- 论坛徽章:
- 0
|
20可用积分
RFC882 DNS
最近在建立电邮系统时遇到了一点儿小问题，希望大家帮帮忙 ……
寄信时，怎样确定客户端使用的是真实的寄件人地址？比方说，以mailer的身份通过验证，但是却以test为发信人地址，
要如何避免这种冒名情况？
看了一下
Postfix: The Definitive Guide
书上如是说：
12.3.2.2 Preventing sender spoofing
To make sure that clients use correct sender addresses when relaying, Postfix allows you to map sender addresses to SASL logins. For example, if you have an address kdent@example.com that should be used only by the SASL user kdent, you can create a file requiring the correct user for that address:
kdent@example.com kdent
The file is a normal Postfix lookup table and allows regular expressions as well as local parts and domains (see Chapter 4 for information on Postfix lookup tables). Use the parameter smtpd_sender_login_maps in main.cf to indicate the table you create:
smtpd_sender_login_maps = hash:/etc/postfix/sasl_senders
You can list as many addresses as you need in the table. To reject messages from users attempting to use incorrect sender addresses or users who are not authenticated at all who attempt to use a specified address, include the restriction reject_sender_login_mismatch with your restriction parameters (see Chapter 11 for information on UBE restrictions).
我按其方法做了如下：
- smtpd_sasl_auth_enable=yes
- broken_sasl_auth_clients=yes
- smtpd_recipient_restrictions= reject_unknown_recipient_domain,
- reject_unauth_pipelining,reject_unauth_destination,
- reject_sender_login_mismatch,permit_sasl_authenticated
- smtpd_sender_login_maps=mysql:/etc/postfix/mysql_sasl_senders.cf
- smtpd_sasl_local_domain=$myhostname,$mydomain,localhost.$mydomain
- smtpd_sasl_security_options=noanonymous
- smtpd_sasl_application_name=smtpd
- smtpd_banner=Welcome to $myhostname ESMTP,adm:black! U can mail to me!
数据库里面内容是:
mysql> select * from mailbox;
+-----------------+-------+----------+----------+---------+------+------+-------+
| name | home | username | password | maildir | uid | gid | quota |
+-----------------+-------+----------+----------+---------+------+------+-------+
| black@black.vnt | black | black | black | black/ | NULL | NULL | |
| blue@black.vnt | blue | blue | blue | blue/ | NULL | NULL | |
| jack@black.vnt | jack | jack | jack | jack/ | 0 | 0 | |
| test@black.vnt | test | test | test | test/ | NULL | NULL | |
+-----------------+-------+----------+----------+---------+------+------+-------+
4 rows in set (0.00 sec)
mysql_sasl_senders.cf表里面的内容是 已经postmap过)
mail:/etc/postfix# less mysql_sasl_senders.cf
user = mail
password = mail
hosts = localhost
dbname = mail
table = mailbox
select_field = username
where_field = name
如果我把reject_sender_login_mismatch去除,正常发信但是没能 Preventing sender spoofing.
但是我加上这一次则出现
Nov 21 11:32:19 mail postfix/smtpd[2394]: NOQUEUE: reject: RCPT from host.black.vnt[200.0.10.1]: 553 5.7.1 <black@black.vnt>: Sender address rejected: not logged in; from=<black@black.vnt> to=<blue@black.vnt> proto=ESMTP helo=<blacklaptop>
正常用户也不能用了
各位可知道原因啊？？？谢谢 |
最佳答案
查看完整内容
我使用的方法基本是和你一样的，我不用milter，我的配置如下： （根据我的环境是成功的）main.cf里： 我的maps.cf放在/etc/postfix/mysql里的，别照搬哟mysql_virtual_alias_user_maps.cf内容：user = XXXXpassword = XXXXhosts = 127.0.0.1dbname = postfixtable = aliasselect_field = gotowhere_field = addressmysql_virtual_sender_maps.cf内容：user = XXXXpassword = XXXXhosts = 127.0.0.1dbname = postfixtable = mailbox ...
|
免费注册
发表于 2007-11-21 12:30
