Re: mailfront : only allow allow authenticated user address as MAIL FROM (Return-Path) ?

Erwin Hoffmann <[email protected]> Mon, 5 Sep 2016 14:18:33 +0200

Newsgroups	gmane.mail.qmail.general
Message-ID	<[email protected]>

Hi Olivier,

I think I solved that problem partially with my approach 'Mail From: Adress Verification' (MAV).

There is a separate patch against qmail available, though it is part of my former 'Spamcontrol' patch and now -- of course -- s/qmail.

http://fehcom.de/sqmail.html (-> qmail -> MAV).

Best regards.
--eh.


> Am 30.08.2016 um 16:53 schrieb Olivier Mueller <[email protected]>:
> 
> Hi,
> 
> I hope you all had a nice summer !
> 
> I just got a few cases where user accounts were compromised (weak password or hacked pc's + stolen passwords) and then used to send massive spams, for example last night:
> 
> tcpserver: pid 20727 from 195.223.y.y
> tcpserver: ok 20727 omicron:62.48.x.x:25 :195.223.y.y::51731
> mailfront[20727]: SASL AUTH LOGIN username=info sys_username=o67a123
> domain=example.org
> mailfront[20727]: MAIL FROM:<****@comcast.net>
> mailfront[20727]: RCPT TO:<****@yahoo.com>
> mailfront[20727]: RCPT TO:<****@eddy.foamex.com>
> mailfront[20727]: RCPT TO:<****@lifeway.com>
> (....)
> mailfront[20727]: RCPT TO:<****@clorox.com>
> mailfront[20727]: RCPT TO:<****@yahoo.com>
> mailfront[20727]: RCPT TO:<****@yahoo.com>
> 
> 
> As you can see, the "MAIL FROM:" part used as Return-Path is completely forged.  I just checked the docs to try to find a way to prevent this directly with mailfront and its plugins, but with no success yet : have anyone here using mailfront implemented this ? If yes, a short message would be great, thanks !
> 
> Next step would be to check if the Header-"From: " field is also valid, but this would most probably be more complex.
> 
> 
> Kind regards & a nice week to you,
> Olivier
> 
> 

Dr. Erwin Hoffmann | FEHCom | http://www.fehcom.de | PGP Key-Id: EE00CF65

signature.asc (application/pgp-signature, 842 B)