On Friday 04 June 2004 11:29, Markus Gaugusch wrote:

To prevent spoofing, you can enable SPF for your domain (SuSE should do so as well, and also everybody else who reads this). See http://spf.pobox.com for more information.

I'm well aware of what SPF might do to prevent this kind of abuse. However, I don't have access to TXT records since the webinterface of the registrar's nameservers do not allow me to configure TXT records (yet). I have not been able to convince them that allowing their users to configure TXT records has no unexpected security implications and that it would be a welcome addition to their service. Since SPF is still not widely supported (only a small percentage of domains is actually using it to block incoming traffic) I do not want to take the additional burden to operate my own nameserver for my domains (yet). Best regards, Arjen PS Since I read this list too, there is no reason to send message both to the mailing list and in private.

Quoting Markus Gaugusch <markus@gaugusch.at>:

To prevent spoofing, you can enable SPF for your domain (SuSE should do so as well, and also everybody else who reads this). See http://spf.pobox.com for more information.

Basically, SPF means that you insert a TXT record into your DNS zone that specifies which IP-addresses and MX servers are allowed to send mail with a FROM that contains your domain name.

SPF breaks forwarding. My domains used to publish SPF info until my customers started complaining. If anyone from your domain sends mail to someone who uses a forwarding service (very common in virtual domain setups), your mail will be dropped. For instance, let's say I own foo.com, and have it hosted at a hosting company, having any mail sent to it forwarded to my local ISP mail account. A fairly typical setup for a domain owner of a small set. If my local ISP uses SPF, I will no longer recieve mail sent to foo.com. My friend Bob sends the mail to foo.com, which then sends it to me. The SPF for Bob's domain doesn't list foo.com. My mail gets dropped. SPF is SERIOUSLY flawed. Security is about getting the legitimate through while blocking the bad. SPF fails on this account.

On Fri, 2004-06-04 at 11:56, Arjen de Korte wrote:

smtpd_recipient_restrictions = permit_mynetworks, permit_auth_destination, reject

Can't remember why I stopped using smtpd_recipient_restrictions (I think I was still trying out various configurations with content filters as I use trend interscan virus wall, which connects always as localhost, have fixed this now with the content_filter=smtp[localhost]:10026 string and editing my master.cf to match this nicely)

Your (quite minimal) configuration will not stop the virus in question, the sender host matches all criteria you listed here. I have no problems in stopping the virusses entering my system (a single RBL in smtpd_client_restrictions is sufficient in case of the 'dip.t-dialin.net' senders), it is the virus warnings from perfectly legitimate systems that are bothering me.

Yup, I started a string about these some months ago (when I needed coffee and a break from users wasting my time by insiting they had a virus as user@somewhere told them so. [snip my previous] From: "Barry Gill" <b@rry.co.za> Date: Thu, 11 Mar 2004 09:40:28 +0200 Message-ID: <PMEJIAOJHLLNGELPDEEIAEJKCBAA.b@rry.co.za> Subject: [suse-security] Anti-Virus reports Hello All. As most of you are technical, you should for the most part be in control of, or have the ear of the person who is in control of your corporate anti-virus solutions. Please for the sake of the internet can you STOP your servers sending virus notifications to the originators of the message as with today's modern virii 90% of virii use spoofed "from:" addresses. So, every time some poor person out there with MY name in their address book, or contacts folder gets a virus, I get 3000 messages (as I am sure do most of you on this list at least) telling me that I sent a virus to someone I have never heard of in my life before. This form of server administration is a very very poor form of security as you are willfully informing people who have possibly never thought of you or your servers before several key steps that it may have taken them some time to figure out. Things like... Antigen for Exchange found ScanMail for Microsoft Exchange took action on the message. The message details were: Symantec AVF detected an unrepairable NAV for Microsoft Exchange etc etc etc. Sending out mass mailer responses to virii wastes as much respource as coping with the virii themselves. Stop wasting your and my bandwidth, send reports only to admin, check the headers and if you receive mail form an address or domain often and the headers check out, THEN notify the admin/postmaster of that domain. I mean please, telling Lucy in the clerks dept about the fact that she is sending virii to somebody she has never met in Luxembourg is only going to cost her tima and money as she will call out her IT people to clean her "infected machine" Sorry about the rant, this is just one of the most annoying things that for some reason no-one ever seems to consider when setting up all this AV stuff. Barry [/snip of my previous]