LinkBack URL
About LinkBacks
Helpful Exim ACLs -- Add Your Own
With so much spam discussion on the board lately, I thought maybe we can put our heads together in one thread and come up with the most helpful Exim ACLs for everyone to share.
I'll start off with a custom HELO ACL we use on our servers:
HELO BASED EXIM ACL (CPANEL ADDITIONAL)
This is a tutorial on how to add a HELO scanning ACL to your exim configuration in cPanel to help cut down on load and spam at the same time. Use this at your own risk! The potential to block legitimate traffic is of course a factor. Educate your users, clients and friends. Oh, and yourself!
Background Information
The "HELO" (or "EHLO") is part of the simple procedure machines use to send mail - SMTP, or Simple Mail Transfer Protocol. We won't delve into the details here, suffice it to say that mail servers should follow the SMTP procedure. Most mail servers (including cPanel's standard Exim configuration) are set up to be forgiving. Spammers sometimes don't follow the rules in order to take advantage of our attempt to accept every piece of mail that comes down the pipe. But we can set up our cPanel server to block what we know is not following the rules.
The Procedure
1. Log in to WHM as root and scroll down the left hand side until you find "Service Configuration". Click the "Exim Configuration Editor" link.
2. Click the "Advanced Editor" button at the right side bottom.
3. In the first input box you might see some options already there. Scroll below them and add the following two lines, replacing the IPs in the local_ips hostlist with your own IPs for your server:
Be sure you add the extra "empty space" after 127.0.0.1 - it's not a typo!Code:hostlist local_ips = 127.0.0.1: :192.168.1.1:192.168.1.2:192.168.1.3 acl_smtp_helo = check_helo
4. Now scroll all the way down until you find "begin acl" and three input boxes in a row. In the second box you will most likely see the "check_recipient" ACL. I don't know why everyone always uses the second box, but I usually use the first one to keep my addtions separated from cPanels. In the first box, add the following:
5. I've added a comment before each distinct rule so you can have some idea of what these do if you've never used them before. In a nut shell, these are going to drop any connection to the mail server if:Code:check_helo: # HELO is empty or not sent deny condition = ${if eq{$sender_helo_name}{}} message = You have sent no HELO! Please see RFC 2821 section 4.1.1.1 log_message = Bad HELO: Empty HELO # HELO is not a fully qualified domain name deny condition = ${if match {$sender_helo_name} {\.} {no}{yes}} message = Your mail server announcement ($sender_helo_name) \ is a single word rather than a FQDN. This is \ in breach of RFC2821 log_message = Bad HELO: Not FQDN # IP Only is sent as the HELO deny condition = ${if match {$sender_helo_name}\ {^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\$}\ {yes}{no}} message = Your server announces itself ($sender_helo_name) with a plain \ IP address which is in breach of RFC2821. log_message = Bad HELO: IP Only Announce # Someone is trying to spoof your own IPs! deny condition = ${if eq {$sender_helo_name} {$interface_address} {yes}{no}} message = HELO/EHLO IP is local. You are not this server. log_message = Bad HELO: Local IP Spoof Attempt # Someone is trying to spoof a domain on the server deny condition = ${if match_domain{$sender_helo_name}\ {+local_domains}} message = Forged HELO: you are not $sender_helo_name log_message = Forged HELO: $sender_helo_name Spoof Attempt accept
(a) There is no HELO set or it's empty. A HELO statement must by definition be followed by a fully qualified domain name (FQDN). Some spammers try to get around this by sending an empty HELO.
(b) The HELO is not a FQDN. Same as above - a FQDN should be a domain name that can be used to find an IP. (IE: timmysbox is not a FQDN, but mail.timmysbox.net is!)
(c) An IP is sent instead of a FQDN. Spammers will sometimes even try to put your IP as the sending server, hoping it will trick the MTA into thinking the connection is local I suppose. We zap it here.
(d) A domain that resides on your server is sent as the HELO. How could your server be sending itself an email? Zap that connection!
6. Now scroll to the page bottom and SAVE. This will save your new configuration within cPanel so that it will not be overwritten when upgrading to a new version. It restarts Exim as well for you so you can test the results right away. And if your spam problem is like most people, you'll see the results pretty quickly. Do
and watch the scrolling log for any forged or bad HELO messages from our ACL. After a little while, try this one:Code:tail -f /var/log/exim_mainlog
and scroll through all the spammer connections your machine has dropped BEFORE processing. This procedure is especially helpful to those running high memory eaters like SpamAssassin and/or MailScanner, since the message is dropped rather than run through the queue and scanned.Code:grep "HELO" /var/log/exim_mainlog | more
Hope this helps people out there. Comments, suggestions, additions welcomed!
Reply With Quote
Originally Posted by mickalo
