Slightly OT - Exim / Apache

[Rick Cooper]

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
> Behalf Of Steve Campbell
> Sent: Friday, December 09, 2005 9:08 AM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: Slightly OT - Exim / Apache
>
>
> Kai,
>
> I could use this ability here, but only find the sendmail_from
> parameter for
> Windows PHP. Could you explain how this is done or point me to something,
> please? We run multiple virtual hosts on many servers, and not only do we
> get a log entry from apache that it changed the sender, but it always
> indicates the hostname as the sender.
>
[...]

I don't know how you would do it through php.ini, I mean you could use
the -f user at domain in your sendmail line but how about simply requiring all
your virtual admins to use a valid from address? if they are using php it
can easily be added to the fourth param. Set exim to reject any sender local
part that is apache (or whatever your www user is) and set your apache user
as trusted in your exim config so it can set the from address (if the web
server is local to the mail server). I would also send them information as
to how to check the referrer to ensure that someone isn't high jacking their
forms.

I think if they understand policy is no mail from apache@ will be accepted,
and you provide them with the information as to how to set the from address
in their scripts they will comply rather quickly.

It might even be worth your while to create a mail script that uses the pear
package that they are able to include in their scripts and have your wrapper
add an X- header that is required by exim from their web service from
addresses or it won't run. For instance if you have a virtual user at xyz.com
and your wrapper adds X-VMail-from:user at xyz.com when mail hits exim with a
sender address of user at xyz.com and the X-Vmail-from: header is wrong or
missing reject the mail.

But at least require they use a real from address, hopefully something you
and your clients understand is only used in their web forms

Rick



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!