Hi Tim
THanks for thre reply.
Interesting approach this! Hadn't thought of it, but its quite true.
Just one or two questions:
- I take it this covers EHLO greetings as well?
- the /etc/exim/blocked_helos in the first example, I'm not clear on
what goes in that file. From the condition that looks like it will
block all mail that doesn't have a hostname in the file?
On Tue, 2004-01-20 at 09:57, Tim Jackson wrote:
> Hi Konrad, on Tue, 20 Jan 2004 09:41:18 +0000 you wrote:
>
> > So what I was wondering was whether anyone know of any more
> > comprehensive list of dynamic IP address ranges:
>
> SORBS have one. However, before you do that, have you done any HELO
> checks? There have been many examples posted here but a couple which I've
> found are quite effective (especially against the stuff coming from DSL
> lines) and "cheap" to do are:
>
> # Forged hostname - HELOs as my own hostname or domain
> deny message = Forged hostname detected in HELO:$sender_helo_name
> hosts = !+relay_from_hosts
> !authenticated = *
> condition = ${lookup {$sender_helo_name} \
> lsearch{/etc/exim/blocked_helos}{yes}{no}}
>
>
> where /etc/exim/blocked_helos contains a list of hostnames associated with
> my server. (i.e. any hostnames which have an A to its IP address and are
> used in MX records)
>
> also:
>
> # Forged hostname - HELOs as one of my own IPs
>
> deny message = Forged IP detected in HELO: $sender_helo_name
> hosts = !+relay_from_hosts
> !authenticated = *
> condition = ${if \
> eq{$sender_helo_name}{$interface_address}{yes}{no}}
>
>
> I take no credit (or blame ;) for these; they came from this list
> originally. They've been working well for me though.
>
>
> Tim
>
> --
>
> ## List details at http://www.exim.org/mailman/listinfo/exim-users Exim details at http://www.exim.org/ ##
--
***********************************************************
* Konrad Michels
* IT Manager
* Surfkitchen Limited
* +441189298079
***********************************************************
The information contained in this message is confidential. It is
intended solely for the use of the individual or entity to whom it is
addressed and other authorised to receive it. If the reader of this
message is not the intended recipient, you are hereby notified that any
use, copying, dissemination or disclosure of this information is
strictly prohibited. If you are not the intended recipient, please
delete it immediately and contact the sender by e-mail or telephone.
Internet e-mails are not necessarily secure. SurfKitchen accepts no
responsibility either for breaches of confidence that may arise through
the use of this medium or for changes to any e-mail which occur after
the e-mail has been sent.
