0

We have a server with DirectAdmin panel where is exim. It's default configuration like here:

http://files.directadmin.com/services/exim.conf

We get e-mails for example from kontakt@hoseo.pl to kontakt@hoseo.pl it's spoofed:

Examples:

1.

Return-path: <nickedc@gmail.com>
Envelope-to: kontakt@hoseo.pl
Delivery-date: Thu, 12 Sep 2013 03:15:21 +0200
Received: from [200.10.67.162] (helo=gmail.com)
by omega.hoseo.pl with esmtp (Exim 4.80.1)
(envelope-from <nickedc@gmail.com>)
id 1VJvV7-0003OM-UP
for kontakt@hoseo.pl; Thu, 12 Sep 2013 03:15:21 +0200
Received: from [191.7.129.87] (account quadrennial16@gmail.com HELO lyjqnysvr.nfevzzqxeweo.tv)
by (CommuniGate Pro SMTP 5.2.3)
with ESMTPA id 125612437 for kontakt@hoseo.pl; Wed, 11 Sep 2013 20:17:47 -0500
Date: Wed, 11 Sep 2013 20:17:47 -0500
From: <kontakt@hoseo.pl>
X-Mailer: The Bat! (v3.5.25) Home
X-Priority: 3 (Normal)
Message-ID: <9925188213.R1G0JAD6616751@hfvnvpdpni.dahsrtr.ru>
To: <kontakt@hoseo.pl>
Subject: Jestem gotow placic Ci 95 euro za spolecznie uzyteczne prace wykonywane w wolnym czasie 
MIME-Version: 1.0
Content-Type: text/html;
charset=iso-8859-2
Content-Transfer-Encoding: 7bit
X-Antivirus: avast! (VPS 130911-1, 2013-09-11), Inbound message
X-Antivirus-Status: Clean

2.

Return-path: <dishwashersd333@google.com>
Envelope-to: kontakt@hoseo.pl
Delivery-date: Thu, 12 Sep 2013 02:14:09 +0200
Received: from [190.235.181.209]
by omega.hoseo.pl with esmtp (Exim 4.80.1)
(envelope-from <dishwashersd333@google.com>)
id 1VJuXw-004BKW-NW
for kontakt@hoseo.pl; Thu, 12 Sep 2013 02:14:09 +0200
Received: from [113.131.148.117] (helo=zczdtmhvqilhrkl.tnksjy.ru)
by with esmtpa (Exim 4.69)
(envelope-from )
id 1MMSEG-7581uu-1R
for kontakt@hoseo.pl; Thu, 12 Sep 2013 12:13:24 +1200
Date: Thu, 12 Sep 2013 12:13:24 +1200
From: <kontakt@hoseo.pl>
X-Mailer: The Bat! (v3.5) Educational
X-Priority: 3 (Normal)
Message-ID: <5655874272.ZBYQ02EL661445@ukcchbjmedjown.tboxgld.tv>
To: <kontakt@hoseo.pl>
Subject: Czy chcialbys (chcialabys) pomagac chorym w wolnym czasie i zarabiac minimum 300 euro w tygodniu? 
MIME-Version: 1.0
Content-Type: text/html;
charset=Windows-1252
Content-Transfer-Encoding: 7bit
X-Antivirus: avast! (VPS 130911-1, 2013-09-11), Inbound message
X-Antivirus-Status: Clean

3.

Return-path: <walesg61@gmail.com>
Envelope-to: kontakt@hoseo.pl
Delivery-date: Thu, 12 Sep 2013 00:07:26 +0200
Received: from [181.67.29.61] (helo=gmail.com)
by omega.hoseo.pl with esmtp (Exim 4.80.1)
(envelope-from <walesg61@gmail.com>)
id 1VJsZJ-003a4R-Rp
for kontakt@hoseo.pl; Thu, 12 Sep 2013 00:07:26 +0200
Date: Wed, 11 Sep 2013 23:09:57 +0100
From: <kontakt@hoseo.pl>
To: <kontakt@hoseo.pl>
Subject: Zapraszamy do zarobienia dodatkowo w wolnym czasie minimum 100 euro za godzine. 
X-Mailer: vfvlsvltd
MIME-Version: 1.0
Content-Type: text/html;
charset=unicode
Content-Transfer-Encoding: 7bit
X-Antivirus: avast! (VPS 130911-0, 2013-09-11), Inbound message
X-Antivirus-Status: Clean

In Postfix to prevent this can do:

smtpd_recipient_restrictions = [...]
permit_sasl_authenticated,
check_sender_access proxy:mysql:/etc/postfix/mysql/mysql_virtual_nosasl.cf,
[...]

The first rule lets emails from users who have gone through SASL. The second checks to see if the sender's domain in the MAIL FROM is one of my domains. If so, it will block email from 554 Checking rules * _restrictions ends on the first match. So if the sender from my domain has not completed the permit_sasl_authenticated, it means that it is not my user and another rule should be blocked.

How do this with DirectAdmin exim.conf?

Lukas
  • 1
  • 2

1 Answers1

0

and more about spoofing

When an SMTP email is sent, the initial connection provides two pieces of address information: MAIL FROM: - generally presented to the recipient as the Return-path: header but not normally visible to the end user,[6] and by default no checks are done that the sending system is authorized to send on behalf of that address. RCPT TO: - specifies which email address the email is delivered to, is not normally visible to the end user but may be present in the headers as part of the "Received:" header. Together these are sometimes referred to as the "envelope" addressing, by analogy with a traditional paper envelope.[7] Once the receiving mail server signals that it accepted these two items, the sending system sends the "DATA" command, and typically sends several header items, including: From: Joe Q Doe - the address visible to the recipient; but again, by default no checks are done that the sending system is authorized to send on behalf of that address. Reply-to: Jane Roe - similarly not checked The result is that the email recipient sees the email as having come from the address in the From: header; they may sometimes be able to find the MAIL FROM address; and if they reply to the email it will go to either the address presented in the MAIL FROM: or Reply-to: header - but none of these addresses are typically reliable.[8] Furthermore the mail server may not check that these domains have been registered in the DNS and are configured to receive emails. This may generate backscatter if a reply is generated.

user3475897
  • 1
  • 1