OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: Sendmail-like 'access' table?
From: Bodo Moeller (3moellerinformatik.uni-hamburg.de)
Date: Wed Feb 09 2000 - 07:39:23 CST

On Wed, Feb 09, 2000 at 01:50:05PM +0100, Ralf Hildebrandt wrote:
> On Wed, Feb 09, 2000 at 01:40:54PM +0100, Bodo Moeller wrote:

>> For Sendmail, I have a table /etc/mail/access with local users
>> that are not to receive mail (locked accounts that may be re-activated
>> when the user comes to us and can provide a good reason for giving
>> them an account on our machines). The Sendmail SMTP-server rejects
>> e-mail for these users (table entry "550 Mailbox disabled for this
>> user"). The table contains just the local parts of the e-mail
>> addresses, accounts at other sites with identical user names
>> can still be reached.
>>
>> With the Postfix 'access' table, it seems the table size would have to
>> be size O(N^2) instead of O(N) because I'd have to list complete
>> addresses including domain names, and our sendmail.cw lists nearly all
>> workstations in our domain. (Assumptions: For a total of N users,
>> we have O(N) blocked users, and O(N) workstations.) The Postfix
>> 'relocated' table is nearly what I want, however the message printed
>> for users in 'relocated' is not quite appropriate ("user has moved to
>> /dev/null" is the best I could come up with). Are there better
>> options?

> This is not true. See:
> http://www.informatik.uni-bonn.de/pub/software/postfix/access.5.html
>
> forbidden_user 550 That user is not allowed to receive mail
> another_user 550 That user was a spammer

I tried

     smtpd_recipient_restrictions = dbm:/etc/postfix/access,permit_mynetworks,check_relay_domains

in /etc/postfix/main.cf and

     bmoeller REJECT

in /etc/postfix/access. Then mail via SMTP to my test account
'bmoeller' at this mail host is corretly blocked, but mail to
bmoelleracm.org is blocked too, and I don't appreciate that :-)