AuthenticatingForward

This document is describes how to use exim4 as relay server for internal network. 1. Creating the perl functions: we need to create several perl functions to be able check authorization at third party mail servers: The internal mail server in this example have the "mail." prefix.

{{{
    
sub check_mail_dot($) {
    my $host = shift;
    $host = "mail.".$host;
    my $res = Net::DNS::Resolver->new();
    my $query = $res->search($host) or {
        return 1;
    };

    my $ip;
    if ($query) {
        foreach my $rr ($query->answer) {
            next unless $rr->type eq "A";
            $ip = $rr->address;

            # the following regexp is eq our network:
            my $regexp = ":superscript:`192.168.1|`192.168.2|^192.168.3";

            if ($ip !~ $regexp) {
                return 1;
            }
        }
    } else {
        return 1;
    }

    if ($ip !~ $regexp) {
        return 1;
    }
}

sub pop3auth ($$) {
    my $login = shift;
    my $password = shift;
    my $mailserver = $login;
    my $hosthelo = "H=(".Exim::expand_string('$sender_helo_name').")[".Exim::expand_string('$sender_host_address')."]";
    #warn "$hosthelo popauth: login: $login,password: $password";
    $mailserver = ~s/.*@//;
    $mailserver = "mail.".$mailserver;
    my $host = $mailserver;
    my $record;
    my $res = Net::DNS::Resolver->new();
    my $query = $res->search($host) or {
        warn "$hosthelo Auth failed - could not found $host " and return 1;
    };

    my $ip;
    if ($query) {
        foreach my $rr ($query->answer) {
            next unless $rr->type eq "A";
            $ip = $rr->address;

            # the following regexp is eq our network:
            my $regexp = ":superscript:`192.168.1|`192.168.2|^192.168.3";

            if ($ip !~ $regexp) {
                warn "$hosthelo found not our network ip ($host:$ip)!";
                return 1;
            }
        }
    } else {
        warn "$hosthelo Failed to resolve ip of $host!";
    }

    my $pop3 = Net::POP3->new($mailserver) or {
        warn "$hosthelo Auth failed - could not connect to pop3 server $mailserver" and return 1;
    };
    my $tot_msg = $pop3->login($login, $password) or {
        warn "$hosthelo Auth failed - pop3 srever decline $login,$password" and return 1;
    };
    warn "$hosthelo Auth passed for $login with $password at $mailserver";
    return 0;
}

}}}

---

2. in the exim configuration we need to make new router,transport and authentificator:

auth_route:
        driver = manualroute
        condition = ${if match{$authenticated_id}{\@}{1}{0}}
        domains = *
        transport = auth_transport
        route_list = * ${perl{logtohost}{$authenticated_id}}

auth_transport:
        driver = smtp
        hosts_try_auth = *
        hosts_require_auth = *

begin authenticators

plain:
   driver = plaintext
   public_name = PLAIN
   server_prompts = :
   server_condition = "${if eq {${perl{pop3auth}{$2}{$3}} }{0}{1}}"
   server_set_id = $2::$3
   client_send = ^${perl{parse_login}{$authenticated_id}}^${perl{parse_password}{$authenticated_id}}

login:
   driver = plaintext
   public_name = LOGIN
   server_prompts = "Username:: : Password::"
   server_condition = "${if eq {${perl{pop3auth}{$1}{$2}} }{0}{1}}"
   server_set_id = $1::$2
   client_send = : ${perl{parse_login}{$authenticated_id}}:${perl{parse_password}{$authenticated_id}}

If wish to you use RCPT Callout verification you will need in next routers:

verify_router_special:
     driver = manualroute
     domains = +mailertable
     verify_only = true
     transport = remote_smtp
     route_list = * mail.$domain
     condition = ${if match{$authenticated_id}{\@}{1}{0}}

verify_router:
        driver = dnslookup
        transport = remote_smtp
        verify_only = true
        domains = *
        condition = ${if match{$authenticated_id}{\@}{1}{0}}

---

CategoryHowTo