Re: outgoing address compromised

I recently discovered that some viruses had harvested the list-outgoing
address from some of my mailing lists.

After searching the majordomo-users archive I found others who had
encountered similar problems.

I'm running majordomo-1.94.5 with postfix so the sendmail solutions didn't
work for me.
Though the concept does translate.

The messages are typically using forged headers with return-mail addresses
of innocent
3rd parties. Instead of trying to direct the message via an "error: nouser
User unknown" bounce to
the innocent 3rd party, I elected to create a canonical recipient map table
containing
all of the <list>-outgoing aliases on my server (over 30) and redirect them
to "junkmaster".
This user is then aliased to /dev/null. This way the viruses/spam sent
directly to the list are quietly dropped.

In my main.cf file I added the line:

	recipient_canonical_maps = hash:/etc/postfix/recipient_canonical_map

and recipient_canonical_map contains lines similar to the following:

	# canonical names to redirect messages sent directly to
"list-outgoing"
	#
	test-outgoing	junkmaster
	staff-outgoing	junkmaster
	parttime-outgoing	junkmaster

This list is then compiled using the postmap command

/etc/aliases entry is:

	#
	# Junk messages that are sent to <list>-outgoing
	junkmaster:		/dev/null

I hope this is useful to others who encounter this problem.

Chris Knowles
Redeemer University College
Ancaster, Ontario Canada