На Solaris-сервере, выполняющего функции SMTP-relay организации, потребовалось разделить пользователей на тех, кому разрешено обмениваться почтой с внешними абонентами и тех, кому разрешена только внутренняя переписка. С этой целью было написано несколько ruleset-ов для sendmail(1M), расширяющих функциональность стандартной "access database". Ниже шаблоны соответствующих файлов.
/etc/mail/access:
| # |
| # FireWall: |
| # |
| # <firewall_rule> | := <domain_rule> | <user_rule> |
| # <domain_rule> | := FW:<domain> <domain_type> |
| # <domain_type> | := INSIDE | OUTSIDE |
| # <user_rule> | := FW:<user> <user_type> |
| # <user_type> | := INOUT | IN | OUT | NONE | user@domain |
| # <domain> | := domain | .domain | . |
| # <user> | := user@domain | user@ | @domain | @ |
| # |
| # Root delivery only local |
| # |
| FW:root@ | NONE |
| # |
| # My domains |
| # |
| FW:my-domain.tld | INSIDE |
| FW:.my-domain.tld | INSIDE |
| # |
| # Network operations mailbox names |
| # |
| FW:abuse@my-domain.tld | IN |
| FW:noc@my-domain.tld | IN |
| FW:security@my-domain.tld | IN |
| # |
| # Support mailbox names for specific internet services |
| # |
| # SMTP - [RFC821], [RFC822] |
| FW:postmaster@my-domain.tld | IN |
| #MAILER-DAEMON@my-domain.tld | IN |
| # |
| # DNS - [RFC1033-RFC1035] |
| FW:bindmaster@my-domain.tld | IN |
| FW:hostmaster@my-domain.tld | IN |
| # |
| # NNTP - [RFC977] |
| #FW:news@my-domain.tld | IN |
| #FW:newsmaster@my-domain.tld | IN |
| #FW:usenet@my-domain.tld | IN |
| # |
| # HTTP - [RFC2068] |
| FW:webmaster@my-domain.tld | IN |
| FW:www@my-domain.tld | IN |
| # |
| # UUCP - [RFC976] |
| #FW:uucp@my-domain.tld | IN |
| #FW:nuucp@my-domain.tld | IN |
| # |
| # FTP - [RFC959] |
| #FW:ftp@my-domain.tld | IN |
| #FW:ftpmaster@my-domain.tld | IN |
| # |
| # Users with full access |
| # |
| FW:user@my-domain.tld | INOUT |
| # |
| # Access Rules |
| # |
| ... |
/etc/mail/sendmail.mc:
| divert(-1) |
| define(`_CF_DIR_',/etc/mail/cf/) |
| include(_CF_DIR_`m4/cf.m4') |
| divert(0) |
| OSTYPE(solaris8) |
| FEATURE(access_db) |
| FEATURE(blacklist_recipients) |
| FEATURE(mailertable) |
| FEATURE(no_default_msa) |
| FEATURE(use_cw_file) |
| define(`confBIND_OPTS', `WorkAroundBrokenAAAA') |
| define(`confMAX_MIME_HEADER_LENGTH', `256/128') |
| define(`confNO_RCPT_ACTION', `add-to-undisclosed') |
| define(`confPRIVACY_FLAGS', `authwarnings,needmailhelo,noetrn,noexpn,noverb,novrfy') |
| define(`confTO_IDENT', `0s') |
| MAILER(local) |
| MAILER(smtp) |
#
|
# FireWall
|
#
|
LOCAL_CONFIG
|
Kstorage macro
|
|
LOCAL_RULESETS
|
SLocal_check_mail
|
| R$* | $: $1 $| $>FireWall_host $&{client_name}
|
| R$* $| INSIDE | $@ $(storage {FireWallUser} $@ $1 $) OK
|
| R$* $| $* | $: $>FireWall_user $1
|
| ROUTSIDE | $@ OK
|
| R$* | $#error $@ 5.7.1 $: "550 Access denied"
|
|
SLocal_check_rcpt
|
| R$* | $: $>FireWall_user $1
|
| RINOUT | $@ OK
|
| RIN | $@ OK
|
| R$* | $: $1 $| $>FireWall_host $&{client_name}
|
| ROUTSIDE $| OUTSIDE | $@ OK
|
| R$* $=O $* $| OUTSIDE | $#error $@ 5.1.1 $: "551 User has moved; please try " <$1$2$3>
|
| R$* $| OUTSIDE | $#error $@ 5.1.1 $: "550 User unknown"
|
| ROUTSIDE $| INSIDE | $: OK $| $>FireWall_user $&{FireWallUser}
|
| R$* $| INOUT | $@ OK
|
| R$* $| OUT | $@ OK
|
| ROK $| $* | $#error $@ 5.7.1 $: "550 Outgoing access denied"
|
|
SFireWall_canonify
|
| R$* | $: $>3 $1
|
| R< @ $+ > : $* | $>3 $2
|
| R$* $=O $* < @ $* > | $@ $>FireWall_canonify $1 $2 $3
|
| R$* < @ $* . > | $1 < @ $2 >
|
|
SFireWall_host
|
| R[ $* ] | $@ OUTSIDE
|
| R$=w | $@ INSIDE
|
| R$* | $: $(access FW: $1 $: ? $) $| .$1
|
| R? $| . $+ . $+ | $(access FW: .$2 $: ? $) $| .$2
|
| R? $| $* | $@ OUTSIDE
|
| R$* $| $* | $@ $1
|
|
SFireWall_user
|
| R$* | $: $| $>FireWall_canonify $1
|
| R$| < @ > | $@ OUTSIDE
|
| R$| $* < @ $=w > | $: $1 @ $2 $| INSIDE
|
| R$| $* < @ $* > | $: $1 @ $2 $| ?
|
| R$| $* | $: $1 @ $j $| INSIDE
|
| R$* @ $* $| ? | $: $1 @ $2 $| $>FireWall_host $2
|
| R$* @ $* $| OUTSIDE | $@ OUTSIDE
|
| R$* @ $=M $| INSIDE | $: $1 @ $2 $| $M
|
| R$* @ $=w $| INSIDE | $: $1 @ $2 $| $M
|
| R$* @ $* $| INSIDE | $: $1 @ $2 $|
|
| R$* @ $+ $| $+ | $: $1 @ $3 $|
|
| R$* @ $* $| $* | $: $1 @ $2 $| $(access FW: $1 @ $2 $: ? $)
|
| R$+ @ $+ $| ? | $: $1 @ $2 $| $(access FW: @ $2 $: ? $)
|
| R$+ @ $+ $| ? | $: $1 @ $2 $| $(access FW: $1 @ $: ? $)
|
| R$* $| ? | $@ NONE
|
| R$* $| $* | $@ $2 |
