debian etch + exim + аутентификация локальных пользователей

а нарисуй сюда роутеры (только освой плиз преформаттед текст)

сдается мне, что в ацл отрабатывает правило которое релеит для твоих доменов, оно стоит до аутентификации, вот это

accept .ifndef CHECK_RCPT_POSTMASTER local_parts = postmaster .else local_parts = CHECK_RCPT_POSTMASTER .endif domains = +local_domains : +relay_to_domains

тьфу блин, сам забыл, советчик :)

  accept
    .ifndef CHECK_RCPT_POSTMASTER
    local_parts = postmaster
    .else
    local_parts = CHECK_RCPT_POSTMASTER
    .endif
    domains = +local_domains : +relay_to_domains

роутеры.

/etc/exim4/conf.d/router/01_mysql_config:

system_aliases:
    driver = redirect
    allow_fail
    allow_defer
    data = ${lookup mysql{SELECT recipients FROM aliases \
	                    WHERE local_part='${local_part}' AND domain='${domain}'}}
		    
userforward:
    driver = redirect
    allow_fail
    allow_defer
    data = ${lookup mysql{SELECT recipients FROM userforward \
                            WHERE local_part='${local_part}' AND domain='${domain}'}}
									
mysqluser:
    driver = accept
    condition = ${if eq{} {${lookup mysql{SELECT home FROM users \
	                    WHERE id='${local_part}' AND mbox_host='${domain}' \
	                    AND active='Y'}}}{no}{yes}}
    transport = mysql_delivery


И сразу транспорт:
/etc/exim4/conf.d/transport/01_exim_mysql:

mysql_delivery:
    driver = appendfile
    check_string = ""
    create_directory
    delivery_date_add
    directory = ${lookup mysql{SELECT CONCAT(home, "/", id, "@", mbox_host) FROM users \
                                WHERE id='${local_part}' AND mbox_host='${domain}'}}
    directory_mode = 770
    envelope_to_add
    group = dovecot
    maildir_format
    maildir_tag = ,S=$message_size
    message_prefix = ""
    message_suffix = ""
    mode = 0660
    quota = ${lookup mysql{SELECT quota FROM users \
                WHERE id='${local_part}' AND mbox_host='${domain}'}{${value}M}}
    quota_size_regex = S=(\d+)$
    quota_warn_threshold = 75%
    return_path_add


И еще на всякий случай /etc/exim4/conf.d/main/00_localmacross:

MAIN_TLS_ENABLE = false
AUTH_SERVER_ALLOW_NOTLS_PASSWORDS = true

MAILDIR_HOME_DIRECTORY_MODE = 770
MAILDIR_HOME_MODE = 660
MAILDIR_HOME_MAILDIR_LOCATION = /var/spool/mail/$local_part@$domain

CHECK_RCPT_LOCAL_ACL_FILE = /etc/exim4/conf.d/acl/rcpt_local_acl
CHECK_MAIL_HELO_ISSUED = true
HELO_ALLOW_CHARS = _

CHECK_RCPT_IP_DNSBLS = cbl.abuseat.org:bl.spamcop.net:list.dsbl.org:dnsbl.sorbs.net:dnsbl.njabl.org:du
l.ru

/etc/exim4/conf.d/acl/rcpt_local_acl:

accept  authenticated = *

deny message  = "This server does not accept mail from relays with dynamic ip"
condition     = ${if match{$sender_host_name} \
		{adsl|dialup|pool|peer|dhcp|dynamic} \
		{yes}{no}}

Может кому пригодится - пока сделал так:

.ifdef LOCAL_USERS_MUST_AUTH
    deny message  = "Even local users need to authenticate!"
    hosts         = *:!+relay_from_hosts
    !authenticated = *
    condition       = ${ if match_domain{$sender_address_domain}{abc.ru:xyz.ru}{yes}{no} }
.endif

Может можно как-то более изящно и правильно?