On Wed, 13 Mar 1996, John Henders wrote:
> As you say, I can't see any way to assure that MAIL FROM agrees with the
> incoming connection, but setting policy on what sites can connect to
> your mailer and send mail to a non-local address is still useful.
Indeed. I will (in due course) provide some features.
> > Such as stopping students using Telnet to forge mail?
>
> I thought about ways to stop this here as well, and there isn't any, as
> you say. The only thing I've found useful for this is identd, and
> clearly putting the ident user in the header. As well, exim already does
> the right thing by greeting the user with the identd lookup and the real
> IP they come from, as I would imagine a forger seeing this would seek
> elsewhere for a less perceptive mailer to spoof.
That was the intention!
> Liberal use of Appearantly-from: headers should help to.
Er, um. After some discussion I'm going to remove the Apparently-From
headers, since apparently (ho, ho) they are no longer the done thing.
Exim will just stuff in a From: header instead. Note that by default it
already puts Return-Path in locally delivered messages, and this
contains the envelope (i.e. MAIL FROM) sender, so you can see what it
was even if From: says something else.
--
Philip Hazel University Computing Service,
ph10@??? New Museums Site, Cambridge CB2 3QG,
P.Hazel@??? England. Phone: +44 1223 334714
