Anti-relay filter configuration issues

Question

Configuration issues with the anti-relay filter in Messaging Server 4.1x.
The following information addresses common questions about configuration issues
with the anti-relay filter in Messaging Server 4.1x:<BR>
<P>
<OL>
<LI><B>Question:</B><BR>
What is the difference between the delivery
and submission
options?<BR>
<P>
<B>Answer:</B><BR>
The submission option
allows specified users to send email to any email address in the world.
These users are typically internal users.
<P>
The delivery option
allows specified users to receive email from anybody. These users
are also typically internal users.
<P>
A standard filter will appear something as follows:<BR>
<P>
# This is the anti-relay config file written by Jay at iPlanet
# The first section sets default conditions
resolvehostnames:0
useauthinfo:0
advertiseauthinfo:1
# This section sets domains to be delivered to by anybody
delivery:*@my.domain.com
# This section sets domains that can send any place
submission:129.12.4.*
<P>
<P>
<LI><B>Question:</B><BR>
The delivery
option works properly. However, why doesn't the
submission option
appear to be allowing emails from specified users to pass through?
<P>
<B>Answer:</B><BR>
The problem with the submission behavior could be due to the setting of the
the resolvehostnames
parameter. If this parameter is turned on
(resolvehostnames:1),
then <I>all</I> entries in this configuration file must be fully qualified
host names. Although wildcards will work, you cannot specify IP
addresses with this configuration setting.
<P>
<P>
<LI><B>Question:</B><BR>
Is it possible to allow people outside of my network to connect to the server
and send mail out?
<P>
<B>Answer:</B><BR>
Yes. To allow outside users to connect to the server and send mail
to any address, without granting the same privilege to the rest of the world,
activate the authenticated SMTP portion of the filter via the
useauthinfo option.
Setting this parameter to "1" (i.e., useauthinfo:1
) will require a user who is not in a
submission address and who is attempting to send email to an address not in
the delivery range to authenticate with a user ID and password.
</OL>
<P>
For additional information on the anti-relay filter, please refer to the
Messaging Server 4.1 Administrator's Guide at<BR>
<P>
http://docs.iplanet.com/docs/manuals/messaging/nms41/ag/ubefiltr.htm#1073677

Answer 1

Prashant:
Are you using a UBE filter to configure domain-based anti-relayinging? We had better luck with the anti-relay plug-in. There is some info on this (for 4.15) at
http://docs.sun.com/source/816-6044-10/ubefiltr.htm#1069973
You have to enable the plug-in using configutil, per the above. The anti-relay plug-in is controlled by antirelay.conf. Be aware that the pattern matching rules are very limited, and not well documented. Fortunately, the source code to the plug-in is included, and you can see what it is doing. To pass the tests we had to add a hard-coded test for a "%" in the source and recompile:
*** antirelay.c.orig Thu Oct 31 04:42:13 2002
--- antirelay.c Thu Oct 31 04:22:07 2002
*** 934,939 ****
--- 934,940 ----
* Weight must be non-zero to begin with so that matches on just "*"
* will work.
+ if( strchr(text,'%') != NULL ) return ABORT;
weight = TRUE;
for ( ; *p; text++, p++) {
if (*text == '\0' && p != '')
Not a really elegant hack, but we didn't need a fully functional regex engine.