relaying

[Danielit]

I have sendmail 8.12.8 running on solaris.

I need to restrict relaying in such a way that sendmail will alow relaying to/from my domain only.

How can i achieve it ? I created sendmail.cf file using the m4 macros and used feature('relay_entire_domain').

Are there any precautions that I should take care of before using this feature ?

 

[jmiturbe]

Hello,

I think that all precautions are good and denying relay is one of them. I think I read at sendmail book that the relaying feature was a patch to deny the relaying and that later this feature was extended or upgraded with the access.db feature, which offers more flexibility and protection against spam too.

I can't exactly remember, but I think that we are using both relay-domains and access.db.

Take a look at access.db.

Bye,

jmiturbe

 

[TalentedFool]

You can use both the relay-domains file and the access file

In the relay-domains file just stick your domain.

If you only want mail to/from your domain to be relayed in the access file you can put something like

yourdomain.com RELAY
ANY REJECT

This should allow only relaying to/from your domain.

in the config file (sendmail.mc), You'll need to specify to use the access file using FEATURE(`access_db`) and re-compile it using the M4 compiler in the normal way and restart sendmail.

Let me know how you got on with this. If it didn't work I'll dig a lttle deeper into our system and see how we're doing it.

Lee ~ Remember - Nothing is Fool Proof to a Talented Fool ~

 

[pmkincaid]

One caveat to what TalentedFool talked about -- you need to compile NEWDB support into sendmail to use the access_db feature (since you have to 'makemap' on the access file you create to make the access file into a db file).

I unfortunately only know the quirks of Linux to get NEWDB support into it... Take a look at the README file in the sendmail directory of the tarball for more info on the NEWDB.

One thing you can try is what TalentedFool stated about recreating the cf file from the mc using FEATURE(access_db), create an /etc/mail/access file then do 'makemap hash /etc/mail/access < /etc/mail/access' and see if it errors out. If it does, you need to investigate the NEWDB thing, if you get an access.db file with no errors about not having db supprt, you should be good to go.

Hope this helps,
Paul