Hello List! Im in desperate need for an SMTP proxy. Well, not just another proxy, it needs basically to do this: - Listen on external interface, port 25 - If mail arrives, check the DESTINATION address of the delivered email and verify that against a list of valid destination addresses - If the RCPT TO is valid* (in "allowed" list), then the proxy should relay the mail to an internal server - If RCPT TO is not a valid* one (e.x. spam_victimXY@hotmail.com), then it should drop the mail and close the spammer's connection. Is there such a program? I can imagine one could do that as a netfilter module...its a shame I cant code in C. :( The other approach I can think of would be AMAVIS maybe? That would be neat too, then it would have integrated virus protection. So, can AMAVIS do *exactly as I need (described above) ? Or is there some simpler solution (the more simple, the better because this is for a packet filter, that y I tought of a netfilter module) that would provide me with the needed features? help and ty :) Chris Burri jun. Systems & Network Engineer Synecta Informatik AG Zwinglistrasse 3 CH-9000 St. Gallen .-. /v\ L I N U X // \\ >Phear the Penguin< /( )\ ^^-^^ * valid and not valid: if a site has an email server and hosts domains on it, then one can say that an email, coming in on the external public IP of the site should have an email address that ends in one of the domains the site actually hosts, unless the mail was either sent in error, or it is a spam MAIL (some corporate level groupware servers are notoriously vulnerable to SPAM under certain conditions). Example for Site "dontlikespam.org" : If mail comes in on external interface, with an RCPT TO of "sales@dontlikespam.org", then it should be passed thru. If mail comes in on external interface, with an RCPT TO of "john.doe@dontlikespam.org", then it should be passed. If mail comes in on external interface, with an RCPT TO of "somebody@hotmail.com", then it should be blocked, and the connection that feeds the mail shall be dropped. in the "allow" list, there would be one entry like "dontlikespam.org" The RCPT TO must be checked strictly. Means, relay@hotmail.com% @dontlikespam.org must not circumvent it. Maybe there should be a keyword in the config file to disable (default is on) strict checking. Outgoing mail comes from internal interface and will not be tested. Externals connecting from remote sites either use dial-up and thus come from internal interface, or they use a VPN and thus wont appear on the external interface either.
On Fri, 2 Mar 2001 christian.burri@synecta.ch wrote:
- Listen on external interface, port 25 - If mail arrives, check the DESTINATION address of the delivered email and verify that against a list of valid destination addresses - If the RCPT TO is valid* (in "allowed" list), then the proxy should relay the mail to an internal server - If RCPT TO is not a valid* one (e.x. spam_victimXY@hotmail.com), then it should drop the mail and close the spammer's connection.
The other approach I can think of would be AMAVIS maybe? That would be neat too, then it would have integrated virus protection. So, can AMAVIS do *exactly as I need (described above) ? Or is there some No, that's somehwat beyond the scope of amavis, I'm afraid. Hum, what about postfix, ORBS/RBL and such? Wouldn't it full-fill most of your requirements? Or maybe perl-esmtpd (http://perl-esmtpd.sourceforge.net/), but I never used it.
HTH best regards, Rainer Link -- Rainer Link | SuSE - The Linux Experts link@suse.de | Developer of A Mail Virus Scanner (amavis.org) www.suse.de | Founder OpenAntiVirus Project (www.openantivirus.org)
Postfix.
Kurt Seifried, seifried@securityportal.com
Securityportal - your focal point for security on the 'net
----- Original Message -----
From:
Hello List!
Im in desperate need for an SMTP proxy. Well, not just another proxy, it needs basically to do this:
- Listen on external interface, port 25
- If mail arrives, check the DESTINATION address of the delivered email and verify that against a list of valid destination addresses
- If the RCPT TO is valid* (in "allowed" list), then the proxy should relay the mail to an internal server
- If RCPT TO is not a valid* one (e.x. spam_victimXY@hotmail.com), then it should drop the mail and close the spammer's connection.
Is there such a program? I can imagine one could do that as a netfilter module...its a shame I cant code in C. :(
The other approach I can think of would be AMAVIS maybe? That would be neat too, then it would have integrated virus protection. So, can AMAVIS do *exactly as I need (described above) ? Or is there some simpler solution (the more simple, the better because this is for a packet filter, that y I tought of a netfilter module) that would provide me with the needed features?
help and ty :)
Chris Burri jun. Systems & Network Engineer Synecta Informatik AG Zwinglistrasse 3 CH-9000 St. Gallen
.-. /v\ L I N U X // \\ >Phear the Penguin< /( )\ ^^-^^
* valid and not valid:
if a site has an email server and hosts domains on it, then one can say that an email, coming in on the external public IP of the site should have an email address that ends in one of the domains the site actually hosts, unless the mail was either sent in error, or it is a spam MAIL (some corporate level groupware servers are notoriously vulnerable to SPAM under certain conditions).
Example for Site "dontlikespam.org" :
If mail comes in on external interface, with an RCPT TO of "sales@dontlikespam.org", then it should be passed thru. If mail comes in on external interface, with an RCPT TO of "john.doe@dontlikespam.org", then it should be passed. If mail comes in on external interface, with an RCPT TO of "somebody@hotmail.com", then it should be blocked, and the connection that feeds the mail shall be dropped.
in the "allow" list, there would be one entry like "dontlikespam.org"
The RCPT TO must be checked strictly. Means, relay@hotmail.com% @dontlikespam.org must not circumvent it. Maybe there should be a keyword in the config file to disable (default is on) strict checking.
Outgoing mail comes from internal interface and will not be tested.
Externals connecting from remote sites either use dial-up and thus come from internal interface, or they use a VPN and thus wont appear on the external interface either.
--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com
At 06:12 AM 3/03/2001, you wrote:
Hello List!
Im in desperate need for an SMTP proxy. Well, not just another proxy, it needs basically to do this:
- Listen on external interface, port 25
- If mail arrives, check the DESTINATION address of the delivered email and verify that against a list of valid destination addresses
- If the RCPT TO is valid* (in "allowed" list), then the proxy should relay the mail to an internal server
- If RCPT TO is not a valid* one (e.x. spam_victimXY@hotmail.com), then it should drop the mail and close the spammer's connection.
Is there such a program? --snip--
This is exactly what Obtuse SMTPD was designed to do. It is on the SuSE cd's in the "sec" section, labeled "smtpd" Check out www.obtuse.com for more info. I have it running happily sitting in front of both Postfix and Sendmail. I hear you cen even use qmail if you so desire as a backend. Cheers --- Nix - nix@susesecurity.com http://www.susesecurity.com
On Mon, 5 Mar 2001, Nix wrote:
At 06:12 AM 3/03/2001, you wrote:
Im in desperate need for an SMTP proxy. Well, not just another proxy, it needs basically to do this: [cut] This is exactly what Obtuse SMTPD was designed to do. It is on the SuSE cd's in the "sec" section, labeled "smtpd" Check out www.obtuse.com for more info. I have it running happily sitting in front of both Postfix and Sendmail. I hear you cen even use qmail if you so desire as a backend. Yes, you can. But STRIP_QUOTES=1 has to be set in the Makefile for smtpd/smtpfwdd - so I assume you have to recompile it on your own. I used smtpd one together with AMaViS :-)
best regards, Rainer Link -- Rainer Link | SuSE - The Linux Experts link@suse.de | Developer of A Mail Virus Scanner (amavis.org) www.suse.de | Founder OpenAntiVirus Project (www.openantivirus.org)
Quoting Nix (suse@nix.hispeed.com) on Mon, Mar 05, 2001 at 02:54:24AM +0100:
Im in desperate need for an SMTP proxy. Well, not just another proxy, it needs basically to do this: This is exactly what Obtuse SMTPD was designed to do. It is on the SuSE cd's in the "sec" section, labeled "smtpd" Check out www.obtuse.com for more info. I have it running happily sitting in front of both Postfix and Sendmail. I
I stopped using it. It does not handle Mailer Daemon Bounces with <> Addresses propperly. Apart from that it is quite nice. cheers afx -- atsec information security GmbH Phone: +49-89-44249830 Steinstrasse 68 Fax: +49-89-44249831 D-81667 Muenchen, Germany WWW: www.atsec.com May the Source be with you!
participants (5)
-
Andreas Siegert -
christian.burri＠synecta.ch -
Kurt Seifried -
Nix -
Rainer Link