2013-10-02 147 views
0

我們有一個帶有DirectAdmin面板的服務器,它是exim。它的默認配置喜歡這裏:如何防止欺騙電子郵件帳戶在exim?

http://files.directadmin.com/services/exim.conf

我們得到的電子郵件,例如從[email protected][email protected]它的欺騙:

例子:

1.

Return-path: <[email protected]> 
Envelope-to: [email protected] 
Delivery-date: Thu, 12 Sep 2013 03:15:21 +0200 
Received: from [200.10.67.162] (helo=gmail.com) 
by omega.hoseo.pl with esmtp (Exim 4.80.1) 
(envelope-from <[email protected]>) 
id 1VJvV7-0003OM-UP 
for [email protected]; Thu, 12 Sep 2013 03:15:21 +0200 
Received: from [191.7.129.87] (account [email protected] HELO lyjqnysvr.nfevzzqxeweo.tv) 
by (CommuniGate Pro SMTP 5.2.3) 
with ESMTPA id 125612437 for [email protected]; Wed, 11 Sep 2013 20:17:47 -0500 
Date: Wed, 11 Sep 2013 20:17:47 -0500 
From: <[email protected]> 
X-Mailer: The Bat! (v3.5.25) Home 
X-Priority: 3 (Normal) 
Message-ID: <[email protected]> 
To: <[email protected]> 
Subject: Jestem gotow placic Ci 95 euro za spolecznie uzyteczne prace wykonywane w wolnym czasie 
MIME-Version: 1.0 
Content-Type: text/html; 
charset=iso-8859-2 
Content-Transfer-Encoding: 7bit 
X-Antivirus: avast! (VPS 130911-1, 2013-09-11), Inbound message 
X-Antivirus-Status: Clean 

2.

Return-path: <[email protected]> 
Envelope-to: [email protected] 
Delivery-date: Thu, 12 Sep 2013 02:14:09 +0200 
Received: from [190.235.181.209] 
by omega.hoseo.pl with esmtp (Exim 4.80.1) 
(envelope-from <[email protected]>) 
id 1VJuXw-004BKW-NW 
for [email protected]; Thu, 12 Sep 2013 02:14:09 +0200 
Received: from [113.131.148.117] (helo=zczdtmhvqilhrkl.tnksjy.ru) 
by with esmtpa (Exim 4.69) 
(envelope-from) 
id 1MMSEG-7581uu-1R 
for [email protected]; Thu, 12 Sep 2013 12:13:24 +1200 
Date: Thu, 12 Sep 2013 12:13:24 +1200 
From: <[email protected]> 
X-Mailer: The Bat! (v3.5) Educational 
X-Priority: 3 (Normal) 
Message-ID: <[email protected]> 
To: <[email protected]> 
Subject: Czy chcialbys (chcialabys) pomagac chorym w wolnym czasie i zarabiac minimum 300 euro w tygodniu? 
MIME-Version: 1.0 
Content-Type: text/html; 
charset=Windows-1252 
Content-Transfer-Encoding: 7bit 
X-Antivirus: avast! (VPS 130911-1, 2013-09-11), Inbound message 
X-Antivirus-Status: Clean 

3.

Return-path: <[email protected]> 
Envelope-to: [email protected] 
Delivery-date: Thu, 12 Sep 2013 00:07:26 +0200 
Received: from [181.67.29.61] (helo=gmail.com) 
by omega.hoseo.pl with esmtp (Exim 4.80.1) 
(envelope-from <[email protected]>) 
id 1VJsZJ-003a4R-Rp 
for [email protected]; Thu, 12 Sep 2013 00:07:26 +0200 
Date: Wed, 11 Sep 2013 23:09:57 +0100 
From: <[email protected]> 
To: <[email protected]> 
Subject: Zapraszamy do zarobienia dodatkowo w wolnym czasie minimum 100 euro za godzine. 
X-Mailer: vfvlsvltd 
MIME-Version: 1.0 
Content-Type: text/html; 
charset=unicode 
Content-Transfer-Encoding: 7bit 
X-Antivirus: avast! (VPS 130911-0, 2013-09-11), Inbound message 
X-Antivirus-Status: Clean 

在後綴爲防止這可怎麼辦:

smtpd_recipient_restrictions = [...] 
permit_sasl_authenticated, 
check_sender_access proxy:mysql:/etc/postfix/mysql/mysql_virtual_nosasl.cf, 
[...] 

的第一條規則從誰通過了SASL讓用戶的電子郵件。第二個檢查是否在MAIL FROM中的發件人域是我的域之一。如果是這樣,它將阻止來自554的電子郵件。檢查規則* _限制在第一場比賽結束。因此,如果來自我的域的發件人尚未完成permit_sasl_authenticated,則意味着它不是我的用戶,並且應阻止另一個規則。

DirectAdmin exim.conf如何做到這一點?

回答

0

和更多關於欺騙

當發送SMTP電子郵件,初始連接提供的地址兩條信息: MAIL FROM: - 通常呈現給接收方作爲回覆路徑:頭,但通常不對最終用戶可見[6],默認情況下不進行檢查,發送系統被授權代表該地址發送。 RCPT TO: - 指定電子郵件傳送到哪個電子郵件地址,通常對最終用戶不可見,但可能作爲「Received:」標題的一部分出現在標題中。通過類比傳統的紙質信封,這些有時被稱爲「信封」尋址。[7] 一旦接收郵件服務器通知它接受這兩個項目,發送系統發送「DATA」命令,並且通常發送幾個標題項目,包括: 來自:Joe Q Doe--收件人可見的地址;但是,默認情況下,沒有檢查發送系統被授權代表該地址發送。 回覆:Jane Roe - 同樣不檢查 結果是,電子郵件收件人看到電子郵件已經來自From:標題中的地址;他們有時可能會找到MAIL FROM地址;如果他們回覆電子郵件,它將轉到MAIL FROM:或Reply-to:標題中顯示的地址 - 但這些地址都不可靠。[8] 此外,郵件服務器可能無法檢查這些域是否已在DNS中註冊並被配置爲接收電子郵件。如果生成回覆,這可能會產生反向散射。