26da30bbbc
break each ruleset into identified sections. (called groups).
note which groups can be reordered.
each group accepts and returns the same strings,
as much as possible.
reactivate Paul Vixie's RBL (in check_mail)
add rules to limit mail relaying to a list of hosts and domains
in the R class (check_rcpt, not active on hub.freebsd.org)
Submitted by: jmb
117 lines
4.1 KiB
Plaintext
117 lines
4.1 KiB
Plaintext
# list of hosts and domains for whom we relay mail.
|
|
# all .forward hosts, domains must be listed in this file.
|
|
# same for hosts and domains in /etc/aliases
|
|
FR-o /etc/sendmail.cR
|
|
|
|
# database declarations
|
|
Kdenyip hash -o -a.REJECT /etc/mail/denyip.db
|
|
Kfakenames hash -o -a.REJECT /etc/mail/fakenames.db
|
|
Kspamsites hash -o -a.REJECT /etc/mail/spamsites.db
|
|
|
|
# helper rulsesets; useful for debugging sendmail configurations
|
|
#
|
|
#
|
|
Scheck_rbl
|
|
# lookup up an ip address in the Realtime Blackhole List.
|
|
R$-.$-.$-.$- $: $(host $4.$3.$2.$1.rbl.maps.vix.com $:OK $)
|
|
|
|
Sxlat # for sendmail -bt
|
|
# sendmail treats "$" and "|" as two distinct tokens
|
|
# this rule "pastes" them together into one token
|
|
# and then calls check_relay.
|
|
R$* $$| $* $: $1 $| $2
|
|
R$* $| $* $@ $>check_relay $1 $| $2
|
|
|
|
Scheck_relay
|
|
# called with "hostname.tld $| IP address" of connecting host.
|
|
# hostname.tld is the fully-qualified domain name
|
|
# IP address is dotted-quad with surrounding "[]" brackets.
|
|
#
|
|
# each group of rules in this ruleset is independent.
|
|
# each accepts and return "hostname.tld $| IP address"
|
|
# use the ones that you want comment out the rest
|
|
# you may rearrange the groups but not the rules in each group.
|
|
# each group is preceded and followed by a comment
|
|
#
|
|
# host must NOT be in the "spamsites" database--BEGIN
|
|
R$* $| $* $: <$1 $| $2> $1
|
|
R<$*> $+.$+.$+ <$1> $3.$4
|
|
R<$*> $+.$+ $: <$1> $(spamsites $2.$3 $)
|
|
R<$*> $*.REJECT $#error $: "521 blocked. contact postmaster@FreeBSD.ORG"
|
|
R<$*> $* $: $1
|
|
# host must NOT be in the "spamsites" database--END
|
|
# ip address must NOT be in the "denyip" database--BEGIN
|
|
R$* $| $* $: $1 $| $(denyip $2 $)
|
|
R$* $| $*.REJECT $#error $: "521 blocked. contact postmaster@FreeBSD.ORG"
|
|
# ip address must NOT be in the "denyip" database--END
|
|
# Host must resolve--BEGIN
|
|
R$* $| $* $: <$1 $| $2> $>3 foo@$1
|
|
R<$*> $*<@$*.> $: $1
|
|
R<$*> $*<@$*> $#error $: "451 Domain does not resolve"
|
|
# Host must resolve--END
|
|
R$* $@ OK
|
|
|
|
Scheck_mail
|
|
# called with envelope sender (everything after ":") in
|
|
# "Mail From: xxx", of SMTP conversation
|
|
# may or may not have "<" ">"
|
|
# the groups of rules in this ruleset ARE NOT independent.
|
|
# "remove all RFC-822 comments" must come first
|
|
# "Paul Vixie's RBL" must be last
|
|
# you may rearrange the other rules.
|
|
#
|
|
# use the ones that you want comment out the rest
|
|
# each group is preceded and followed by a comment
|
|
#
|
|
# remove all RFC-822 comments--BEGIN
|
|
# MUST be first rule in check_mail rulseset.
|
|
R$* $: $>3 $1
|
|
# remove all RFC-822 comments--END
|
|
# mail must come from a DNS resolvable host--BEGIN
|
|
R$* < @ $+ . > $: $1 @ $2
|
|
R$* < @ $+ > $#error $: "451 Domain does not resolve"
|
|
# mail must come from a DNS resolvable host--END
|
|
# mail must NOT come from a known source of spam--BEGIN
|
|
# resolved. second check: one of the know spam sources?
|
|
R$+ @$+ $: <$1@$2> $1 @$2
|
|
R<$*> $+ @$+.$+.$+ <$1> $4.$5
|
|
R<$*> $* $: $(spamsites $2 $: OK $)
|
|
R$+.REJECT $#error $: 521 $1
|
|
R<$*> $* $: $1
|
|
# mail must NOT come from a known source of spam--END
|
|
# ip address must NOT be in Paul Vixie's RBL--BEGIN
|
|
R$* $: $1 $: $(dequote "" $&{client_addr} $)
|
|
R$* $: $>check_rbl $1
|
|
R$*.com. $#error $: "550 Mail refused, see http://maps.vix.com/rbl"
|
|
# ip address must NOT be in Paul Vixie's RBL--END
|
|
R$* $@ OK
|
|
|
|
Scheck_rcpt
|
|
# called with envelope recipient (everything after ":") in
|
|
# "Rcpt To: xxx", of SMTP conversation
|
|
# may or may not have "<" ">" and or RFC-822 comments.
|
|
# let ruleset 3 clean this up for us.
|
|
#
|
|
# do NOT reorder these two groups of rules.
|
|
# restrict mail relaying to host and domains listed in /etc/sendmail.cR
|
|
#
|
|
# mail must NOT be addressed "fakenames"--BEGIN
|
|
R$* $: <$1> $>3 $1
|
|
R<$*> $+ < @ $+ > $: <$1> $(fakenames $2 $: OK $)
|
|
R$+.REJECT $#error $: 521 $1
|
|
R<$*> $* $: $1
|
|
# mail must NOT be addressed "fakenames"--END
|
|
# mail must come from or go to this machine or machines we allow to relay--BEGIN
|
|
# R$* $: $>Parse0 $>3 $1
|
|
# R$+ < @ $* . > $* $: $1 < @ $2 >
|
|
# R<$+ @ $=w> $@ OK
|
|
# R<$+ @ $* $=R> $@ OK
|
|
# R$* $: $(dequote "" $&{client_name} $)
|
|
# R$=w $@ OK
|
|
# R$* $=R $@ OK
|
|
# R$@ $@ OK
|
|
# R$* $#error $: "550 Relaying Denied"
|
|
# mail must come from or go to this machine or machines we allow to relay--BEGIN
|
|
R$* $@ OK
|
|
|