Juniper man pages - smtpd Address Checking

SMTPD version 2 Address Checking rules

The address check file, when enabled is read for each RCPT line in the SMTP dialogue. Each rule is checked with the current source (SMTP client machine and possibly user from ident) and the current FROM: and RCPT: addresses. rules are read from top to bottom of the file, and the first match stops the check, with the action determined by the first field of the rule.

Anything on a line after a pound sign (#) is ignored as a comment.

An address check rule line has four fields:
[allow|deny|noto]:SourceList:FromList:ToList[:XXX message for deny/noto]

The first field must normally be one of the strings "allow","deny", or "noto". This determines the disposition of a message which matches a the rule. A matching "allow" rule allows the smtp connection to proceed. A matching "deny" rule will terminate the smtp connection when matched with a failure, and the message will not be delivered to *any* of it's recipients. A "noto" rule will prevent the delivery of a message to the matching combination, failing that RCPT command, and returning a 550 code in the SMTP dialogue, but will allow delivery to continue if other rules allow further recipients. If NODO_DELAY and DENY_DELAY are set nonzero in the makefile at compile time, there are two additional rule keywords; "noto_delay", and "deny_delay". These rules function exactely like a noto or deny, except that smtpd will sleep for the delay amount before returning the error code to the client, causing a "pregnant pause" in the SMTP dialogue.

The Second Field is a List of Source Patterns, separated by white space. These match against the incoming SMTP connection's originating hostname, IP address and possibly username returned by an ident call.

The Third field is a list of Address Patterns, separated by white space. These match against the MAIL FROM: portion of the smtp dialogue.

The Fourth field is a list of Address Patterns, separated by white space. These match against the RCPT TO: portion of the smtp dialogue.

The Fifth field is optional, and if present is used on matching the rule if it is a deny or noto rule. It should be the complete smtp dialogue message to be sent to the remote smtp client. It should start with an appropriate smtp error code. The following substitutions are made in the string:

• %F is replaced with the MAIL FROM: address.
• %T is replaced with the RCPT TO: address.
• %H is replaced with the connecting hostname, or "UNKNOWN"
• %U is replaced with the connecting user from ident, or "UNKNOWN"
• %I is replaced with the connecting host IP address.

For a rule to match a match must be successfully made against all three lists. A match against a list occurs when any of the patterns in it match. EXCEPT, the keyword "EXCEPT" may be used in a list to indicate exceptions to matches: For example:
pattern1 pattern2 pattern3 EXCEPT pattern4
will match against any string that matches pattern1 pattern2 or pattern3, except for those that also match pattern4.

all characters in patterns except in specials must be lower case. lower case letters in patterns match against both upper and lower case letters in sources. '*' in a pattern matches 0 or more characters. If smtpd was compiled with USE_REGEX set in the makefile, a pattern may be enclosed in slashes "//", to indicate that it is a POSIX style regular expression, which is matched against case insensitively.

Source Patterns:

• ALL matches everything, including empty string
• KNOWN matches a known reply from the network, in the case of resolved hostnames or ident values.
• UNKNOWN matches an unknown reply from the network, in the case of resolved hostnames or ident values.
• TRUSTED matches a connection arriving on a trusted interface (If smtpd was compiled with JUNIPER_SUPPORT and you are running on an machien with the Juniper firewall toolkit)
• UNTRUSTED matches a connection arriving on an untrusted interface (If smtpd was compiled with JUNIPER_SUPPORT and you are running on an machien with the Juniper firewall toolkit)
• NS=pattern matches a connection arriving from a source whose nameserver or mail exchanger matches pattern. (if NS_MATCH set to 1 in Makefile)

Example Source Patterns:

 #Allow anything from anywhere to an address ending in obtuse.com:
 allow:ALL:ALL:ALL@*obtuse.com
 #don't allow unregistered hosts, unless via a trusted interface 
 
 deny:UNKNOWN EXCEPT TRUSTED:ALL:ALL
 
 #deny mail from anything ending in .cyberpromo.com
 deny:ALL:*.cyberpromo.com:ALL
 #and deny anything relayed by a host ending in .cyberpromo.com
 deny:*.cyberpromo.com:ALL:ALL		  
 
 	
 #Simple ident example, useful *only* if you can trust the ident
 #value returnd by the machine. (You can't unless you control it
 #or trust the person that does not to make it lie)	
 #Allow mail if the user part of the FROM address matches ident.  
 allow:KNOWN@idents.trusted.here:USER@idents.trusted.here:ALL
 
 # A more complex example. The typical university case of making
 # sure users don't subscribe other users to majordomo mailing lists by
 # forging mail via smtp.
 # allow users that mta's run as to send anything
 allow:root@ALL daemon@all uucp@all:ALL:ALL
 # other known users can send to majordomo only as themselves according
 # to ident.
 allow:KNOWN@ALL:USER@ALL:majordomo@ALL
 # Below shows a custom message too
 deny:ALL:ALL:majordomo@ALL:550 You can't send majordomo mail from %F when you are %U@%H (ip %I). 
 
 
 # The normal antispam case, assumes JUNIPER_SUPPORT,
 # We trust everything from inside on a trusted interface to go out
 allow:UNTRUSTED:ALL:ALL
 # DNS registerd clients can talk to me, with mail for my domains
 allow:KNOWN:ALL:*my.domain *myother.domain
 # unregistered clients get punted.
 deny:UNKNOWN:ALL:ALL
 # otherwise mail to nonlocal users won't get relayed.
 noto:ALL:ALL:ALL