Re: Greylisting or Postfix

On Wed, Dec 06, 2006 at 12:09:02PM +1100, Graham Miller wrote:
>George Georgalis wrote:
>>
>> I run openbsd spamd
>
>That looks interesting. Thanks for the tip. I'll check that out. We use
>CentOS here so it will be interesting to see if has a port for that OS.

I highly doubt there will be a port, needs a BSD kernel for pf.


>So I then wrote a new greylistd program based on the code from DJB's
>rblsmtpd. By using the same timeout and exit routines as he does, I figured
>the program would avoid connection hangup problems. And I used the same
>error logging style as djb too. So that is much tidier.

bravo! nice app.

>I am using 120 seconds as a greylist wait time at the moment. This has
>considerably reduced the spam further.

I think you'll find 60 seconds is sufficient but 30 minutes is just fine.

>So what is the downside of doing it in this way?

some mta are non-rfc 2821 and will not retry on 4xx deferral, but I
presume they are rare. also test delivery to someone @verizon.net
they have a return-path verification system that gives deferral
when they don't get 250 for RCPT to: (verify sender) on the mx of
the sending MAIL from: address. (am I clear?) it is a lame system
that isn't rfc as I read, but it is verizon.

...if verizon cannot get a rcpt->250 from the return path address
at its mx, it gives deferral... it may get by your greylister but
I get 451 for 7 days, without special attention.

>> Next line of defense is a QMAILQUEUE script that does a variety of
>> tests, including spamassassin, you could probably use mailfront
>> here, but I've not tried it. Anyway, pass the test and mail goes to
>> qmail-queue, fail and a header is added, the return path is striped
>> and it goes to qmail-queue anyway (ie users can get smtp rejected
>> mail in their spam mailbox, prune the maildir with cron find old and
>> rm).
>
>Mmmm, we do not do this. Once we accept the email, we deliver it to the
>client.

I'm not sure if you are following me or just disagree. I've been told
to just drop mail that I smtp reject, but I find it valuable to
give user's access to smtp rejected messages.

http://galis.org/pub/script/prequeue

I use ipsvd a tcpserver replacement... but the mail is not
accepted, rejected or deferred until that QMAILQUEUE script
exits. ...so all mail accepted is delivered, and mail rejected
is available.  I'm able to do this without rcpt verification and
no back-scatter because I strip the return-path from rejected
messages before trying delivery.

>Mailfront does this well with vmailmgr mailboxes.

well, I'm looking at using cvm, but per post on bgware, I've got
build problems :-\

// George


-- 
George Georgalis, systems architect, administrator <IXOYE><

---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]