From e6fad12921326ac84cfc0438d746fd11c47d88b8 Mon Sep 17 00:00:00 2001 From: Wietse Venema Date: Mon, 4 Apr 2005 00:00:00 -0500 Subject: [PATCH] postfix-2.3-20050404 --- postfix/HISTORY | 16 + postfix/README_FILES/SASL_README | 16 +- postfix/README_FILES/SMTPD_POLICY_README | 5 +- postfix/html/SASL_README.html | 22 +- postfix/html/SMTPD_POLICY_README.html | 5 +- postfix/html/postconf.5.html | 11 + postfix/html/smtpd.8.html | 422 +++++++++++---------- postfix/man/man5/postconf.5 | 5 + postfix/man/man8/smtpd.8 | 5 + postfix/mantools/postlink | 1 + postfix/proto/SASL_README.html | 22 +- postfix/proto/SMTPD_POLICY_README.html | 5 +- postfix/proto/postconf.proto | 7 + postfix/proto/postconf.spec | 461 ----------------------- postfix/src/global/log_adhoc.c | 4 +- postfix/src/global/mail_params.h | 4 + postfix/src/global/mail_version.h | 2 +- postfix/src/lmtp/lmtp_sasl_glue.c | 21 ++ postfix/src/smtp/smtp_sasl_glue.c | 23 +- postfix/src/smtpd/smtpd.c | 51 ++- postfix/src/smtpd/smtpd_sasl_glue.c | 21 ++ postfix/src/tls/tls_scache.c | 8 +- 22 files changed, 409 insertions(+), 728 deletions(-) delete mode 100644 postfix/proto/postconf.spec diff --git a/postfix/HISTORY b/postfix/HISTORY index 404cecfcc..af7f827aa 100644 --- a/postfix/HISTORY +++ b/postfix/HISTORY @@ -10606,6 +10606,22 @@ Apologies for any names omitted. specific to 8bit->7bit conversion; they can also happen with generic address mapping. File: smtp/smtp_proto.c. + Safety: SASL 2.1.19 has a version lookup routine that we + can use to detect compile time / run time version mis-matches + (also known as DLL hell). Files: src/smtpd/smtpd_sasl_glue.c, + src/smtp/smtp_sasl_glue.c, src/lmtp/lmtp_sasl_glue.c. + +20050404 + + Typo: missing comma after dsn=x.yy.zz logging. File: + global/log_adhoc.c. + + Feature: specify "smtpd_sasl_authenticated_header = yes" + to report the SASL login name in the Received: message + header, so that the login name is shared with the whole + world. Based on code by Branko F. Gracnar. Files: + smtpd/smtpd.c, and documentation. + Open problems: Med: disable header address rewriting after XCLIENT? diff --git a/postfix/README_FILES/SASL_README b/postfix/README_FILES/SASL_README index 15a9da90c..5a2482a9f 100644 --- a/postfix/README_FILES/SASL_README +++ b/postfix/README_FILES/SASL_README @@ -20,14 +20,6 @@ When receiving mail, Postfix logs the client-provided username, authentication method, and sender address to the maillog file, and optionally grants mail access via the permit_sasl_authenticated UCE restriction. -Postfix does not record the client's SASL authentication information in message -headers, and does not pass it on via SMTP commands when forwarding mail, -because it is no-one else's business to know the client username and -authentication method. People who need to know can find the information in the -local Postfix maillog file. Some day, Postfix message headers will be -configurable and then one can record the SASL username without having to edit C -code. - This document covers the following topics: * What SASL versions are supported @@ -123,6 +115,14 @@ In order to allow mail relaying by authenticated clients: smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated ... +To report SASL login names in Received: message headers (Postfix version 2.3 +and later): + + /etc/postfix/main.cf: + smtpd_sasl_authenticated_header = yes + +Note: the SASL login names will be shared with the entire world. + In /usr/local/lib/sasl/smtpd.conf (SASL version 1.5.5) or /usr/local/lib/sasl2/ smtpd.conf (SASL version 2.1.1) you need to specify how the server should validate client passwords. diff --git a/postfix/README_FILES/SMTPD_POLICY_README b/postfix/README_FILES/SMTPD_POLICY_README index 4cdca8b4b..27ddd95e9 100644 --- a/postfix/README_FILES/SMTPD_POLICY_README +++ b/postfix/README_FILES/SMTPD_POLICY_README @@ -262,8 +262,9 @@ To invoke this service you would specify "check_policy_service inet:127.0.0.1: GGrreeyylliissttiinngg mmaaiill ffrroomm ffrreeqquueennttllyy ffoorrggeedd ddoommaaiinnss It is relatively safe to turn on greylisting for specific domains that often -appear in forged email. A list of frequently forged MAIL FROM domains can be -found at http://www.monkeys.com/anti-spam/filtering/sender-domain-validate.in. +appear in forged email. At some point in cyberspace/time a list of frequently +forged MAIL FROM domains could be found at http://www.monkeys.com/anti-spam/ +filtering/sender-domain-validate.in. 1 /etc/postfix/main.cf: 2 smtpd_recipient_restrictions = diff --git a/postfix/html/SASL_README.html b/postfix/html/SASL_README.html index faf8dca4f..9d584b411 100644 --- a/postfix/html/SASL_README.html +++ b/postfix/html/SASL_README.html @@ -37,15 +37,6 @@ authentication method, and sender address to the maillog file, and optionally grants mail access via the permit_sasl_authenticated UCE restriction.

-

Postfix does not record the client's SASL authentication -information in message headers, and does not pass it on via SMTP -commands when forwarding mail, because it is no-one else's business -to know the client username and authentication method. People who -need to know can find the information in the local Postfix maillog -file. Some day, Postfix message headers will be configurable and -then one can record the SASL username without having to edit C -code.

-

This document covers the following topics: