Gray at 11:02, 11 July 2015

2015-07-11T11:02:17Z

Gray: Created page with "The `mailutils acl` command tests GNU Mailutils access control lists. By default it reads ACL from the Mailutils configiration file section..."

2015-07-11T11:00:21Z

Created page with "The <tt>mailutils acl</tt> command tests GNU Mailutils access control lists. By default it reads ACL from the Mailutils configiration file section..."

New page

The <tt>[[mu|mailutils]] acl</tt> command tests GNU Mailutils [[Access Control List|access control lists]]. By default it reads ACL from the Mailutils configiration file section "acl". The command takes a list of IP addresses as its arguments, applies the ACL to each of these addresses in turn and prints the result.

To select the ACL to test, two options are provided. The <tt>--file</tt> (<tt>-f</tt>) option supplies the name of configuration file to read instead of the default one. The <tt>--path</tt> (<tt>-p</tt>) option supplies the [[path]] to the ACL section to use instead of the default ".acl". For example, to test ACL in section <tt>server 198.51.100.33</tt> of file <tt>/etc/pop3d.conf</tt> use:

mailutils acl --file=/etc/pop3d.conf --path=/server="198.51.100.33"/acl ''address''

As an example of its use, consider file <tt>test.conf</tt> with the following contents:

<nowiki>
acl {
deny from 10.10.10.1;
deny from 10.10.1.0/24;
log from any "Connect from ${address}";
allow from 10.0.0.0/8;
allow from 192.168.1.0/24;
deny from any;
}
</nowiki>

Then, running <tt>mailutils acl --file=test.conf 127.0.0.1</tt> you will get:

Testing 127.0.0.1:
mailutils: Connect from 127.0.0.1
127.0.0.1: deny

More examples:

$ mailutils acl --file=test.conf 127.0.0.1 10.10.10.1 10.10.1.3 10.5.3.1 192.168.1.0 192.168.2.0
Testing 127.0.0.1:
mailutils: Connect from 127.0.0.1
127.0.0.1: deny
Testing 10.10.10.1:
10.10.10.1: deny
Testing 10.10.1.3:
10.10.1.3: deny
Testing 10.5.3.1:
mailutils: Connect from 10.5.3.1
10.5.3.1: accept
Testing 192.168.1.0:
mailutils: Connect from 192.168.1.0
192.168.1.0: accept
Testing 192.168.2.0:
mailutils: Connect from 192.168.2.0
192.168.2.0: accept

The <tt>mailutils</tt> option <tt>--debug-level</tt> will give you a [[Debug_level#acl|deeper insight]] into the address matching algorithm:

$ mailutils --debug-level=acl.trace9 acl --file test.conf 127.0.0.1
Testing 127.0.0.1:
mailutils: Checking sockaddr 127.0.0.1
mailutils: 1:deny: Does 10.10.10.1/255.255.255.255 match 127.0.0.1? no;
mailutils: 2:deny: Does 10.10.1.0/255.255.255.0 match 127.0.0.1? no;
mailutils: 3:log: Does any match 127.0.0.1? yes;
mailutils: Expanding "Connect from ${address}"
mailutils: Expansion: "Connect from 127.0.0.1".
mailutils: Connect from 127.0.0.1
mailutils: 4:accept: Does 10.0.0.0/255.0.0.0 match 127.0.0.1? no;
mailutils: 5:accept: Does 192.168.0.0/255.255.0.0 match 127.0.0.1? no;
mailutils: 6:deny: Does any match 127.0.0.1? yes;
127.0.0.1: deny

== See also ==
* [[mailutils (utility)]]

[[Category:utilities]]

@@ Line 7: / Line 7: @@
 As an example of its use, consider file <tt>test.conf</tt> with the following contents:
-<nowiki>
+ <nowiki>
 acl {
          deny from 10.10.10.1;

Mailutils acl - Revision history

Gray at 11:02, 11 July 2015

Gray: Created page with "The mailutils acl command tests GNU Mailutils access control lists. By default it reads ACL from the Mailutils configiration file section..."

Gray: Created page with "The `mailutils acl` command tests GNU Mailutils access control lists. By default it reads ACL from the Mailutils configiration file section..."