Re: [Exim] SMTP Auth doesn't prevent users from sending as o…

Page principale
Supprimer ce message
Répondre à ce message
Auteur: Eric Rutherford
Date:  
À: exim-users
Sujet: Re: [Exim] SMTP Auth doesn't prevent users from sending as other users
what do you mean at ACM time?
i can deny something at any stage by having a bad condition?




> On Fri, 19 Mar 2004, Eric Rutherford wrote:
>
> > does anyone know how to prevent this? its like spoofing but even more
> > convincing because it comes from the real server. is there a way to
> > make sure the name they are sending with is the same as the username
> > they authenticated with?
>
> The name they authenticated with can be saved in $authenticated_id (your
> config seems to do this). So you can check at ACL time:
>
>   deny  message "You must send as the id you authenticate with"
>         authenticated = *
>         condition = ${if eq

{$authenticated_id}{$sender_address_local_part}\
>                     {no}{yes}}

>
> This is off the top of my head, and untested.
>