OOT : Email Bombing (was : Re: [opensuse] Kalvin Weng is out of the office.)

newer
[opensuse] BIOS question

older
[opensuse] Pam Pilot not working

Masim "Vavai" Sugianto

2 Dec 2008 2 Dec '08

02:10

On Tue, Dec 2, 2008 at 9:03 AM, Kalvin Weng wrote:

...

I will be out of the office starting 2008-12-02 and will not return until 2008-12-06.

well, we will have email bombing from 2008-12-02 to 2008-12-06 :-P Maybe we must have a rule "do not use autoreply feature for you email address that registered on mailing list :-)" -- Best Regards, Masim "Vavai" Sugianto /************************************************************/ Blog (ID) : http://www.vavai.com/blog/index.php Blog (EN) : http://www.vavai.net Community : http://www.opensuse.or.id /************************************************************/ -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Show replies by date

Amedee Van Gasse

2 Dec 2 Dec

09:31

New subject: OOT : Email Bombing (was : Re: [opensuse] Kalvin Weng is out of the office.)

On Tue, December 2, 2008 03:10, Masim \"Vavai\" Sugianto wrote:

...

On Tue, Dec 2, 2008 at 9:03 AM, Kalvin Weng wrote:

...
I will be out of the office starting 2008-12-02 and will not return until 2008-12-06.

well, we will have email bombing from 2008-12-02 to 2008-12-06 :-P

Maybe we must have a rule "do not use autoreply feature for you email address that registered on mailing list :-)"

I just updated my /etc/postfix/maps/header_checks and reloaded Postfix. # Reject OOTO-messages /^Subject:.*out of the office.*$/ REJECT Out Of The Office messages will not be delivered. Normally I shouldn't even get this message myself (because of the subject). Amedee -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Amedee Van Gasse

09:38

New subject: [opensuse] Blocking autoreplies at the MTA (postfix)

On Tue, December 2, 2008 10:31, Amedee Van Gasse wrote:

...

On Tue, December 2, 2008 03:10, Masim \"Vavai\" Sugianto wrote:

...
On Tue, Dec 2, 2008 at 9:03 AM, Kalvin Weng wrote:

...
I will be out of the office starting 2008-12-02 and will not return until 2008-12-06.

well, we will have email bombing from 2008-12-02 to 2008-12-06 :-P

Maybe we must have a rule "do not use autoreply feature for you email address that registered on mailing list :-)"

I just updated my /etc/postfix/maps/header_checks and reloaded Postfix.

# Reject OOTO-messages /^Subject:.*out of the office.*$/ REJECT Out Of The Office messages will not be delivered.

Normally I shouldn't even get this message myself (because of the subject).

OK, so that one didn't work. Because of the extra spaces. Aargh! Now it's: /^Subject:.*out.*of.*the.*office.*$/ REJECT Out Of The Office messages will not be delivered. Any comments, suggestions, improvements are welcome. EDIT: now it works, because I cannot even *send* the email. Squirrelmail tells me: Requested action not taken: mailbox unavailable Server replied: 550 5.7.1 Out Of The Office messages will not be delivered. So I changed the subject line. -- Amedee -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Matthias Bach

10:05

New subject: [opensuse] Blocking autoreplies at the MTA (postfix)

Hi! Am Dienstag, 2. Dezember 2008 10:38 schrieb Amedee Van Gasse:

...

OK, so that one didn't work. Because of the extra spaces. Aargh! Now it's:

/^Subject:.*out.*of.*the.*office.*$/ REJECT Out Of The Office messages will not be delivered.

Any comments, suggestions, improvements are welcome.

You might want to filter only out of office replies sent to mailing list. I cannot try right now, but something like this: /^Subject:\[*.\].*out.*of.*the.*office.*$/ REJECT Out Of The Office messages will not be delivered. That way you should still get the informative out of office replies from people that you sent a direct mail to. Regards, Matthias -- Matthias Bach www.marix.org -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Sylvester Lykkehus

10:34

New subject: [opensuse] Blocking autoreplies at the MTA (postfix)

On 2008-12-02 11:05, Matthias Bach wrote:

...

Hi!

Am Dienstag, 2. Dezember 2008 10:38 schrieb Amedee Van Gasse:

...
OK, so that one didn't work. Because of the extra spaces. Aargh! Now it's:

/^Subject:.*out.*of.*the.*office.*$/ REJECT Out Of The Office messages will not be delivered.

Any comments, suggestions, improvements are welcome.

You might want to filter only out of office replies sent to mailing list. I cannot try right now, but something like this: /^Subject:\[*.\].*out.*of.*the.*office.*$/ REJECT Out Of The Office messages will not be delivered.

Or simply do a match for the X-Mailinglist header

...

That way you should still get the informative out of office replies from people that you sent a direct mail to.

Regards, Matthias

/Sylvester -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Sylvester Lykkehus

10:39

New subject: [opensuse] Blocking autoreplies at the MTA (postfix)

On 2008-12-02 11:34, Sylvester Lykkehus wrote:

...

Or simply do a match for the X-Mailinglist header

Scratch that, that won't work of course, since the out of office replies are sent directly to your personal address.

...

/Sylvester

-- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Carlos E. R.

10:51

New subject: [opensuse] Blocking autoreplies at the MTA (postfix)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Tuesday, 2008-12-02 at 10:38 +0100, Amedee Van Gasse wrote:

...

OK, so that one didn't work. Because of the extra spaces. Aargh! Now it's:

/^Subject:.*out.*of.*the.*office.*$/ REJECT Out Of The Office messages will not be delivered.

Any comments, suggestions, improvements are welcome.

You also can filter them out with spamassassinn, ie, with a score. After all, there are few messages of that kind. If there are many, just send a copy to the list owner, so that he can take action and unsusbscribe the culprit - which hopefully will teach him to do things right next time >:-) - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (GNU/Linux) iEYEARECAAYFAkk1EyAACgkQtTMYHG2NR9UBzACfaZ2IV1wIa0uv7eYOb15KShp9 PK0AniH6JuRtis8RyUOgn0SMuM/Gn4xr =gYlE -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Amedee Van Gasse

15:47

New subject: [opensuse] Blocking autoreplies at the MTA (postfix)

On Tue, December 2, 2008 11:51, Carlos E. R. wrote:

...

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

On Tuesday, 2008-12-02 at 10:38 +0100, Amedee Van Gasse wrote:

...
OK, so that one didn't work. Because of the extra spaces. Aargh! Now it's:

/^Subject:.*out.*of.*the.*office.*$/ REJECT Out Of The Office messages will not be delivered.

Any comments, suggestions, improvements are welcome.

You also can filter them out with spamassassinn, ie, with a score. After all, there are few messages of that kind. If there are many, just send a copy to the list owner, so that he can take action and unsusbscribe the culprit - which hopefully will teach him to do things right next time >:-)

That would defeat the entire purpose of blocking certain mail at the MTA. I want to REJECT mail while the SMTP session is still open. If I first ACCEPT mail and then filter it with SpamAssassin, I simply cannot reject it any more, because the sender address is unreliable. Email spoofing is all too common and I don't want to be a bounce spammer. Now if there are people who are going to say that you *can* use SpamAssassin at the MTA, that would be nice and I will certainly try. But I'm afraid that adding SpamAssassin to the smtpd_recipient_restrictions (if it is technically possible at all) might cause a lot of load that I don't have with a few simple lines of header_checks. -- Amedee -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Carlos E. R.

16:25

New subject: [opensuse] Blocking autoreplies at the MTA (postfix)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Tuesday, 2008-12-02 at 16:47 +0100, Amedee Van Gasse wrote:

...

...
...
Any comments, suggestions, improvements are welcome.

You also can filter them out with spamassassinn, ie, with a score. After all, there are few messages of that kind. If there are many, just send a copy to the list owner, so that he can take action and unsusbscribe the culprit - which hopefully will teach him to do things right next time >:-)

That would defeat the entire purpose of blocking certain mail at the MTA. I want to REJECT mail while the SMTP session is still open. If I first ACCEPT mail and then filter it with SpamAssassin, I simply cannot reject it any more, because the sender address is unreliable. Email spoofing is all too common and I don't want to be a bounce spammer.

I know that, but the main caveat is that you may also loose bonafide out of office replies, or people commenting about such things, as you yourself noted. It is your system and your choice, of course. You prefer to go low on cpu. But you asked for comments... you got them ;-) - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (GNU/Linux) iEYEARECAAYFAkk1YW4ACgkQtTMYHG2NR9XQ2ACeNc1ulgn2oinMilB7ww4yRldv oDEAnjnMdDb8kxoEHLULc3zyeiBo3ul9 =HoOz -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Amedee Van Gasse

19:44

New subject: [opensuse] Blocking autoreplies at the MTA (postfix)

Carlos E. R. schreef:

...

On Tuesday, 2008-12-02 at 16:47 +0100, Amedee Van Gasse wrote:

...
...
...
Any comments, suggestions, improvements are welcome.

You also can filter them out with spamassassinn, ie, with a score. After all, there are few messages of that kind. If there are many, just send a copy to the list owner, so that he can take action and unsusbscribe the culprit - which hopefully will teach him to do things right next time

...
:-)

...
That would defeat the entire purpose of blocking certain mail at the MTA. I want to REJECT mail while the SMTP session is still open. If I first ACCEPT mail and then filter it with SpamAssassin, I simply cannot reject it any more, because the sender address is unreliable. Email spoofing is all too common and I don't want to be a bounce spammer.

I know that, but the main caveat is that you may also loose bonafide out of office replies, or people commenting about such things, as you yourself noted.

It is your system and your choice, of course. You prefer to go low on cpu. But you asked for comments... you got them ;-)

OK, then we understand each other. ;-) It is indeed my system, used only by myself and the mrs, and I really don't care about a few missing out of offices. Anyway an out of office is a bit "enterprisey" and I usually don't mail a lot of "enterprisey" people. -- Amedee -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Sandy Drobic

12:10

New subject: [opensuse] Blocking autoreplies at the MTA (postfix)

Amedee Van Gasse wrote:

...

On Tue, December 2, 2008 10:31, Amedee Van Gasse wrote:

...
On Tue, December 2, 2008 03:10, Masim \"Vavai\" Sugianto wrote:

...
On Tue, Dec 2, 2008 at 9:03 AM, Kalvin Weng wrote:

...
I will be out of the office starting 2008-12-02 and will not return until 2008-12-06. well, we will have email bombing from 2008-12-02 to 2008-12-06 :-P

Maybe we must have a rule "do not use autoreply feature for you email address that registered on mailing list :-)" I just updated my /etc/postfix/maps/header_checks and reloaded Postfix.

# Reject OOTO-messages /^Subject:.*out of the office.*$/ REJECT Out Of The Office messages will not be delivered.

Normally I shouldn't even get this message myself (because of the subject).

OK, so that one didn't work. Because of the extra spaces. Aargh! Now it's:

/^Subject:.*out.*of.*the.*office.*$/ REJECT Out Of The Office messages will not be delivered.

Any comments, suggestions, improvements are welcome.

There are several caveats to your approach: - if you reject mails at the smtp level you should have your own mailserver that is the responsible mx for your domain, otherwise you will become a source of backscatter - header_checks are not the best tool for this problem since the headers are evaluated one line after the other without a way to combine patterns of several lines. As Carlos already proposed, Spamassassin is much better suited for this task, since you can check for a listmail header and the subject header and then set the appropriate action. That way you don't block desired autoresponder mails. -- Sandy List replies only please! Please address PMs to: news-reply2 (@) japantest (.) homelinux (.) com -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

G T Smith

13:37

New subject: [opensuse] Blocking autoreplies at the MTA (postfix)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Sandy Drobic wrote:

...

Amedee Van Gasse wrote:

...
On Tue, December 2, 2008 10:31, Amedee Van Gasse wrote:

...
On Tue, December 2, 2008 03:10, Masim \"Vavai\" Sugianto wrote:

There are several caveats to your approach:

- if you reject mails at the smtp level you should have your own mailserver that is the responsible mx for your domain, otherwise you will become a source of backscatter

- header_checks are not the best tool for this problem since the headers are evaluated one line after the other without a way to combine patterns of several lines.

As Carlos already proposed, Spamassassin is much better suited for this task, since you can check for a listmail header and the subject header and then set the appropriate action. That way you don't block desired autoresponder mails.

or alternatively procmail which you can use to refine your basic filtering rules .... IIRC spamassassin is normally invoked via procmail for individual accounts anyway... - -- ============================================================================== I have always wished that my computer would be as easy to use as my telephone. My wish has come true. I no longer know how to use my telephone. Bjarne Stroustrup ============================================================================== -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (GNU/Linux) Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org iEYEARECAAYFAkk1OgcACgkQasN0sSnLmgJu3wCgjouKghiYH0nqcjIVZlxgyqGP wqoAoPjN4hx8Eg+8V9mlgb+OHnMEZYYD =GzHW -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Amedee Van Gasse

16:06

New subject: [opensuse] Blocking autoreplies at the MTA (postfix)

On Tue, December 2, 2008 14:37, G T Smith wrote:

...

or alternatively procmail which you can use to refine your basic filtering rules .... IIRC spamassassin is normally invoked via procmail for individual accounts anyway...

I didn't know that procmail could reject mail at the mta. (subject) *g* I already know how to write procmail rules that have multiple conditions or that are nested. I just wanted to stop unwanted email a bit earlier, *before* it touches userspace. I'm not ungrateful for your suggestion, but it's simply not what I'm doing. -- Amedee -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Amedee Van Gasse

16:01

New subject: [opensuse] Blocking autoreplies at the MTA (postfix)

On Tue, December 2, 2008 13:10, Sandy Drobic wrote:

...

There are several caveats to your approach:

- if you reject mails at the smtp level you should have your own mailserver that is the responsible mx for your domain, otherwise you will become a source of backscatter

I know. Just check it yourself: $ dig amedee.be +short $ dig amedee.be mx +short $ dig intrepid.warp.be +short Then check the headers of my emails: Received: from intrepid.warp.be (intrepid.warp.be [62.213.207.37]) by mx2.suse.de (Postfix) with ESMTP id D49214648A for ; Tue, 2 Dec 2008 10:31:57 +0100 (CET) So as you can see, I'm ok.

...

- header_checks are not the best tool for this problem since the headers are evaluated one line after the other without a way to combine patterns of several lines.

As Carlos already proposed, Spamassassin is much better suited for this task, since you can check for a listmail header and the subject header and then set the appropriate action. That way you don't block desired autoresponder mails.

It is my opinion that even if SpamAssassin is better in theory, it is a bulky behemoth compared to my simple header_checks. I'm afraid that my server will run out of memory or cpu when I use SA. Since it's a virtual xen server shared with a couple of people, I'm trying to be polite to the others. I once had a trashing error because of Amavis (yet another memory monster), and I won't let that happen again. -- Amedee -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Sandy Drobic

3 Dec 3 Dec

10:55

New subject: [opensuse] Blocking autoreplies at the MTA (postfix)

Amedee Van Gasse wrote:

...

On Tue, December 2, 2008 13:10, Sandy Drobic wrote:

...
There are several caveats to your approach:

- if you reject mails at the smtp level you should have your own mailserver that is the responsible mx for your domain, otherwise you will become a source of backscatter

I know. Just check it yourself:

$ dig amedee.be +short $ dig amedee.be mx +short $ dig intrepid.warp.be +short

My list was more for the benefit of those that stumble on that thread later and wish to implement something similar. Hopefully they will also find my comments and reconsider if they don't meet the requirements. (^-^)

...

It is my opinion that even if SpamAssassin is better in theory, it is a bulky behemoth compared to my simple header_checks. I'm afraid that my server will run out of memory or cpu when I use SA. Since it's a virtual xen server shared with a couple of people, I'm trying to be polite to the others. I once had a trashing error because of Amavis (yet another memory monster), and I won't let that happen again.

I heartily approve of such a considerate approach. Amavisd-new is indeed quite a resource hog, even more, if it is running as a proxy filter. My solution against pesky mails is to use dedicated mailaddresses for mailinglists and a restriction class in Postfix to reject all mails to these addresses when the submitting client is not the listserver. It is also the reason for my footer and my nonexistant spam problem. (^-^) -- Sandy List replies only please! Please address PMs to: news-reply2 (@) japantest (.) homelinux (.) com -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Amedee Van Gasse

22:37

New subject: [opensuse] Blocking autoreplies at the MTA (postfix)

Sandy Drobic schreef:

...

My solution against pesky mails is to use dedicated mailaddresses for mailinglists and a restriction class in Postfix to reject all mails to these addresses when the submitting client is not the listserver.

It is also the reason for my footer and my nonexistant spam problem. (^-^)

Note to self: * configure multiple mailaddresses in Thunderbird and Squirrelmail * set up restriction class in postfix * resubscribe to various mailing lists * comment out the ooto-rejection -- Amedee -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

5627

Age (days ago)

5628

Last active (days ago)

List overview

Download

15 comments

7 participants

participants (7)

Amedee Van Gasse
Carlos E. R.
G T Smith
Masim "Vavai" Sugianto
Matthias Bach
Sandy Drobic
Sylvester Lykkehus