<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<tt>Hi Alex.<br>
<br>
I'm replying to you off-list.<br>
<br>
There is a flaw with my version in that it could be beaten with a
special header.<br>
But that can be fixed.<br>
<br>
The current version has a "secret" header added by the MTA to any
message submitted by an authenticated user.<br>
The function checks for the existence of that header.<br>
The MTA is also configured to remove the "secret" header from any
outgoing messages so that it doesn't get discovered.<br>
However, if someone were to find out the secret header, then they could
add it and beat my function.<br>
<br>
However, another approach which could be done and would fix the problem
of a header being inserted is:<br>
<br>
- Configure MTA to add a header to all incoming messages (say
"X-Authenticated: No" for example) except form messages submitted by
authenticated users.<br>
- If there is no way to exempt adding the header for authenticated
users, then perhaps the MTA can be configured to strip the header back
off again from any messages submitted by authenticated users.<br>
- Have the custom function check for the lack of that header.<br>
<br>
By doing the above, it doesn't matter if anyone discovers your header,
since adding it won't help.<br>
I haven't looked into how to do that yet, but will in the future.<br>
<br>
But for now, here is what I've done with Exim and my CustomFunction.<br>
The header has been changed in the examples below.<br>
<br>
In my exim configuration I have the following in my "acl_check_rcpt:"
ACL configuration to add the header:<br>
<br>
accept<br>
authenticated = *<br>
add_header = X-Secret-Header: Blah<br>
control = submission/sender_retain<br>
<br>
And the following "headers_remove" value in my "remote_smtp" and
"remote_smtp_smarthost" transports to remove the header:<br>
<br>
remote_smtp:<br>
driver = smtp<br>
headers_remove = </tt><tt>X-Secret-Header<br>
etc...<br>
<br>
<br>
</tt><tt>Then, my CheckSMTPAuth function is as follows:<br>
<br>
package MailScanner::CustomConfig;<br>
<br>
# Package to check message headers to determine if a message was
recieved via an SMTP AUTH connection.<br>
# The header it is checking for is configured to be added by the
Exim mail server when an authenticated session is detected.<br>
# Using this function, I should be able to add the following to the
MailScanner.conf to skip spam checks for authenticated users:<br>
#<br>
# Spam Checks = &CheckSMTPAuth<br>
#<br>
<br>
use strict;<br>
<br>
sub InitCheckSMTPAuth<br>
{<br>
# Empty<br>
}<br>
<br>
sub EndCheckSMTPAuth<br>
{<br>
# Empty<br>
}<br>
<br>
</tt><tt> sub CheckSMTPAuth<br>
{<br>
my ($message) = @_;<br>
return 1 unless $message;<br>
</tt><br>
<tt> foreach (@{$message->{headers}})<br>
{<br>
if (/X-Secret-Header: Blah/)<br>
{<br>
MailScanner::Log::InfoLog("Message %s from
(%s) is authenticated", $message->{id}, $message->{fromuser});<br>
return 0;<br>
}<br>
}<br>
return 1;<br>
</tt><tt> }</tt><br>
<tt><br>
1;<br>
<br>
Instead to try the new approach where you have a lack of a header for
authenticated user, I guess you'd have something like:<br>
<br>
</tt><tt> sub CheckSMTPAuth<br>
{<br>
my ($message) = @_;<br>
return 1 unless $message;<br>
</tt><br>
<tt> foreach (@{$message->{headers}})<br>
{<br>
if (/X-Authenticated: No/)<br>
{<br>
return 1;<br>
</tt><tt> }<br>
</tt><tt> }<br>
<br>
# If we get here, then the "X-Authenticated: No" header was
not found.<br>
#<br>
</tt><tt> MailScanner::Log::InfoLog("Message %s from
(%s) is authenticated", $message->{id}, $message->{fromuser});<br>
return 0;<br>
</tt><tt> }</tt><br>
<tt><br>
Regards,<br>
</tt>
<pre class="moz-signature" cols="1000">----------
Jim Barber
DDI Health
</pre>
<br>
<br>
Alex Neuman wrote:<br>
Would you like to share your function? Or at least share your
experiences? Does it work with a particular MTA? Can it be fooled by a
carefully crafted header?<br>
<br>
<div class="gmail_quote">On Thu, Feb 26, 2009 at 8:18 PM, Jim Barber <span
dir="ltr"><<a moz-do-not-send="true"
href="mailto:jim.barber@ddihealth.com">jim.barber@ddihealth.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote"
style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div id=":fi" class="ArwC7c ckChnd">Hi Jules.<br>
<br>
I have a CustomFunction that checks for users that are using SMTP AUTH.<br>
eg:<br>
Spam Checks = &CheckSMTPAuth</div>
</blockquote>
</div>
<br>
<br clear="all">
<br>
-- <br>
Alex Neuman van der Hans<br>
Reliant Technologies<br>
+507 6781-9505<br>
+507 202-1525<br>
<a moz-do-not-send="true" href="mailto:alex@rtpty.com">alex@rtpty.com</a><br>
Skype: alexneuman<br>
</body>
</html>