Re: [Mimedefang] Blocking Dictionary Attacks

2009-06-09 Thread David F. Skoll
afo cliff wrote: Yes thanks, I tried that, the down side for me is that it sends a User Unknown reject notification, which I'm trying to avoid. I don't want my server to waste time sending 10,000 rejects to a zombie somewhere. ??? It doesn't send a notification. All it does is reply with a

Re: [Mimedefang] Blocking Dictionary Attacks

2009-06-09 Thread afo cliff
Matt Garretson wrote: afo cliff wrote: @mydomain.com bitbucket You can also do something like this in your virtusertable: @mydomain.com  error:5.1.1:550 User unknown Then, you won't need the bitbucket alias. See http://www.sendmail.org/m4/features.html Yes thanks, I tried that, the

Re: [Mimedefang] SELinux labeling

2009-06-09 Thread Stephen L Johnson
On Tue, 2009-06-09 at 00:35 -0500, Kenneth Porter wrote: Has anyone come up with a good scheme/policy for labeling files in the MD directory so that both MD and ClamAV (and perhaps spamd and other AVs) have access to them? If I understand you question, you can run the clamd process as the

Re: [Mimedefang] Blocking Dictionary Attacks

2009-06-09 Thread Les Mikesell
afo cliff wrote: Matt Garretson wrote: afo cliff wrote: @mydomain.com bitbucket You can also do something like this in your virtusertable: @mydomain.com error:5.1.1:550 User unknown Then, you won't need the bitbucket alias. See http://www.sendmail.org/m4/features.html Yes thanks, I tried

Re: [Mimedefang] Blocking Dictionary Attacks

2009-06-09 Thread afo cliff
Renaud, FILTERING BY RECIPIENT You can define a function called filter_recipient in your filter. This lets you reject messages to certain recipients, rather than waiting until the whole message has been sent. Note that for this check to take place, you must use

Re: [Mimedefang] Blocking Dictionary Attacks

2009-06-09 Thread afo cliff
Ok, I'm convinced. I'll send the failure responses. ___ NOTE: If there is a disclaimer or other legal boilerplate in the above message, it is NULL AND VOID. You may ignore it. Visit http://www.mimedefang.org and http://www.roaringpenguin.com

Re: [Mimedefang] Blocking Dictionary Attacks

2009-06-09 Thread Matt Garretson
afo cliff wrote: Thanks for the info. It mentions using the -t flag ... however, I start mimedefang with service mimedefang start so I don't have any control over the flags that are being used. It sounds like you have Fedora or a Redhat variant? There should be /etc/sysconfig/mimedefang

Re: [Mimedefang] Blocking Dictionary Attacks

2009-06-09 Thread Les Mikesell
Matt Garretson wrote: afo cliff wrote: Thanks for the info. It mentions using the -t flag ... however, I start mimedefang with service mimedefang start so I don't have any control over the flags that are being used. It sounds like you have Fedora or a Redhat variant? There should be

Re: [Mimedefang] Blocking Dictionary Attacks

2009-06-09 Thread afo cliff
Ok, then it looks like it's better to stick with access/virtusertable rejection. But, if you have defined everyone in virtusertable with default rejects, sendmail will process invalid recipients faster than mimedefang can. You might still get a few instances where where a message comes in with

Re: [Mimedefang] Blocking Dictionary Attacks

2009-06-09 Thread Paul Murphy
afo cliff afocl...@gmail.com 09/06/2009 17:18 Ok, then it looks like it's better to stick with access/virtusertable rejection. No, it is infinitely better to do it in filter_recipient, and terminate the connection after a number of invalid recipients. Consider the case where a spammer

Re: [Mimedefang] Blocking Dictionary Attacks

2009-06-09 Thread Les Mikesell
Paul Murphy wrote: afo cliff afocl...@gmail.com 09/06/2009 17:18 Ok, then it looks like it's better to stick with access/virtusertable rejection. No, it is infinitely better to do it in filter_recipient, and terminate the connection after a number of invalid recipients. Consider the case

Re: [Mimedefang] Blocking Dictionary Attacks

2009-06-09 Thread David F. Skoll
Les Mikesell wrote: Spammers are a lot smarter than that these days. If you watch your logs during a dictionary attack you are likely to see the messages come in from dozens of different IP addresses that are obviously coordinating the address space and timing so you don't see a big number

Re: [Mimedefang] Blocking Dictionary Attacks

2009-06-09 Thread Ben Kamen
That reminds me, I lost my sendmail blackhole script when my server crashed last year... I think some people asked me for it -- if you still have a copy you could email me, I'd really appreciate it. Thanks, -Ben ___ NOTE: If there is a disclaimer

Re: [Mimedefang] Blocking Dictionary Attacks

2009-06-09 Thread Paul Murphy
Les Mikesell l...@futuresource.com 09/06/2009 18:59 Spammers are a lot smarter than that these days. If you watch your logs during a dictionary attack you are likely to see the messages come in from dozens of different IP addresses that are obviously coordinating the address space and

[Mimedefang] (was Re: Blocking Dictionary Attacks)

2009-06-09 Thread Matt Garretson
Les Mikesell wrote: a large number of invalid recipients that makes it obvious spam but it will still be accepted for a small number of valid addresses. You might be able to figure that out with some work in filter_recipient - or just BTW, this reminds me, is MIMEdefang yet able to

[Mimedefang] Multiline Responses revisited

2009-06-09 Thread Michiel Brandenburg
Howdie all, Attached there is a patch against mimedefang.c to enable multiline responses. This was mentioned in the mailing list some time back and was a todo on my private mimedefang list. Can someone take a look at it, and implement it within mimedefang if you like it. Now my c is kinda

Re: [Mimedefang] (was Re: Blocking Dictionary Attacks)

2009-06-09 Thread -
--- On Tue, 6/9/09, Matt Garretson ma...@assembly.state.ny.us wrote: Les Mikesell wrote: a large number of invalid recipients that makes it obvious spam but it will still be accepted for a small number of valid addresses.  You might be able to figure that out with some work in

[Mimedefang] Your mail to the MIMEDefang list was not delivered

2009-06-09 Thread -
--- On Tue, 6/9/09, MIMEDefang Mail Daemon mimedef...@roaringpenguin.com wrote: The message you sent about 'Re: [Mimedefang] Blocking Dictionary Attacks' was not delivered to the MIMEDefang mailing list, because it appeared to contain too much quoted material.  Messages are rejected if they

Re: [Mimedefang] (was Re: Blocking Dictionary Attacks)

2009-06-09 Thread David F. Skoll
Matt Garretson wrote: BTW, this reminds me, is MIMEdefang yet able to access sendmail macros defined after the MAIL FROM stage? No, this was never implemented. Regards, David. ___ NOTE: If there is a disclaimer or other legal boilerplate in the

Re: [Mimedefang] (was Re: Blocking Dictionary Attacks)

2009-06-09 Thread Matt Garretson
- wrote: --- On Tue, 6/9/09, Matt Garretson wrote: $SendmailMacros{'nbadrcpts'} in every filter function, but it never has a value. Did you tell Sendmail to provide the value? The default setting is: Yup, in sendmail.mc : define(`confMILTER_MACROS_ENVRCPT', confMILTER_MACROS_ENVRCPT``,