Subject: Re: pppoe(4) man page in conjunction with Postfix leaves gaping
To: Wolfgang S. Rupprecht <wolfgang+gnus20031001T202141@wsrcc.com>
From: Greg Troxel <gdt@ir.bbn.com>
List: tech-userlevel
Date: 10/02/2003 08:32:01
    From: wolfgang+gnus20031001T202141@wsrcc.com (Wolfgang  S. Rupprecht)

    mynetworks = 127.0.0.1/32, [::1/128]

I basically agree, but this is perhaps a little tight; I would accept
the IP addresses (not networks) actually configured on interfaces.
But I suppose this only matters if people set their own IP address
instead of 127.0.0.1 as a SMTP server.

Being a bit stronger than Wolfgang:

Postfix is *broken* to accept relaying from any address that does not
belong to the local machine.  The notion that the local net can
generally be trusted is simply untenable, and relaying for it - be it
a /30, a /24 or a /8 - should only be turned on by a conscious
decision to do so.

I have to fix this every time I configure postfix; many of my machines
are on networks where I don't wish to trust the rest of the machines.

Whether or not the netmask for the pppoe device ought to be
changed/fixed is another story; netmasks are not particularly
semantically meaningful for PPP devices, and thus arguably /32 makes
sense.  But this is really quite separable from the postfix issue.

-- 
        Greg Troxel <gdt@ir.bbn.com>