You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by redtailjason <ja...@redtailtechnology.com> on 2016/03/30 15:18:17 UTC
Configuration Help Request: Spoofed Email Being Whitelisted
Hello. We are seeing an issue where spoofed spam is being whitelisted to our
domain. We host over 10,000 mailboxes but the issue is only occurring to
within our corporate domain. I have checked all local configs on our eight
scanners and do not show that our domain has been whitelisted.
Our primary SpamAssassin technician left the company unexpectedly and I am
working to learn the ins and outs of SA. Our system uses Symantec Secure
Messaging Gateway as our gateway. It then hands off the email to SA for
scanning.
I believe this may be related to a particular configuration within
SpamAssassin, Amavis, or Postfix but I am having trouble isolating it. Any
help you may be able to provide would be greatly appreciated.
Below is an excerpt from the headers of an example. Please let me know what
additional information you may need to know.
Return-Path: EPSON@redtailtechnology.com
Received: from 192.168.1.236 (LHLO smtp.redtailtechnology.com)
(192.168.1.236) by store1.redtailtechnology.com with LMTP; Wed, 30 Mar 2016
04:50:54 -0700 (PDT)
Received: from smtp.redtailtechnology.com (localhost [127.0.0.1])
by smtp.redtailtechnology.com (Postfix) with ESMTPS id 8D1AC241E6
for <ja...@redtailtechnology.com>; Wed, 30 Mar 2016 04:50:54 -0700
(PDT)
Received: from smtp.redtailtechnology.com (localhost [127.0.0.1])
by smtp.redtailtechnology.com (Postfix) with ESMTPS id 60A7E2419F
for <ja...@redtailtechnology.com>; Wed, 30 Mar 2016 04:50:54 -0700
(PDT)
Received: from smfemlsec008.redtailtechnology.com (unknown [192.168.4.38])
by smtp.redtailtechnology.com (Postfix) with ESMTP id 0D46E23040
for <ja...@redtailtechnology.com>; Wed, 30 Mar 2016 04:50:54 -0700
(PDT)
Received: from localhost (localhost [127.0.0.1])
by smfemlsec008.redtailtechnology.com (Postfix) with ESMTP id D0F0C440D55
for <ja...@redtailtechnology.com>; Wed, 30 Mar 2016 04:50:54 -0700
(PDT)
X-Virus-Scanned: Debian amavisd-new at smfemlsec008.redtailtechnology.com
X-Spam-Flag: NO
X-Spam-Score: 0
X-Spam-Level:
X-Spam-Status: No, score=x tagged_above=-999 required=6 WHITELISTED tests=[]
autolearn=unavailable
Received: from smfemlsec008.redtailtechnology.com ([IPv6:::ffff:127.0.0.1])
by localhost (smfemlsec008.redtailtechnology.com [::ffff:127.0.0.1])
(amavisd-new, port 10024)
with ESMTP id d8lTFWK8x7HI for <ja...@redtailtechnology.com>;
Wed, 30 Mar 2016 04:50:54 -0700 (PDT)
Received: from MAILSECURITY010.redtailtechnology.com (unknown
[192.168.5.250])
by smfemlsec008.redtailtechnology.com (Postfix) with ESMTP id 991A5440D37
for <ja...@redtailtechnology.com>; Wed, 30 Mar 2016 04:50:54 -0700 (PDT)
X-AuditID: c0a805fa-f79cd6d000005f93-77-56fbbd9dffc7
Received: from [1.22.69.90] (Unknown_Domain [192.168.1.175])
by MAILSECURITY010.redtailtechnology.com (Symantec Messaging Gateway) with
SMTP id 69.3E.24467.E9DBBF65; Wed, 30 Mar 2016 04:50:54 -0700 (PDT)
From: EPSON <EP...@redtailtechnology.com>
To: "jason@redtailtechnology.com" <ja...@redtailtechnology.com>
Subject: Emailing: docment_445.tiff
Thread-Topic: Emailing: docment_445.tiff
Thread-Index: AdF19gcy1pI0QqthRiW4cvvoSHimaQ==
Date: Wed, 30 Mar 2016 17:20:47 +0530
Message-ID: <5E...@redtailtechnology.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
x-originating-ip: [192.168.9.7]
Content-Type: multipart/mixed;
boundary="_009_969736950B901A97BC6F12CCEAED34481501232322711FCF93emamil_"
MIME-Version: 1.0
X-MXScan-Scan: Scanned by MxScan 2.7.501.0 for WIN-3EAMS8MV18J
X-MXScan-Msgid: 11014316981197995070449318587208_
X-MXScan-License: {Unregistered Version} Only for personal and
non-commercial use. Commercial use is PROHIBITED and requires a license.
X-MXScan-AntiVirus: ClamAV devel-clamav-0.97-408-ge11f7cc/21435/Wed, 30 Mar
2016 17:20:47 +0530 [Clean]
X-MXScan-AntiSpam: KEYWORD [Pass], RDNSBL [Pass], URLBL [NA], SPAMASSASSIN
[NA], DCC_CHECK [NA]
X-MXScan-SpamScore: 0
X-MXScan-ProcessingTime: 5.063 sec(s)
X-ME-Bayesian: 0.000000
--
View this message in context: http://spamassassin.1065346.n5.nabble.com/Configuration-Help-Request-Spoofed-Email-Being-Whitelisted-tp120328.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: Configuration Help Request: Spoofed Email Being Whitelisted
Posted by Reindl Harald <h....@thelounge.net>.
Am 30.03.2016 um 15:18 schrieb redtailjason:
> Hello. We are seeing an issue where spoofed spam is being whitelisted to our
> domain. We host over 10,000 mailboxes but the issue is only occurring to
> within our corporate domain. I have checked all local configs on our eight
> scanners and do not show that our domain has been whitelisted.
>
> Our primary SpamAssassin technician left the company unexpectedly and I am
> working to learn the ins and outs of SA. Our system uses Symantec Secure
> Messaging Gateway as our gateway. It then hands off the email to SA for
> scanning.
why does your "Symantec Secure Messaging Gateway" accept inbound mail
from the internet with your own domain at all?
Re: Configuration Help Request: Spoofed Email Being Whitelisted
Posted by RW <rw...@googlemail.com>.
On Wed, 30 Mar 2016 06:18:17 -0700 (MST)
redtailjason wrote:
> Hello. We are seeing an issue where spoofed spam is being whitelisted
> to our domain.
>..
> X-Spam-Score: 0
> X-Spam-Level:
> X-Spam-Status: No, score=x tagged_above=-999 required=6 WHITELISTED
> tests=[] autolearn=unavailable
I'm not sure this header was actually generated by spamassassin. Note
the "score=x" rather than "score=0.0" and I don't recall there being a
tag to insert "WHITELISTED" like that.
I suspect that some glue code bypassed SA and put in dummy headers.
Re: Configuration Help Request: Spoofed Email Being Whitelisted
Posted by Bill Cole <sa...@billmail.scconsult.com>.
On 31 Mar 2016, at 10:50, Matus UHLAR - fantomas wrote:
>> On 30 Mar 2016, at 9:48, Matus UHLAR - fantomas wrote:
>>
>>> On 30.03.16 06:18, redtailjason wrote:
>> [....]
>>> The headers you have posted show mail that only goes through
>>> internal IPs and localhost, that mail doesn't seem to come from
>>> outside.
>
> On 31.03.16 09:23, Bill Cole wrote:
>> I believe that this is not correct.
>
> I have looksed at all headers in the original mail, they were
> localhost or
> from private range 192.168.0.0/16
>
>>> it also looks that it comes from EPSON scanner, and has .tiff
>>> attachment
>>> that is quite common for scanned documents.
>>
>> It is meant to seem that way. This is a very common flavor of spam
>> these days, although no well-run system accepts it.
>>
>> Unfortunately...
>>
>> [...]
>>
>>>> Received: from [1.22.69.90] (Unknown_Domain [192.168.1.175])
>>>> by MAILSECURITY010.redtailtechnology.com (Symantec Messaging
>>>> Gateway) with
>>>> SMTP id 69.3E.24467.E9DBBF65; Wed, 30 Mar 2016 04:50:54 -0700 (PDT)
>>
>> 1.22.69.90 is a known recently active spambot:
>> http://www.abuseat.org/lookup.cgi?ip=1.22.69.90 and it seems like
>> that spambot is using a proper IP literal of its own IP as its HELO
>> argument, but is actually appearing to be 192.168.1.175. This is
>> possible in some environments that use firewalls which NAT inbound
>> connections so that they seem to come from the firewall itself.
>
> Well, if this is the case, I'm done with it. Are you going to help
> anyone
> with that dumb network copnfiguration, that makes it very hard to
> fight
> spam?
Well, he DID mention that he just had the "primary SpamAssassin guy"
leave unexpectedly, maybe that guy did networking too and wasn't very
good at it, or he flipped an obscure setting on a networking device on
his way out the door as sabotage. Only people with broken stuff need
fixing help anyway...
[...]
> I agree. But I would first check if that's really the NAT nonsense
> (hide
> real IP, so we can't find it in blacklists...)
Yes, it's very annoying. Some years back (10?) it was the default config
for F5 Big-IP load balancers and I had to throw a major fit to get the
MTA's at my employer out from behind that junk to where DNS would (and
did) do their load balancing without an extra layer of complexity.
Perhaps it is relevant to note that the OP's domain has a single MX and
when I connected to port 25 on it this morning it bannered as
MAILSECURITY009.redtailtechnology.com and I went no further, but note
that the OP shows a MAILSECURITY010.redtailtechnology.com handling mail.
Odd, that...
Just now I did this:
$ telnet mail1.redtailtechnology.com 25
Trying 65.74.131.101...
Connected to mail1.redtailtechnology.com.
Escape character is '^]'.
220 MAILSECURITY005.redtailtechnology.com ESMTP Symantec Messaging
Gateway
ehlo dynnat.scconsult.com
250-MAILSECURITY005.redtailtechnology.com says EHLO to
192.168.1.175:44719
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-SIZE 62914560
250 PIPELINING
quit
221 2.3.0 MAILSECURITY005.redtailtechnology.com closing connection
Well, there's your problem right there: there's a gang of Symantec
Messaging Gateway devices (probably at least 10 of them, maybe MANY
more) that think they only ever get mail from 192.168.1.175, which is
obviously whitelisted because it's an internal RFC1918 IP and your
inside machines like desktops and the laptops people take home and let
their kids play on NEVER get infected (ummm...) I bet 192.168.1.175 is
the inside interface on a load balancer. Maybe even a F5 Big-IP, as I
understand they still are quite popular.
To the Original Poster:
Hey, Jason: STOP DOING THAT, IT'S VERY VERY BAD.
DNS round-robin is generally all you need to balance load reasonably
across a reasonable number of inbound MTAs. If you really need that
third digit to name all your gateways, I know a guy who came up with a
way to make scores of MXs swarm like bees in DNS for XO back when it was
Concentric and I can probably hook you up with him, although he's
probably not cheap. If all you have is a dozen, 4 equal-cost MX's
pointing to names with 3 different A records will do the trick, if you
keep the TTL's shortish.
Re: Configuration Help Request: Spoofed Email Being Whitelisted
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
>On 30 Mar 2016, at 9:48, Matus UHLAR - fantomas wrote:
>
>>On 30.03.16 06:18, redtailjason wrote:
>[....]
>>The headers you have posted show mail that only goes through
>>internal IPs and localhost, that mail doesn't seem to come from
>>outside.
On 31.03.16 09:23, Bill Cole wrote:
>I believe that this is not correct.
I have looksed at all headers in the original mail, they were localhost or
from private range 192.168.0.0/16
>>it also looks that it comes from EPSON scanner, and has .tiff
>>attachment
>>that is quite common for scanned documents.
>
>It is meant to seem that way. This is a very common flavor of spam
>these days, although no well-run system accepts it.
>
>Unfortunately...
>
>[...]
>
>>>Received: from [1.22.69.90] (Unknown_Domain [192.168.1.175])
>>> by MAILSECURITY010.redtailtechnology.com (Symantec Messaging
>>>Gateway) with
>>>SMTP id 69.3E.24467.E9DBBF65; Wed, 30 Mar 2016 04:50:54 -0700 (PDT)
>
>1.22.69.90 is a known recently active spambot:
>http://www.abuseat.org/lookup.cgi?ip=1.22.69.90 and it seems like
>that spambot is using a proper IP literal of its own IP as its HELO
>argument, but is actually appearing to be 192.168.1.175. This is
>possible in some environments that use firewalls which NAT inbound
>connections so that they seem to come from the firewall itself.
Well, if this is the case, I'm done with it. Are you going to help anyone
with that dumb network copnfiguration, that makes it very hard to fight
spam?
> On
>the other hand, this is a proprietary device which may be building
>its Received header perversely... In any case, something is either
>claiming to be or seeming to be a spambot in Mumbai when talking to
>an inbound MTA in California, which seems unlikely to be in any way a
>normal internal mail transmission.
>
>This is a problem at the "Symantec Messaging Gateway" device and
>possibly with how it sees connections from the net at large.
>Fortunately, Symantec has people paid to support their systems (at
>least for p[aying customers) and one need not post the same thing 3
>times in 5 minutes to a public mailing list to get them to respond.
>
>So the OP needs to talk to his vendor. It is;letting mail in from a
>source that NO ONE should be accepting mail from. The family of bot
>CBL thinks that 1.22.69.90 is running says HELO in sub-second times
>after connecting whether it sees a banner or not. If Symantec's crap
>doesn't refuse that sort of client it is living up to their
>reputation for selling the widest collection of popular but broken
>garbage of any tech vendor.
I agree. But I would first check if that's really the NAT nonsense (hide
real IP, so we can't find it in blacklists...)
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
"To Boot or not to Boot, that's the question." [WD1270 Caviar]
Re: Configuration Help Request: Spoofed Email Being Whitelisted
Posted by Bill Cole <sa...@billmail.scconsult.com>.
On 30 Mar 2016, at 9:48, Matus UHLAR - fantomas wrote:
> On 30.03.16 06:18, redtailjason wrote:
[....]
> The headers you have posted show mail that only goes through
> internal IPs and localhost, that mail doesn't seem to come from
> outside.
I believe that this is not correct.
> it also looks that it comes from EPSON scanner, and has .tiff
> attachment
> that is quite common for scanned documents.
It is meant to seem that way. This is a very common flavor of spam these
days, although no well-run system accepts it.
Unfortunately...
[...]
>> Received: from [1.22.69.90] (Unknown_Domain [192.168.1.175])
>> by MAILSECURITY010.redtailtechnology.com (Symantec Messaging
>> Gateway) with
>> SMTP id 69.3E.24467.E9DBBF65; Wed, 30 Mar 2016 04:50:54 -0700 (PDT)
1.22.69.90 is a known recently active spambot:
http://www.abuseat.org/lookup.cgi?ip=1.22.69.90 and it seems like that
spambot is using a proper IP literal of its own IP as its HELO argument,
but is actually appearing to be 192.168.1.175. This is possible in some
environments that use firewalls which NAT inbound connections so that
they seem to come from the firewall itself. On the other hand, this is a
proprietary device which may be building its Received header
perversely... In any case, something is either claiming to be or seeming
to be a spambot in Mumbai when talking to an inbound MTA in California,
which seems unlikely to be in any way a normal internal mail
transmission.
This is a problem at the "Symantec Messaging Gateway" device and
possibly with how it sees connections from the net at large.
Fortunately, Symantec has people paid to support their systems (at least
for p[aying customers) and one need not post the same thing 3 times in 5
minutes to a public mailing list to get them to respond.
So the OP needs to talk to his vendor. It is;letting mail in from a
source that NO ONE should be accepting mail from. The family of bot CBL
thinks that 1.22.69.90 is running says HELO in sub-second times after
connecting whether it sees a banner or not. If Symantec's crap doesn't
refuse that sort of client it is living up to their reputation for
selling the widest collection of popular but broken garbage of any tech
vendor.
Re: Configuration Help Request: Spoofed Email Being Whitelisted
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
On 30.03.16 06:18, redtailjason wrote:
>Hello. We are seeing an issue where spoofed spam is being whitelisted to our
>domain.
this is quote common issue for people that whitelist their own
domain/address and then wonder that spammers use them too.
(and spammers use their domains/addresses because many people whitelist
them).
>Below is an excerpt from the headers of an example. Please let me know what
>additional information you may need to know.
The headers you have posted show mail that only goes through
internal IPs and localhost, that mail doesn't seem to come from outside.
it also looks that it comes from EPSON scanner, and has .tiff attachment
that is quite common for scanned documents.
that means, it may be scanned document, or a fax, hoever it's not easy to
process scanned faxes for spammines.
>Return-Path: EPSON@redtailtechnology.com
>Received: from 192.168.1.236 (LHLO smtp.redtailtechnology.com)
> (192.168.1.236) by store1.redtailtechnology.com with LMTP; Wed, 30 Mar 2016
> 04:50:54 -0700 (PDT)
>Received: from smtp.redtailtechnology.com (localhost [127.0.0.1])
> by smtp.redtailtechnology.com (Postfix) with ESMTPS id 8D1AC241E6
> for <ja...@redtailtechnology.com>; Wed, 30 Mar 2016 04:50:54 -0700
>(PDT)
>Received: from smtp.redtailtechnology.com (localhost [127.0.0.1])
> by smtp.redtailtechnology.com (Postfix) with ESMTPS id 60A7E2419F
> for <ja...@redtailtechnology.com>; Wed, 30 Mar 2016 04:50:54 -0700
>(PDT)
>Received: from smfemlsec008.redtailtechnology.com (unknown [192.168.4.38])
> by smtp.redtailtechnology.com (Postfix) with ESMTP id 0D46E23040
> for <ja...@redtailtechnology.com>; Wed, 30 Mar 2016 04:50:54 -0700
>(PDT)
>Received: from localhost (localhost [127.0.0.1])
> by smfemlsec008.redtailtechnology.com (Postfix) with ESMTP id D0F0C440D55
> for <ja...@redtailtechnology.com>; Wed, 30 Mar 2016 04:50:54 -0700
>(PDT)
>X-Virus-Scanned: Debian amavisd-new at smfemlsec008.redtailtechnology.com
>X-Spam-Flag: NO
>X-Spam-Score: 0
>X-Spam-Level:
>X-Spam-Status: No, score=x tagged_above=-999 required=6 WHITELISTED tests=[]
> autolearn=unavailable
>Received: from smfemlsec008.redtailtechnology.com ([IPv6:::ffff:127.0.0.1])
> by localhost (smfemlsec008.redtailtechnology.com [::ffff:127.0.0.1])
>(amavisd-new, port 10024)
> with ESMTP id d8lTFWK8x7HI for <ja...@redtailtechnology.com>;
> Wed, 30 Mar 2016 04:50:54 -0700 (PDT)
>Received: from MAILSECURITY010.redtailtechnology.com (unknown
>[192.168.5.250])
> by smfemlsec008.redtailtechnology.com (Postfix) with ESMTP id 991A5440D37
> for <ja...@redtailtechnology.com>; Wed, 30 Mar 2016 04:50:54 -0700 (PDT)
>X-AuditID: c0a805fa-f79cd6d000005f93-77-56fbbd9dffc7
>Received: from [1.22.69.90] (Unknown_Domain [192.168.1.175])
> by MAILSECURITY010.redtailtechnology.com (Symantec Messaging Gateway) with
>SMTP id 69.3E.24467.E9DBBF65; Wed, 30 Mar 2016 04:50:54 -0700 (PDT)
>From: EPSON <EP...@redtailtechnology.com>
>To: "jason@redtailtechnology.com" <ja...@redtailtechnology.com>
>Subject: Emailing: docment_445.tiff
>Thread-Topic: Emailing: docment_445.tiff
>Thread-Index: AdF19gcy1pI0QqthRiW4cvvoSHimaQ==
>Date: Wed, 30 Mar 2016 17:20:47 +0530
>Message-ID: <5E...@redtailtechnology.com>
>Accept-Language: en-US
>Content-Language: en-US
>X-MS-Has-Attach: yes
>X-MS-TNEF-Correlator:
>x-originating-ip: [192.168.9.7]
>Content-Type: multipart/mixed;
> boundary="_009_969736950B901A97BC6F12CCEAED34481501232322711FCF93emamil_"
>MIME-Version: 1.0
>X-MXScan-Scan: Scanned by MxScan 2.7.501.0 for WIN-3EAMS8MV18J
>X-MXScan-Msgid: 11014316981197995070449318587208_
>X-MXScan-License: {Unregistered Version} Only for personal and
>non-commercial use. Commercial use is PROHIBITED and requires a license.
>X-MXScan-AntiVirus: ClamAV devel-clamav-0.97-408-ge11f7cc/21435/Wed, 30 Mar
>2016 17:20:47 +0530 [Clean]
>X-MXScan-AntiSpam: KEYWORD [Pass], RDNSBL [Pass], URLBL [NA], SPAMASSASSIN
>[NA], DCC_CHECK [NA]
>X-MXScan-SpamScore: 0
>X-MXScan-ProcessingTime: 5.063 sec(s)
>X-ME-Bayesian: 0.000000
>
>
>
>--
>View this message in context: http://spamassassin.1065346.n5.nabble.com/Configuration-Help-Request-Spoofed-Email-Being-Whitelisted-tp120328.html
>Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Linux IS user friendly, it's just selective who its friends are...