Sender address spoofing protection with domain aliases

W

wavoe

Verified User
Joined
Nov 21, 2007
Messages
78
Location
Belgium
I recently updated exim and now I had the error "Account [email protected] can not send emails from [email protected]".

I could see from the documentation and the exim.pl script that domain aliases are covered, however I have a special case over here:
I'm using roundcube to send the emails and I have a main domain configured "domain.be", with some aliases like domain.nl
When I log on to roundcube I'm using already for years [email protected] as username (instead of .be) and I configured an identity [email protected] there.

So my /etc/virtual is looking like this:
Code: 
ls -l /etc/virtual/domain*
lrwxrwxrwx 1 mail mail   14 Dec 28 20:13 /etc/virtual/domain.eu -> domain.be
lrwxrwxrwx 1 mail mail   14 Dec 28 20:13 /etc/virtual/domain.net -> domain.be
lrwxrwxrwx 1 mail mail   14 Dec 28 20:13 /etc/virtual/domain.nl -> domain.be

/etc/virtual/domain.be:
total 92
-rw------- 1 mail      mail     285 Dec 29 11:45 aliases
-rw------- 1 mail      mail       0 Dec 28 20:12 autoresponder.conf
-rw------- 1 mail      mail    1679 Nov 19  2013 dkim.private.key
..

The suggestion I have is to adapt some lines in exim.pl for the method deny_auth_sender around this line:
return "no" if ($auth_user eq $sender_user && -l $domain_dir && $auth_domain eq readlink($domain_dir));
To (or any similar suggestion):
Code: 
my $auth_dir = "/etc/virtual/" . $auth_domain;       

# Allow same local part from alias domain
return "no" if ($auth_user eq $sender_user && -l $domain_dir && $auth_domain eq readlink($domain_dir));       
return "no" if ($auth_user eq $sender_user && -d $auth_dir && readlink($auth_dir) eq $sender_domain);

So that in this case some kind of reverse check is also done for domain aliases usage.
 
romans said:
@wavoe Did you try checking these changes in DA which were done several versions ago ?

https://docs.directadmin.com/changelog/version-1.680.html#️-sender-address-spoofing-protection
Click to expand...
Yes I'm aware of this change, and one case that is mentioned is working as expected:
* Same address (local part) but a different domain is allowed to be used if the domain is an alias of the main address domain

But it doesn't work when you are authenticated with an alias and try to send in name of the main address domain
 
You must log in or register to reply here.
Back
Top