<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
On 8/12/11 8:49 AM, Mark Martinec wrote:
<blockquote
cite="mid:201108121449.56745.Mark.Martinec+amavis@ijs.si"
type="cite">
<pre wrap="">Jo,
</pre>
<blockquote type="cite">
<pre wrap="">If I get on a random cafe's wireless network, the local hosts might be in
192.168.1.0/24. Should I allow them to relay mail? Should I allow their
outbound mail to bypass spam check? Absolutely not, I'm sure you would
agree.
</pre>
</blockquote>
</blockquote>
maybe not amavid.. in fact, any connection to amavis from 169* would
be strange... unless your laptop also did not get a good ip and
pulled a 169* address.<br>
<br>
in SA default 'local.cf' I think they have internal_networks
192.168/16 10/8 172.16/12. might need 169.254/16.<br>
<br>
this doesn't give the internal network the right to relay, and, most
installs will override internal_* and trusted* with their outbound
mail server ip's, and you still have to set the mynets up in amavisd
to include/not include 169*.<br>
<br>
but, given this discussion, I think Ill post a bugzilla to SA.
internal_networks don't trigger DCC, PYZON,RAZOR, SPF or RBL checks.<br>
<br>
<br>
<blockquote
cite="mid:201108121449.56745.Mark.Martinec+amavis@ijs.si"
type="cite">
<pre wrap="">
It is exactly the same argument why one can and should safely
include the 127.0.0.0/8 in the trusted_networks list. The same
applies to private address ranges and link-local address space.
</pre>
</blockquote>
i think SA from (3.2* onward include 127.0.0.0/8 by default?) it you
put it it yourself, you get a lint warning:<br>
<br>
without 127 in local.cf:<br>
<br>
su - vscan -c 'spamassassin --lint'<br>
(no lint errors)<br>
<br>
echo 'internal_networks 127/8' >> local.cf<br>
(or trusted_networks, doesn't matter)<br>
<br>
su - vscan -c 'spamassassin --lint'<br>
Aug 12 14:06:00.917 [8635] warn: netset: cannot include 127.0.0.0/8
as it has already been included<br>
<br>
so, question begs: I think this is in default local.cf:<br>
<br>
grep networks local.cf<br>
internal_networks 192.168/16 172.16/12 10/8<br>
<br>
should SA add 169.254/8 by default for completeness?<br>
<br>
<br>
<blockquote
cite="mid:201108121449.56745.Mark.Martinec+amavis@ijs.si"
type="cite">
<pre wrap=""> Mark
</pre>
</blockquote>
<br>
<br>
<div class="moz-signature">-- <br>
Michael Scheidell, CTO<br>
o: 561-999-5000<br>
d: 561-948-2259<br>
<font color="#999999">></font><font color="#cc0000"> <b>| </b></font>SECNAP
Network Security Corporation
<style type="text/css">
<!--
.unnamed1 {
margin: 1em;
padding: 1px;
} -->
</style>
<ul class="unnamed1">
<li>Best Mobile Solutions Product of 2011</li>
<li>Best Intrusion Prevention Product</li>
<li>Hot Company Finalist 2011</li>
<li>Best Email Security Product</li>
<li>Certified SNORT Integrator</li>
</ul>
</div>
<br>
<div id="disclaimer.secnap.com"><hr />
<p>This email has been scanned and certified safe by SpammerTrap®.
<br />For Information please see
<a href="http://www.secnap.com/products/spammertrap/">http://www.secnap.com/products/spammertrap/</a></p> <hr /></div>
<br>
</body>
</html>