodrom.north.de == kuolema.infodrom.org
> > carelia.infodrom.north.de == carelia.infodrom.org
> >
> > I don't want to run two big servers and don't walk around with two
> > laptops just because the MTA is too stupid to implement source
> > based routing.
>
> you can run multiple instances of postfix on one machine, each with a
> different config file and spool directory.

If there are multiple instances of postfix, how would I be supposed
to route the mail from the MUA to the proper MTA?

> > You forgot that I MUST NOT use the non-commercial leased line for
> > ANY commercial activities. Thus uucp over tcp would be technically
> > possible but is not a legal solution. Anyway, you will still need
> > to split outgoing mail by policy, i.e. commercial -> uucp, non-commercial
> > using smtp.
>
> show me *any* MTA which can distinguish between commercial and
> non-commercial email.

Smail can - and does, perfectly, though for locally inserted mail
a little kludge is required. Though, Smail does not distinguish
between commercial and non-commercial mail, but distinguishes
between different sender domains through it's wonderful query-path
router.

> probably the best you can do is use a transport map to send mail for
> particular domains via your non-commercial link and mail for everything
> else via your commercial link.

That's not usable since some of my commercial customers are also my
friends so I also send private email to them - or I send debian email
to them, which is non-commercial.

> non-technical problems generally aren't all that amenable to technical
> solutions. you'll have to kludge it and occasionally there will be
> mistakes. excrement occurs.

I don't mind kludges, however it would be nice if they won't be
required.

> > > if you can find a uucp provider who uses stunnel or similar to allow
> > > ssl encrypted uucp connections. see http://taz.net.au/postfix/uucp/
> > > for an example of how to set this up (a howto on setting up uucp with
> > > stunnel...it assumes you already know taylor uucp reasonably well).
> >
> > You're hopelessly missing the point, sorry.
>
> hey, it was you who mentioned uucp as a possible solution. i just
> provided some extra information on a way of making uucp over tcp more
> secure.
>
> i don't know about your situation - if a solution isn't viable for you
> then you shouldn't suggest it.

UUCP *is* possible and done here, though no uucp over ip but uucp over
modem, just like I proposed it. Please read what I said:

> Solution a) Get a modem,
> use a shell login at your provider's, solution b) also get a
> modem, but use dialup via uucp or ppp and dump & receive
> commercial mails using that way.

"dialup over uucp" not being "uucp over dialup ppp/ip", but still
security is an orthogonal issue.

Regards,

        Joey 

-- 
Never trust an operating system you don't have source for!

This archive was generated by hypermail 2b27 : Mon Jan 03 2000 - 18:15:33 CST