Author: Charlie Date: To: \"Exim-users\" Subject: Re: [exim] How do ISP's restrict access without authentication
Thanks everyone for your replies, and sorry for the late reply.
So, here is my problem.
I need to be able to authenticate traffic that is automatically being routed
to my mail server from a hotel's network.
I have the hotel's IP address, so I can authenticate based on that. I cannot
authenticate based on any sort of username/password, because the SMTP
redirection software they use cannot properly adjust these values to match
what we need.
The problem is that authentication based solely on IP address is not good
enough, because within a few days, the mail server is 'discovered' by
Chinese spammers. We've also tried the same thing with an entirely different
hotel (and the different IP address). This was also discovered as being a
mail server that authenticates solely by IP address, and was quickly spammed
by the Chinese spammers (using a forged IP address).
My question is this - is there anything I can do properly authenticate this
SMTP traffic?
On 2009-10-26 13:33, Charlie wrote: > Hi,
> I was wondering how exactly ISP's - that don't require authentication -
> manage to restrict access to their customers only.
> I know that Exim can restrict access by IP address, but IP addresses can
> be
> spoofed (and very often are spoofed by automated scanners which search for
> SMTP servers that are open in this way).
> How then, do ISP's manage to prevent their servers from being abused?
> In other words, if an ISP only authenticates based on IP address, then
> surely that would leave their server open to abuse.
> The answer to this question will help me a lot.
> Thanks
>
>
>
