OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: Inverse access restrictions?

From: Noel Jones (njonesmegan.vbhcs.org)
Date: Wed Apr 11 2007 - 17:15:23 CDT


At 04:53 PM 4/11/2007, Lloyd Zusman wrote:
>Martin Schmitt <mas <at> scsy.de> writes:
>
> > smtpd_restriction_classes =
> > greylist_policy
> >
> > smtpd_recipient_restrictions =
> > [...]
> > greylist_policy
> > [...]
> >
> > greylist_policy =
> > check_recipient_access hash:/etc/postfix/greylist_bypass_rcpts
> > check_policy_service unix:private/mygreylister
>
>Yes, this is even closer to what I was looking for. I agree with the
>kluginess of the /./ regexp. And I presume that I would put something
>like this in greylist_bypass_rcpts:
>
>usermydomain.tld dunno

Nope, dunno won't work like that. Dunno causes postfix to skip that
single restriction, not the class. Using smtpd_restriction_classes
doesn't buy you anything this time.

Use dunno with a regexp/pcre table or use OK and put greylisting in a
different smtpd_*_restrictions section.

In this example, recipients you don't want to greylist would be
listed as OK in no_greylist_recipients

smtpd_sender_restrictions =
   permit_mynetworks
   permit_sasl_authenticated
   check_recipient_access hash:/etc/no_greylist_recipients
   check_policy_service unix:whatever...

smtpd_recipient_restrictions =
    (other usual restrictions go here)

--
Noel Jones