[heroes] Dropping/Blocking Email Addresses from our mailing lists
Hi Today I got an emergency call from our security team: their mailing list was "spammed" from a bot (aka ticket system) - as the ticket system address (which looks it was in CC of one Email to the list) generated an Email to the list - getting an answer from mlmmj that it is not subscribed, which generated a new ticket with an automated answer, which was answered by mlmmj... (I think you got the loop) As result, I created /etc/postfix/sender_access with : $EMAIL DROP inside, did "postmap /etc/postfix/sender_access" and adapted /etc/postfix/main.cf : smtpd_recipient_restrictions = [...],check_sender_access hash:/etc/postfix/sender_access For the moment, this seems to successful break the loop, but as I'm neither the maintainer of the system nor sure that this is a good/stable solution, I hope that I simply did not break too much... Feel free to adjust/remove/whatever with the above information. Maybe someone has already a better idea...? with kind regards, Lars -- To unsubscribe, e-mail: heroes+unsubscribe@opensuse.org To contact the owner, e-mail: heroes+owner@opensuse.org
Heym On 28.02.2017 16:03, Lars Vogdt wrote:
Feel free to adjust/remove/whatever with the above information. Maybe someone has already a better idea...?
There is a system wide /etc/postfix/mlmmj-killfile already. If that is overkill you can also use the 'discard' access rule[1] for a specific list. Henne [1] http://mlmmj.org/docs/readme-access/ -- Henne Vogelsang http://www.opensuse.org Everybody has a plan, until they get hit. - Mike Tyson -- To unsubscribe, e-mail: heroes+unsubscribe@opensuse.org To contact the owner, e-mail: heroes+owner@opensuse.org
Lars Vogdt wrote:
Today I got an emergency call from our security team: their mailing list was "spammed" from a bot (aka ticket system) - as the ticket system address (which looks it was in CC of one Email to the list) generated an Email to the list - getting an answer from mlmmj that it is not subscribed, which generated a new ticket with an automated answer, which was answered by mlmmj... (I think you got the loop)
Still getting some of them trickling through :-)
As result, I created /etc/postfix/sender_access with : $EMAIL DROP inside,
There is no DROP action for sender access, REJECT would probably be better. I think DROP led to "451 4.3.5 Server configuration error; from=<rt@de-cix.net>" being generated, a temp reject. Still, problem mostly solved/postponed. I guess the guys at de-cix will have noticed the problem too ... /Per -- Per Jessen, Zürich (6.3°C) openSUSE mailing list admin -- To unsubscribe, e-mail: heroes+unsubscribe@opensuse.org To contact the owner, e-mail: heroes+owner@opensuse.org
participants (3)
-
Henne Vogelsang
-
Lars Vogdt
-
Per Jessen