On Tue, Sep 02, 2014 at 09:15:32AM -0500, Noel Jones wrote:
> > and the 'file.CIDR' contains:
> >
> > ! 195.98.0.0/19 OK
> > ! 195.98.128.0/19 OK
> > ! ... OK
> > ! ... OK
> > ! 212.26.160.0/19 OK
> > 0.0.0.0/0 REJECT
> >
> > Is that so?
>
> Yes, that should work.
No, that's invalid. The cidr_table(5) documentation does not
include support for negation. To specify a table of excluded
addresses:
main.cf:
smtpd_sasl_exceptions_networks =
# Don't exclude these
!cidr:${config_directory}/allow-sasl.cidr,
# Exclude the rest
0.0.0.0/0
allow-sasl.cidr:
192.0.2.0/24 permit_sasl_authenticated
10.0.0.0/8 permit_sasl_authenticated
172.16.0.0/12 permit_sasl_authenticated
192.168.0.0/16 permit_sasl_authenticated
...
The form of the RHS of allow-sasl.cidr is deliberate, instead
of disallowing authentication, one can allow all addresses to
authenticate, but use allow-sasl.cidr as an access(5) table
to allow relaying from only certain SASL clients:
# Postfix 2.10 or later, ocnsider: smtpd_relay_restrictions
smtpd_recipient_restrictions =
permit_mynetworks,
check_client_access cidr:${config_directory}/allow-sasl.cidr,
reject_unauth_destination,
... UCE restrictions ...
--
Viktor.
