[prev in list] [next in list] [prev in thread] [next in thread] 

List:       exim-users
Subject:    Re: [exim] implementing a per user white list using Exim
From:       Dave Lugo <dlugo () etherboy ! com>
Date:       2005-04-28 19:32:55
Message-ID: Pine.LNX.4.58.0504281528520.27299 () davepc ! etherboy ! com
[Download RAW message or body]

On Thu, 28 Apr 2005, Marc Sherman wrote:
> 
> Chris Spak wrote:
> > 
> > We would like to implement a "authorized sender" capability, this 
> > would allow our customer to only receive email from people that they
> > have on their white list.
> > 
> > If the incoming message is from someone not on a receiver's white 
> > list then the system would save the email message for 48 hours and 
> > send the sender an
> > 
> > email form to complete.  The sender would need to enter their name 
> > and email address. If the sender responds, the response is then sent 
> > to the receiver for approval to add this person to the white list and
> >  allow the message waiting and future messages to pass through to the
> >  receiver.
> 
> What you're talking about is called challenge/response, and is widely 
> considered to be a very bad idea.  For the most recent discussion on the 
> topic, please read the thread rooted at:
> http://www.exim.org/mail-archives/exim-users/Week-of-Mon-20050321/msg00030.html
> 


The only C/R that I've heard about and that isn't too horrible is 
to perform the rejections at end-of-DATA (ie: fakereject if you'd like), 
and have the rejection text point to a a web page for further info.

Direct-to-MX viruses/trojans are quite unlikely to return those 
rejections to the forged senders.

This still isn't perfect (transparent port 25 redirection, etc), which 
is why applying it to only 'tainted' connections may be preferable to 
doing it for all.


-- 
--------------------------------------------------------
Dave Lugo   dlugo@etherboy.com    LC Unit #260   TINLC
Have you hugged your firewall today?   No spam, thanks.
--------------------------------------------------------
Are you the police?  . . . .  No ma'am, we're sysadmins.

-- 
## List details at http://www.exim.org/mailman/listinfo/exim-users 
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://www.exim.org/eximwiki/
[prev in list] [next in list] [prev in thread] [next in thread]