Subversion Repositories planix.SVN

.TH SMTPD 6

.SH NAME 

smtpd \- SMTP listener configuration

.SH DESCRIPTION

The

SMTP

daemon 

of

.IR mail (1)

implements the slave side of the SMTP protocol

to accept incoming mail on TCP port 25.

In general, 

.IR smtpd 's

default parameters

are sufficient for internal systems

on protected networks, but external or

gateway systems require additional

security mechanisms.

The files

.BR /mail/lib/smtpd.conf ,

containing configuration parameters,

and

.BR /mail/lib/blocked ,

containing

banished addresses, provide the means to

exercise these facilities.

.SS Input Format

In both files input lines

consist of a verb followed by one or more

parameters.  These tokens are separated by white space or

commas and all characters following a

.B #

are comments.  A

.B #

cannot be escaped.  Continuation lines are

not supported, but verbs that take multiple parameters

can be restated on many lines and the associated

parameters accumulate into a single set.

All token processing is case-insensitive.

.PP

Many parameters are

.IR addresses ,

either numeric IP addresses in CIDR notation

or a

.I "sender address"

in UUCP-style format.

.PP

An IP address in CIDR notation has the form

.PP

.EX

	aaa.bbb.ccc.ddd/mask

.EE

.PP

consisting of a four octet IP address, a slash,

and a

.I mask length

specifying the number of significant high-order bits.

The lower the mask length, the larger the

range of addresses covered by the CIDR address;

see RFC 1878 for a discussion of mask lengths.

Missing low-order octets are assumed to be zero.

If a mask length is not given, a mask length of

16, 24, or 32 is assumed for addresses containing

two, three, or four octets, respectively.  These

mask lengths select a class B, class C or Class D

address block.  Notice that this convention differs

from the standard treatment, where the default mask length

depends on the allocation class of the network

block containing the address.

.PP

.I "Sender addresses"

are specified in UUCP notation as

follows:

.PP

.EX

	[domain!]...domain!user

.EE

.PP

It is seldom necessary to specify more than one domain.

When

.I domain

is missing or

.BR * ,

the address selects the specified user in all domains.

A

.I domain

of the form

.BI *. domain

selects the domain and all of its sub-domains.

For example,

.B example.com!user

only matches the account

.I user

in domain

.BR example.com ,

while

.B *.example.com!user

selects that account in

.B example.com

and all of its sub-domains.

When

.I user

is omitted or

.BR * ,

the address selects all users in the specified domain.

Finally, when

.B *

is the last character of the user name it is a wild-card

matching all user names beginning with

.IR user .

This limited pattern matching capability should be used with care.

For safety, the sender addresses

.BR * ,

.BR ! ,

.BR *! ,

.B !*

and 

.B *!*

are ignored.

.SS /mail/lib/smtpd.conf

This file contains configuration options

and parameters describing the local domain.

Many of the options can also be specified on the command

line; command line options always override the values in

this file.

Configuration options are:

.PD0

.TP 10

.BI defaultdomain " domain"

The name of the local domain; it is appended to addresses

lacking a domain qualification.

This is identical to the

.B -h

command line option.

.TP 10

.BR norelay \ [ on\f1|\fPoff ]

If

.I on

is specified, relaying is prohibited

from unauthorized networks to external domains.

Authorized networks and domains must be specified

by the

.B ournets

and

.B ourdomains

verbs described below.  Setting this option on is equivalent to specifying the

.B -f

command line flag, but the list of

networks and domains can only be specified in

this file.

.TP 10

.BR verifysenderdom \ [ on\f1|\fPoff ]

When

.IR on ,

.I smtpd

verifies that the first domain of the sender's address

exists.  The test is cursory; it checks only that

there is a DNS delegation for the domain.

Setting the option on is equivalent to specifying the

.B -r

command line option and

is useful for detecting some unreturnable

messages as well as messages with randomly

generated domain names.

.TP 10

.BR saveblockedmsg \ [ on\f1|\fPoff ]

When

.IR on ,

causes copies of blocked messages to be saved

in subdirectories of

.BR /mail/queue.dump .

Directories are named with the date and file names

are random numbers.

If this option is

.I off

blocked messages are discarded.

Setting this option on is equivalent to specifying the

.B -s

command line option.

.TP 10

.BR ournets " \fIIP address\fP [, \fIIP address\fP, ..., \fIIP address\fP]"

This option specifies trusted

source networks that are allowed to relay mail to external domains.

These are usually the internal networks of the local domain, but they

can also include friendly

external networks.  Addresses

are in CIDR notation.

.TP 10

.BR ourdomains " \fIdomain\fP [, \fIdomain\fP, ..., \fIdomain\fP]"

This option specifies destination domains that are allowed

to receive relayed mail.  These are usually the domains

served by a gateway system.

Domain specifications conform to the format

for sender addresses given above.

.PD

.PP

When the

.B norelay

option is enabled or the

.B -f

command line option given, 

relaying is allowed only if the source IP address is in

.B ournets

or the destination domain is specified in

.BR ourdomains .

.SS Blocked Addresses

.I Smtpd

consults

.B /mail/ratify

(see

.IR ratfs (4))

for a list of banned addresses.

Messages received from these addresses are

rejected with a 5\fIxx\fP-series SMTP error code.

There is no option

to turn blocking on or off; if 

.B /mail/ratify

is mounted,

.I smtpd

will use it, even for connections from trusted networks.

.PP

The command line format and address specifications

conform to the notation described above.  If the parameters

of the verb is sender addresses in UUCP format, the line

must begin with an

.B *

character; if the parameters are one or more IP addresses,

the

.B *

must precede the verb.  Most

verbs cause messages to be rejected; verbs

of this class generally select different error

messages.  The remaining verbs specify addresses that

are always accepted, in effect overriding blocked addresses.

The file is processed in order, so an override must

precede its associated blocked address.

Supported verbs are:

.PD0

.TP 10

.BR dial " \fIIP address\fP [,..., \fIIP address\fP]"

The parameters are IP addresses associated with

dial-up ports.  The rejection message states

that connections from dial-up ports are not accepted.  Copies

of messages are never saved.

.TP 10

.BR block " \fIaddress\fP [, ... \fIaddress\fP]"

Messages from addresses

matching the parameters

are rejected with an error message saying

that spam is not accepted.  The message is saved if

the option is enabled.

.TP 10

.BR relay " \fIaddress\fP [, ... \fIaddress\fP]"

This verb is identical to

.BR block ,

but the error message states that

the message is rejected because the sending

system is being used as a spam relay.

.TP

.BR deny " \fIaddress\fP [, ... \fIaddress\fP]"

The

.B deny

command rejects a message when the 

sender address matches one of its parameters.

The rejection message asks the sender to

contact

.BR postmaster @

.I hostdomain

for further information.

This verb is usually used to block

inadvertently abusive traffic, for example,

mail loops and stuck senders.  Messages are

never saved.

.TP

.BR allow " \fIaddress\fP [, ... \fIaddress\fP]"

The

.B allow

verb negates the effect of subsequent blocking commands.

It is useful when a large range of addresses contains

a few legitimate addresses, for example, when

a mail server is in a Class C network block

of modem ports.  Rather than enumerate the dial ports, it is

easier to block the entire Class C with a

.B dial

command, and precede it with an override for

the address of the mail server.  Similarly,

it is possible to block mail from an entire

domain while accepting mail from a few friendly

senders in the domain.

The verb

.B accept

is a synonym for

.BR allow .

.PD

.PP

.IR Scanmail (8)

describes spam detection

software that works well with

the capabilities described here

and

.IR mail (1)

defines additional 

.I smtpd

command line arguments applicable

to exposed systems.

.SH "SEE ALSO"

.IR mail (1),

.IR ratfs (4),

.IR scanmail (8)