>i just started my new job and found an ultra1 solaris box 2.4 or 2.5 (no
>monitor, must access it by telnet..) with spamming problems. It runs a
>Netscape Mail Server 2.0 that is SMPT/POP3 servee for users in the LAN, and
>it seems to be lacking of any defense against spammers, and also our
>connectivity provider told so.. :-(
>is there any way, by the OS, to make port 25 accessible only from a range of
>IP numbers and a particular domain? Just while we change our mail server
>software...
The simplest and most straightforward way would be to go get IP Filter
from http://www.ipfilter.org/ , install it, and add a rule that looks
something like this:
block in on hme0 proto tcp from any to any port = 25
pass in on hme0 proto tcp from 10.20.30.0/255.255.255.0 to any port = 25
The first rule says that by default, all tcp connections through
interface hme0 to port 25 should be ignored (i.e. packets dropped).
The second says that ones coming from the network 10.20.30.0 should be
exceptions, i.e. should be allowed in.
Actually, it might be more friendly (to others' mail servers) to refuse
the connection instead of just ignoring its packets, which you could do
by changing the first rule to this:
block return-rst in on hme0 proto tcp from any to any port = 25
The problem with the port-blocking approach is that you're refusing all
connections from the outside, legitimate or not. So, you're not going
to get any mail from the outside at all, unless maybe you have an MX
machine that can relay it onward. (If so, you'll want to make sure you
allow it to connect, probably using with a special rule.)
Hope that helps.
- Logan
--
my your his her our their _its_
I'm you're he's she's we're they're _it's_
by