You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Ralf Hildebrandt <Ra...@charite.de> on 2017/11/27 12:57:25 UTC
Scoring mails from "not mynetworks" but using my domain in the
headers?
How can I distinguish my internal networks from the evil internet in a
spamassassin rule?
I want to give messages coming from "not mynetworks" but using my
domain in the From: header some additional points:
header MY_FROM From =~ /charite.de/i
describe MY_FROM Sender is from charite.de
# Now you create a rule to combine them:
meta MY_FROM_FROM_OUTSIDE MY_FROM && HOW_DO_I_QUERY_TRUSTED_NETWORKS
describe MY_FROM_FROM_OUTSIDE Sender is from my domain, but comes from the outside
score MY_FROM_FROM_OUTSIDE 1.0
--
Ralf Hildebrandt Charite Universitätsmedizin Berlin
ralf.hildebrandt@charite.de Campus Benjamin Franklin
https://www.charite.de Hindenburgdamm 30, 12203 Berlin
Geschäftsbereich IT, Abt. Netzwerk fon: +49-30-450.570.155
Re: Scoring mails from "not mynetworks" but using my domain in the
headers?
Posted by RW <rw...@googlemail.com>.
On Mon, 27 Nov 2017 13:57:25 +0100
Ralf Hildebrandt wrote:
> How can I distinguish my internal networks from the evil internet in a
> spamassassin rule?
>
> I want to give messages coming from "not mynetworks" but using my
> domain in the From: header some additional points:
>
> header MY_FROM From =~ /charite.de/i
> describe MY_FROM Sender is from charite.de
>
> # Now you create a rule to combine them:
> meta MY_FROM_FROM_OUTSIDE MY_FROM &&
> HOW_DO_I_QUERY_TRUSTED_NETWORKS describe MY_FROM_FROM_OUTSIDE Sender
> is from my domain, but comes from the outside score
> MY_FROM_FROM_OUTSIDE 1.0
Anything that only passed through trusted servers should hit
ALL_TRUSTED. Check that that that is so before relying on it, as it
may need some additional configuration.
Re: Scoring mails from "not mynetworks" but using my domain in the
headers?
Posted by Benny Pedersen <me...@junc.eu>.
Ralf Hildebrandt skrev den 2017-11-27 13:57:
> How can I distinguish my internal networks from the evil internet in a
> spamassassin rule?
>
> I want to give messages coming from "not mynetworks" but using my
> domain in the From: header some additional points:
>
> header MY_FROM From =~ /charite.de/i
> describe MY_FROM Sender is from charite.de
>
> # Now you create a rule to combine them:
> meta MY_FROM_FROM_OUTSIDE MY_FROM &&
> HOW_DO_I_QUERY_TRUSTED_NETWORKS
> describe MY_FROM_FROM_OUTSIDE Sender is from my domain, but comes
> from the outside
> score MY_FROM_FROM_OUTSIDE 1.0
+1
perldoc Mail::SpamAssassin::Conf
see section trusted_networks and msa_networks, internal_networks
feed them with ifconfig ips, this should be same in postfix and amavisd
(mynetworks)
so all 3 programs know your own networks, then all programs gives better
handling of your own networks with does not need special larning new
rules to write :=)
when it works you would see ALL_TRUSTED for sasl auth users in
spamassassin, and NO_RELAYS for pickup mails sent with sendmail command
you would change MY_FROM to __MY_FROM so it does not score 1.0
all the best of seen your books of knowledge is needed to be readed :=)
Re: Scoring mails from "not mynetworks" but using my domain in the
headers?
Posted by Benny Pedersen <me...@junc.eu>.
Ralf Hildebrandt skrev den 2017-11-28 00:31:
> Putting my rules in place already pointed out several hosts not on our
> network
> sending mail as charite.de senders...
your rules, your problem :=)
in amavisd 0.01 it was designed to use xclient forwards in postfix so
amavisd know what clients it really was, that could be used in the 2
default policy banks, one for incomming mails, and one for originated in
mynetworks in amavisd
you have possible maked a error that all policy banks have default
originated mails signed so you search amavisd.conf for originating,
removed if found outside of a policy bank, defult must be not defined
should i really help more by installing oldest amavidd to show configs ?
in newer versions of amavisd its just getting more easy to make more
errors
i just wish there was a command to dump config just like dovecot -n and
postfix -n, so we all knows why it fails
all we now have is endless debate and missing books :(
qoute from howtos
https://www.ijs.si/software/amavisd/amavisd-new-docs.html
# regular incoming mail, originating from anywhere (usually from
outside)
# the MX record (or backup mailers) should point to this IP address
192.0.2.1:smtp inet n - n - - smtpd
-o content_filter=amavisfeed:[127.0.0.1]:10040
# incoming mail from fetchmail, considered externally originating
# (add 'smtphost localhost/2345' to the poll section in .fetchmailrc)
127.0.0.1:2345 inet n - n - - smtpd
-o content_filter=amavisfeed:[127.0.0.1]:10041
-o smtpd_client_restrictions=permit_mynetworks,reject
-o mynetworks=127.0.0.0/8
# IP address to be used by internal hosts for mail submission
192.0.2.2:smtp inet n - n - - smtpd
-o content_filter=amavisfeed:[127.0.0.1]:10042
-o smtpd_client_restrictions=permit_mynetworks,reject
# or, tcp port 587 to be used by internal hosts for mail submission
submission inet n - n - - smtpd
-o content_filter=amavisfeed:[127.0.0.1]:10042
-o smtpd_client_restrictions=permit_mynetworks,reject
# locally originating mail submitted on this host through a sendmail
binary
pickup fifo n - n 60 1 pickup
-o content_filter=amavisfeed:[127.0.0.1]:10043
did you read that ?
$interface_policy{'10040'} = 'EXT';
$interface_policy{'10041'} = 'EXT-FM';
$interface_policy{'10042'} = 'INT';
$interface_policy{'10043'} = 'INT-HOST';
$interface_policy{'10044'} = 'AUTH'; # to be used in the next example
# regular incoming mail, originating from anywhere (usually from
outside)
$policy_bank{'EXT'} = {
# just use global settings, no special overrides
};
# incoming mail from fetchmail, considered externally originating
$policy_bank{'EXT-FM'} = {
log_level => 2,
# no bounces for spam, not even for score below
spam_dsn_cutoff_level_maps:
final_spam_destiny => D_DISCARD,
};
# locally originating mail guaranteed to be from inside
$policy_bank{'INT'} = {
# enable/redirect admin notifications for locally originating
malware:
virus_admin_maps => ["virusalert\@$mydomain"],
spam_admin_maps => ["virusalert\@$mydomain"],
# be slightly more permissive on spam levels for mail from our
hosts:
spam_kill_level_maps => [7.0],
spam_dsn_cutoff_level_maps => [15],
final_virus_destiny => D_BOUNCE, # (unless in
viruses_that_fake_sender_maps)
final_spam_destiny => D_BOUNCE, # (unless above
spam_dsn_cutoff_level_maps)
bypass_banned_checks_maps => [ 1 ], # allow sending any file type or
name
# provide customized sender notifications for spam from our users:
notify_spam_sender_templ =>
read_text("$MYHOME/notify_spam_sender.txt"),
};
# mail locally submitted on the host on which MTA runs
$policy_bank{'INT-HOST'} = {
# NOTE: this is just an example; ignoring internally generated spam
# may not be such a good idea, consider zombified infected local PCs
bypass_spam_checks_maps => [ 1 ],
bypass_banned_checks_maps => [ 1 ],
final_spam_destiny => D_PASS,
final_banned_destiny => D_PASS,
};
# authenticated mail (used by the next example)
$policy_bank{'AUTH'} = {
# enable admin notifications for malware originating from our users:
virus_admin_maps => ["virusalert\@$mydomain"],
spam_admin_maps => ["virusalert\@$mydomain"],
# be slightly more permissive on spam levels for mail from our
users:
spam_kill_level_maps => 7.0,
spam_dsn_cutoff_level_maps => 15,
bypass_banned_checks_maps => 1, # allow sending any file type or name
final_bad_header_destiny => D_BOUNCE; # block invalid headers
};
lastly maybe read
Configuring multiple mail paths in amavisd section on how to make
originating work
why do i write all that ?, i use spampd :=)
Re: Scoring mails from "not mynetworks" but using my domain in the
headers?
Posted by Ralf Hildebrandt <Ra...@charite.de>.
* Bill Cole <sa...@billmail.scconsult.com>:
> On 27 Nov 2017, at 8:57 (-0500), Ralf Hildebrandt wrote:
>
> > * Tobi <ja...@gmx.ch>:
> > > ALL_TRUSTED should fire if msg is only transported via trusted
> > > hosts, so
> > > you can do && !ALL_TRUSTED
> > > But would it not be better to not accept such messages in first place
> > > and reject them on your border mta?
> >
> > This is my border MTA.
>
> One safe & useful tactic is to not accept mail on your border MTA with the
> envelope sender in a local domain, and instead have a submission server
> (port 587) for local users to submit through. No need for SA.
This is not about envelope, this is about the header.
> Hitting on the From *header* and an external source is (as noted by RW)
> trickier
Exactly.
> because traditional mailing list configuration (i.e. pre-DMARC with
> 'p=reject') usually preserves the original From header. Even worse are
> websites (such as some newspapers) who have "email this page" functions
> which require users to provide their email address for use in the From
> header. DMARC is likely to erode these senders over time but since the
> use of 'p=reject' is not a widespread norm, it will take a while.
Putting my rules in place already pointed out several hosts not on our network
sending mail as charite.de senders...
--
Ralf Hildebrandt Charite Universitätsmedizin Berlin
ralf.hildebrandt@charite.de Campus Benjamin Franklin
https://www.charite.de Hindenburgdamm 30, 12203 Berlin
Geschäftsbereich IT, Abt. Netzwerk fon: +49-30-450.570.155
Re: Scoring mails from "not mynetworks" but using my domain in the
headers?
Posted by Bill Cole <sa...@billmail.scconsult.com>.
On 27 Nov 2017, at 8:57 (-0500), Ralf Hildebrandt wrote:
> * Tobi <ja...@gmx.ch>:
>> ALL_TRUSTED should fire if msg is only transported via trusted hosts,
>> so
>> you can do && !ALL_TRUSTED
>> But would it not be better to not accept such messages in first place
>> and reject them on your border mta?
>
> This is my border MTA.
One safe & useful tactic is to not accept mail on your border MTA with
the envelope sender in a local domain, and instead have a submission
server (port 587) for local users to submit through. No need for SA.
Hitting on the From *header* and an external source is (as noted by RW)
trickier because traditional mailing list configuration (i.e. pre-DMARC
with 'p=reject') usually preserves the original From header. Even worse
are websites (such as some newspapers) who have "email this page"
functions which require users to provide their email address for use in
the From header. DMARC is likely to erode these senders over time but
since the use of 'p=reject' is not a widespread norm, it will take a
while.
--
Bill Cole
bill@scconsult.com or billcole@apache.org
(AKA @grumpybozo and many *@billmail.scconsult.com addresses)
Currently Seeking Steady Work: https://linkedin.com/in/billcole
Re: Scoring mails from "not mynetworks" but using my domain in the
headers?
Posted by Ralf Hildebrandt <Ra...@charite.de>.
* Tobi <ja...@gmx.ch>:
> ALL_TRUSTED should fire if msg is only transported via trusted hosts, so
> you can do && !ALL_TRUSTED
> But would it not be better to not accept such messages in first place
> and reject them on your border mta?
This is my border MTA.
--
Ralf Hildebrandt Charite Universitätsmedizin Berlin
ralf.hildebrandt@charite.de Campus Benjamin Franklin
https://www.charite.de Hindenburgdamm 30, 12203 Berlin
Geschäftsbereich IT, Abt. Netzwerk fon: +49-30-450.570.155
Re: Scoring mails from "not mynetworks" but using my domain in the
headers?
Posted by RW <rw...@googlemail.com>.
On Mon, 27 Nov 2017 14:32:11 +0100
Tobi wrote:
> But would it not be better to not accept such messages in first place
> and reject them on your border mta?
There are legitimate reasons to receive them, e.g. mailing lists.
Re: Scoring mails from "not mynetworks" but using my domain in the
headers?
Posted by Tobi <ja...@gmx.ch>.
ALL_TRUSTED should fire if msg is only transported via trusted hosts, so
you can do && !ALL_TRUSTED
But would it not be better to not accept such messages in first place
and reject them on your border mta?
Am 27.11.2017 um 13:57 schrieb Ralf Hildebrandt:
> How can I distinguish my internal networks from the evil internet in a
> spamassassin rule?
>
> I want to give messages coming from "not mynetworks" but using my
> domain in the From: header some additional points:
>
> header MY_FROM From =~ /charite.de/i
> describe MY_FROM Sender is from charite.de
>
> # Now you create a rule to combine them:
> meta MY_FROM_FROM_OUTSIDE MY_FROM && HOW_DO_I_QUERY_TRUSTED_NETWORKS
> describe MY_FROM_FROM_OUTSIDE Sender is from my domain, but comes from the outside
> score MY_FROM_FROM_OUTSIDE 1.0
>
>