such as: 1. drop all mails that include attachments.

or drop all attachments. not mail itself.

2. drop all mails that include HTML/Javascript/ActiveX/Flash.

so only plain text is allowed. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

On 20 Dec 2006, bmarsh@bmarsh.com wrote:

Spamassassin - good but in my view a lot of maintenance

This what cron is for. I use a script to train SA with the mails in my spam mailbox everyday and a weekly script to train SA for HAM. Charles -- printk("VFS: Busy inodes after unmount. " "Self-destruct in 5 seconds. Have a nice day...\n"); linux-2.3.99-pre8/fs/super.c

Joachim Kieferle wrote:

Steven T. Hatton wrote:

...

It just keeps getting worse. I really don't want to change my email address, but it's all over the Internet, and the spammers are killing my inbox. I don't want to spend a lot of time on this issue, I just want to be able to block these idiots. I'm running a postfix mail server. Is there an easy was to thwart spam? I use the filters built into KMail, but they seem almost worthless.

Hi Steven,

adding

smtpd_recipient_restrictions = [ ......], reject_rhsbl_client blackhole.securitysage.com, reject_rhsbl_sender blackhole.securitysage.com, reject_rbl_client relays.ordb.org, reject_rbl_client blackholes.easynet.nl, reject_rbl_client cbl.abuseat.org, reject_rbl_client proxies.blackholes.wirehub.net, reject_rbl_client bl.spamcop.net, reject_rbl_client sbl.spamhaus.org, reject_rbl_client opm.blitzed.org, reject_rbl_client dnsbl.njabl.org, reject_rbl_client list.dsbl.org, reject_rbl_client multihop.dsbl.org

relays.ordb.org has shut down a few days ago. cbl.abuseat.org \ opm.blitzed.org > all three are included in zen. spamhaus.org sbl.spamhaus.org / bl.spamcop.net is rather heavyhanded. While it will block a lot of spamzombies, indiscriminate use will almost guarantees that you will reject servers you want to receive mail from.

to the "main.cf" on the mailserver already reduced the amount of spam by approx. 50% on our server [....] means that you should leave your current policies like "permit_mynetworks" how it currently is.

With blacklists, helo checks, some basic sanity checks, adress verify you can reject about 80% of spam already.

Postgrey http://isg.ee.ethz.ch/tools/postgrey/ has also been mentioned to reduce the amount of spam quite well. I'll use that on one of the upcoming mailservers, so I don't have any experience with that up to now.

Greylisting works indeed very well against spam but it also introduces some delay until most regular senders are known to the server. You might also consider policyd-weight, that uses the weighted result of many checks to reject/accept mails.

However both recommendations just work on mailservers directly accepting the mail,

Correct. Otherwise you can only use spamassassin to analyse and tag the mail. Sandy -- List replies only please! Please address PMs to: news-reply2 (@) japantest (.) homelinux (.) com -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Steven T. Hatton wrote:

On Wednesday 20 December 2006 16:10, Joachim Kieferle wrote:

...

Steven T. Hatton wrote:

...

It just keeps getting worse. I really don't want to change my email address, but it's all over the Internet, and the spammers are killing my inbox. I don't want to spend a lot of time on this issue, I just want to be able to block these idiots. I'm running a postfix mail server. Is there an easy was to thwart spam? I use the filters built into KMail, but they seem almost worthless.

Hi Steven,

adding

smtpd_recipient_restrictions = [ ......], reject_rhsbl_client blackhole.securitysage.com, reject_rhsbl_sender blackhole.securitysage.com, reject_rbl_client relays.ordb.org, reject_rbl_client blackholes.easynet.nl, reject_rbl_client cbl.abuseat.org, reject_rbl_client proxies.blackholes.wirehub.net, reject_rbl_client bl.spamcop.net, reject_rbl_client sbl.spamhaus.org, reject_rbl_client opm.blitzed.org, reject_rbl_client dnsbl.njabl.org, reject_rbl_client list.dsbl.org, reject_rbl_client multihop.dsbl.org

to the "main.cf" on the mailserver already reduced the amount of spam by approx. 50% on our server [....] means that you should leave your current policies like "permit_mynetworks" how it currently is.

Postgrey http://isg.ee.ethz.ch/tools/postgrey/ has also been mentioned to reduce the amount of spam quite well. I'll use that on one of the upcoming mailservers, so I don't have any experience with that up to now.

However both recommendations just work on mailservers directly accepting the mail,

best

Joachim

Well, I'm still getting mail from this list, so it's not blocking everything. It will take some time to determine if I've blocked things I don't want blocked. So far I have no new spam in the inbox in over an hour. That is very good. Far better than 50%. Thanks

Steven

Hi Steven, "grep blocked /var/log/mail" shows which mails are blocked. All sender / recipient combinations that I have seen so far were spam. Counting the amount of blocked spam, for our site it's about 2'000 mails that are blocked per day. IF BY ACCIDENT a mail is blocked, the positive effect from that is, that the senders are informed about blocking (e.g. Blocked - see http://cbl.abuseat.org/lookup.cgi?ip=82.197.44.218), whereas SpamAssassin "just" marks the spam and one tends to delete the spam without even reading the header / sender. Sandy gave some very good comments on the sites one should get the blocking information from. That's very helpful, since I just googled this list from a postfix configuration site and didn't up to now find the time to go into details of each site. Thanks for that. Best and Merry Christmas, Joachim -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Sandy Drobic wrote:

Joachim Kieferle wrote:

[RBLs listed]

[... more info about blocking mails]

A lot of spam is rejected by helo checks and greylisting.

Sandy Hi Sandy,

two questions about that: 1. could you please point to some info about how to implement "helo checks" (maybe a snippet from the main.cf?) and 2. is there greylisting available out of the (OpenSuSE 10.2) box? Best Joachim -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Thursday 2006-12-21 at 11:18 +0100, Sandy Drobic wrote:

...

2. is there greylisting available out of the (OpenSuSE 10.2) box?

Not that I am aware of. But Postgrey is not difficult to implement.

Yes, it is. There is a sample in (2.1) "SMTPD_POLICY_README.html", another in "postconf.5.html". There is a "greylist.pl" and "spf.pl" script in the "./examples/smtpd-policy/" directory. I don't know if that's the best implementation, but at least it is there. - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFFin9KtTMYHG2NR9URAlc3AJ4gxrUMVbAyY9Sltxszje24HlrUQQCeMZZ3 MWzLHh+hN2xYahNrwrWzD2o= =ONvg -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

John Andersen wrote:

On Wednesday 20 December 2006 23:37, Joachim Kieferle wrote:

...

IF BY ACCIDENT a mail is blocked, the positive effect from that is, that the senders are informed about blocking (e.g. Blocked - see http://cbl.abuseat.org/lookup.cgi?ip=82.197.44.218), whereas SpamAssassin "just" marks the spam and one tends to delete the spam without even reading the header / sender.

Whoa there big fella!

You are ADDING to the PROBLEM by generating backscatter, and probably joe jobbing some poor schmuck who the spammer pretended to be.

Wrong. The mail is not accepted and instead REJECTED during the smtp dialogue. The responsibility for the mail remains with the sending client. May that be the spammer or a normal mailserver. Dec 17 04:52:12 spamkill postfix/smtpd[18477]: NOQUEUE: reject: RCPT from customer.optindirectmail.83.sls-hosting.com[204.14.1.83]: 554 5.7.1 Service unavailable; Client host [204.14.1.83] blocked using zen.spamhaus.org; http://www.spamhaus.org/SBL/sbl.lasso?query=SBL27197; Opt-in, yeah, sure... Not even a queue file has been created yet. That is exactly the difference to the normal use of amavisd-new or spamassassin: that filtering happens after you accepted the mail, so you can't reject the mail at that stage. At that point you can only tag-and-deliver. The biggest problem on the corporate side are gateway mailserver that accept a mail without knowing if the recipient is even valid. They try to relay the mail to the internal exchange server which is then telling them the recipient is invalid. Then they bounce the mail back to the, in case of spam forged, sender address. That is the backscatter we all know and love. :-(( Sandy -- List replies only please! Please address PMs to: news-reply2 (@) japantest (.) homelinux (.) com -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Daniel Bauer wrote:

I am not at all an expert, but I dislike the option of rejecting emails due to a blacklist. I prefer to have spam in my spam-folder (after it has been marked by Spam-Assassin), where I can quickly overview the subject lines.

This is only possible if you do not receive too much spam. We lost some emails in the past because they were buried in a heap of spam. The woman who had to wade through all the junk just skimmed over the subject lines and then deleted all mail that didn't catch her eye.

Some years ago my (old) ISP started rejecting e-mails using a blacklist. At that moment one of the lagest german ISP's ("Schlund+Partner" and its numerous sub-companies) was blacklisted. I suddenly had no more business contacts to Germany anymore and it took quite a while for me to find out why... The ISP told me, I should write to my business partners that they shall change their ISP. This sounded like a joke to me, as many of my partners are quite large companies and their IT staff for sure is much more experienced than I am. In the end I changed to another ISP that let *me* decide from whom I want to receive mail or not.

The purpose of a mailserver is to receive desired mails and send valid mails. If an administrator is using restrictions that defeat that purpose he needs the change these settings. I definitely can understand your decision, I would have done the same. That is exactly the reason why I am warning everyone not to use a huge list of blacklists without investigating their listing policy, delisting policy and the user experience. A company mailserver can afford to apply stricter checks than a general purpose isp mailserver. I spend half an hour every day just to review the maillog to verify that I did not misconfigure my systems to reject the wrong clients.

Using blacklists for warning/marking purposes seems ok to me, but letting a blacklist make decisions can be dangerous. Just my opinion.

Spamassassin and consorts do that kind of check. Unfortunately, these checks are expensive (many external dns queries and cpu intensive content checks). If you have a high-volume mailserver you will probably choke on all the spam that gets processed by the content_filter. My approach is to weed out most of the obvious spam clients with reasonable blacklists, postfix checks and selective greylisting and then let spamassassin deal with the rest. For better detection of picture spam I even installed FuzzyOCR to recognize these spams. That spam only gets tagged and then delivered to the mailbox of the recipient. Sandy -- List replies only please! Please address PMs to: news-reply2 (@) japantest (.) homelinux (.) com -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Carlos E. R. wrote:

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

The Thursday 2006-12-21 at 12:35 +0100, Sandy Drobic wrote:

...

...

Using blacklists for warning/marking purposes seems ok to me, but letting a blacklist make decisions can be dangerous. Just my opinion. Spamassassin and consorts do that kind of check. Unfortunately, these checks are expensive (many external dns queries and cpu intensive content checks). If you have a high-volume mailserver you will probably choke on all the spam that gets processed by the content_filter.

However, I understand that this is precisely what SuSE server does. You know, _I_ would be rejected otherwise ;-)

The Suse server is not exactly high-volume. It may receive some ten thousand mails per day, not much more. Believe me, if the list server had to process all mails that it is SENDING for spam and viruses it would need some SERIOUS hardware. (^-^) I am very glad that the suse server accepts mails from dynamic ips. Though the listserver has the protection of only allowing the list subscribers as sender addresses. That is probably why it is possible at all. The postfix-users mailing list gets a lot of cries for help because the mail queue has piled up into dimensions that threaten to bury the server. Usually it is because either to many mails are waiting to be processed or because of a misconfiguration the machine is not used efficiently. Unfortunately nothing can be done if the machine is simply buried in a spam run. So my policy is to use pretty reasonable checks that seldom reject wanted mails, configure a whitelist for those few (usually a handful within some month) and let spamassassin analyse the rest. Since robust and capable server hardware has become easily affordable it is possible for low-level volume sites (less than 50000 mails per day) to use pre-queue content filtering and reject the mails directly. The configuration is a bit more difficult because all filtering has to be done fast and only as many concurrent connections are possible as concurrent content_filter processes are supported by the hardware. Sandy -- List replies only please! Please address PMs to: news-reply2 (@) japantest (.) homelinux (.) com -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Carlos E. R. wrote:

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

The Thursday 2006-12-21 at 14:08 +0100, Sandy Drobic wrote:

...

...

However, I understand that this is precisely what SuSE server does. You know, _I_ would be rejected otherwise ;-) The Suse server is not exactly high-volume. It may receive some ten thousand mails per day, not much more. Believe me, if the list server had to process all mails that it is SENDING for spam and viruses it would need some SERIOUS hardware. (^-^)

Probably. What about gmail? I can send to them ;-)

They are welcome to receive whatever spam they want. On the other hand I am not happy when they forward the crap to my server, which does happen again and again.

...

I am very glad that the suse server accepts mails from dynamic ips. Though the listserver has the protection of only allowing the list subscribers as sender addresses. That is probably why it is possible at all.

That's true, but I understand the entry server was the same for the whole company - SuSE, that is, not Novell. Maybe the use other blocks, but AFAIK, not dymamic IPs. Which is very fortunate for me, of course.

True, it is after all a Linux product they support, and on linux you will likely have more network services installed like a web or mailserver than on a windows machine.

...

So my policy is to use pretty reasonable checks that seldom reject wanted mails, configure a whitelist for those few (usually a handful within some month) and let spamassassin analyse the rest.

I suppose I would do mostly the same in your place.

In the end it comes down to "how do I implement a transparent and robust mail system, that works efficiently without needing too much fiddling and attention?". So each administrator has do decide for himself: - how reliable should mail be received - how much spam can be received without hindering daily work - what legal requirements does he have to obey The answers and your priorities change with every company.

...

Since robust and capable server hardware has become easily affordable it is possible for low-level volume sites (less than 50000 mails per day) to use pre-queue content filtering and reject the mails directly. The configuration is a bit more difficult because all filtering has to be done fast and only as many concurrent connections are possible as concurrent content_filter processes are supported by the hardware.

pre-queue? Wow. :-O

What kind of software do they use for that? Can postfix do that?

I know that postfix and amavisd-new are used on some low-level volume sites to filter mail in a pre-queue configuration. The real trouble is you have to configure your system with two priorities: - filtering must be fast to avoid time-outs during mail processing - hardware must be reasonable fast to provide enough resources for sufficient concurrent mail connections These days you can buy a decent but relatively cheap server with - 2 dualcore cpus - fast raid controller with big cache and bbu - 4 GB RAM - GBit LAN That will allow you to set up a server that can process at least 30 concurrent mails (depending on your max allowed mailsize, header/body checks and your content_filter configuration) without much problems. For most low-volume sites this will be enough, and they can reject recognized spam directly. Of course this does not work if you need to allow huge mails. Sandy -- List replies only please! Please address PMs to: news-reply2 (@) japantest (.) homelinux (.) com -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Michael Leuty wrote:

On 20/12/06, Steven T. Hatton wrote:

...

Is there an easy way to thwart spam?

I let the clever chaps at Google do all the hard work for me, and pass all my mail through GMail. There are very few false negatives and even fewer false positives.

Mike

BTW, and maybe somebody can tell me this, is there some sort of mindset of the spammer which justifies sending out all these e-mails. Something that says, yes my actions are horribly reprehensible and wrong, but people will like me enough to buy my merchandise. The good will you shoot to crap with this must be intense. And I know it's hard to look at things from the perspective of slime, but maybe somebody can explain it to me. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Carlos E. R. wrote:

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

The Wednesday 2006-12-20 at 16:16 -0700, John Meyer wrote:

...

BTW, and maybe somebody can tell me this, is there some sort of mindset of the spammer which justifies sending out all these e-mails. Something

Business... from their point of view. Sending is cheap, so they probably send by the million. If sucess rate is one per thousand, that's a one thousand hit.

Last I heard the return rate was about one per thirty thousand, so they need to send LOTS of spam. :-(( Sandy -- List replies only please! Please address PMs to: news-reply2 (@) japantest (.) homelinux (.) com -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org