Debian Bug report logs - #409350
greylistd: exim4 config acl error (senders = : means <> bounce list excluded!)

Reply or subscribe to this bug.

Display info messages

Message #5 received at [email protected] (full text, mbox, reply):

From: Luke Kenneth Casson Leighton <[email protected]>

To: Debian Bug Tracking System <[email protected]>

Subject: greylistd: exim4 config acl error (senders = : means <> bounce list excluded!)

Date: Fri, 02 Feb 2007 09:19:47 +0000

Package: greylistd
Severity: normal


excluding "<>" bounce senders from acl_check_rcpt is a really bad idea.

the reason is because then it allows attackers to constantly try
different usernames at the target.

in the instance where this is combined with an LMTP delivery (which is
presently broken on exim4 as the transport always says 'YEP!  go _right_
on through!) then every single message that is listed as coming from <>
(bounce) will end up in the queue, even though there is no mailbox for
it.

and _that_ results in dozens of frozen messages in the queue, per day.

the comments are nice - but it assumes that _local_ callback attempts
to LMTP actually work and that _local_ delivery actually works.

so, perhaps the problem isn't "!senders = :" but more that the
greylisting acl is oversimplistic, and doesn't distinguish between
recipient callbacks that go to local, and recipient callbacks that go to
remote.

... is this worth investigating?



-- System Information:
Debian Release: testing/unstable
Architecture: i386
Kernel: Linux highfield 2.6.16-1-686 #2 Mon Apr 10 22:16:40 UTC 2006 i686
Locale: LANG=C, LC_CTYPE=C

Message #10 received at [email protected] (full text, mbox, reply):

From: "David L. Anselmi" <[email protected]>

To: [email protected]

Subject: greylistd: exim4 config acl error (senders = : means <> bounce list excluded!)

Date: Sat, 26 Jan 2008 20:14:46 -0700

In version 0.8.6 besides the acl_check_rcpt there's acl_check_data, 
which runs the greylist check at data time for <>.  So it seems that 
bounces will get checked, just at data time rather than rcpt time.

Does that solve the problem?

Dave

Send a report that this bug log contains spam.