Re: ZAPA: Re: [EXIM] IP spoofing

Top Page
Delete this message
Reply to this message
Author: Marilyn Davis
Date:  
To: zapa
CC: marilyn, exim-users
Subject: Re: ZAPA: Re: [EXIM] IP spoofing

Thank you Jeffrey,

> On Fri, 7 May 1999, Marilyn Davis wrote:
>
> > But this from Peter Lister worries me:
> >
> > > If I understand you correctly, you wish to check IP
> > > addresses (i.e. the 32 bit number not the domain name) - I take it you
> > > know that there is frequently very little relation between the two.
>
> > Can you explain how it legitimately happens that IP addresses and
> > domain names aren't related?
>
> I'm not entirely sure what you are asking or what Pete said (I didn't see
> his message).


You're right on in your answers though.

>
> First there is a shocking number of hosts sending mail without proper
> reverse (PTR) lookups. So there are legitimate, but misconfigured,
> mailhubs for which you can't map from IP address to any domain name.
>
> Secondly, it must be noted that addresses and names constitute a many to
> many relationship. A single name can have multiple IP addresses:
>
> % nslookup www.pgp.net
> Name:    www.pgp.net
> Addresses:  128.232.0.23, 129.242.4.248, 129.142.64.11, 131.234.116.2
>           129.132.119.131, 209.151.24.2, 195.64.0.35

>


This is the direction I'm thinking of going. I'm thinking that I
could modify exim so that it does an nslookup on the domain name of the
incoming mail. I can parse the results and also parse the headers
and if I don't find a match, reject the mail.

> And a single IP address can be associated with a large number of names.
>
> Also a single host can have serveral IP addresses (often WWW virtual
> hosting is done that way).
>
> But I am not sure if PRL is referring to other sorts of things.
>
> > > ObExim: should exim really worry about this? IMO it ought to leave blocking
> > > source routed stuff to the OS and/or network infrastructure.
> >
> > I'd say yes. Exim should worry about it.
>
> I agree. In principle, of course, these should be handled at by the OS
> and/or the networking boxes. But it is useful to have this also
> configurable for particular services.


My sysadmin tells me that the OS is a good place for it because the
OS handles the TCP. And, he sets a parameter there for this. Am I
making sense?

                                       *
Marilyn                               *
                                     *
                                    *
Marilyn Davis, Ph.D.-------------- * ---- eVote - online polling 

|                                 *       software for email lists:
|                          *     *        eVote-info@??? 

marilyn@???      *   *         
(650) 965-7121 ------------- * * -------- http://www.deliberate.com 
                              *           




>
> -j
>
> -- 
> Jeffrey Goldberg                +44 (0)1234 750 111 x 2826
>  Cranfield Computer Centre      FAX         751 814
>  J.Goldberg@???     http://WWW.Cranfield.ac.uk/public/cc/cc047/
> Relativism is the triumph of authority over truth, convention over justice.

>



--
*** Exim information can be found at http://www.exim.org/ ***