OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: HELO / MAIL FROM vs client
From: Gert-Jan Looy (gjsiemens.nl)
Date: Tue Jul 04 2000 - 08:55:36 CDT

I like your second proposal, rejecting all mail from siemens.nl
which does not come from our internal mail server.

Only... how I do that?
(This machine has only one physical network interface)

Thanks for thinking along!

Johan Almqvist wrote:
>
> On Tue, Jul 04, 2000 at 03:33:01PM +0200, Gert-Jan Looy wrote:
> > Someone connecting from the outside to our firewall-postfix
> > and then sending mail with "MAIL FROM: someonesiemens.nl" ,
> > so that the recipient thinks that the mail really comes
> > from Siemens , which it does not.
> >
> > What I would like is to match the clients real domain with the domain
> > entered in the "helo" and "mail from" entries.
> >
> > Is this possible?
>
> Even if this is possible it isn't a good idea: I, for example, send my
> mail with MAIL FROM: almqvist.net but my machine's name is actually
> (if reverse-lookupped) alpha.lunds.lu.se. Still, I think you might want
> to have this message - and I want to have this envelope sender.
>
> If someone pretends to "live" in your domain, legal action may be an idea.
> On the firewall mailserver, you could also consider rejecting all mail from
> the siemens.nl domain that comes in on the "public interface" - if you are
> sure that no-one of you co-workers at Siemens does what I do as described
> in the paragraph above.
>
> -Johan
> --
> Johan Almqvist