Прошу помощи! Проблема следующая:
Аутентификация SMTP работает хорошо - запрашивает пароль, правильно аутентифицирует. Но если снять галочку аутентификации, то ничего не происходит и отправка писем происходит и без запроса пароля... без аутентификации!! Т.е. если кто-то в своей мыльнице (например, TheBat!) создаст ящик такой же, как у меня, то он спокойно отправляет письма от моего имени! Получить не может, т.к. тут запрашивается пароль, а отправить - без проблем! И это не есть ГУТ!!
Подскажите где копать, что и как настраивать? Вот часть конфига экзима:
Код: Выделить всё
acl_smtp_connect = acl_connect
acl_smtp_mail = acl_mail
acl_smtp_notquit = acl_notquit
acl_smtp_rcpt = check_recipient
acl_smtp_data = check_message
begin acl
acl_mail:
accept authenticated = *
accept condition = ${if match_ip{$sender_host_address}\
{iplsearch;/etc/relayhosts}{1}\
{${if eq{$sender_host_address}{127.0.0.1}{1}{0}}}}
accept hosts = +relay_hosts
deny
condition = ${if eq{$sender_helo_name}{}}
message = HELO required before MAIL
drop
condition = ${if match{$sender_helo_name}{$primary_hostname}}
message = "REJECTED - Bad HELO - Host impersonating [$sender_helo_name]"
drop
condition = ${if eq{[$interface_address]}{$sender_helo_name}}
message = "REJECTED - Interface: $interface_address is _my_ address"
drop
condition = ${if isip{$sender_helo_name}}
message = Access denied - Invalid HELO name (See RFC2821 4.1.3)
drop
# Required because "[IPv6:<address>]" will have no .s
condition = ${if match{$sender_helo_name}{\N^\[\N}{no}{yes}}
condition = ${if match{$sender_helo_name}{\N\.\N}{no}{yes}}
message = Access denied - Invalid HELO name (See RFC2821 4.1.1.1)
drop
condition = ${if match{$sender_helo_name}{\N\.$\N}}
message = Access denied - Invalid HELO name (See RFC2821 4.1.1.1)
drop
condition = ${if match{$sender_helo_name}{\N\.\.\N}}
message = Access denied - Invalid HELO name (See RFC2821 4.1.1.1)
accept
acl_connect:
accept
hosts = +trustedmailhosts
accept
condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/trustedmailhosts}{1}{0}}
# ignore pop before smtp
accept
condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/relayhosts}{1}{${if eq{$sender_host_address}{127.0.0.1}{1}{0}}}}
accept
hosts = +relay_hosts : +backupmx_hosts
#only rate limit port 25
accept
condition = ${if eq {$interface_port}{25}{no}{yes}}
defer
message = The server has reached its limit for processing requests from your host. Please try again later.
log_message = "Host is ratelimited ($sender_rate/$sender_rate_period max:$sender_rate_limit)"
ratelimit = 1.2 / 1h / strict / per_conn / noupdate
drop
message = Your host is not allowed to connect to this server.
log_message = Host is banned
hosts = +spammeripblocks
# do not change the comment in the line below, it is required for /usr/local/cpanel/bin/check_exim_config
#acl_smtp_notquit is required for this to work (exim 4.68)
accept
acl_notquit:
# ignore authenticated hosts
accept authenticated = *
# ignore pop before smtp
accept condition = ${if match_ip{$sender_host_address}{iplsearch;/etc/relayhosts}{1}{${if eq{$sender_host_address}{127.0.0.1}{1}{0}}}}
accept hosts = +relay_hosts
#only rate limit port 25
accept condition = ${if eq {$interface_port}{25}{no}{yes}}
warn condition = ${if match {$smtp_notquit_reason}{command}{yes}{no}}
log_message = "Connection Ratelimit - $sender_fullhost because of notquit: $smtp_notquit_reason ($sender_rate/$sender_rate_period max:$sender_rate_limit)"
ratelimit = 1.2 / 1h / strict / per_conn
Код: Выделить всё
begin authenticators
dovecot_plain:
driver = dovecot
public_name = PLAIN
server_socket = /var/run/dovecot/auth-client
server_set_id = $auth1
server_condition = ${if and {{!match {$auth1}{\N[/]\N}}{eq{${if match {$auth1}{\N[+%:@]\N}{${lookup{${extract{2}{+%:@}{$auth1}}}lsearch{/etc/demodomains}{yes}}}{${lookup{$auth1}lsearch{/etc/demousers}{yes}}}}}{}}}{true}{false}}
dovecot_login:
driver = dovecot
public_name = LOGIN
server_socket = /var/run/dovecot/auth-client
server_set_id = $auth1
server_condition = ${if and {{!match {$auth1}{\N[/]\N}}{eq{${if match {$auth1}{\N[+%:@]\N}{${lookup{${extract{2}{+%:@}{$auth1}}}lsearch{/etc/demodomains}{yes}}}{${lookup{$auth1}lsearch{/etc/demousers}{yes}}}}}{}}}{true}{false}}
