Pegasus Mail & Mercury

Is there a filtering rule I could put in that would filter out mail from local user accounts that haven't authenticated?  This would eliminate spam I get that has a local email address as the sender. 

The short answer is "no" - I can't think of any way of doing this at the moment.

The idea is not without a certain merit, though. Let me think about it a bit.

Cheers!

-- David --

This could be done easily if Mercury would put an AUTHENTICATED tag in the header. 

It should be solved by small daemon by SMTP server hooking. I know if connection is authjorized here, and i am using this information in GrayWall. (Authorized connections are not delayed anymore...)

So, most easy way is small daemon what can detect this state and add requested header to message. I must think about it too. 

As I noted in another thread, adding a header indicating that the message originated from an authenticated connection is trivially easy, and I'll do it as a standard part of MercuryS for v4.53. You can then create rules that simply look for that header.

Cheers!

-- David --

David Harris:

As I noted in another thread, adding a header indicating that the message originated from an authenticated connection is trivially easy, and I'll do it as a standard part of MercuryS for v4.53. You can then create rules that simply look for that header.

Cheers!

-- David --

Brilliant!

I came up with a quasi work around.  I setup a filtering rule to add a +50 to all messages from local accounts (There are only 3).  I set up another rule to add -999 to all accounts that had a certain signature line in the body. This isn't exactly reading an AUTH tag, but as close as I can get.

I just sent an email to myself but don't see which header indicates an authenticated user.? What should I be looking for.

 

Jim

There isn't one, and such a header could easily be faked, so it would have limited usefulness.

However, similar kinds of spam (with non-existent local MAIL FROM, or with identical MAIL FROM and RCPT TO) can be rejected at SMTP transaction level by using a SMTP event daemon I wrote. There is a lot of spam with those characteristics around at the moment. 

There is a download package for the event daemon here:
http://downloads.serieguide.se/SmtpEvt.zip

There are some additional features in it so be sure to have a look at the readme file.

/Rolf 

Thanks Rolf, I have downloaded your daemon and will take a look at it tomorrow.  One thing I don't understand though is that earlier in this thread David Harris himself said "As I noted in another thread, adding a header indicating that the message originated from an authenticated connection is trivially easy, and I'll do it as a standard part of MercuryS for v4.53. You can then create rules that simply look for that header.  Cheers!  -- David --"

 Did something change his mind?

 Thanks again, 

 

Jim

I can't remember this being discussed any further so I'm not sure why it wasn't included. There are a lot of ideas for additions and improvements around at all times, though, so I guess it could simply have been forgotten along the way.

/Rolf