Re: Which ACLs to use

On Tue, Aug 17, 2004 at 04:24:43PM -0400, Michael F. Sprague wrote:
> I'm looking for some opinions on which ACLs to use.  For example, I would
> like to reject connections when the sender tries to forge my IP address in
> the HELO/EHLO statement.  I would have figured the best place to do this would
> be in the acl_smtp_helo ACL.  I did some research and most examples I found
> were in not in the acl_smtp_helo ACL.
>

My primary reason for putting this later on (I do it in smtp_rcpt) is
because some of my authenticated relaying users have braindead mailers.
If some tests (such as prohibiting "helo localhost") can't go there, then
why not wait and do them all together?

After RCPT I know if the user authenticated so can bypass the check.


> Would it not be a good idea to do sender verification in the acl_smtp_mail
> ACL?
>

One might argue that gives more information than is needed to the sending
machine.  A legitimate failure will be sent text to describe the error; an
automated process (assuming it doesn't parse the return text) will just
see a generic failure.

Same reason as you wait until username AND password are provided before
giving a failure - to do otherwise is to give too much information away
about the usernames available.


Dave

-- 

-    Dave Baker      :      [email protected]      :      http://dsb3.com/    -
GnuPG:  1024D/D7BCA55D / 09CD D148 57DE 711E 6708  B772 0DD4 51D5 D7BC A55D