Re: [Exim] SPAM from DHCP users

Page principale
Supprimer ce message
Répondre à ce message
Auteur: Rick Cooper
Date:  
À: exim-users
Sujet: Re: [Exim] SPAM from DHCP users
I have been using the following on a low volume server (Makes it easier to
validate the reject was righteous) and so far so good. I hestitate to post
this because it's obviously not checking the HELO against the ptr but I am
happy being pretty sure the helo name A record(s) is the same as the the IP
that I am connected to. I have no desire to add fuel to the "debate" about
DNS.

#CHECK SENDER IP AGAINST HELO NAME
deny message = You do not appear to be who you say you are. HELO WAS:
$sender_helo_name, HOSTNAME IS: $sender_host_name IP IS
[$sender_host_address] IP SHOULD be: $acl_c0
    sender_domains = !+local_domains
    set acl_c0 = ${lookup dnsdb{a=${extract{1}{
(}{$sender_helo_name}}}{$value}{NO-A-RECORD-FOUND}}
    condition = ${if and {\
                        {!eq{}{$sender_host_address}}\
                        {!eq{}{$sender_helo_name}}\
                        {!match{${lookup dnsdb{a=${extract{1}{
(}{$sender_helo_name}}}{$value}}}{$sender_host_address}}\
                    }\
                    {yes}{no}}

Produces output such as:

2003-06-30 18:20:07 H=pc-30-239-162.las-condes3.pc.metropolis-inter.com
(yahoo.ca) [200.30.239.162] F=<cmadden_il@???> rejected RCPT
<rick@???>: You do not appear to be who you say you are. HELO
WAS: yahoo.ca, HOSTNAME IS: pc-30-239-162.las-condes3.pc.metropolis-inter
com IP IS [200.30.239.162] IP SHOULD be: 66.218.71.198

There is alot of information, to help check the reject, that will be removed
when I put the ACL on the other servers


Rick Cooper
-------Original Message-------

From: Segree, Gareth
Date: Tuesday, July 01, 2003 11:32:51 AM
To: 'exim-users@???'
Subject: [Exim] SPAM from DHCP users

This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.
--
[ Picked text/plain from multipart/alternative ]
Is there some how that I can use exim to verify the host sending a mail in
an attempt to block spammers.
They connect to my mail server and type something like.

Helo compuserve.com

Yet their address is adsl1.earthlink.xxx.xxx.xxx.xxx


--

--

## List details at http://www.exim.org/mailman/listinfo/exim-users Exim
details at http://www.exim.org/ ##




.