Re: CBL Composite Blocking List problem

SEE New inserted paragraphs below


At 06:59 PM 7/20/2004 +0200, you wrote:
>On Tue, 20 Jul 2004, Paul Gleave wrote:
>
> > So I'm beginning to wonder if the confirmation messages that ASK
> > sends out are being interpreted by someone somewhere as spam.  If
> > this is the case, then "Houston we have a problem".
> >
> > Anyone else got any thoughts on this?

I indeed have thoughts on this
I was also blocked by CBL and demanded they prove cause.
As it was the upgrade to ask that does smtp_validate
was opening the port to the mx server of rhe sender
(for demonstration lets say "foo.com")
then Issuing the command HELO   foo.com   (BAD)
The HELO should have been from my machine domain
as in  HELO  ads-ent.com   (GOOD)
Then on occasion  it would send something like:
RCPT  <[email protected]>
(Again VERY BAD)  This was not a valid address obviously and should
never have been sent.

Actual line from my log file:
2004/07/18 18:41:46 [99563]:   smtp_validate: Command=RCPT TO: 
<[email protected]>, SMTP code=250, return=1

I fixed both the problems in askmail.py:
(NOTE:  There needs to be a global config in the 
.askrc  for  "rc_helodomain: "  [mail server])

original:
                         ## Establish the SMTP connection the usual way, 
then try an "RCPT TO"
                         ## to an invalid user name. If it says 2xx, we 
assume this MX says 2xx
                         ## for everyone and return "valid".

--                        invalidmail = "askprobe%d@%s" % 
(int(time.time()), domain)

                         cmds = [
--                                ("HELO %s"         % 
helo_domain,               200, 299, -1),
                                 ("MAIL FROM: <%s>" % 
envelope_from,     200, 299, -1),
--                                ("RCPT TO: <%s>"   % 
invalidmail,       500, 599, 1),
                                 ("RCPT TO: <%s>"   % 
email,             200, 299, 0),
                                 #("QUIT", 
999, 999, 0)    ## Invalid if it got here
                         ]

Changed:
                         ## Establish the SMTP connection the usual way, 
then try an "RCPT TO"
                         ## to an invalid user name. If it says 2xx, we 
assume this MX says 2xx
                         ## for everyone and return "valid".


                         cmds = [
+                                ("HELO 
inet.ads-ent.com"        ,       200, 299, -1),
                                 ("MAIL FROM: <%s>" % 
envelope_from,     200, 299, -1),
                                 ("RCPT TO: <%s>"   % 
email,             200, 299, 0),
                                 #("QUIT", 
999, 999, 0)    ## Invalid if it got here
                         ]



>This is a frequent issue brought on this list / a frequent argument
>against ASK and other Challenge-Response systems (check the archive).
>Some people argue that, since you can never know for sure who sent the
>message, you should never send an automated reply. Please note that
>this apply not only to Challenge-Response systems like ASK but also to
>any "vacation" program, (stupid) virus warning, failed delivery error
>messages, etc. Consider the worst case (I guess it happened to many of
>us). Some spammer repeatedly forges its "From:" with your personal
>address. The forged address will then receive tons of "failed
>delivery" error messages, to be compared to at most 1-2 confirmation
>requests from ASK or similar...
>
>Yes there is something bad here, but I really think that ASK is the
>wrong target in this case. The real fix is to fix SMTP so that you can
>have some more or less trusted source address. Some people are working
>hard towards this: http://spf.pobox.com/ (I strongly suggest anyone
>interested by antispam efforts to check this URL).
>
>Back to ASK and you being blacklisted: if some guy received a couple
>of ASK confirmation requests, he surely had received at least 100
>spams and 30 "failed delivery" at the same time. Complaining only
>about ASK confirmation requests is a demonstration of bad faith... as
>said above: wrong target. Some people are irrationally angry at C-R
>systems, trying to fight what it's easy to fight instead of fighting
>the bulk.
>http://kmself.home.netcom.com/Rants/challenge-response.html
>
>
>Any decent blacklist system should publish the justification for every
>blacklisted domain. Could you find the one for your server ?
>
>
> > Also: Marco - the SBL seems like quite a good idea (as long as it
> > only traps the baddies) and it can be freely downloaded - have you
> > thought of integrating it into ASK?
>
>I don't think any other spam filter should be "integrated" into ASK. A
>more flexible and generally speaking better design IMHO is to "pipe"
>multiple filters, in the order the user wants.
>
>
>--
>"Je n'ai fait cette lettre-ci plus longue que parce que je n'ai pas eu
>le loisir de la faire plus courte." -- Blaise Pascal
>
>
>
>-------------------------------------------------------
>This SF.Net email is sponsored by BEA Weblogic Workshop
>FREE Java Enterprise J2EE developer tools!
>Get your free copy of BEA WebLogic Workshop 8.1 today.
>http://ads.osdn.com/?ad_idG21&alloc_id040&opÌk
>_______________________________________________
>A-S-K-users mailing list
>[email protected]
>https://lists.sourceforge.net/lists/listinfo/a-s-k-users




__/ __/ __/ __/ __/ __/ __/ __/ __/ __/ __/ __/ __/


Allan Simmons

http://www.ads-ent.com
http://www.ads-promotions.com
http://www.check-software.com

-----BEGIN PGP SIGNATURE-----

iQA/AwUBPabLOqNFGWdH62fIEQI/zQCg2I2a/yYoA4I86IvZGggvbGnJ5W8AoII+XlayCwaof0qUbdWoy8+szVy7=5GMx
-----END PGP SIGNATURE-----



-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_idG21&alloc_id040&op=click