control external sending

[gabriellai86]

Hi,

How can I control external access as I have 2 domain names. 1 domain names' users are allowed to send externally, and another domain names' users are not allowed to send externally, every emails will be stays in internally only.

Any idea?
Please help

 

[thedaver]

There isn't a means to control this to my knowledge under qmail. smtp-auth authentication could be used to establish a valid user for purposes of allowing injecting/sending mail, but I'm not aware of mainstream controls to permit/deny users of a specific domain to have external sending privileges controlled.

D.E.R. Management - IT Project Management Consulting

http://www.dermanagement.com/

 

[gabriellai86]

I came across a qmail plugin called empf policy.. anyone try that? I've tested it, but it seems doesn't works.

 

[BIS]

I guess you could add a line in tcp.smtp for your domain with something like

10.2:allow,RELAYCLIENT="@checksender" (if your lan is in the 10.2 range of course)

In virtualdomains have a line like

checksender:checkdomain

And then in /alias/ in the .qmail-checkdomain-default pass the mail through a script (simply add the line "|/path/to/script" )

In the script check the sender's domain, if allowed pass the mail back to qmail-inject, if not then bounce it.

 

[gabriellai86]

What I would like to achieve is that abc.com will be staying internally only, while abc.com.my is a valid FQDN, and users in abc.com.my are allowed to send emails externally.

abc.com is just a local domain name for internal emailing purposes. Hosted with Bind, a local DNS Server.

Whenever user@abc.com tries to send email to gmail.com, yahoo.com or hotmail.com, it will be bounced.

I wanna achieve that.

Please assist.

 

[thedaver]

I guess I don't think this makes any sense in pursuing from a technical standpoint.

The email "from:" or "reply to:" can easily be spoofed to avoid your proposed control if you intend to control through inspection of this header value.

I *think* that BIS's suggestion will work if the user authentication scheme is differentiating between users at abc.com and abc.com.my. However, if a single person (user) would be required to sign use different email accounts to communicate with different domains, then I think that's a non-starter.

Why all the fuss? Perhaps if you describe the actual problem you're trying to solve there may be an alternative.

D.E.R. Management - IT Project Management Consulting

http://www.dermanagement.com/