in reply to Port 80 Mail Relay (Spammers Welcome?)

uggh, been there done that... The issue is fundamental to the way the script works, so I don't know if there is really a good way to patch this one up *and* retain backwards compatability.

However, when I inherited a similiar situation, I did manage to stop the script kiddies. Luckilly the entire site was dynamic (SSI), so we put an extra field in all the FORM pages. This value of this hidden field changed every hour and was valid for two hours. If a request came in that didn't have a valid value, we didn't send the mail.

We managed to get rid of the real-world problem, even though theoretically it wasn't any more secure. It does require slight modification to the submission page, so it might not be what you need, but it did work fine for us.

-Blake

  • Comment on Re: Port 80 Mail Relay (Spammers Welcome?)

Replies are listed 'Best First'.
Re: Re: Port 80 Mail Relay (Spammers Welcome?)
by ginseng (Pilgrim) on Sep 13, 2001 at 15:14 UTC
    whoa, I like this. It can be extended.

    I don't like SSI (and fortunately only one existing customer was using it, so I only support it on one site :) but I could require ... what, an include of some kind? ... on the form page that generates a key. if the key is not there, the mail just doesn't go.

    I can quickly and easily migrate all existing forms using a perl script, and require all new forms to use the key generator. Instructions can be integrated with the existing "how to".

    I will admit first though, btrott has written a replacement program called stamp that I'm looking at right now. It looks *really* good, though it's not backward compatible. (Thanks to crazyinsomniac who pointed it out to me.)

[reply]
      I wasn't advocating SSI, just pointing out that the submission forms weren't static html. You've got the basic idea though... a carefully crafted perl -pi -e 's///' on the existing forms, along with an hourly cron job to update the "secret" key was all it took. Not a great solution, but perhaps good-enough for the short term.

      -Blake

[reply]
[d/l]

        How about an encrypted string containing a timestamp (to avaoid the cron job), the recipient address and a secret key that must be passed as hidden input and validated by formmail?

        alex pleiner <alex@zeitform.de>
        zeitform Internet Dienste

[reply]

In Section Seekers of Perl Wisdom