Blocking outgoing messages?

[Paweł Tęcza-2]

Hello,

Is it a way to block outgoing messages from my authenticated users
to specified e-mail address? Something like "badfrom user@domain"
in the bofh file, but for external addresses.

Recently many of my users have received the phishing messages. I sent
a warning to them, of course, but some of the users replied to
the address from Reply-To: header. Fortunately nobody disclosed
his password :)

I know I can block IP address of MX for that domain using firewall,
but I rather prefer block only one e-mail address.

Have you ever been attacked by the phishing messages? What do you do
in that situations to protect yourself?

My best regards,

Pawel



-------------------------------------------------------------------------
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services for
just about anything Open Source.
http://sourceforge.net/services/buy/index.php
_______________________________________________
courier-users mailing list
courier-users@...
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users

[Bernd Wurst]

Hi.

On Thursday 26 June 2008, Paweł Tęcza wrote:
> Is it a way to block outgoing messages from my authenticated users
> to specified e-mail address? Something like "badfrom user@domain"
> in the bofh file, but for external addresses.

spamtrap user@...

regards, Bernd

--
<DigiGnome> Real life should have a fucking search function, or something.
<DigiGnome> I need my socks.


-------------------------------------------------------------------------
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services for
just about anything Open Source.
http://sourceforge.net/services/buy/index.php
_______________________________________________
courier-users mailing list
courier-users@...
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users

[Paweł Tęcza-2]

Bernd Wurst napisał(a):

> Hi.
>
> On Thursday 26 June 2008, Paweł Tęcza wrote:
>> Is it a way to block outgoing messages from my authenticated users
>> to specified e-mail address? Something like "badfrom user@domain"
>> in the bofh file, but for external addresses.
>
> spamtrap user@...

Hello Bernd,

Thanks a lot for your reply!

Are you sure that option works for users on outer mail servers?
I have not checked it yet, but I understand description of spamtrap
option that it's only for users in my hosted domains.

In my opinion difference between badfrom and spamtrap options is that
badfrom is for addresses in MAIL FROM: and spamtrap is for addresses
in RCPT TO:, but both are for domains I host. Please correct me,
if I'm wrong.

Maybe my post wasn't clear enough, but I don't want to block messages
which my server *receives* from user@... address. I need
to block messages my users *send* to that address and it's not one
of my addresses, of course.

Cheers,

Pawel

-------------------------------------------------------------------------
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services for
just about anything Open Source.
http://sourceforge.net/services/buy/index.php
_______________________________________________
courier-users mailing list
courier-users@...
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users

[Jeff Jansen-2]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

"Pawel Tecza" <ptecza@...> wrote on 2008-Jun-27:
> Maybe my post wasn't clear enough, but I don't want to block messages
> which my server *receives* from user@... address. I need
> to block messages my users *send* to that address and it's not one
> of my addresses, of course.

Create an alias for the "bad" address on your server and do something
with it locally.  Then it won't ever leave your server.

HTH

Jeff Jansen

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFIZE5IGfIHDMaiC9cRAo96AKCMGz1wR8AcVIXRNupQS6kVX+psiQCgsDU5
gJPQWZVjsUh5fFFVoEixt78=
=zOkJ
-----END PGP SIGNATURE-----

-------------------------------------------------------------------------
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services for
just about anything Open Source.
http://sourceforge.net/services/buy/index.php
_______________________________________________
courier-users mailing list
courier-users@...
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users

[Bernd Wurst]

Hi.

On Thursday 26 June 2008, Pawel Tecza wrote:
> In my opinion difference between badfrom and spamtrap options is that
> badfrom is for addresses in MAIL FROM: and spamtrap is for addresses
> in RCPT TO:, but both are for domains I host. Please correct me,
> if I'm wrong.

I've never seen such a limitation.
But seems like you're right. In a current test, this did not work as I
expected.
Sorry, I thought this could contain arbitrary values for recipient addresses.
This seems wrong.


> Maybe my post wasn't clear enough, but I don't want to block messages
> which my server *receives* from user@... address. I need
> to block messages my users *send* to that address and it's not one
> of my addresses, of course.

I understood what you want, thought this should work...

Okay, I'm out. A custom alias won't work either, I suppose.

A courierfilter should be able to do this, perhaps one of the pytonfilters can
blacklist some addresses?

regards, Bernd

--
Outside the killings, Washington has one of the lowest crime rates
in the country.  -  Mayor Marion Barry, Washington, D.C.


-------------------------------------------------------------------------
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services for
just about anything Open Source.
http://sourceforge.net/services/buy/index.php
_______________________________________________
courier-users mailing list
courier-users@...
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users

[Paweł Tęcza-2]

On Pt, 2008-06-27 at 10:19 +0800, Jeff Jansen wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> "Pawel Tecza" <ptecza@...> wrote on 2008-Jun-27:
> > Maybe my post wasn't clear enough, but I don't want to block messages
> > which my server *receives* from user@... address. I need
> > to block messages my users *send* to that address and it's not one
> > of my addresses, of course.
>
> Create an alias for the "bad" address on your server and do something
> with it locally.  Then it won't ever leave your server.

Hi Jeff,

Thank you very much for the tip! It really works and does what I want :)

Below is an example piece of aliases file. It forwards user's reply to
postmaster and does a copy of the reply in a text file.

phisher@...: postmaster@..., phishing-reply
phishing-reply: |cat >> /path/to/phishing-reply.txt

I think it can be useful for another postmasters.

Have a nice day,

Pawel



-------------------------------------------------------------------------
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services for
just about anything Open Source.
http://sourceforge.net/services/buy/index.php
_______________________________________________
courier-users mailing list
courier-users@...
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users

[Paweł Tęcza-2]

Hello again :)

On Pt, 2008-06-27 at 07:06 +0200, Bernd Wurst wrote:

> Hi.
>
> On Thursday 26 June 2008, Pawel Tecza wrote:
> > In my opinion difference between badfrom and spamtrap options is that
> > badfrom is for addresses in MAIL FROM: and spamtrap is for addresses
> > in RCPT TO:, but both are for domains I host. Please correct me,
> > if I'm wrong.
>
> I've never seen such a limitation.
> But seems like you're right. In a current test, this did not work as I
> expected.
> Sorry, I thought this could contain arbitrary values for recipient addresses.
> This seems wrong.

No problem :)

> > Maybe my post wasn't clear enough, but I don't want to block messages
> > which my server *receives* from user@... address. I need
> > to block messages my users *send* to that address and it's not one
> > of my addresses, of course.
>
> I understood what you want, thought this should work...
>
> Okay, I'm out. A custom alias won't work either, I suppose.
>
> A courierfilter should be able to do this, perhaps one of the pytonfilters can
> blacklist some addresses?

I'm not very familiar with pythonfilters by Gordon Messmer, but Jeff
Jansen has just pointed me the solution. It seems that using aliases is
a good method to blocking outgoing messages.

My best regards,

Pawel



-------------------------------------------------------------------------
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services for
just about anything Open Source.
http://sourceforge.net/services/buy/index.php
_______________________________________________
courier-users mailing list
courier-users@...
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users

[Sam Varshavchik]

Paweł Tęcza writes:

> Below is an example piece of aliases file. It forwards user's reply to
> postmaster and does a copy of the reply in a text file.
>
> phisher@...: postmaster@..., phishing-reply
> phishing-reply: |cat >> /path/to/phishing-reply.txt
>
> I think it can be useful for another postmasters.

The whole problem with this approach is then you'll need to constantly
maintain and update a list of phishing mailboxes.

This is a losing war. The only solution here is a large cluestick, applied
sufficiently to the lusers' heads.



-------------------------------------------------------------------------
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services for
just about anything Open Source.
http://sourceforge.net/services/buy/index.php
_______________________________________________
courier-users mailing list
courier-users@...
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users

[Paweł Tęcza-2]

On Pt, 2008-06-27 at 07:07 -0400, Sam Varshavchik wrote:

> Paweł Tęcza writes:
>
> > Below is an example piece of aliases file. It forwards user's reply to
> > postmaster and does a copy of the reply in a text file.
> >
> > phisher@...: postmaster@..., phishing-reply
> > phishing-reply: |cat >> /path/to/phishing-reply.txt
> >
> > I think it can be useful for another postmasters.
>
> The whole problem with this approach is then you'll need to constantly
> maintain and update a list of phishing mailboxes.

Hi Sam,

Fortunately we have been attacked only one time. I hope I never need to
use that tip :)

> This is a losing war. The only solution here is a large cluestick, applied
> sufficiently to the lusers' heads.

I believe that people aren't so stupid to send their passwords to
anyone, but I would like to have any weapons to protect also dumb users.

Best regards,

Pawel





-------------------------------------------------------------------------
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services for
just about anything Open Source.
http://sourceforge.net/services/buy/index.php
_______________________________________________
courier-users mailing list
courier-users@...
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users