Re: Solution to SMTPAuth compromised accounts.

2013-09-13 Thread /dev/rob0
On Fri, Sep 13, 2013 at 04:29:28AM +, Viktor Dukhovni wrote: > Sadly Postfix does not have an access table keyed by the SASL > login name. Perhaps we should bite the bullet, and add one, +1, a check_sasl_auth_access feature would be useful, despite the fact that other approaches can accompli

Re: Solution to SMTPAuth compromised accounts.

2013-09-13 Thread Wietse Venema
Viktor Dukhovni: > > Can we add something similar to the "smtpd_client_restrictions" or > > "smtpd_recipient_restrictions", and adding a new rule-entry which > > would simply confirm that the "SMTPAuth LDAP 'user' used way back, > > is still accountStatus=enabled" ? Built-in message rate limit: /

Re: Solution to SMTPAuth compromised accounts.

2013-09-13 Thread José Borges Ferreira
On 09/13/2013 08:47 AM, lst_ho...@kwsoft.de wrote: > A workaround might be to force a mismatch with smtpd_sender_login_maps > by removing the MAIL FROM --> Login-ID match in the table, no? But > this only applies if reject_sender_login_mismatch could/should be used > of course. On top of that, plea

Re: Solution to SMTPAuth compromised accounts.

2013-09-13 Thread lst_hoe02
Zitat von Viktor Dukhovni : On Fri, Sep 13, 2013 at 11:45:54AM +0900, Jorgen Lundman wrote: However, quite often the 3rd party involved uses software that can use pipelining, and simply keeps sending mail, even though the SMTPAuth account has been stopped. What you are calling "pipelining"

Re: Solution to SMTPAuth compromised accounts.

2013-09-12 Thread Stan Hoeppner
On 9/12/2013 9:45 PM, Jorgen Lundman wrote: > > Hello all, > > Talking about the customer outgoing SMTP servers, where customers > connect and are forced to SMTPAuth before they can send mail out to the > Internet. We use LDAP for SMTPAuth verification. > > Occasionally, a customer account is co

Re: Solution to SMTPAuth compromised accounts.

2013-09-12 Thread Viktor Dukhovni
On Fri, Sep 13, 2013 at 11:45:54AM +0900, Jorgen Lundman wrote: > However, quite often the 3rd party involved uses software that can > use pipelining, and simply keeps sending mail, even though the > SMTPAuth account has been stopped. What you are calling "pipelining" is more properly called conn

Solution to SMTPAuth compromised accounts.

2013-09-12 Thread Jorgen Lundman
Hello all, Talking about the customer outgoing SMTP servers, where customers connect and are forced to SMTPAuth before they can send mail out to the Internet. We use LDAP for SMTPAuth verification. Occasionally, a customer account is compromised, and used for sending large volumes of spam.