You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Spam Admin <sa...@harthosp.org> on 2004/06/07 17:13:32 UTC
[OT] Interesting Data Points
I implemented a new Postfix/Amavis-D/SA/RDJ/URI box this morning. The
current one is working great, but it's on a Dell desktop and that gives
management the willies. The new SA box is on better, server-class
hardware and will eventually be the top dog; both are receive-only
filter-and-forward boxes, fronting my GroupWise email system.
For testing purposes, I implemented the new box as a secondary server,
with a numerically-higher MX preference. I expected to see some traffic
on it within an hour or two, but within *23 seconds* of adding the DNS
records I started getting hit by spammers. 23 seconds!!! I claim the new
world's record...
What is interesting to note that that this box is receiving 100% UCE;
no legitimate non-UCE email is coming in. Virtually 100% of the first
hour of that was getting blocked at the SMTP level by reference to
dynablock.njabl.org with other RBLs starting to creep in as the morning
progressed. So far, everything that gets by the RBLs is getting
quarantined by SA/RDJ/SpamURI - everything. This info tells me a few
things:
- The worms on broadband PCs that are running these spam servers like
to hit the secondary (and probably tertiary) MX records first. I'm
guessing they figure secondary MX servers are likely less "secure" and
more likely to allow email in. Very clever, actually. I had never
considered it, and could very well have put up an "unprotected"
secondary email server.
- Blocking at the SMTP level, especially for dynamic IP addresses, is a
very good thing. Amavis never sees it and SA nevers even has to bother
with reviewing and scoring it.
- I'm not getting in ANY (zero, zilch, nada) legitimate email into my
secondary server after 3 hours of being up, so that server could make a
very good honeypot for Bayes training...
- Since no legitimate email is being directed to the secondary server,
this means that my primary SA box - running on a Dell GX270 workstation
- is very easily keeping up with up to 5,000 emails per hour. Other than
for hardware fault-tolerance, I don't need a server-class machine to do
this.
Three hours into the experiment, I'm starting to see hits from the
following RBLs kicking in, with dynablock still leading the way. This
tells me that other non-broadband-based spammers are getting clued into
the existence of a secondary MX server (my DNS TTL is set very low right
now for other unrelated reasons):
- dnsbl.sorbs.net
- combined.njabl.org
- bl.spamcop.net
- cbl.abuseat.org
- sbl-xbl.spamhaus.org
Also, we're rejecting emails based on HELO errors (claiming to be
localhost or our domain name) and I'm also starting to see blocked
attachment types (viruses/worms) showing up, PIFs mostly.
This has been a very instructive and entertaining morning. I'm going to
let this guy run as the secondary for the week to see what else I can
learn...
Greg Amy
Systems Engineer
Hartford Hospital
Re: [OT] Interesting Data Points
Posted by Jonathan Nichols <jn...@pbp.net>.
>
> True, but you also have no chance of salvage either. A FP here is a hard
> failure. It's got it's benefits, and it's drawbacks, be aware of both.
>
>> - I'm not getting in ANY (zero, zilch, nada) legitimate email into my
>> secondary server after 3 hours of being up, so that server could make a
>> very good honeypot for Bayes training...
>
>
> This is only true until your primary MX is down for some reason. Be
> careful unless you're 100% certain of always-up performance from your
> primary.
>
> It's also possible for a legitamate server to have a temporary link
> failure on their end and wind up at the secondary MX. (ie: if their link
> is down when they try the primary, but comes back up before the try the
> secondary...) It's rare, but can happen.
>
>
Doesn't Exchange often ignore the secondary MX listings and fail if it
can't reach the Primary? I thought I read about Exchange doing stupid
stuff like that before, but I can't remember if it was still valid or
was Exchange 5.5....
I actually keep a "valid_emails" list and push it out to the secondary
MX when it changes. Otherwise, yeah, the mailq gets filled up with cruft
that it keeps trying to deliver to the primary. Blah.
Re: [OT] Interesting Data Points
Posted by Matt Kettler <mk...@evi-inc.com>.
At 11:13 AM 6/7/2004, Spam Admin wrote:
>- The worms on broadband PCs that are running these spam servers like
>to hit the secondary (and probably tertiary) MX records first. I'm
>guessing they figure secondary MX servers are likely less "secure" and
>more likely to allow email in. Very clever, actually. I had never
>considered it, and could very well have put up an "unprotected"
>secondary email server.
Yes, very true.. this is why I always take the opposite approach and make
secondary MX's more selevtive.
>- Blocking at the SMTP level, especially for dynamic IP addresses, is a
>very good thing. Amavis never sees it and SA nevers even has to bother
>with reviewing and scoring it.
True, but you also have no chance of salvage either. A FP here is a hard
failure. It's got it's benefits, and it's drawbacks, be aware of both.
>- I'm not getting in ANY (zero, zilch, nada) legitimate email into my
>secondary server after 3 hours of being up, so that server could make a
>very good honeypot for Bayes training...
This is only true until your primary MX is down for some reason. Be careful
unless you're 100% certain of always-up performance from your primary.
It's also possible for a legitamate server to have a temporary link failure
on their end and wind up at the secondary MX. (ie: if their link is down
when they try the primary, but comes back up before the try the
secondary...) It's rare, but can happen.
Re: [OT] Interesting Data Points
Posted by Theo Van Dinter <fe...@kluge.net>.
On Mon, Jun 07, 2004 at 11:28:29AM -0400, Scott Rothgaber wrote:
> Not less secure, but maybe less armed. The secondary might not have all
> of the anti-spam stuff on it, so the message gets accepted. Now the
> messages are being forwarded to the primary by a trusted host.
Another usual issue is that the secondaries usually don't have
the primary's address list available. So they'll accept mail for
unknown_user@example.com, try to relay to the primary, the primary bounces
it as "user unknown", then the secondary has to sit there trying to send
a DSN back to the sending address -- probably a forgery.
--
Randomly Generated Tagline:
"The user's computer downloads the ActiveX code and simulates a 'Blue
Screen' crash, a generally benign event most users are familiar with
and that would not necessarily arouse suspicions."
-- Security exploit description on http://www.zks.net/p3/how.asp
SA Configuration questions
Posted by "David J. Duffner - NWCWEB.com" <we...@nwcweb.com>.
Greetings,
Using SA 2.60 w/MailScanner on an Ensim Pro 3.7 Fedora
Core box. 99% of traffic is using Apache 1.3 platform, all
e-mail tossing through Sendmail (latest revisions & patches).
Got SA working much better, tagging things properly
and toss out the junk. Once the tweaks went in, mail volume
has gone down as the junk gets shredded.
Occasionally stuff that's not taggable as spam gets
through and I know there's a few I personally was receiving
that were tagged as spam and need to be whitelisted.
For the life of me the Wiki & Docs are so technically
oriented that I can't make heads or tails out of them or
anything I scanned in the archives.
There's mention of either creating or a pre-existing-
post-install 'user' on the server that users can forward
spam (or whitelist material) to so that it automatically
handles them. There's also command-line options for manually
white or blacklisting mail, but I can't determine what it
wants in order to do it properly. If I submit anything on
the command line with SA, it just sits there until a CTRL-C
out. If I shoot it at spamd, it comes back 'address already
in use'.
Since there's multiple characteristics in each e-mail
that vary as the SpamLords change their technique, I know some
of this gets past that could be added for future reference.
So... Pardon the rookie questions, but:
Where is, or how do I create, the 'user' to handle white
and blacklisting reports?
Also, how do you drop a bogus spam mail into things from
the command line and/or whitelist?
NOTE: Using spamd as a daemon as part of the package.
Also note that I'm looking to simplify how this works for the
non-technical users on our servers. Get spam, forward spam,
help block spam. Nothing elaborate and would prefer the auto-
drop feature over having to add another manual entry requirement
as we do with the firewalls. Last note, NOT running the autolearn
or Bayesian setups as it's been noted with Ensim OS's that in
combo with MailScanner and other utils that system performance
drags into the ground and CPU usage goes insane after about 24
hours of runtime.
Any help or suggestions greatly appreciated!
David J. Duffner
VP Operations
NWC Corporation
NWCWEB.com
============================================
NWCWEB.com - Your Design & Hosting Solution!
Featuring Ensim Pro/Linux Servers, Hosted
Accounts, Web Design and e-Commerce services
NWC Corporation - Global e-Pay Solutions
============================================
--
Message scanned by MailScanner, and is believed to be clean.
CONFIDENTIALITY NOTICE: This transmission intended for the
specified destination and person. If this is not you, this
e-mail must be deleted immediately. www.nwcweb.com
RE: [OT] Interesting Data Points
Posted by Shayne Lebrun <sl...@muskoka.com>.
> This of course breaks the MX priority scheme, and smtp RFC...
>
Do it the other way, as you said; primary, secondary, tertiary.
Set up some checks so that if the primary or secondary are accepting mail,
anything received by the tertiary is quietly accepted and dropped. Or get
fancy; start blacklisting servers, whatever.
Re: [OT] Interesting Data Points
Posted by DEFFONTAINES Vincent <vi...@coe.int>.
Scott Rothgaber wrote:
> Spam Admin wrote:
>
>> secondary MX servers are likely less "secure"
>
>
> Not less secure, but maybe less armed. The secondary might not have
> all of the anti-spam stuff on it, so the message gets accepted. Now
> the messages are being forwarded to the primary by a trusted host.
>
> You need to have the same SMTP-level stuff on the secondary!
>
>
This topic leads to (possibly?) interesting new anti-spam MX architectures :
As spammers use the traditionnal MX-priority scheme to turn around
tests, this might be a way to go, provided you own enough IP addresses :
Imagine you own 2 physical boxes for incoming emails at your domain.
The "old" traditionnal scheme would be to have one primary MX on first
box, and one secondary on the 2nd box.
"New" scheme : set 2 public IPs per box.
Each box owns a Primary MX on one of its IP, which guarantees email
serving redundancy, and basic failover.
On it's second IP, each box listens as secondary MX, and this is getting
interesting : you use secondary MX only to trap spam.
You can quite safely assume no legit email will never come it on
secondary, as you own 2 primary MXes...
So any email coming in a secondary MX can safely be considered as spam,
hence, silently dropped, bayes fed, spamcoped, etc...
This of course breaks the MX priority scheme, and smtp RFC...
Probably some more clever extend of this can be thought of.
(using third MX maybe?)
Vincent
Re: [OT] Interesting Data Points
Posted by "C. Bensend" <be...@bennyvision.com>.
> Not less secure, but maybe less armed. The secondary might not have all
> of the anti-spam stuff on it, so the message gets accepted. Now the
> messages are being forwarded to the primary by a trusted host.
>
> You need to have the same SMTP-level stuff on the secondary!
Well, maybe.
My two secondary MX hosts have _no_ filtering, no anti-spam anything.
However, when they spool any queued messages to my primary, they're
filtered with the rest of the unwashed masses. My secondaries are in
no way trusted. And personally, I don't understand why anyone WOULD
trust secondary MX hosts. To me, they're just another mailserver, and
are nothing special.
Benny
--
"Oh, the Jedis are going to feel this one!" -- Professor Farnsworth,
"Futurama"
Re: [OT] Interesting Data Points
Posted by Scott Rothgaber <sc...@palmetto.tv>.
Spam Admin wrote:
> secondary MX servers are likely less "secure"
Not less secure, but maybe less armed. The secondary might not have all
of the anti-spam stuff on it, so the message gets accepted. Now the
messages are being forwarded to the primary by a trusted host.
You need to have the same SMTP-level stuff on the secondary!
Re: [OT] Interesting Data Points
Posted by Duncan Hill <sa...@nacnud.force9.co.uk>.
On Monday 07 June 2004 16:13, Spam Admin wrote:
> - Since no legitimate email is being directed to the secondary server,
> this means that my primary SA box - running on a Dell GX270 workstation
I've observed this behaviour myself. However, there is a slight flaw in the
logic :>
Assume, that for whatever reason, the primary MX is unavailable. The
secondary is now no longer a spam trap, but a real MX.
And, I've seen some $bigname ISP MTAs that skip the primary MX, and head right
for the secondary, despite the primary being alive and reachable from the
ISP's netspace.
Now, a neat trick is the script someone here (or in postfix land) sent to me,
which knows whether the primary is up, and alters an SA score on the
secondary based on this condition. If the primary is alive, and you send
mail to the secondary, an additional x points are tacked on. If the primary
is dead, they aren't tacked on.
The biggest problem is assuming that the remote end will obey the RFCs when
sending legit mail. Should be known by now that this isn't always the case.
The best defense on a secondary is probably the list of valid email addresses
to deliver to. This will stop bounce-storms from dictionary attacks bogging
down your servers. Toss in some useful but not over-the-top DNSBLs (based on
preference of course), and you have a secondary MX that can be a legit MX
(safely) and still defend itself against a large portion of spammers.
And whoever said MX 127.0.0.1 - I keep seeing that coming up on the postfix
list (I think) and the general reply is 'Stop breaking things'. MX of . is
supposedly the correct way, otherwise real MTAs start getting 'mail loops
back to me' errors.
Re: [OT] Interesting Data Points
Posted by Jon Trulson <jo...@radscan.com>.
On Wed, 9 Jun 2004, David B Funk wrote:
> From: David B Funk <db...@engineering.uiowa.edu>
> Date: Wed, 9 Jun 2004 21:21:06 -0500 (CDT)
> Subject: Re: [OT] Interesting Data Points
> To: spamassassin-users@incubator.apache.org
> X-Spam-Status: No, hits=-4.9 required=5.0 tests=AWL,BAYES_00 autolearn=ham
> version=2.60
>
> On Tue, 8 Jun 2004, Jon Trulson wrote:
>
> > I think at least some of these spammers see that the secondary (at
[...]
> >
> > Anybody tried creating a bogus, low numbered secondary? Would be
> > neato if the spammers got delayed a bit trying to connect to a
> > non-existant machine...
>
> Actually tried this.
> Created an alias interface on a machine, DNS listed it as a high MX and
> ip-filtered its port 25 (so I could monitor attempts to use it).
>
> Saw numerous spammer hits on it but also saw hits by legitmate
> mail sites. Dropped it when I got some complaints from users about
> delivery errors from people they corresponded with.
>
Bummer. Guess I won't try this then :)
Thanks!
--
Jon Trulson mailto:jon@radscan.com
ID: 1A9A2B09, FP: C23F328A721264E7 B6188192EC733962
PGP keys at http://radscan.com/~jon/PGPKeys.txt
#include <std/disclaimer.h>
"I am Nomad." -Nomad
Re: [OT] Interesting Data Points
Posted by David B Funk <db...@engineering.uiowa.edu>.
On Tue, 8 Jun 2004, Jon Trulson wrote:
> I think at least some of these spammers see that the secondary (at
> least in my case) accepts alot of their spam, so they assume "Ah ha! my
> crap is getting through here!". Though in reality, once the secondary
> tries to deliver it to the primary (with all of the spamassassin goodness
> on it), it gets dumped.
>
> Anybody tried creating a bogus, low numbered secondary? Would be
> neato if the spammers got delayed a bit trying to connect to a
> non-existant machine...
Actually tried this.
Created an alias interface on a machine, DNS listed it as a high MX and
ip-filtered its port 25 (so I could monitor attempts to use it).
Saw numerous spammer hits on it but also saw hits by legitmate
mail sites. Dropped it when I got some complaints from users about
delivery errors from people they corresponded with.
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
Re: [OT] Interesting Data Points
Posted by Lucas Albers <ad...@cs.montana.edu>.
Jon Trulson said:
> Anybody tried creating a bogus, low numbered secondary? Would be
> neato if the spammers got delayed a bit trying to connect to a
> non-existant machine...
Spammers have an unlimited number of zombie systems running ratware smtp
servers that spew out upwards of 5,000 simultaneous connections.
You can't tarpit them, don't bother.
Greylisting does help though.
--
Luke Computer Science System Administrator
Security Administrator,College of Engineering
Montana State University-Bozeman,Montana
Re: [OT] Interesting Data Points
Posted by Jon Trulson <jo...@radscan.com>.
On Mon, 7 Jun 2004, Martin Hepworth wrote:
> From: Martin Hepworth <ma...@solid-state-logic.com>
> Date: Mon, 07 Jun 2004 16:21:10 +0100
> Subject: Re: [OT] Interesting Data Points
> To: Spam Admin <sa...@harthosp.org>
> Cc: spamassassin-users@incubator.apache.org
> X-Spam-Status: No, hits=-4.8 required=5.0 tests=AWL,BAYES_00 autolearn=ham
> version=2.60
>
> Gary
>
> yup, we get alot of our spam via our secondary MX at our ISP. The
> spammers seem to think that somehow people trust the secondary MX server
> when it delivers to the main MX server...dunno why???
>
Yes I wondered about this too... Our secondary does no spam
checking at all (except for a few MTA RBL's). Then it just stores it for
delivery to the primary.
I think at least some of these spammers see that the secondary (at
least in my case) accepts alot of their spam, so they assume "Ah ha! my
crap is getting through here!". Though in reality, once the secondary
tries to deliver it to the primary (with all of the spamassassin goodness
on it), it gets dumped.
Anybody tried creating a bogus, low numbered secondary? Would be
neato if the spammers got delayed a bit trying to connect to a
non-existant machine...
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> Spam Admin wrote:
> > I implemented a new Postfix/Amavis-D/SA/RDJ/URI box this morning. The
> > current one is working great, but it's on a Dell desktop and that gives
> > management the willies. The new SA box is on better, server-class
> > hardware and will eventually be the top dog; both are receive-only
> > filter-and-forward boxes, fronting my GroupWise email system.
> >
> > For testing purposes, I implemented the new box as a secondary server,
> > with a numerically-higher MX preference. I expected to see some traffic
> > on it within an hour or two, but within *23 seconds* of adding the DNS
> > records I started getting hit by spammers. 23 seconds!!! I claim the new
> > world's record...
> >
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
--
Jon Trulson mailto:jon@radscan.com
ID: 1A9A2B09, FP: C23F328A721264E7 B6188192EC733962
PGP keys at http://radscan.com/~jon/PGPKeys.txt
#include <std/disclaimer.h>
"I am Nomad." -Nomad
Re: [OT] Interesting Data Points
Posted by Martin Hepworth <ma...@solid-state-logic.com>.
Gary
yup, we get alot of our spam via our secondary MX at our ISP. The
spammers seem to think that somehow people trust the secondary MX server
when it delivers to the main MX server...dunno why???
--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300
Spam Admin wrote:
> I implemented a new Postfix/Amavis-D/SA/RDJ/URI box this morning. The
> current one is working great, but it's on a Dell desktop and that gives
> management the willies. The new SA box is on better, server-class
> hardware and will eventually be the top dog; both are receive-only
> filter-and-forward boxes, fronting my GroupWise email system.
>
> For testing purposes, I implemented the new box as a secondary server,
> with a numerically-higher MX preference. I expected to see some traffic
> on it within an hour or two, but within *23 seconds* of adding the DNS
> records I started getting hit by spammers. 23 seconds!!! I claim the new
> world's record...
>
**********************************************************************
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.
This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.
**********************************************************************
Re: [OT] Interesting Data Points
Posted by Kai <ka...@conti.nu>.
On 6/7/2004 at 11:13 AM, "Spam Admin" <sa...@harthosp.org> wrote:
> For testing purposes, I implemented the new box as a secondary server,
> with a numerically-higher MX preference. I expected to see some traffic
> on it within an hour or two, but within *23 seconds* of adding the DNS
> records I started getting hit by spammers. 23 seconds!!! I claim the new
> world's record...
> What is interesting to note that that this box is receiving 100% UCE;
> no legitimate non-UCE email is coming in. Virtually 100% of the first
> hour of that was getting blocked at the SMTP level by reference to
> dynablock.njabl.org with other RBLs starting to creep in as the morning
> progressed. So far, everything that gets by the RBLs is getting
> quarantined by SA/RDJ/SpamURI - everything. This info tells me a few
> things:
> - The worms on broadband PCs that are running these spam servers like
> to hit the secondary (and probably tertiary) MX records first. I'm
Worms doing this are a more recent development.
I only saw this thread now, 9 days later, but rewind 2 months,
over on Spamtools-L : FYI.
--------
Date: Mon, 5 Apr 2004 16:33:14 -0400
From: "Kai Schlichting"
Organization: Doh
To: spamtools
Subject: [spamtools] a trapping smtpd to catch lowest-MX rapists
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 8bit
X-DCC-IECC-Metrics: xuxa.iecc.com 1107; Body=1 Fuz1=1 Fuz2=1
List-Help: <mailto:spamtools-request@lists.abuse.net?subject=help> (List Instructions)
List-Unsubscribe: (Use this command to get off the list)
<mailto:spamtools-request@lists.abuse.net?body=unsubscribe%20spamtools>
List-Subscribe: (Use this command to join the list)
<mailto:spamtools-request@lists.abuse.net?body=subscribe%20spamtools>
List-Post: <ma...@lists.abuse.net>
List-Owner: <ma...@lists.abuse.net> (Contact Person for Help)
List-ID: <spamtools.abuse.net>
Precedence: bulk
Sender: owner-spamtools@lists.abuse.net
Reply-To: spamtools@lists.abuse.net
I have written a fake SMTP daemon a couple of weeks ago that I wish
to share: dummy-smtpd, available at http://www.spamshield.org/#tools
" (V1.0, 20040327) - a fake logging SMTP daemon, designed to fool spamware
attempting to circumvent your spam filters by connecting to your domains'
lowest-priority mail exchanger (MX)"
I've used this for about 2 months on all of the domains we MX for, and
the results are quite staggering: unless you have a primary MX that
is busy/slow/unavailable at times, a lowest-priority MX will receive
almost nothing but connections from proxy-raping spamware trying to
deliver mail for your domain(s), in the hope that your secondary MX's
don't have the same strong spam protection mechanisms (and possibly
not a full view of deliverable addresses) as your primary MX.
Unfortunately, this assumption is a valid one at a lot of large,
corporate sites.
- Much of that proxy-rapist spamware never calls back (on the primary MX),
after going through 10-30 open proxies for the same rejected or
delayed (550/450 return code) mail to a single recipient.
Of course, there's a few well-known computer criminals/spamhauses spewing
directly from their own IP space, that are using the 'deliver to lowest-MX
only' trick as well: newageoptin.com/merchantcommerce.com/aka Boris Mizhen/
tautel.ru (AS 30857) is one such criminal spamfactory. See
log example below.
Beware: dummy-smtpd has a rather foul potty mouth by default -
see source, or try your luck at the lowest-priority MX for
conti.nu, by trying to issue a few not-so-RFC2821-syntax-compliant
commands :)
There's a "Sendmail" syslog style mode built-in as well, that
generates syslog entries in SM format, with a few enhancements like
EHLO/HELO parameter used, all valid and invalid addresses used
in RCPT TO: listed on the to= line, all DNSBL matches, assumed host
type (dynamic IP, etc.) and rDNS state (forged, unknown, FCrDNS)
of the connecting host.
Whether you use dummy-smtpd for 'experimental purposes', or as a
defensive mechanism, or even as a feeder into a DNSBL, is really up
to you.
bye,Kai
ps: this daemon is most certainly not suitable for high-volume sites,
as it's written in Perl and needs way too much memory for way too many
wall-clock seconds. Adjusting the command delays (all configurable
in seconds) is probably desirable.
--
| Currently seeking new employment/contract Kai Schlichting |
| in NYC/Long Island area. Sophisticated Technical Peon |
| http://www.SpamShield.org |
| This .sig formats right with a fixed-size font :) |
LeasedLines-FrameRelay-IPLs-ISDN-PPP-Cisco-Consulting-VoiceFax-Data-Muxes
WorldWideWebAnything-Intranets-NetAdmin-UnixAdmin-Security-ReallyHardMath
Debug log example:
2004/03/26 11:29:11: dummy-smtpd[27820]: connect 82.114.51.52:62496 ([unknown rDNS status]
www2.c05.localnetservice.com)
2004/03/26 11:29:11: dummy-smtpd[27820]: 2 sec: [82.114.51.52] DNSBL-listed in ahbl,sbl
2004/03/26 11:29:24: dummy-smtpd[27820]: 15 sec: [82.114.51.52] unmatched/forged hostname: HELO
www2.c05.localnetservice.com
2004/03/26 11:29:35: dummy-smtpd[27820]: 26 sec: [82.114.51.52] MAIL FROM:
<Ac...@onlinebargains01.com>
2004/03/26 11:29:46: dummy-smtpd[27820]: 37 sec: [82.114.51.52] RCPT TO: <XX...@pac-rim.net> -
fails: User unknown. This address has been defunct for 4 years or more - only spammers would ever
send mail to it - Spammers must die.
2004/03/26 11:30:02: dummy-smtpd[27820]: 53 sec: [82.114.51.52] cmd: DATA
2004/03/26 11:30:12: dummy-smtpd[27820]: [82.114.51.52] DATA: Received: (qmail 6852 invoked by uid
0); 26 Mar 2004 19:38:13 +0300
2004/03/26 11:30:12: dummy-smtpd[27820]: [82.114.51.52] DATA: From: Memory Accelerator
<Ac...@onlinebargains01.com>
2004/03/26 11:30:12: dummy-smtpd[27820]: [82.114.51.52] DATA: Return-path:
<iu...@onlinebargains01.com>
2004/03/26 11:30:12: dummy-smtpd[27820]: [82.114.51.52] DATA: To: <XX...@pac-rim.net>
2004/03/26 11:30:12: dummy-smtpd[27820]: [82.114.51.52] DATA: Subject: Increase Your Pc's Memory
Instantly
2004/03/26 11:30:12: dummy-smtpd[27820]: [82.114.51.52] DATA: Date: Fri, 26 Mar 2004 19:38:13 +0300
2004/03/26 11:30:12: dummy-smtpd[27820]: [82.114.51.52] DATA: Message-Id:
<sd...@onlinebargains01.com>
2004/03/26 11:30:12: dummy-smtpd[27820]: [82.114.51.52] DATA: Mime-Version: 1.0
2004/03/26 11:30:12: dummy-smtpd[27820]: [82.114.51.52] DATA: Content-Type: text/html;
charset="iso-8859-1"
2004/03/26 11:30:12: dummy-smtpd[27820]: [82.114.51.52] DATA:
2004/03/26 11:30:12: dummy-smtpd[27820]: 63 sec: [82.114.51.52] read complete header up to 25 lines
- aborting.
2004/03/26 11:30:12: dummy-smtpd[27820]: out: [82.114.51.52] 452 4.5.0 Requested mail action
aborted: insufficient system storage
2004/03/26 11:30:12: dummy-smtpd[27820]: 63 sec: closed connection with [82.114.51.52]
Simulated Sendmail log:
Mar 26 11:29:46 localhost dummy-smtpd[27820]: 03261129P27820: <XX...@pac-rim.net>... User unknown.
This address has been defunct for 4 years or more - only spammers would ever send mail to it -
Spammers must die.
Mar 26 11:30:12 localhost dummy-smtpd[27820]: 03261129P27820:
from=<Ac...@onlinebargains01.com>, size=2000, class=0, nrcpts=1, proto=SMTP,
ehlo=www2.c05.localnetservice.com, daemon=dummy-smtpd, dnsbls=ahbl,sbl, host_type=untrusted,
rdns=unknown_forged, relay=www2.c05.localnetservice.com [82.114.51.52] (may be forged)
Mar 26 11:30:12 localhost dummy-smtpd[27820]: 03261129P27820: to=<XX...@pac-rim.net>,
delay=00:01:03, xdelay=00:01:03, mailer=local, pri=0, dsn=4.0.0, stat=Deferred: caught in dummy-smtpd
trap