On Fri, 14 Dec 2001, Jim Pazarena wrote:
> Following is the header from a virus.
> Notice the viri attempts to tamper with the sender's email address
> by changing ONE letter in the Return-path & "From " line as opposed
> to the correct address in the "From:" line.
>
> Is there any way to trap these differences during smtp to refuse with
> a 550 ?
>
> |From iereford@??? Fri Dec 14 16:08:25 2001
<snip>
> |FROM: The Brigdens <hereford@???>
In Exim 4 you can do this kind of checking more easily. If you happen to
know that it is always the first letter that is different, you could
perhaps write a regular expression to do the comparison. However, if you
want to implement "check that the addresses match except for one letter
in the local part" it would probably be easier to write the logic in C
and use Exim 4's facility for running a locally-supplied C function as
the final check before accepting a message.
--
Philip Hazel University of Cambridge Computing Service,
ph10@??? Cambridge, England. Phone: +44 1223 334714.
