Default config: reject on too many bad RCPT

An example exploit failed against my system, because I had this sanity guard in
place; it's not a real security fix since a careful attacker could find enough
valid recipients to hit that problem, but it highlights that this is a useful
enough pattern that we should encourage its wider use.

(cherry picked from commit 2a636a39fff29b7c3da1798767a510dfed982a62)

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index bad2933cbaddff3fc04bfdfe571516c4ad7605fc..3dbae7f768cc0f9d2a2b3adc8eea8a75558d41a9 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -167,6 +167,8 @@ HS/01 Enforce absolute PID file path name.
 
 HS/02 Handle SIGINT as we handle SIGTERM: terminate the Exim process.
 
+PP/01 Add a too-many-bad-recipients guard to the default config's RCPT ACL.
+
 
 Exim version 4.94
 -----------------

diff --git a/src/src/configure.default b/src/src/configure.default
index 3423ee0af64b3b8410919a802ccbf76a818be20e..d94c148c11805698e6361d6fcf17493b4f893abe 100644 (file)
--- a/src/src/configure.default
+++ b/src/src/configure.default
@@ -449,6 +449,20 @@ acl_check_rcpt:
 
   require verify        = sender
 
+  # Reject all RCPT commands after too many bad recipients
+  # This is partly a defense against spam abuse and partly attacker abuse.
+  # Real senders should manage, by the time they get to 10 RCPT directives,
+  # to have had at least half of them be real addresses.
+  #
+  # This is a lightweight check and can protect you against repeated
+  # invocations of more heavy-weight checks which would come after it.
+
+  deny    condition     = ${if and {\
+                        {>{$rcpt_count}{10}}\
+                        {<{$recipients_count}{${eval:$rcpt_count/2}}} }}
+          message       = Rejected for too many bad recipients
+          logwrite      = REJECT [$sender_host_address]: bad recipient count high [${eval:$rcpt_count-$recipients_count}]
+
   # Accept if the message comes from one of the hosts for which we are an
   # outgoing relay. It is assumed that such hosts are most likely to be MUAs,
   # so we set control=submission to make Exim treat the message as a