Re: [exim] Exim v4.72 - authenticating to server without hav…

Kezdőlap
Üzenet törlése
Válasz az üzenetre
Szerző: Graeme Fowler
Dátum:  
Címzett: Juergen Edner
CC: exim-users
Tárgy: Re: [exim] Exim v4.72 - authenticating to server without having a valid account
On Wed, 2010-09-08 at 19:33 +0200, Juergen Edner wrote:
> thank you for that hint. Unfortunately it's not always the same
> IP address. Based on a friends log file 145 different addresses
> have been used until now.
> One my friends pointed me to the following thread which exactly
> describes the same problem:
>
> http://blog.windfluechter.net/content/getting-hit-spammer-exim


You did see this reply, didn't you?

http://lists.exim.org/lurker/message/20100907.201156.8e7345b2.en.html

The problem here is that there's a plethora of pages describing Exim
configuration out there, most of which are nothing whatsoever to do with
Exim itself having been put there by enthusiasts - not that there's
anything wrong with this.

However, if someone put up something with a corner case like you have,
and it became widely accepted, then spammers are going to learn sooner
or later that trying an invalid user with a NULL password might work.

I'll make a point of checking the docs and the wiki to ensure it isn't
coming from here, but you need to make the changes described above.

In terms of it being a "bug" - it isn't. It's a misconfiguration, and
now we need to determine where that came from.

Graeme