RE: CBV
"Seth Goodman" <[email protected]>
| Newsgroups | gmane.mail.spam.srs.general |
|---|---|
| Message-ID | <[email protected]> |
> From: Seth Goodman > Sent: Saturday, May 08, 2004 5:07 PM > > <...> > I know that most people choose > to shut off VRFY to discourage dictionary attacks, and I don't know how > people feel about turning on EXPN. Replying to my own post: Another thought that _might_ make allowing EXPN more acceptable is to only accept the command _after_ receiving a MAIL FROM:<>, RCPT TO:<...> that passes. This means that the SMTP-client has a valid MAIL FROM: string that came from your outgoing MTA. Even if the MAIL FROM: was harvested from a promiscuous sending account and the CBV passes, expanding the recipient list will only yield the attacker's address who harvested the MAIL FROM:. If the CBV doesn't pass, you simply deny the EXPN command. I don't know if this violates RFC2821, but it does make it safe to permit EXPN under limited circumstances. -- Seth Goodman