A simple exim4 trick for preventing catch-all abuse.

Posted by forrest on Wed 25 May 2005 at 03:49

I used to have a "catch-all" address set up on my mailserver, so that mail set to any unknown address would be forwarded to my personal account. That's cool because you can just make up addresses on the fly when you're filling out webforms and such, to help keep track of who's distributed your e-mail address.

As soon as spammers learned about my domain, though, having a catch-all address sucked. I got all sorts of spam to the weirdest made-up users at my domain, not to mention the mailer-daemon messages sent to addresses spammers had forged using my domain.

I still wanted to be able to make up addresses easily, and keep track of who had my address. So I decided to set up my mailserver so that messages to users starting with a certain prefix (in my case, fc_) would get forwarded to me. I could still make up addresses, but all the spam would get bounced (unless it happened by chance to begin with the magic prefix, and that hasn't happened yet).

So, how do you set this up on a debian box with exim4?

I took the debian default of having my exim4 configuration in multiple files under /etc/exim4/conf.d; if you have one big file, you'll have to find the appropriate place to insert this snippet.

I had to insert a special router in conf.d/router to handle my prefix. Because exim4 goes through the routers in order until it finds one to handle the message, I had to insert my router after the standard rewrites had occured, but before any of the routers which actually deliver the message. I decided to create a file starting with 450, which would put it right after 400_exim4-config_system_aliases, the router which handles /etc/aliases. I called my file 450_local-not_so_smart. I recommend using _local for anything you add yourself, to keep it straight from the debian config files, which all have _exim4. As for the rest of the filename, well, I wasn't sure it was a good idea when I set it up, but now I'm convinced it's great.

The contents of /etc/exim4/conf.d/router/450_local-not_so_smart look like this:

not_so_smart:
  debug_print = "R: not_so_smart for $local_part@$domain"
  driver = redirect
  local_part_prefix = fc_
  data = forrest@example.com
  retry_use_local_part

(I changed my real domain to example.com in the above, to keep from giving the spambots one more place to pick off my address.)

I hope someone else finds this useful; I think it really works wonders.

This article can be found online at the Debian Administration website at the following bookmarkable URL (along with associated comments):

http://www.debian-administration.org/article/A_simple_exim4_trick_for_preventing_catch-all_abuse.