Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Recently I'm receiving (a lot of) spam with "mail from:" from legitimate users (on my server) but a different "Return path". This should not happen for our users, that is, mail received for myuser@mydomain.com should allways have an equal return path "myuser@mydomain.com".

I need to setup an exim4 filter rule that checks for "@mydomain.com" and then checks for the sender email address is the return path. If different, the email should be rejected.

I know there are situations this can be a legitimate use (like using gmail) but these are not allowed by our policy.

Can someone give me a hint where/how to implement this rule?

Thanks

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

Take a look at exim filters. Basically you need something like (UNTESTED and not sure of the syntax):

if $header_from: contains "@mydomain.com" and $reply_address is not $header_from:
then
    fail 
    seen finish
endif

You can provide a meaningful reject message next to fail as in fail test "some message".

share|improve this answer
    
Thanks, but I was under the impression that this is only for individual user use, like a file in the user's home directory. Is there a way to set it globally? That would be perfect, because then I could test it on a test user. –  Miguel Sep 15 '11 at 12:40
    
@Miguel Sure there is! Search for system_filter= in your exim configuration. I have in my cPanel installations: system_filter=/etc/exim_filter. –  Mr Shunz Sep 15 '11 at 12:55
    
Thanks! That seems to be it, I don't actually have that entry on any file on my /etc/exim4. In which file do you have that? is it sa-exim.conf (/etc/exim4/sa-exim.conf) ? –  Miguel Sep 15 '11 at 13:13
    
@Muguel Seems like you have a splitted configuration. Is it a Debian distro? I use exim with cPanel under CentOS so i have only a big /etc/exim4.conf. I have the options near the top, probably /etc/exim4/conf.d/main/02_exim4-config_options will do. –  Mr Shunz Sep 15 '11 at 13:38
    
Yes, it's a split conf, under debian. I will test this, I do have that file. Thanks! –  Miguel Sep 15 '11 at 13:43
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.