Re: Need help solving a Sender/From address dilemma

Hi,

On Thu, 29 Apr 2010 10:08:17 am Russell Robinson wrote:
> Here's my solution for Exim.  It seems to work quite well.

Just a clarification of what the solution does and what it *does not* do.

Since implementing it, it has blocked 6 of these types of spam and allowed one through.

Exim's helo_try_verify_hosts (the "try" simply means it doesn't immediately fail and therefore can be tested later in an acl) checks that the host name given in the HELO or EHLO command either:
is an literal IP address matching the calling address of the host (I presume they mean TCP remote connetion address), or
matches the host name that Exim obtains by doing a reverse lookup of the calling host address, or 
when looked up using gethostbyname() (or getipnodebyname() when available) yields the calling host address.

In other words, I would expect amazon.com (gmail.com, hotmail.com, etc.) to send me emails from a host that obeys one of the above conditions.

An example of spam that got blocked is was from host:
	(abecha.com) [188.218.144.142]

Sure enough, if you test the IP address 188.218.144.142 it doesn't pass the above tests.

The spam that got through was from host:
	(93-81-62-13.broadband.corbina.ru) [93.81.62.13]

This passes the tests and so it got through.

Note that I'm not actually testing whether this is an amazon server or that it has anything to do with the From address.

The next step, therefore, would be to grab the actual connecting host name and check that it comes from the From address's domain or matches "amazon" in some way.

That is, From "[email protected]" is sent by host "somehost.amazon.com".

The *problem* with that logic is it's wrong.

It's perfectly reasonable for From "[email protected]" to be sent by host "somehost.amazon.net", or even a complete third party host (host.mailforwarding-company.net).

Perhaps testing the sender's (Return-path) address against the connecting host is a better way?

Any comments or suggestions?

Jason replied:
> but i'd wager that if you look at the headers of that message, you'll
> see it was sent from a non-Amazon mail server. that's how you tell the
> legitimate messages apart from the forgeries. it's something your MTA
> can decipher; it can compare the return-path address with the server
> that is trying to send the message to you. real amazon.com email will be
> sent from an *.amazon.com server. the same is true for other large sites
> like gmail, hotmail, AOL, etc. i've been doing this for years under
> Postifx using a method similar to this:

So, you could be blocking legitimate email, right?

In practice, maybe not, but certainly possible.  (And you would not find out if amazon changed it's method of sending - the mail would be blocked silently.)

-- 
Russell Robinson ([email protected])

------------------------------------------------------------------------------

_______________________________________________
tmda-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tmda-users