![(EXIM)ACL 仅允许内部域发送到内部组别名](https://linux22.com/image/607781/%EF%BC%88EXIM%EF%BC%89ACL%20%E4%BB%85%E5%85%81%E8%AE%B8%E5%86%85%E9%83%A8%E5%9F%9F%E5%8F%91%E9%80%81%E5%88%B0%E5%86%85%E9%83%A8%E7%BB%84%E5%88%AB%E5%90%8D.png)
我正在尝试创建一个 ACL 规则,该规则仅允许内部用户/白名单用户向特定组别名(例如 all@ 或 office2@)发送邮件
我知道我需要类似的东西:
deny log_message = $sender_address is not permitted to send to myprotecteddomain.com my2protecteddomain.com
domains = myprotecteddomain.com : my2protecteddomain.com
! senders = *myowndomain.com
但可能使用包含白名单地址的外部文件,我不太擅长 Exim ACL!
答案1
如果你只需要本地用户使用这个,那么我认为你不应该使用它,sender
因为它很容易被伪造——相反,你应该配置 SMTP授權(begin authenticators
部分),接下来你可以使用如下内容:
deny recipients = lsearch*@;/etc/exim/protected-recipients
!authenticated = *
message = Sending denied - protected list - not authenticated - returned to sender
log_message = PROTECTED - sending denied not - authenticated - - logged to file
deny recipients = lsearch*@;/etc/exim/protected-recipients
condition = ${lookup{$authenticated_id}lsearch{/etc/exim/allowed-users}{no}{yes}}
message = Sending denied - protected list - no access - returned to sender
log_message = PROTECTED - sending denied - no access - logged to file
对于recipients
我来说lsearch*@;
,您可以像这样使用完整的电子邮件地址和通配符:
[email protected]
*@protected-domain
对于经过身份验证的用户,您只需逐行列出其名称(注意yes
并按no
查找顺序排列)。
如果您也需要远程用户,那么您可以添加:
accept recipients = lsearch*@;/etc/exim/protected-recipients
!sender_domains = +local_domains
condition = ${lookup{$sender_address}lsearch{/etc/exim/allowed-users}{yes}{no}}
在第一次拒绝之前,每行列出一个地址。