Re: Web host spam vs spam filters

On Thu 20/Jun/2013 22:22:22 +0200 Chris Lewis wrote:
>>
>> Yes - though I've been told that most of the scripts used to send
>> botnet spam aren't very different than what's used on Windows boxes.
>> At least they don't seem to use the local MTA.
> 
> Right.  All of the ones I've seen are written in PHP or Perl, and do
> direct-to-MX.
> 
> The operators of these machines tend to be at least somewhat more
> technically astute than the canonical "grandma on DSL", and real MTA
> logs are too much of a dead giveaway as to the presence and ultimate
> eradication of the malware.

OTOH, while firewalls on Windows boxes tend to maintain lits of what
processes are authorized to do outbound connections, on *nix servers the
concept is different.  But Linux iptables has an xt_owner module that
matches on a uid range, so, beside blocking outbound port 25 on
non-MTAs, one could block attempts to send mail by wrong user-ids on
MTAs.  Undoubtedly a sign of barbarization...
-
This is the asrg mailing list.  To change your subscription settings, see
http://lists.services.net/cgi-bin/mj_wwwusr/domain=lists.gurus.org