OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: Selective *non*-enforcement of FQDN rules?

From: Wietse Venema (wietseporcupine.org)
Date: Fri Aug 22 2008 - 19:01:58 CDT

Michael G. Reed:
> I've been looking around to see how I can deal with a
> particular site that doesn't report a FQDN in the HELO/EHLO line. I
> have smtpd_recipient_restrictions containing:
>
> reject_non_fqdn_sender
> reject_non_fqdn_recipient
> reject_non_fqdn_hostname
>
> to help with SPAM issues. I want these enforced for everyone EXCEPT
> one site (heck, one IP) that needs to talk to me (but I've been unable
> to get their admin to fix their broken configuration). Is this
> possible or am I just missing something really obvious? Any pointers
> would be greatly appreciated. Thanks!

Perhaps:

/etc/postfix/main.cf:
    smtpd_recipient_restrictions =
        ...
        check_client_access pcre:/etc/postfix/client_pcre
        ...

/etc/postfix/client_pcre:
    192.168.0.1/32 dunno
    0.0.0.0/0 reject_non_fqdn_sender, reject_non_fqdn_recipient, ...
    ::/0 reject_non_fqdn_sender, reject_non_fqdn_recipient, ...

Not intuitive, but effective.

man 5 access
man 5 cidr_table

        Wietse