Refuse Relay to certain authenticated sessions

Dear all,

Currently my sendmail server relays email for my users when they
connect from their home (Access table allows IP based relaying) and it
relays their email when they connect from abroad if they use an
authenticated session. So far so good.

However as a quite significant amount of accounts and passwords of my
customer base have been disclosed recently, I would like to introduce
a file containing logins of compromised customers that the server
should refuse to relay the mails for, even if they authenticate
successfully (it may also simply reject the session, when
authentication with a login in this file is done). Otherwise -
surprise - the session is used to send unsollicited mails that bypass
a lot of traditional checks (because the session is authenticated, but
by a bot).

I checked the older mails in this newsgroup, but I only found
questions and answers about allowing relaying for authenticated
sessions instead of refusing it.
I had a look at the Bat book and at the sendmail rules for auth and
Trust. This made me belief, it should be possible to do what I am
looking for, but I am not experienced enough for writing the rules
myself.
Is there anybody who could give me a hint on writing a customized
sendmail.cf rule?

Many thanks in advance

Guy-Ambesch
.

Relevant Pages

  • Re: [PHP] Back to security
    ... Think of HTTPS as like a bank vault in the basement of a branch bank. ... If you authenticate users outside the steel wall, ... sessionID is compared with the one in DB, ... Compare the output of on the two pages, ...
    (php.general)
  • Re: Read session data of all users
    ... I'm trying to come up with a better way to authenticate a user across ... different web applications from a central place. ... and app3 will be redirected to authenticate with app1 if their session ... or at least get a reference to a HttpSessionState objects ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: how to re-use existing session?
    ... but I had to authenticate to forward the port. ... a session running, although it's in the background. ... I can also remove the -N switch to the initial SSH command, ...
    (comp.security.ssh)
  • Re: Question regarding bypassing security
    ... won't let you authenticate to windows like that anymore. ... >server database behind it and does authentication. ... > no user ID/password, it needs to check the session status. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Erasing an OTP file on a SD card.
    ... Better to do DH key exchange for each ... authenticate it against a persistent key (symmetric or ... >>after the key agreement and destroy the agreed key after the session ...
    (sci.crypt)