You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Andy Pieters <x_...@yahoo.fr> on 2005/11/13 21:48:38 UTC
Blocking on tld and/or HELO with own domain
Hi list
We have been receiving a lot of spam from the .jp tld lately. What's more is
this:
Received: from vlaamse-kern.com (pl027.nas934.d-osaka.nttpc.ne.jp
[61.197.82.27])
by giga.vlaamse-kern.com (8.13.1/8.13.1) with SMTP id jADFi1Wo028374
for andy@vlaamse-kern.com; Sun, 13 Nov 2005 16:44:02 +0100
Note that OUR domain is vlaamse-kern.com and that the sender pretends to be
vlaamse-kern.com as well!
Other statistics:
From: =?iso-2022-jp?B?QVRTVVNISQ==?=<at...@hotmail.com>
From pretends to be hotmail but is not.
With this info, is it possible to craft a rule that rejects these messages?
We have spamassassin running via kmail on all user accounts and I noticed a
spamassasin subdirectory in /etc/mail on the smtp server. I don't know if
sendmail calls it automatically?
With kind regards
Andy
--
Now listening to Top! Radio Live www.topradio.be/stream on amaroK
Geek code: www.vlaamse-kern.com/geek
Registered Linux User No 379093
If life was for sale, what would be its price?
www.vlaamse-kern.com/sas/ for free php utilities
--
Re: Blocking on tld and/or HELO with own domain
Posted by mouss <us...@free.fr>.
Andy Pieters a écrit :
>Hi list
>
>We have been receiving a lot of spam from the .jp tld lately. What's more is
>this:
>
>Received: from vlaamse-kern.com (pl027.nas934.d-osaka.nttpc.ne.jp
>[61.197.82.27])
> by giga.vlaamse-kern.com (8.13.1/8.13.1) with SMTP id jADFi1Wo028374
> for andy@vlaamse-kern.com; Sun, 13 Nov 2005 16:44:02 +0100
>
>Note that OUR domain is vlaamse-kern.com and that the sender pretends to be
>vlaamse-kern.com as well!
>
>
you can add an SA rule, but it's easier to block this in the MTA. I
don't use SM, but in postfix, this amounts to creatin a file containing
things like:
vlaamse-kern.com REJECT
.vlaamse-kern.com REJECT
and using that in a helo check (you can replace REJECT with a code+message, such as "5xx Please be polite").
to do it later, you can setup a rule to catch the above in SA (postfix offers header checks). but make sure to only catch the bad ones (not yours), so be as precise as possinle.
>Other statistics:
>
>From: =?iso-2022-jp?B?QVRTVVNISQ==?=<at...@hotmail.com>
>
>>From pretends to be hotmail but is not.
>
>
This is different. you can use SPF in general or only for some sites.
but you may want to accept mail with sender *@domain when they don't
come from that domain. forwarding is one case, but other cases are
possible. This is really a site dependent decision.
Re: Blocking on tld and/or HELO with own domain
Posted by Craig McLean <cr...@fukka.co.uk>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Kenneth Porter wrote:
> --On Sunday, November 13, 2005 11:26 PM +0000 Craig McLean
> <cr...@fukka.co.uk> wrote:
>
>> Ok, well if you read my last message, I've indicated a better way than
>> appending the whole thing in. Just include it using a line like:
>>
>> include(`/usr/share/sendmail-cf/hack/block_bad_helo.m4')dnl
>>
>> to your sendmail.mc, do a "make sendmail.cf" and then "service sendmail
>> restart".
>
> I think you can replace that with:
>
> HACK(block_bad_helo)dnl
>
> See the macro definitions in cfhead.m4. HACK is essentially the same as
> FEATURE, except that it looks in the hack directory and doesn't check
> that a mailer is defined first.
>
That's what I like about Unix/Linux, you learn something new every day ;-)
C.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
iD8DBQFDeMDlMDDagS2VwJ4RAswwAKDuxbK1QGGPcbcYI/CyIy8XI7P09wCg2dlU
9+SYWVvtmCN6QjMWlBtfO48=
=rBKv
-----END PGP SIGNATURE-----
Re: Blocking on tld and/or HELO with own domain
Posted by Kenneth Porter <sh...@sewingwitch.com>.
--On Sunday, November 13, 2005 11:26 PM +0000 Craig McLean
<cr...@fukka.co.uk> wrote:
> Ok, well if you read my last message, I've indicated a better way than
> appending the whole thing in. Just include it using a line like:
>
> include(`/usr/share/sendmail-cf/hack/block_bad_helo.m4')dnl
>
> to your sendmail.mc, do a "make sendmail.cf" and then "service sendmail
> restart".
I think you can replace that with:
HACK(block_bad_helo)dnl
See the macro definitions in cfhead.m4. HACK is essentially the same as
FEATURE, except that it looks in the hack directory and doesn't check that
a mailer is defined first.
Re: Blocking on tld and/or HELO with own domain
Posted by Craig McLean <cr...@fukka.co.uk>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Andy Pieters wrote:
> On Sunday 13 November 2005 23:06, Craig McLean wrote:
>> Andy Pieters wrote:
>>> Hi list
>>>
>>> We have been receiving a lot of spam from the .jp tld lately. What's
>>> more is this:
>> [snip]
>> [Saw this on the fedora list..]
>
> Correct, and the list also sugested to post on spamassassin...
Yep, that was me ;-)
This is a list for users and admins of SA, about configuring and
rule-writing and so-on.
[snip]
>> http://www.cs.niu.edu/~rickert/cf/bad-ehlo.html for caveats!
>
> I tried that, I appended the m4 file to the sendmail.mc file and then did a
> Make -C /etc/mail and service mail restart but after that sendmail doesn't
> even start.
Ok, well if you read my last message, I've indicated a better way than
appending the whole thing in. Just include it using a line like:
include(`/usr/share/sendmail-cf/hack/block_bad_helo.m4')dnl
to your sendmail.mc, do a "make sendmail.cf" and then "service sendmail
restart".
>
> The instructions are a bit vague as well, I want to specify that 127.0.0.1 is
> allowed to forward (duh!) and 81.220.168.250 as well. Furthermore I want
> that if someone claims to be vlaamse-kern.com it gets rejected.
Don't worry about that, as long as 81.220.168.250 HELOs as a valid (i.e.
with a "." in it) hostname that's not vlaamse-kern.com then you'll be
fine. Localhost mail is allowed.
> Furthermore I lost the sendmail.mc file because I thought vi made a backup
> copy but aparently it didn't and I deleted the sendmail.mc.
I'll forward mine to you.
> postfix is a replacement for sendmail?
Yep. http://www.postfix.org/
>> Also, assuming you are using Fedora on a box with 24/7 connection, you
>> might consider commenting out the accept_unresolvable_domains feature,
>> and changing the confPRIVACY_FLAGS to something more restrictive, like
>> `goaway,nobodyreturn,needmailhelo'.
>>
> Could you explain what this means please?
You'll have a line like:
define(`confPRIVACY_FLAGS', `authwarnings,novrfy,noexpn,restrictqrun')dnl
in sendmail.mc. Consider changing it to
define(`confPRIVACY_FLAGS',`goaway,nobodyreturn,needmailhelo,restrictqrun')dnl
'goaway' means that sendmail will give almost no help to the remote
system when it connects (it shouldn't need *any* help) and is a "catch
all" for a bunch of other rules (at least on bsd). 'nobodyreturn' Won't
return the body of a message if it is bounced, 'needmailhelo' requires
that a HELO is recieved before mail can be sent, and 'restrictqrun' will
only allow root to run the mail queue manually.
If you want to have a chat about this (sendmail, that is) in more
detail, we might want to take it off-list.
C.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
iD8DBQFDd8u5MDDagS2VwJ4RAsP1AKDwqVFPeV/DFZSR/IkNrOBF2tktjwCg5OE7
XeM/Uu6CK4UqTpnZdFHIPVk=
=mBgT
-----END PGP SIGNATURE-----
Re: Blocking on tld and/or HELO with own domain
Posted by Andy Pieters <x_...@yahoo.fr>.
On Sunday 13 November 2005 23:06, Craig McLean wrote:
> Andy Pieters wrote:
> > Hi list
> >
> > We have been receiving a lot of spam from the .jp tld lately. What's
> > more is this:
>
> [snip]
> [Saw this on the fedora list..]
Correct, and the list also sugested to post on spamassassin...
> As mentioned on the Fedora list, if you want to block by "fake" HELO at
> the MTA level, you can do so using the sendmail m4 hack at
> http://www.cs.niu.edu/~rickert/cf/hack/block_bad_helo.m4
> You should be aware that anything which refuses "incorrect" HELOs in
> this way breaks a few best-practice rules and at least one RFC (2821)
> and is, as the name suggests, a hack. See
> http://www.cs.niu.edu/~rickert/cf/bad-ehlo.html for caveats!
I tried that, I appended the m4 file to the sendmail.mc file and then did a
Make -C /etc/mail and service mail restart but after that sendmail doesn't
even start.
The instructions are a bit vague as well, I want to specify that 127.0.0.1 is
allowed to forward (duh!) and 81.220.168.250 as well. Furthermore I want
that if someone claims to be vlaamse-kern.com it gets rejected.
Furthermore I lost the sendmail.mc file because I thought vi made a backup
copy but aparently it didn't and I deleted the sendmail.mc.
postfix is a replacement for sendmail?
> Also, assuming you are using Fedora on a box with 24/7 connection, you
> might consider commenting out the accept_unresolvable_domains feature,
> and changing the confPRIVACY_FLAGS to something more restrictive, like
> `goaway,nobodyreturn,needmailhelo'.
>
Could you explain what this means please?
With kind regards
Andy
--
Currently not listening to amaroK
Geek code: www.vlaamse-kern.com/geek
Registered Linux User No 379093
If life was for sale, what would be its price?
www.vlaamse-kern.com/sas/ for free php utilities
--
Re: Blocking on tld and/or HELO with own domain
Posted by Craig McLean <cr...@fukka.co.uk>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Andy Pieters wrote:
> Hi list
>
> We have been receiving a lot of spam from the .jp tld lately. What's more is
> this:
[snip]
[Saw this on the fedora list..]
Andy,
As mentioned on the Fedora list, if you want to block by "fake" HELO at
the MTA level, you can do so using the sendmail m4 hack at
http://www.cs.niu.edu/~rickert/cf/hack/block_bad_helo.m4
You should be aware that anything which refuses "incorrect" HELOs in
this way breaks a few best-practice rules and at least one RFC (2821)
and is, as the name suggests, a hack. See
http://www.cs.niu.edu/~rickert/cf/bad-ehlo.html for caveats!
First make copies of your current sendmail.(cf|mc) and submit.(cf|mc),
just in case.
Drop the m4 file from the link above into /usr/share/sendmail-cf/hack/
and include it into /etc/mail/sendmail.mc (like the cf.m4 file is..). Do
your "make sendmail.cf" and restart sendmail.
You can also do this with MimeDefang, as suggested by Alexander Dalloz
in http://www.redhat.com/archives/fedora-list/2005-November/msg02176.html
Or you can do it with postfix, as suggested by Andy Green in
http://www.redhat.com/archives/fedora-list/2005-November/msg02179.html
Also, assuming you are using Fedora on a box with 24/7 connection, you
might consider commenting out the accept_unresolvable_domains feature,
and changing the confPRIVACY_FLAGS to something more restrictive, like
`goaway,nobodyreturn,needmailhelo'.
C.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
iD8DBQFDd7jTMDDagS2VwJ4RAkxxAJ9giqbqmU+OOmgxjvOoP0YcA2C+OQCfVvbo
Ku6+O9I3IyKJtrH5IQzzcBw=
=x5dS
-----END PGP SIGNATURE-----
Re: Blocking on tld and/or HELO with own domain
Posted by Andy Pieters <x_...@yahoo.fr>.
Hi List
Thank you all for your contributions.
With kind regards
Andy
--
Now listening to Alphaville - Forever Young on amaroK
Geek code: www.vlaamse-kern.com/geek
Registered Linux User No 379093
If life was for sale, what would be its price?
www.vlaamse-kern.com/sas/ for free php utilities
--