Re: outgoing address compromised

test-outgoing is aliased via canonical map rather than in the aliases list.
In the aliases list test-outgoing includes the email addresses of the list
members.

The canonical recipient map is checked against traffic originating on port
25, once the message has started processing by the majordomo wrapper program
it is no longer on port 25.

Another way to say it is, only incoming messages on port 25 destined for
test-outgoing are going to the trash bin.

How does that sound?
Chris

-----Original Message-----
From: [email protected]
[mailto:[email protected]] On Behalf Of Peter A. Chapman
Sent: Wednesday, August 01, 2007 3:08 PM
To: [email protected]
Subject: Re: outgoing address compromised


I'm confused.  If test-outgoing is aliased to /dev/null rather than
include:/usr/local/majordomo/lists/test won't all e-mail messages sent to
the test majordomo mailing list be sent to the big trash can in the sky?
How does a legitimate e-mail message get distributed to the mailing list
rather than forwarded to junkmaster?  I've never used postfix.  Is postfix
able to flag messages sent to test-outgoing that don't originate from test?


-------

At 01:37 PM 8/1/2007, Chris Knowles wrote:
>I recently discovered that some viruses had harvested the list-outgoing
>address from some of my mailing lists.
>
>After searching the majordomo-users archive I found others who had
>encountered similar problems.
>
>I'm running majordomo-1.94.5 with postfix so the sendmail solutions didn't
>work for me.
>Though the concept does translate.
>
>The messages are typically using forged headers with return-mail addresses
>of innocent
>3rd parties. Instead of trying to direct the message via an "error: nouser
>User unknown" bounce to
>the innocent 3rd party, I elected to create a canonical recipient map table
>containing
>all of the <list>-outgoing aliases on my server (over 30) and redirect them
>to "junkmaster".
>This user is then aliased to /dev/null. This way the viruses/spam sent
>directly to the list are quietly dropped.
>
>In my main.cf file I added the line:
>
>        recipient_canonical_maps =
hash:/etc/postfix/recipient_canonical_map
>
>and recipient_canonical_map contains lines similar to the following:
>
>        # canonical names to redirect messages sent directly to
>"list-outgoing"
>        #
>        test-outgoing   junkmaster
>        staff-outgoing  junkmaster
>        parttime-outgoing       junkmaster
>
>This list is then compiled using the postmap command
>
>/etc/aliases entry is:
>
>        #
>        # Junk messages that are sent to <list>-outgoing
>        junkmaster:             /dev/null
>
>I hope this is useful to others who encounter this problem.
>
>Chris Knowles
>Redeemer University College
>Ancaster, Ontario Canada