On Thu, Mar 11, 2004 at 05:59:49PM +0000, Jamie Penman-Smithson wrote:
> This type of forgery is usually best handled at the MTA level, I've
> setup Postfix to reject mail which appears to originate locally, but is
> being received from somewhere else, You don't say what MTA you're using,
> but I'm sure there is similar functionality available.
We're in the process of overhauling our mail server, and will
be moving to postfix, amavis-new and clamav when we do (I've
already done this at home and its catching a ton of
viruses)
In the meanwhile, though, it seems at the very least that
Mailman has a bug whereby the privacy filters seem to check
the "envelope-from" and do not check it against the From: in
the message header. The Mailman post log for my system lists
the information in the From: header, when clearly this was not
the address that was checked.
Now I know how to track these forgeries back to the address
that is being used as a "gateway" (the envelope-from), but
Mailman itself could perhaps do a better job of making sure
the two addresses agree (assuming that won't break something
else).
--
| | Under any conditions, anywhere, whatever you
Caleb Epstein | bklyn . org | are doing, there is some ordinance under which
cae at | Brooklyn Dust | you can be booked.
bklyn dot org | Bunny Mfg. | -- Robert D. Sprecht,
| | Rand Corp.
------------------------------------------------------
Mailman-Users mailing list
[EMAIL PROTECTED]
http://mail.python.org/mailman/listinfo/mailman-users
Mailman FAQ: http://www.python.org/cgi-bin/faqw-mm.py
Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/
