Postfix whitelist podruhe

[Jan Dušátko]

Zdravim
nedavno jsem se ptal na konfiguraci postfix whitelistu. Mam ponekud 
paranoidni(restriktivni) nastaveni, prestze to neni prehnane, mam 
obcas problemy s prijmem posty. Bohuzel spousta postovnich uradu nema
zaznam v DNS(adresa, reverzni zaznam, MX zaznam). V ramci moznosti
vyuzivam kontrolu na spamlisty atd. Problem je v tom, ze se snazim
nakonfigurovat whitelist (misto kde bych zapsal seznam domen), 
bohuzel mam nekde nejaky problem. Bohuzel, neco mam spatne, protoze
mi postfix mirne propousti. Napada nekoho, kde by mohla byt chyba ?

Dle rady jsem zkusil vyuzit maximum informaci z dokumentace 
http://www.postfix.org/documentation.html

kontrola na domeny je senders, hello a recipients access udelana
nasledujicim zpusobem (zatim symlinky):

tiscali.cz			whitelist
volny.cz                whitelist
*                       all_restrictive

main.cf obsahuje nasledujici nastaveni:

queue_directory = /var/spool/postfix
command_directory = /usr/local/sbin
daemon_directory = /usr/local/libexec/postfix
sendmail_path = /usr/local/sbin/sendmail
newaliases_path = /usr/local/bin/newaliases
mailq_path = /usr/local/bin/mailq
setgid_group = maildrop
html_directory = no
manpage_directory = /usr/local/man
sample_directory = /usr/local/etc/postfix
readme_directory = no
mail_owner = postfix
inet_interfaces = all
inet_protocols = all
myhostname = gw.domain0.cz
myhostname0 = mail.domain0.cz
myhostname1 = mail.domain1.cz
myhostname2 = mail.domain3.cz
mydomain0 = domain0.cz
mydomain1 = domain1.cz
mydomain1 = domain3.cz
myorigin = $myhostname0
mydestination = proxy.domain0.cz
mynetworks = 192.168.127.0/24, 127.0.0.0/8
mynetworks_style = host
relay_domains = $myhostname0, $myshostname1, $myhostname2, $mydomain0,
$mydomain1, $mydomain2
relayhost = 192.168.127.5
internal_mail = 192.168.127.5
alias_maps = ldap:/usr/local/etc/openldap/ldap.conf
header_checks = regexp:$config_directory/header_checks
smtpd_restriction_classes = all_restrictive, whitelist
all_restrictive =
      reject_non_fqdn_sender
      reject_unknown_sender_domain
      reject_non_fqdn_recipient
      reject_unknown_recipient_domain
      reject_invalid_hostname
      reject_non_fqdn_hostname
      reject_unknown_hostname
whitelist =
      permit_non_fqdn_sender
      permit_unknown_sender_domain
      permit_non_fqdn_recipient
      permit_unknown_recipient_domain
      permit_invalid_hostname
      permit_non_fqdn_hostname
      permit_unknown_hostname
smtpd_sender_restrictions =
      permit_mynetworks
	check_sender_access hash:/usr/local/etc/postfix/sender_access
smtpd_recipient_restrictions =
      permit_mynetworks
      permit_auth_destination
      permit_mx_backup
      reject_unauth_destination
	check_recipient_access hash:/usr/local/etc/postfix/recipient_access
smtpd_helo_restrictions =
      permit_mynetworks
	check_helo_access hash:/usr/local/etc/postfix/helo_access
smtpd_client_restrictions =
      permit_mynetworks
      reject_unauth_pipelining
      reject_unauth_destination
      reject_rbl_client bl.spamcop.net
      reject_rbl_client sbl-xbl.spamhaus.org
      reject_rbl_client combined.njabl.org
      reject_rbl_client list.dsbl.org
      reject_rbl_client relays.ordb.org
      reject_rbl_client opm.blitzed.org
      reject_rbl_client cbl.abuseat.org
      reject_rbl_client ipwhois.rfc-ignorant.org
      reject_rbl_client dialups.visi.com
smtpd_data_restrictions =
      permit_mynetworks
      permit_sasl_authenticated
      reject_unauth_pipelining
smtpd_delay_reject = yes
smtpd_helo_required = yes
disable_vrfy_command = yes
transport_maps = hash:$config_directory/transport
smtpd_banner = $myhostname0 Microsoft ESMTP MAIL Service, Version:
5.0.2195.6713 ready
debug_peer_level = 2
debugger_command =
      PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
      xxgdb $daemon_directory/$process_name $process_id & sleep 5
unknown_local_recipient_reject_code = 450