[xmail] Re: glst changes?

2006-02-14 Thread Rob Arends
Sure Alan, 
 
Below is my entire glst.conf
The main Tweaks were related to the large MTA pools - yahoo, hotmail, etc.
I ended up rounding everything to /24 bit with some exception to larger
networks (see Bigpond and Optus Australian ISPs)
I also excluded a whole heap of networks for familiar or trusted MTAs - for
mailing lists primarily.
I also reduced the block time (timeo) to 7 minutes, because 60 minutes was
too long and most spammers were not retrying anyway, so 1 minute or 60
minutes was about the same.
I just analysed my historical logs for IP addresses and trends; then after
glst implementation, I watched the glst filter rejections and saw the IPs
and trends and adjusted the mnet and xnet parameters.  After some complaints
I reduced the timeo.
This process took an hour or so each day for a few days .
 
I also use in server.tab
SMTP-MaxErrors3
So that if I get dictionary attacked, then that door is closed too.
 
And the other key ingredient in server.tab
CustMapsList
list.dsbl.org.:0,relays.ordb.org.:0,sbl.spamhaus.org:0,bl.spamcop.net:0
 
I haven't checked recently if all the lists are active, but I've had no
reason to.
 
I get _very_ little spam with this setup.
 
Rob :-)
 
 
 
glst.conf
rejmsg=451 4.7.1 Please try again later
generr=0
rejerr=3
timeo=420
exptimeo=3110400
lametimeo=28800
 
# Round all networks to match on ranges of 256 (last octet=*)
mnet=0.0.0.0,0.0.0.0,255.255.255.0
 
# BigPond - go for match on first 2 octects only
mnet=144.140.82.0,255.255.255.0,255.255.0.0
mnet=144.140.83.0,255.255.255.0,255.255.0.0
mnet=144.140.92.0,255.255.255.0,255.255.0.0
mnet=144.140.93.0,255.255.255.0,255.255.0.0
 
# Optus - go for match on first 2 octects only
mnet=211.29.132.0,255.255.255.0,255.255.0.0
mnet=211.29.133.0,255.255.255.0,255.255.0.0
 
# Hotmail 
mnet=65.52.0.0,255.255.255.0,255.252.0.0
mnet=64.4.0.0,255.255.255.0,255.255.192.0
 
# Yahoo mail
mnet=68.142.200.0,255.255.252.0,255.255.252.0
 
# mailguard.com.au 
mnet=70.84.0.0,255.255.0.0,255.252.0.0
mnet=66.235.184.61,255.255.255.255,255.255.255.0
 
# Exclude the following networks
# Local
xnet=127.0.0.1,255.255.255.255
xnet=10.0.0.0,255.0.0.0
xnet=172.16.0.0,255.240.0.0
xnet=192.168.0.0,255.255.0.0
# IMC
xnet=203.202.100.224,255.255.255.224
xnet=203.202.8.0,255.255.255.0
xnet=203.41.11.128,255.255.255.192
# @lists.techtarget.com
xnet=65.214.43.171,255.255.255.255
xnet=65.214.43.172,255.255.255.255
xnet=65.214.43.174,255.255.255.255
# @list.novell.com
xnet=130.57.1.68,255.255.255.255
# @australiancu.com
net=203.58.62.33,255.255.255.255
# @cav.asn.au
xnet=210.0.98.129,255.255.255.255
# @list.cramsession.com
xnet=63.146.189.86,255.255.255.255
# @newsletters.online.com (cNet)
xnet=206.16.1.130,255.255.255.255
xnet=206.16.1.131,255.255.255.255
xnet=206.16.1.161,255.255.255.255
xnet=206.16.1.162,255.255.255.255
xnet=206.16.1.190,255.255.255.255
xnet=206.16.1.191,255.255.255.255
# @nww.hdsmail.com
xnet=66.37.227.193,255.255.255.255
# @qff.qantas.net.au
xnet=210.9.188.147,255.255.255.255
# @groups.yahoo.com
xnet=66.94.237.0,255.255.255.0
xnet=66.218.66.0,255.255.255.0
xnet=209.73.160.0,255.255.255.0
xnet=216.155.201.0,255.255.255.0
# @myfamily.com
xnet=66.43.22.191,255.255.255.255
xnet=66.43.22.192,255.255.255.255
# @xmr3.com
xnet=205.183.255.0,255.255.255.0
# @newsletters.online.com
xnet=206.16.1.131,255.255.255.255
# @ebay.com
xnet=66.135.215.0,255.255.255.0

/glst.conf


  _  

From: Alan D. Snyder [mailto:[EMAIL PROTECTED] 
Sent: Tuesday, February 14, 2006 11:18 AM
To: Rob Arends
Subject: glst changes?


Rob - what changes did you make to glst?

care to share 'em?

Thanks,
Alan 




-
To unsubscribe from this list: send the line unsubscribe xmail in
the body of a message to [EMAIL PROTECTED]
For general help: send the line help in the body of a message to
[EMAIL PROTECTED]



[xmail] Re: Spammers - How to block them.

2006-02-14 Thread Henri van Riel

Hello Rob,

 Henri, that does sound like it would work.

Sounds like it but there seems to be a glitch somewhere cause I wasn't
receiving *any* mail anymore... Bummer, and that on a day like
Valentine's day ;) I need to take a closer look at my script cause
outgoing mail goes through that script of mine too... Hadn't thought
of that.

One of the problems is that CustMapsList checking and my script take a
while to complete. Quite a while even which in fact makes the problem
worse. At times I have up to 25 servers connected to XMail trying to
deliver mail to users who don't even exist! I want to get rid of those
connection as quickly as possible to free smtp threads so they can
receive valid mails...

I was thinking, is setting SMTP-RDNSCheck to 1 in server.tab going
to be helpfull?

 The only thing to watch with your method, is that you block
 legitimate users that happen to key in the wrong address.

True. I was thinking of constantly tweaking the list of ip addresses
in spammers.tab to a maximum of 100 or so.

 I've had great success with greylisting (glst from Davide).
 I did have to tweak it a bit to deal with the likes of
 hotmail/yahoo/etc because of their many sending MTAs.

I'll have a look but it seems I need GDBM and stuff for it...

 Rob :-)

 -Original Message-
 From: [EMAIL PROTECTED]
 [mailto:[EMAIL PROTECTED] On
 Behalf Of Henri van Riel
 Sent: Tuesday, February 14, 2006 9:23 AM
 To: Jeff Buehler
 Cc: xmail@xmailserver.org
 Subject: [xmail] Re: Spammers - How to block them.


 Hi Jeff,

 You can run ASSP on a different server than XMail.  Also, you can use 
 it simply to verify that the address being sent to is a valid one - it 
 does not need to perform Bayesian -filter based SPAM blocking unless 
 you want it to (you could open up the ruleset, or you can have it 
 simply tag the email that goes through with something if it thinks 
 it's SPAM).  If what you need is to be able to close sessions to 
 invalid addresses quickly, that is the only way I know how to do it.

 I'll certainly look into it but I don't like the idea of having to run
 something in front of XMail... Also, I'd need to install Perl on my
 mailserver which is *strictly* a mailserver.

 What you suggest might work, but spammers domains and addresses change 
 very rapidly, so I'm not certain you would actually cut down the 
 volume much, and you would end up having to process all of that email.  
 ASSP will simply terminate the session more or less immediately if it 
 doesn't like the email, the sender, or the address, or any combination 
 of those things.

 I don't have to process that much email though. First of all, my new
 CustMapsList filters out a lot of spam. If the sender seems ok, XMail first
 checks if the recipient is known. If not, it redirects it to my catch-all
 account. While it is doing that, the filters.pre-data.tab filter kicks in
 *before* the data command, only the headers have arrived so far. Next, my
 script will get the ip address from those headers and exits with code 3
 which makes XMail to terminate the connection. Mail with a valid recipient
 will still go through the filter but that's not a problem.

 Sounds to me that it could work! ;)

 --
 Henri.



 -
 To unsubscribe from this list: send the line unsubscribe xmail in
 the body of a message to [EMAIL PROTECTED]
 For general help: send the line help in the body of a message to
 [EMAIL PROTECTED]


 -
 To unsubscribe from this list: send the line unsubscribe xmail in
 the body of a message to [EMAIL PROTECTED]
 For general help: send the line help in the body of a message to
 [EMAIL PROTECTED]



-- 
Best regards,
 Henrimailto:[EMAIL PROTECTED]

-
To unsubscribe from this list: send the line unsubscribe xmail in
the body of a message to [EMAIL PROTECTED]
For general help: send the line help in the body of a message to
[EMAIL PROTECTED]



[xmail] Re: Spammers - How to block them.

2006-02-14 Thread Phillip R. Shaw

Don't block on catchall. I would guess you have blocked yourself and/or
some of the major email ip addresses that you receive from.

Make a list of the dictionary addresses they are sending to and only
block those by adding the sending ip's in the spammers.tab. I use a
255.255.255.255 mask on them in the spammers.tab, only blocking the one
ip.

Do this by logging any email addresses that receive email, and then copy
the dictionary ones to the address file for the filter to use. I ended
up with a list of around 400 email addresses. (This is for a personal
domain).

You need to be careful doing this by making sure that there is no reason
for anyone to send to that email address. Don't block things like info,
postmaster, admin, sales, and so on. Those are common ones that get
spammed that you don't want to block at this level. Remember that you
are blocking saying that if a computer (maybe your isp's email server)
sends to this address I never want to receive email from that ip address
again. Very heavy handed.

Blocking the dictionary names is not the way to stop all spam, but it
will stop that majority of it if you are targeted. It does take a day or
two to get all the email addresses that are to be blocked, but it is
worth it.

And then delete the spammers.tab once in a while, I try to do it once a
week or so.

I have a very similar setup. The dictionary attack is probably coming
from zombie machines, which come and go very frequently. One of the
things I noticed about the attacks is that the mail will start coming
in. I would receive several hundred in a matter of a few minutes, but
only 3-5 from each ip address. It would be a large number of ip
addresses sending the mail. Return addresses and all of that varied
throughout the messages. Then it would repeat a short time later, with
new ip addresses and email addresses.

The problem with dnsbl was that I would get hit with an attack, and then
in a day or two the ip's would be listed in the dnsbl. It appeared that
someone got together a zombie net, sent the spam, and then gets most of
the machines listed. The listings worked great at some point, but if you
were in the leading edge of the attack you could get thousands of emails
before the ip's are listed.

The advantage of the spammers.tab (the way I understand it) is that if
the connecting ip is listed then the connection is dropped without
receiving any data. When you have limited bandwidth you don't want to
receive the entire message before deciding to drop it.


Phillip

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Henri van Riel
Sent: Tuesday, February 14, 2006 6:18 AM
To: Rob Arends
Cc: xmail@xmailserver.org
Subject: [xmail] Re: Spammers - How to block them.


Hello Rob,

 Henri, that does sound like it would work.

Sounds like it but there seems to be a glitch somewhere cause I wasn't
receiving *any* mail anymore... Bummer, and that on a day like
Valentine's day ;) I need to take a closer look at my script cause
outgoing mail goes through that script of mine too... Hadn't thought
of that.

One of the problems is that CustMapsList checking and my script take a
while to complete. Quite a while even which in fact makes the problem
worse. At times I have up to 25 servers connected to XMail trying to
deliver mail to users who don't even exist! I want to get rid of those
connection as quickly as possible to free smtp threads so they can
receive valid mails...

I was thinking, is setting SMTP-RDNSCheck to 1 in server.tab going
to be helpfull?

 The only thing to watch with your method, is that you block
 legitimate users that happen to key in the wrong address.

True. I was thinking of constantly tweaking the list of ip addresses
in spammers.tab to a maximum of 100 or so.

 I've had great success with greylisting (glst from Davide).
 I did have to tweak it a bit to deal with the likes of
 hotmail/yahoo/etc because of their many sending MTAs.

I'll have a look but it seems I need GDBM and stuff for it...

 Rob :-)

 -Original Message-
 From: [EMAIL PROTECTED]
 [mailto:[EMAIL PROTECTED] On
 Behalf Of Henri van Riel
 Sent: Tuesday, February 14, 2006 9:23 AM
 To: Jeff Buehler
 Cc: xmail@xmailserver.org
 Subject: [xmail] Re: Spammers - How to block them.


 Hi Jeff,

 You can run ASSP on a different server than XMail.  Also, you can use

 it simply to verify that the address being sent to is a valid one -
it 
 does not need to perform Bayesian -filter based SPAM blocking unless 
 you want it to (you could open up the ruleset, or you can have it 
 simply tag the email that goes through with something if it thinks 
 it's SPAM).  If what you need is to be able to close sessions to 
 invalid addresses quickly, that is the only way I know how to do it.

 I'll certainly look into it but I don't like the idea of having to run
 something in front of XMail... Also, I'd need to install Perl on my
 mailserver which is *strictly* a mailserver.

 What you suggest might 

[xmail] xmail and ssl

2006-02-14 Thread Gideon So
 Hi all,

 I want to enable xmail with SSL. I patched my xmail server with the SSL
patch provided. Do I need other software, e.g. stunnel, in order to have SSL
email transfer??

Gideon


MigDal-Gad CrossNet Webmail Service
We do the BEST for Christ
http://www.mcnet.com.hk

-
To unsubscribe from this list: send the line unsubscribe xmail in
the body of a message to [EMAIL PROTECTED]
For general help: send the line help in the body of a message to
[EMAIL PROTECTED]



[xmail] Re: xmail and ssl

2006-02-14 Thread Soenke Ruempler

Hi,

[EMAIL PROTECTED]  wrote on Tuesday, February 14, 2006 3:59
PM:

 I want to enable xmail with SSL. I patched my xmail
 server with the SSL
 patch provided. Do I need other software, e.g. stunnel, in
 order to have SSL
 email transfer??

Which SSL patch?

Yes - IMHO you need stunnel.
-
To unsubscribe from this list: send the line unsubscribe xmail in
the body of a message to [EMAIL PROTECTED]
For general help: send the line help in the body of a message to
[EMAIL PROTECTED]



[xmail] Re: xmail and ssl

2006-02-14 Thread Alexander Hagenah
Hi,

[EMAIL PROTECTED] schrieb am Tuesday, February 14, 2006 3:59 PM:

 I want to enable xmail with SSL. I patched my xmail
 server with the SSL patch provided. Do I need other
 software, e.g. stunnel, in order to have SSL
 email transfer??

We were talking about the topic several times.
Have a look at
http://www.mail-archive.com/cgi-bin/htsearch?method=andformat=shortconfig=
xmail_xmailserver_orgrestrict=exclude=words=ssl

--
Regards,
Alexander Hagenah
http://xmail.topconcepts.net


-
To unsubscribe from this list: send the line unsubscribe xmail in
the body of a message to [EMAIL PROTECTED]
For general help: send the line help in the body of a message to
[EMAIL PROTECTED]



[xmail] Re: Spammers - How to block them.

2006-02-14 Thread Jeff Buehler

Hi Henri -

I suspect this makes little difference, but just in case you aren't 
aware of this, you can run ASSP on a different computer - it doesn't 
have to be the same system, and so Perl also does not need to be on your 
XMail system.  I'm not certain why you have feelings about running 
something in front of XMail if it will simply reduce the burden on your 
server (significantly) but we all have our reasons, I suppose!

If you aren't processing much email, then I can't understand why you are 
getting the server too busy errors you mentioned in your first email.  
Something doesn't sound quite right.  Frankly, even before I was running 
ASSP, I was processing quite a bit of email (thousands a day, sometimes 
more, and thousands more a day of SPAM) and I never received an error 
like that on send.

I understood you to say that you were getting SMTP connect errors 
because XMail was taking too long to refuse invalid users.   Logically, 
if you are receiving server too busy errors simply from refusing emails 
to non-valid users (as I read your first email to be saying), which 
would require an incredible volume of invalid email (or a very, very 
slow server), then the only way to prevent server overload would be to 
put something in front of XMail, since XMail is already refusing those 
emails that are causing the problem.  But I must have misunderstood 
given the direction the rest of this thread has taken.

If it is simply an issue of SPAM in general, and you need to block it, 
and you don't want to use something like ASSP (for reasons of purity?), 
then your best bet is greylisting (as Rob Arends covers well), RBL 
blocking, and perhaps something like you mention with an automated 
addition to the spammers list as a last addition.

Jeff

Henri van Riel wrote:

Hi Jeff,

  

You can run ASSP on a different server than XMail.  Also, you can
use it simply to verify that the address being sent to is a valid
one - it does not need to perform Bayesian -filter based SPAM
blocking unless you want it to (you could open up the ruleset, or
you can have it simply tag the email that goes through with
something if it thinks it's SPAM).  If what you need is to be able
to close sessions to invalid addresses quickly, that is the only way
I know how to do it.



I'll certainly look into it but I don't like the idea of having to run
something in front of XMail... Also, I'd need to install Perl on my
mailserver which is *strictly* a mailserver.

  

What you suggest might work, but spammers domains and addresses
change very rapidly, so I'm not certain you would actually cut down
the volume much, and you would end up having to process all of that
email.  ASSP will simply terminate the session more or less
immediately if it doesn't like the email, the sender, or the
address, or any combination of those things.



I don't have to process that much email though. First of all, my new
CustMapsList filters out a lot of spam. If the sender seems ok, XMail
first checks if the recipient is known. If not, it redirects it to my
catch-all account. While it is doing that, the filters.pre-data.tab
filter kicks in *before* the data command, only the headers have
arrived so far. Next, my script will get the ip address from those
headers and exits with code 3 which makes XMail to terminate the
connection. Mail with a valid recipient will still go through the
filter but that's not a problem.

Sounds to me that it could work! ;)

  


-
To unsubscribe from this list: send the line unsubscribe xmail in
the body of a message to [EMAIL PROTECTED]
For general help: send the line help in the body of a message to
[EMAIL PROTECTED]



[xmail] Re: Spammers - How to block them.

2006-02-14 Thread Henri van Riel

Hi Jeff,

 I suspect this makes little difference, but just in case you aren't
 aware of this, you can run ASSP on a different computer - it doesn't
 have to be the same system, and so Perl also does not need to be on
 your XMail system.  I'm not certain why you have feelings about
 running something in front of XMail if it will simply reduce the
 burden on your server (significantly) but we all have our reasons, I
 suppose!

The main reason for not wanting anything installed before XMail is
mainly because I've been having bad experiences with AVmailGate but
also because I'd much rather have XMail solve my problem. There must
be a way without having to install (and maintain) several tools.

 If you aren't processing much email, then I can't understand why you
 are getting the server too busy errors you mentioned in your first
 email. Something doesn't sound quite right.  Frankly, even before I
 was running ASSP, I was processing quite a bit of email (thousands a
 day, sometimes more, and thousands more a day of SPAM) and I never
 received an error like that on send.

That's odd. How many smtp threads were you running? I've set the
maximum to 16 now where 4 should be enough to handle all incoming mail
(easily!).

 I understood you to say that you were getting SMTP connect errors
 because XMail was taking too long to refuse invalid users.
 Logically, if you are receiving server too busy errors simply from
 refusing emails to non-valid users (as I read your first email to be
 saying), which would require an incredible volume of invalid email
 (or a very, very slow server), then the only way to prevent server
 overload would be to put something in front of XMail, since XMail is
 already refusing those emails that are causing the problem.  But I
 must have misunderstood given the direction the rest of this thread
 has taken.

The server won't break any speed records, that's true. Still, it
should be more than good enough for my purposes. XMail slows down
considerably when I use CustMapsList in server.tab. My guess is that
these services are very slow and XMail has to check 4 or 5 for each
and every email it receives. I guess all my smtp threads are busy
waiting for a reply from these anti-spam services and are unable to
allow other connections. Setting SMTP-RDNSCheck to 1 in my
server.tab also slows down mail processing in XMail.

 If it is simply an issue of SPAM in general, and you need to block
 it, and you don't want to use something like ASSP (for reasons of
 purity?), then your best bet is greylisting (as Rob Arends covers
 well), RBL blocking, and perhaps something like you mention with an
 automated addition to the spammers list as a last addition.

It's not the spam per se, I know how to get rid of that. It's because
99.5% of all incoming mail is for non-existent recipients. I don't
want to check them all to see if it's spam or not cause I already
*know* it's spam. I don't want to waste server resources and internet
bandwidth for something I already know I don't want. I just want to
get rid of those attempts from spammers to deliver spam to my server
as quickly and as easily as possible. 

-- 
Henri.


-
To unsubscribe from this list: send the line unsubscribe xmail in
the body of a message to [EMAIL PROTECTED]
For general help: send the line help in the body of a message to
[EMAIL PROTECTED]



[xmail] Re: Spammers - How to block them.

2006-02-14 Thread Jeff Buehler

Hi Henri -

That's odd. How many smtp threads were you running? I've set the
maximum to 16 now where 4 should be enough to handle all incoming mail
(easily!).
  

Whatever the default is (is it MaxMTAOps? - that is set to 16 on my 
system).  Running on FreeBSD on a Athlon XP running at 2 GHz, 1 gig of 
RAM, fast SCSI hard drive.  Nothing too fancy.  Right now running ASSP 
- clamsmtp - XMail (in this case on the same system) this handily 
processes 4500 (or so) valid emails per day and refuses about the same 
number of additional SPAMs.  Without the CLAMsmtp and ASSP this same 
system processed almost that much email without me ever seeing the 
problem you describe.

It's not the spam per se, I know how to get rid of that. It's because
99.5% of all incoming mail is for non-existent recipients. I don't
want to check them all to see if it's spam or not cause I already
*know* it's spam. I don't want to waste server resources and internet
bandwidth for something I already know I don't want. I just want to
get rid of those attempts from spammers to deliver spam to my server
as quickly and as easily as possible. 

  

Again, if the problem is email to invalid users, I don't see how any of 
the other options you mentioned in XMail will necessarily help.  Perhaps 
they will by using a different mechanism, like RBL check, that is faster 
than XMails own determination of an invalid address, but that seems a 
stretch to me.  ASSP is designed to close the SMTP session immediately 
if it doesn't like an email for any reason specified by the admin, such 
as an invalid address, so it directly addresses the problem you are having.

However, as also mentioned, it seems very strange to me that XMail would 
be so slow on refusing invalid connections as to cause connection 
failures from valid senders if you have a low volume of email - I don't 
know XMail's mechanism behind this (perhaps someone else can clarify) 
but I have never run into that problem, or heard of anyone else running 
into that problem, unless they were getting a HUGE volume of SPAM (and 
not specifically to invalid users).  So it might be worth looking into 
WHY your installation is behaving this way, since it sounds fishy to 
me.  Maybe 4 threads was too low?

Jeff


-
To unsubscribe from this list: send the line unsubscribe xmail in
the body of a message to [EMAIL PROTECTED]
For general help: send the line help in the body of a message to
[EMAIL PROTECTED]



[xmail] Re: Spammers - How to block them.

2006-02-14 Thread Henri van Riel

Hello Phillip,

 Don't block on catchall. I would guess you have blocked yourself
 and/or some of the major email ip addresses that you receive from.

What I did that was preventing XMail from receiving any mail what so
ever was adding the ip address of the spammer.tab with /0 instead of
/32... oops!

 Make a list of the dictionary addresses they are sending to and only
 block those by adding the sending ip's in the spammers.tab. I use a
 255.255.255.255 mask on them in the spammers.tab, only blocking the
 one ip.

I do that too now!

 Do this by logging any email addresses that receive email, and then
 copy the dictionary ones to the address file for the filter to use.
 I ended up with a list of around 400 email addresses. (This is for a
 personal domain).

Hmmm... what's the difference really? I've set up a postmaster account
with a couple of aliases (info, sales, root, etc) and a `fake` mailbox
called `spamtrap` which has the catch-all alias (*). All mail for
known users will go to either their mailbox or to the postmaster's
mailbox. The rest will go through my filter which could add the
sender's ip-address to spammers.tab or the recipients email address
(non-existent) to a dictionary and then return an exitcode 3 to XMail
so it will disconnect without receiving the mail data. 

I've made a script to generate a dictionary and it's been on for 10
minutes now and I already have 349 names in it!

 You need to be careful doing this by making sure that there is no
 reason for anyone to send to that email address. Don't block things
 like info, postmaster, admin, sales, and so on. Those are common
 ones that get spammed that you don't want to block at this level.
 Remember that you are blocking saying that if a computer (maybe your
 isp's email server) sends to this address I never want to receive
 email from that ip address again. Very heavy handed.

Yeah, you're right about that of course.

 Blocking the dictionary names is not the way to stop all spam, but
 it will stop that majority of it if you are targeted. It does take a
 day or two to get all the email addresses that are to be blocked,
 but it is worth it.

It will definitely block most spam. The emails that go through because
the mailbox exists will be checked by the services listed in
CustMapsList, which will reduce spam by another 50-80%.

 And then delete the spammers.tab once in a while, I try to do it
 once a week or so.

I wanted to trim the spammers.tab file so it won't hold more than 200
ip-addresses or so.

 The advantage of the spammers.tab (the way I understand it) is that
 if the connecting ip is listed then the connection is dropped
 without receiving any data. When you have limited bandwidth you
 don't want to receive the entire message before deciding to drop it.

That's how I understand it too! Connection should be dropped `soon`
after a listed ip tries to connect.

-- 
Henri.


-
To unsubscribe from this list: send the line unsubscribe xmail in
the body of a message to [EMAIL PROTECTED]
For general help: send the line help in the body of a message to
[EMAIL PROTECTED]



[xmail] glst tarball windows

2006-02-14 Thread Tony Shiffer

I know this is nuts, but none of the tools I have can open the glst tarball. 
I do have 3 windows programs that handle tar's, but not this tar.  Can 
someone reccomend a windows program that will unpack Davide's tarball on 
Windows - or perhaps someone could make the files available for me?

Tony


- Original Message - 
From: Rob Arends [EMAIL PROTECTED]
To: xmail@xmailserver.org
Cc: 'Alan D. Snyder' [EMAIL PROTECTED]
Sent: Tuesday, February 14, 2006 12:25 AM
Subject: [xmail] Re: glst changes?


 Sure Alan,

 Below is my entire glst.conf
 The main Tweaks were related to the large MTA pools - yahoo, hotmail, etc.
 I ended up rounding everything to /24 bit with some exception to larger
 networks (see Bigpond and Optus Australian ISPs)
 I also excluded a whole heap of networks for familiar or trusted MTAs - 
 for
 mailing lists primarily.
 I also reduced the block time (timeo) to 7 minutes, because 60 minutes was
 too long and most spammers were not retrying anyway, so 1 minute or 60
 minutes was about the same.
 I just analysed my historical logs for IP addresses and trends; then after
 glst implementation, I watched the glst filter rejections and saw the IPs
 and trends and adjusted the mnet and xnet parameters.  After some 
 complaints
 I reduced the timeo.
 This process took an hour or so each day for a few days .

 I also use in server.tab
 SMTP-MaxErrors3
 So that if I get dictionary attacked, then that door is closed too.

 And the other key ingredient in server.tab
 CustMapsList
 list.dsbl.org.:0,relays.ordb.org.:0,sbl.spamhaus.org:0,bl.spamcop.net:0

 I haven't checked recently if all the lists are active, but I've had no
 reason to.

 I get _very_ little spam with this setup.

 Rob :-)



 glst.conf
 rejmsg=451 4.7.1 Please try again later
 generr=0
 rejerr=3
 timeo=420
 exptimeo=3110400
 lametimeo=28800

 # Round all networks to match on ranges of 256 (last octet=*)
 mnet=0.0.0.0,0.0.0.0,255.255.255.0

 # BigPond - go for match on first 2 octects only
 mnet=144.140.82.0,255.255.255.0,255.255.0.0
 mnet=144.140.83.0,255.255.255.0,255.255.0.0
 mnet=144.140.92.0,255.255.255.0,255.255.0.0
 mnet=144.140.93.0,255.255.255.0,255.255.0.0

 # Optus - go for match on first 2 octects only
 mnet=211.29.132.0,255.255.255.0,255.255.0.0
 mnet=211.29.133.0,255.255.255.0,255.255.0.0

 # Hotmail
 mnet=65.52.0.0,255.255.255.0,255.252.0.0
 mnet=64.4.0.0,255.255.255.0,255.255.192.0

 # Yahoo mail
 mnet=68.142.200.0,255.255.252.0,255.255.252.0

 # mailguard.com.au
 mnet=70.84.0.0,255.255.0.0,255.252.0.0
 mnet=66.235.184.61,255.255.255.255,255.255.255.0

 # Exclude the following networks
 # Local
 xnet=127.0.0.1,255.255.255.255
 xnet=10.0.0.0,255.0.0.0
 xnet=172.16.0.0,255.240.0.0
 xnet=192.168.0.0,255.255.0.0
 # IMC
 xnet=203.202.100.224,255.255.255.224
 xnet=203.202.8.0,255.255.255.0
 xnet=203.41.11.128,255.255.255.192
 # @lists.techtarget.com
 xnet=65.214.43.171,255.255.255.255
 xnet=65.214.43.172,255.255.255.255
 xnet=65.214.43.174,255.255.255.255
 # @list.novell.com
 xnet=130.57.1.68,255.255.255.255
 # @australiancu.com
 net=203.58.62.33,255.255.255.255
 # @cav.asn.au
 xnet=210.0.98.129,255.255.255.255
 # @list.cramsession.com
 xnet=63.146.189.86,255.255.255.255
 # @newsletters.online.com (cNet)
 xnet=206.16.1.130,255.255.255.255
 xnet=206.16.1.131,255.255.255.255
 xnet=206.16.1.161,255.255.255.255
 xnet=206.16.1.162,255.255.255.255
 xnet=206.16.1.190,255.255.255.255
 xnet=206.16.1.191,255.255.255.255
 # @nww.hdsmail.com
 xnet=66.37.227.193,255.255.255.255
 # @qff.qantas.net.au
 xnet=210.9.188.147,255.255.255.255
 # @groups.yahoo.com
 xnet=66.94.237.0,255.255.255.0
 xnet=66.218.66.0,255.255.255.0
 xnet=209.73.160.0,255.255.255.0
 xnet=216.155.201.0,255.255.255.0
 # @myfamily.com
 xnet=66.43.22.191,255.255.255.255
 xnet=66.43.22.192,255.255.255.255
 # @xmr3.com
 xnet=205.183.255.0,255.255.255.0
 # @newsletters.online.com
 xnet=206.16.1.131,255.255.255.255
 # @ebay.com
 xnet=66.135.215.0,255.255.255.0

 /glst.conf


  _

 From: Alan D. Snyder [mailto:[EMAIL PROTECTED]
 Sent: Tuesday, February 14, 2006 11:18 AM
 To: Rob Arends
 Subject: glst changes?


 Rob - what changes did you make to glst?

 care to share 'em?

 Thanks,
 Alan




 -
 To unsubscribe from this list: send the line unsubscribe xmail in
 the body of a message to [EMAIL PROTECTED]
 For general help: send the line help in the body of a message to
 [EMAIL PROTECTED]

 


-
To unsubscribe from this list: send the line unsubscribe xmail in
the body of a message to [EMAIL PROTECTED]
For general help: send the line help in the body of a message to
[EMAIL PROTECTED]



[xmail] Re: glst tarball windows

2006-02-14 Thread Davide Libenzi

On Tue, 14 Feb 2006, Tony Shiffer wrote:


 I know this is nuts, but none of the tools I have can open the glst tarball.
 I do have 3 windows programs that handle tar's, but not this tar.  Can
 someone reccomend a windows program that will unpack Davide's tarball on
 Windows - or perhaps someone could make the files available for me?

Any version of Winzip will work. Also the unzip.exe will work. Google will 
help you finding this stuff.


- Davide


-
To unsubscribe from this list: send the line unsubscribe xmail in
the body of a message to [EMAIL PROTECTED]
For general help: send the line help in the body of a message to
[EMAIL PROTECTED]



[xmail] Re: glst tarball windows

2006-02-14 Thread Davide Libenzi

On Tue, 14 Feb 2006, Davide Libenzi wrote:

 On Tue, 14 Feb 2006, Tony Shiffer wrote:

 
 I know this is nuts, but none of the tools I have can open the glst 
 tarball.
 I do have 3 windows programs that handle tar's, but not this tar.  Can
 someone reccomend a windows program that will unpack Davide's tarball on
 Windows - or perhaps someone could make the files available for me?

 Any version of Winzip will work. Also the unzip.exe will work. Google will 
 help you finding this stuff.

Sorry, of course unzip.exe will *NOT* work. Winzip will do though.


- Davide


-
To unsubscribe from this list: send the line unsubscribe xmail in
the body of a message to [EMAIL PROTECTED]
For general help: send the line help in the body of a message to
[EMAIL PROTECTED]



[xmail] Re: xmail and ssl

2006-02-14 Thread Gideon So

Hi


Which SSL patch?
  


The patch Eugene Vasilkov provide. 


Yes - IMHO you need stunnel.
  


I see. Is there anybody can provide a walk thru on how to set up a secure mail 
server with xmail??

Gideon


-- 
::MigDal-Gad CrossNet Ltd::
   ==We do the Best for Christ==
   Tel: 2671-7015 Fax: 3005-4526
   Web: http://www.mcnet.com.hk 

-
To unsubscribe from this list: send the line unsubscribe xmail in
the body of a message to [EMAIL PROTECTED]
For general help: send the line help in the body of a message to
[EMAIL PROTECTED]