/etc/trustedmailhosts too trusting.

I'm working with an issue that I had over the past day or so. I have a bunch of clients who run Exchange Servers. We setup their Exchange servers to pass mail back through the server so that it is virus scanned and logged. The only way I can find to do that is to put the Exchange server on /etc/trustedmailhosts.

This allows the server to send mail without issue. However, a client had an issue where a spammer accessed their Exchange server and started sending spam. Because the server is on /etc/trustedmailhosts, no ratelimiting or domain checks are done. It more or less seems like this creates an open relay for that IP address. I've been running this configuration for a while, but now that I see the potential for abuse, I'm trying to find a work around.

Is anyone else doing this? How do they set it up?

 

I will give that a try and let you know how it works. Thank you.

 

I'm struggling with this because I don't think sender verification is what I'm looking for here. From looking at what verify sender does, the mail from this server would pass that test. The mail is coming from a valid domain, but is being sent by a different domain.

What really needs to happen is that mail from trusted addresses still needs to be rate limited. In my log, I'm seeing rate info on the emails:

2010-03-25 02:07:20 H=adsl-xxxxxxxxx.net (xxxxxxxxxxxxxxxx.com) [x.x.x.x] Warning: Sender rate 44.8 / 1h

What I would like to see happen is that this mail be blocked, if it exceeds a rate limit.

In the long run, trusted mail sources need to be secure, my customer is working on that, but in the meantime, I'd like to rate limit these connections as a little extra security.

 

The problem is that the only way I can get the Exchange servers that send mail through my system to work is in trustedmailhosts. I've tried bypass, but the server can't send mail if they are in bypass. In the test, we had three Exchange servers we were working with that all were listed in localdomains. (The problem server isn't listed in localdomains.. fyi). The only setting that let them send mail was in trustedmailhosts.

Maybe the methodology is wrong, is there something I need to do to get bypass to work? I would prefer that option, if it worked.

 

Actually, that is the solution that we implement already. By blocking the SMTP ports to the Exchange server through their firewall, we were able to eliminate any issues, but because the Exchange servers are not ours, we have to trust that the IT people on the other end of the connection are competent. That isn't really being proactive. I'd like to have a redundant verification on my end in the cPanel severs that connect to the various Exchange servers.

Thanks for the input! Wish I had thought of that a few days ago!