Re: [exim] Reject servers that use my ip address as EHLO

     * accept if host is in relay_from_hosts list
     * deny if HELO is single word
     * deny if HELO is raw IP address
     * deny if HELO is our host name (attack vector)
     * deny if HELO is from domains that handle (local domains or relay for)
     * deny if HELO is in a local MySQL backlist
     * attempt to verify the HELO FQDN - generates a warning
     * accept everything else

         #
         # report TLS status
         #
         warn    condition = ${if def:tls_in_cipher {1}{0}}
                 logwrite = CRYPTO: Client 
$sender_host_address:$sender_host_port using SSL/TLS cipher: $tls_in_cipher

         #
         # accept for relay_from_hosts
         #
         accept  condition = ${if 
match_domain{$sender_helo_name}{$+relay_from_hosts}{true}{false}}
                 logwrite = HELO: Accepted HELO/EHLO $sender_helo_name 
from remote host: $sender_host_address ${if def:sender_host_name 
{($sender_host_name) }} in hostlist relay_from_hosts

         #
         # check for single word greeting messages like "HELO COMPUTER"
         #
         deny    condition = ${if match {$sender_helo_name} {\\.} {no}{yes}}
                 message = Your HELO/EHLO greeting ($sender_helo_name) 
is a single word. \
                         According to RFC2821 you must use your 
fully-qualified domain-name. \
                         Please fix your configuration if you want to 
talk to us
                 logwrite = HELO: HELO/EHLO was not a FQDN : 
$sender_helo_name from $sender_fullhost

         #
         # check for raw IP address in greeting like "HELO 1.2.3.4"
         #
         deny    condition = ${if isip{$sender_helo_name}}
                 #condition = ${if match 
{$sender_helo_name}{^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\$}{yes}{no}}
                 message = Your HELO/EHLO greeting ($sender_helo_name) 
is a plain IP address. \
                         According to RFC2821 you must use your 
fully-qualified domain-name. \
                         Please fix your configuration if you want to 
talk to us
                 logwrite = HELO: HELO/EHLO with bare IP : 
$sender_helo_name from $sender_fullhost

         #
         # check for HELO from our host name... must be a faker!
         #
         deny    condition = ${if match 
{$sender_helo_name}{$primary_hostname}{true}{false}}
                 message = Your HELO/EHLO greeting ($sender_helo_name) 
is using our name! \
                         According to RFC2821 you must use your 
fully-qualified domain-name. \
                         Please fix your configuration if you want to 
talk to us
                 logwrite = HELO: Rejected because remote host used our 
hostname: $sender_helo_name

         #
         # check for HELO from domains that we handle (local domains and 
relay domains)... if so this is fake
         #
         deny    condition = ${if 
match_domain{$sender_helo_name}{$+local_domains:+relay_to_domains}{true}{false}}
                 message = Your HELO/EHLO greeting ($sender_helo_name) 
is using one of our domains! \
                         According to RFC2821 you must use your 
fully-qualified domain-name. \
                         Please fix your configuration if you want to 
talk to us
                 logwrite = HELO: Rejected because remote host used one 
of our domains: $sender_helo_name

         #
         # check for HELO names blacklisted in our database, if we 
reject don't give too much help as to why
         #
         deny    condition = ${if 
match_domain{$sender_helo_name}{+blacklist_helo}{yes}{no}}
                 message = Your HELO/EHLO is not acceptable here
                 logwrite = HELO: Rejected: $sender_helo_name (from 
$sender_fullhost) - blacklisted in database

         #
         # attempt to verify the HELO/EHLO, if it fails just generate a 
log warning - we cannot reject
         # based on this. See also the check_content ACL where we add a 
warning to headers for invalid HELO
         #
         warn    !verify = helo
                 logwrite = HELO: Could not verify HELO/EHLO: 
$sender_helo_name from remote host: $sender_host_address ${if 
def:sender_host_name {($sender_host_name) }}

         #
         # accept everything else
         #
         accept  message = Hello $sender_helo_name
                 logwrite = HELO: Accepted HELO/EHLO $sender_helo_name 
from remote host: $sender_host_address ${if def:sender_host_name 
{($sender_host_name) }}

> I believe some configuration like
>    deny
>      condition   = ${if isip{$sender_helo_name}}
>      !hosts = PROBLEMFAELLE_HELO
>      message     = Access denied - Invalid HELO name (See RFC2821 4.1.3)
>   # Neither an address literal nor something containing dots
>    deny
>      !hosts = PROBLEMFAELLE_HELO
>      condition   = ${if match{$sender_helo_name}{\N^\[\N}{no}{yes}}
>      condition   = ${if match{$sender_helo_name}{\N\.\N}{no}{yes}}
>      message     = Access denied - Invalid HELO name (See RFC2821 4.1.1.1)

>    warn
>      condition   = ${if match{$sender_helo_name}{\N\.$\N}}
>      log_message = HELO ending with dot
>      set acl_c_greylisting = 1
>    warn
>      condition   = ${if match{$sender_helo_name}{\N\.\.\N}}
>      log_message = HELO contains two subsequent dots.
>      set acl_c_greylisting = 1

>    warn
>      condition = ${if match{$sender_helo_name}{$primary_hostname}}
>      log_message = HELO is MY primary hostname
>      set acl_c_greylisting = 1

>> drop    message     = Bad helo name
>>          condition   = ${if  \
>>                           and{    \
>>                               {isip {$sender_helo_name}}  \
>>                               {match_ip{$sender_helo_name}{@[]}}  \
>>                           }{yes}{no}  \
>>                       }