Changeset 2375

Timestamp:

Feb 21, 2013, 11:59:19 PM (12 years ago)

Author:

andersk

Message:

Tighten scripts vhost mail security

Broken MTAs such as MIT’s will rewrite anyone@awesome-cname.mit.edu to
anyone@scripts-vhosts.mit.edu, in violation of RFC 2821.  (This can be
fixed with the Sendmail nocanonify feature or DontExpandCnames option,
which, bewilderingly, are still not the default.)  To prevent such
mail from being misdirected, remove scripts-vhosts from $mydestination
and let it bounce.

Correct r1452 to match literal periods in scripts.mit.edu.

Reserve the well-known (RFC 2142) email addresses
{abuse,hostmaster,noc,postmaster,security}@every-domain for our own
purposes; /etc/aliases maps these to root.

Tested on scripts-f17-dev.

Location:

trunk/server/fedora/config/etc/postfix

Files:

• main.cf (modified) (1 diff)
• virtual (modified) (1 diff)
• virtual_re (modified) (1 diff)

trunk/server/fedora/config/etc/postfix/main.cf

@@ -10 +10 @@
 alias_database = hash:/etc/aliases
 myorigin = scripts.mit.edu
-mydestination = scripts.mit.edu, scripts, $myhostname, scripts-test.mit.edu, scripts-test, scripts-vhosts.mit.edu, scripts-vhosts, localhost
+mydestination = scripts.mit.edu, scripts, $myhostname, scripts-test.mit.edu, scripts-test, localhost
 relayhost =
 mynetworks_style = host

trunk/server/fedora/config/etc/postfix/virtual

@@ -4 +4 @@
 @webzephyr.mit.edu webzephyr
 # Domains also match here
+scripts-vhosts.mit.edu true
 szs.mit.edu true
 webzephyr.mit.edu true

trunk/server/fedora/config/etc/postfix/virtual_re

@@ -1 @@
-/^(.*)@scripts.mit.edu$/ $1@scripts.mit.edu
+/^(.*)@scripts\.mit\.edu$/ $1@scripts.mit.edu
+/^(abuse|hostmaster|noc|postmaster|security)@/ $1@scripts.mit.edu
 /^(.*)@([^@]*)\.scripts\.mit\.edu$/ $2+$1
 /^([^@]*)\.scripts\.mit\.edu$/ true