Practice
I experienced firsthand one spammer trick: when, during the SMTP session with the receiving server, they declare one return address in the "MAIL FROM" command (for example, a real one), and in the body of the letter, in the "From" header, specify the same return address as the one they are sending the letter to (or simply one from your domain).
It turns out that:
a) The SMTP server itself receiving the mail (any one, not necessarily Exim) sees that the letter did not come from its own internal domain (based on the MAIL FROM record), does not require SMTP authorization in that case, and accepts the letter.
b) And the SpamAssassin daemon, later parsing the letter, sees the header "From = address from your domain" and, since most admins have their own domain whitelisted in SpamAssassin (i.e. mail whose From domain is the organization's mail domain), SpamAssassin lets this mail through.
Here's an example. For the example, your organization's domain is: myfirm.ru. SpamAssassin is configured so that all mail from the domain myfirm.ru is whitelisted, i.e. it doesn't even need to be checked.
Spam arrives at manager@myfirm.ru. And it all looks roughly like this:
1) A letter arrives with
SMTP "MAIL FROM: ";
Header "From: ";
2) Since the domain "kakoitodomen.ru" does not belong to the domains served by the server itself (i.e. it is not "myfirm.ru"), and since the server does not yet see the body of the letter at that point, it lets it all through without SMTP authorization as an ordinary incoming letter from somewhere.
3) Having received the letter, the server passes it to SpamAssassin for checking.
4) SpamAssassin, seeing "From = manager@myfirm.ru" in the header, checks it against the whitelist and sees that letters from "*@myfirm.ru" don't even need to be checked. SpamAssassin pays no attention to the fact that the letter actually came from the mailbox specified in the "From" header.
5) SpamAssassin says the letter is not spam (based on the From data) and the SMTP server successfully places this letter in the inbox folder for manager@myfirm.ru.
What we end up with: the letter is spam, the spammer deceived both the SMTP server and SpamAssassin, and the letter was successfully delivered to the person's inbox. Without even being checked!
Let's teach the Exim server (I'm giving the config specifically for it here) to compare these values and reject the letter if:
a) The letter came from a domain served by the server (an internal domain);
b) In the body of the letter the domains of the From and Return-path fields are not equal:
we add the following entry to the acl_check_data section:
In this piece of code you can see that the last comparison is based on a MySQL query. This is valid for Exim configured to use a MySQL database to store information about users and served domains.
In this particular case, the condition triggers if MySQL finds, in the database, in the "domains" table, in the "domain" column, a domain name matching the domain from the "From" header, while the "Active" column must contain "1" - i.e. work with this domain is not blocked.
For your specific configuration, of course, the last condition may differ slightly. Its point is to check that the domain from the "From" header is served by this server.
For example, if the server serves only a single domain and is not configured to store domain information in MySQL, the whole block might look like this:
This way we will deny spammers the ability to deceive our servers and send their garbage.
Comments