NAME
smtp.access - sendmail access-control database
SYNOPSIS
/etc/mail/smtp.access
DESCRIPTION
This section describes the contents of the config file smtp.access (for SMTP access control). It demonstrates all the features.
SAMPLE CONFIG FILE
Here is an example of the config file smtp.access
deny [email protected]
deny [email protected] "Get Lost!"
deny @company.com
permit [email protected]
deny 166.28.8.222/31
deny 192.2
permit 192.2.49
deny 199.12.76.0 255.255.254.0
The first column can be either "permit" or "deny". This is followed by either a complete adress (like "[email protected]"), or a "@" and a domain name (like "@cyberpromo.com") which matches all addresses ending in that domain, or 1-4 IP-address octets and an optional netmask which matches all IP adresses in that range.
In all cases a most-exact-match comparison is performed. If you want to deny access from all IP adresses beginning with 192.2 _except_ for adresses beginning with 192.2.49, you could put:
deny 192.2
permit 192.2.49
Similarly, if you want to prevent everyone that supplies a return address ending in "company.com" except "[email protected]" you could put:
deny @company.com
permit [email protected]
You can specify a netmask using either the modern slash (/) format or the traditional dotted quad format. If you leave out the netmask, it is implied by the number of octets you specify in the address. These are all equivalent:
deny 50.12.76
deny 50.12.76.0/24
deny 50.12.76.0 255.255.255.0
So you could say something like this (whitespace before the mask is fine):
deny 38.0.160.0 /20
permit 38.0.168.0 /22
deny 38.0.168.0 /24
adresses starting with 38.0.169 - 38.0.171 (Longest prefix matches first).
After email address deny-entries (_NOT_ after IP address entries) there can be an optional third column with an error message enclosed in quotes which will be sent to the client instead of the standard "Acces denied". Example:
deny [email protected] "Get Lost!"
There is an implicit "permit all" if no match is found or if the file is empty or does not exist. I imagine that an empty smtp.access file would be the common case.
Be aware that the access control just described consists of two completely different things - access control based on the client's IP address which normally can't be faked, and access control based on the senders envelope return address, which is trivial to bypass but still useful.
Everything following a # through the rest of the line is a comment.
SEE ALSO
sharc-update(8), mk-accessdb(8), mk-relaydb(8) and smtp.relay(5)
AUTHOR
This manual page, based on the original README, was written by Stig Sandbeck Mathisen <[email protected]>, for the Debian GNU/Linux system (but may be used by others).