Home / server / Questions / 486941
In Process
Samuel Jones
Asked: 2013-03-13 03:26:17 +0800 CST

(EXIM) ACL for only allowing internal domain to send to internal group alias

  • 772

I'm trying to create an ACL rule that will only allow internal users/white listed users to send to particular group aliases such as all@ or office2@

I know I need something similar to: 

deny       log_message =  $sender_address is not permitted to send to myprotecteddomain.com my2protecteddomain.com
           domains     = myprotecteddomain.com : my2protecteddomain.com
           ! senders   = *myowndomain.com

But possibly using an external file with white-listed addresses in, I'm not that good at Exim ACLs!

exim

1 Answers

  1. If you need this only for local users then I think you should not use sender because it can be falsified without any trouble - instead you should configure SMTP auth (begin authenticators section) and next you can use something like this:

    deny  recipients   = lsearch*@;/etc/exim/protected-recipients
      !authenticated = *
      message      = Sending denied - protected list - not authenticated - returned to sender
      log_message  = PROTECTED - sending denied not - authenticated - - logged to file

deny  recipients   = lsearch*@;/etc/exim/protected-recipients
      condition    = ${lookup{$authenticated_id}lsearch{/etc/exim/allowed-users}{no}{yes}}
      message      = Sending denied - protected list - no access - returned to sender
      log_message  = PROTECTED - sending denied - no access - logged to file

    For recipients I use lsearch*@; so you can use both full email addresses and wilcarded like this:

    [email protected]
*@protected-domain

    For authenticated users you need just list it names line by line (note yes and no order in lookup).

    If you need remote users too, then you can add:

    accept  recipients   = lsearch*@;/etc/exim/protected-recipients
    !sender_domains = +local_domains
    condition    = ${lookup{$sender_address}lsearch{/etc/exim/allowed-users}{yes}{no}}

    before first deny and list addresses one per line.

    • 1