Re: Majordomo and spammers

If the spammer is a member of my list, then he/she has the ability to send 
messages only to the digest, and not to the list itself.  That pretty much 
leaves the list itself as the spammer, because the digest config file has 
the restrict_post set to the list and the list-digest.

-Tom

----- Original Message ----- 
From: "Peter P. Benac" <[email protected]>
To: <[email protected]>
Sent: Sunday, July 13, 2008 8:16 AM
Subject: Re: Majordomo and spammers


OK I will say this again.  If you have that many messages getting through
(blank or not) to a back end process you need to rethink your front in
process.

If they are showing up in your digest (blank or not) and you have the list
subscription set to CLOSED+CONFIRM or OPEN+CONFIRM and the list is set for
List Members only then the spammer is a member of your list.

My Mail Server rejects THOUSANDS of Spam messages a day.  Maybe 1 or 2 will
get through any one list and is rejected because they are NOT valid members
of that list. Nothing shows up in the digest that hasn't made it though the
regular list.

The following is an example of my alias setup:

[email protected]: "|/etc/mail/majordomo/wrapper resend
@/etc/mail/majordomo/discuss.arg"
[email protected]: :include:/etc/mail/majordomo/lists/discuss
[email protected]: "|/etc/mail/majordomo/wrapper majordomo -l
discuss"
[email protected]: "|/etc/mail/majordomo/wrapper archive2.pl -f
/etc/mail/majordomo/lists/archives/discuss -m -a"
#
#
#
[email protected]: "|/usr/local/bin/demime
'|/etc/mail/majordomo/wrapper digest -r -C -l discuss-digest
[email protected],nobody'"

[email protected]:
:include:/etc/mail/majordomo/lists/discuss-digest
[email protected]: "|/usr/local/bin/demime
'|/etc/mail/majordomo/wrapper majordomo -l discuss-digest'"

Contents of the .arg file

-h discuss.org -l discuss [email protected],nobody

Obviously I masked the real list name and domain.

Regards,
Pete
----
Peter P. Benac, CCNA
Emacolet Networking Services, Inc
Web and Mail Hosting.
Phone: 252-657-9591
Web: http://www.emacolet.com

To have principles...
First have courage.. With principles comes integrity!!!


-----Original Message-----
From: [email protected]
[mailto:[email protected]] On Behalf Of Tom Patterson
Sent: Sunday, July 13, 2008 08:32
To: [email protected]
Subject: Re: Majordomo and spammers

I agree that the subscribers are not the ones sending the graphical messages

if graphical messages are what is causing the problem.  Actually, I think
that it may be all messages from spammers, whether graphical or otherwise.
I didn't save any of the bounces I was getting back, but I think that the
times on at least some of them did correspond to times of some of the blank
messages.  Those messages were not all graphical, because they did have text

that caused majordomo to respond.

The thing is messages, apparently from spammers, are coming in, and
apparently, are causing majordomo to create blank messages in the digest
temporary directory.  The messages are NOT going out to the regular list
members - they never were.

I do have my lists set up so that only list members can post.  The blank
messages have never gone out through the regular messages.  They only show
up in the digest temporary directory, and if left alone, appear as blank
messages within the digest.

I am running demime, and DrWeb to filter messages on the site.

The digests last night did run without any problem.  We modified line #176
as Daniel Liston suggested, and that, along with removing all zero content
messages with a script as part of the cron job to create the digests,
resulted in normal digests.

I am still left with these blank messages being created in the digest
temporary directory, but the problem is now at least manageable.

Probably I will now create a new list starting with an alpha character lower

than the two active lists, and see if I can dump any blank messages into
that new list's directory to further ensure that blank messages don't get
out to any digest subscribers.  Right now, these blank messages are only
going into one of the two active list digests directories, and it is the one

with the starting with alpha "s" as opposed to alpha "v".

-Tom

----- Original Message ----- 
From: "Peter P. Benac" <[email protected]>
To: <[email protected]>
Sent: Sunday, July 13, 2008 6:52 AM
Subject: Re: Majordomo and spammers


Tom,

   It is not your subscribers that are sending the graphical messages. It is
the spammers.

   I would be more curious about what type of spam catching software you are
running on the front end of all of this.  My mail server is running
SpamAssassin, and Mimedefang. Plus I have the list set so only list members
can post. Rejects never end up archived or digested. The mail server checks
for RBDNS, DKIM and SPF records as well.

   Very little Spam makes it to any list I host and 99% if that is rejected
because it comes from non-members. If that much spam is making to a backend
mail processor you might want to beef up the front end.

Regards,
Pete
----
Peter P. Benac, CCNA
Emacolet Networking Services, Inc
Web and Mail Hosting.
Phone: 252-657-9591
Web: http://www.emacolet.com

To have principles...
First have courage.. With principles comes integrity!!!


-----Original Message-----
From: [email protected]
[mailto:[email protected]] On Behalf Of Tom Patterson
Sent: Saturday, July 12, 2008 05:44
To: [email protected]
Subject: Re: Majordomo and spammers

Sorry All,

I responded to earlier messages from Daniel Liston, and did so without
copying in the list, as I just hit the reply to button.  Following is my
response to the first message:
__________________________

Thanks Dan,

Maybe you are correct in the graphical nature of the problem, but I doubt
it.

I have two lists with about 700-750 mostly long time members.  They know
that majordomo strips off any image files, and should not be submitting any.
If they did, it would only be an occasional image - right now, I am getting
a lot of these zero files.  Prior to installing Joe's patch, I was able to
tie the date and time of these blank files to the time that majordomo was
bouncing messages back to the spammers.  Also, I did not have this problem
on my old server which also used demime.  The problem started when I moved
to a new server.

I have already looked to see what files are queued up for the digests, and
there are zero content files sitting there, and arriving regularly.  The
sequence problem I was running into seems to have ocurred as a result of
deleting these zero files.  The solution now appears to be in renaming and
renumbering these files so that they start with 001.  When I did that
earlier today, I was able to pick them up in digests.

I now have a script which will be tried with the cron job tonight.  It will
delete all zero content files, and then rename and renumber the remaining
files immediately prior to calling the cron job to create the digest.  If it
works, the problem will be solved.

I have no idea what is different now than with the earlier server, except
for the mail program.   Whatever, I will keep you posted on the outcome.

-Tom
_________________
----- Original Message ----- 
From: "Ed Kasky" <[email protected]>
To: "Daniel Liston" <[email protected]>; <[email protected]>
Sent: Saturday, July 12, 2008 1:03 AM
Subject: Re: Majordomo and spammers


> FYI, demime also strips attachments at the same time that it strips the
> mime from a message.  I have lots of subscribers scratching their heads on

> that one...
>
> Ed
>