Re: check_badrcptto, to prevent backscatter

2011-03-11 Thread Tim Meadowcroft
On Friday 11 March 2011 03:41:03 Chris Lewis wrote: > I think we'd be better served by coming up with, for example, a "qpsmtpd > way" of doing this sort of thing. > > For example: for basic RCPT TO functionality, have a basic RCPT time > plugin that can handle aliasing, allowable domain relays, l

Re: check_badrcptto, to prevent backscatter

2011-03-10 Thread Tim Meadowcroft
On Thursday 10 March 2011 18:06:04 Robert Spier wrote: > Ask Bjørn Hansen wrote: > > On Mar 10, 2011, at 6:49, Matt Sergeant wrote: > > > Should we have plugins/qmail and plugins/postfix dirs? > > > > I like that idea. > > I'm not sure I do. The existing directories don't really line up that > w

Re: check_badrcptto, to prevent backscatter

2011-03-09 Thread Tim Meadowcroft
On Sunday 06 March 2011 06:42:50 Robert Spier wrote: > Todd Brunhoff wrote: > > Your scripts look like they have a good deal of qmail > > sophistication. Some years ago I ran qmail 1.0.3, after each major > > system crash, I would revisit whether to use qmail, and eventually > > decided to

Re: check_badrcptto, to prevent backscatter

2011-02-05 Thread Tim Meadowcroft
On Saturday 05 February 2011 08:38:12 Todd Brunhoff wrote: > I have a small email server that is just for my wife and I. The > biggest problem I have is backscatter (mail received with invalid local > address that bounces to an invalid sender address). So the following > script blocks all of this

Re: Dealing with joe-job attacks?

2009-05-13 Thread Tim Meadowcroft
On Tuesday 12 May 2009 22:16:14 Steve Kemp wrote: > I wonder how people on the list deal with joe job attacks? > > Right now I accept all incoming messages which are addressed to > valid recipients on the domains I host *AND* all incoming bounces. Personally (and this is a private domain) I

Re: Filter bounce mails with forged domains

2007-04-19 Thread Tim Meadowcroft
On Thu, Apr 19, 2007 at 09:17:26AM +0200, Werner Fleck wrote: > [EMAIL PROTECTED] schrieb: > >[...] > >The spammers who take my domain name in vain tend to use a random > >username for the emails, so I reject bounces sent to non-existent users > > I'm using a different email address for almost ev

Re: Filter bounce mails with forged domains

2007-04-18 Thread Tim Meadowcroft
On Wednesday 18 April 2007 16:18, Mark Farver wrote: > [EMAIL PROTECTED] wrote: > > The spammers who take my domain name in vain tend to use a random > > username for the emails, so I reject bounces sent to non-existent users > > with a special message that says "Looks like you're bouncing a mail

Re: Dumb plugin question

2007-03-12 Thread Tim Meadowcroft
On Monday 12 March 2007 01:48, Matt Sergeant wrote: > Is there a simple rcpt plugin to check against the qmail aliases > directory and the qmail virtualdomains file? This is my check_goodrcptto that reads the assign file (typically /var/qmail/users/assign) and allows for non-alias addresses in

Re: plugin to block unknown connection attempts

2007-02-21 Thread Tim Meadowcroft
On Wednesday 21 February 2007 00:48, Charles Butcher wrote: > On 21/02/2007, at 09:48, Tim Meadowcroft wrote: > > On Tuesday 20 February 2007 21:01, Charles Butcher wrote: > > And that's the type of rule that frustrates me... I operate on a > > dynamic IP, > > but

Re: plugin to block unknown connection attempts

2007-02-20 Thread Tim Meadowcroft
On Tuesday 20 February 2007 21:01, Charles Butcher wrote: > In the end I tweaked spamassassin to give a high score (3.0) to > anything without a PTR. That has worked like a charm because if a > message is even slightly dodgy it will go over the threshold score, but > there's still some headroom t

Re: Spam bounce problem

2006-10-22 Thread Tim Meadowcroft
On Saturday 21 October 2006 11:36, Kjetil Kjernsmo wrote: > OK, thanks, that's a start! BTW, I don't consider this a real joe-job, > as a real joe-job is intended to put the blame on someone, this is just > random abuse. Annoying nevertheless, but not targetted at me. Suppose so, I don't know how

Re: Spam bounce problem

2006-10-21 Thread Tim Meadowcroft
On Friday 20 October 2006 21:14, Kjetil Kjernsmo wrote: > > The easiest short-term solution is to use the check_badrcptto plugin > >   to block the undeliverable addresses at SMTP time.  If > > [EMAIL PROTECTED] gets "joe-jobbed" he will still get the bounces,   > > but at least you won't get the

Re: Apache::Qpsmtpd

2006-04-06 Thread Tim Meadowcroft
On Monday 03 April 2006 21:08, Ask Bjørn Hansen wrote: > I am not sure there's a significant performance difference between > driving qpsmtpd with forkserver or with apache.Also keep in mind > that if a lot of your mails make it to spamassassin or virus > scanning, then those processes will qu

Re: uniq in perl - in_a_not_b()

2005-06-15 Thread Tim Meadowcroft
> sub in_a_not_b { > my ( $ra , $rb , %u , %v ) = ( $_[0] , $_[1] , () , () ) ; > grep { $_ and ! ($u{$_}++) } @$rb ; > grep { $_ and ! ($v{$_}++) and ! $u{$_} } @$ra ; > } Hey have we changed into the "perl haxors" list ?? If the spec is "list of unique (ie duplicates removed) items in @a th

Re: forkserver: config/plugin options

2005-04-19 Thread Tim Meadowcroft
On Tuesday 19 Apr 2005 19:33, Ask Bjørn Hansen wrote: > I like the qmail-ish layout with everything under one directory, but > adding support for FHS would be great. As a relatively recent convert to gentoo, I'd noticed that qpsmtpd is one of the few software packages that doesn't yet seem to co

Re: Multiple sets of plugins

2005-04-14 Thread Tim Meadowcroft
On Wednesday 13 Apr 2005 13:16, Gavin Carr wrote: > I've been using multiple configs for a while and really like it. I'm using > it a couple of ways: > > - to run two instances of qpsmtpd (one small and aggressive, one large and >conservative) off of the same code base. It's easier to upgrade

Re: Foreign langauge spam

2005-04-11 Thread Tim Meadowcroft
On Monday 11 Apr 2005 21:07, Justin Mason wrote: > Tim Meadowcroft writes: > > I've noticed that a fair proportion of what gets thru my filters (and > > just about the only spam that gets past the gmail spam filters on my > > account so far) is foreign language encod

Foreign langauge spam

2005-04-11 Thread Tim Meadowcroft
I've noticed that a fair proportion of what gets thru my filters (and just about the only spam that gets past the gmail spam filters on my account so far) is foreign language encoded spam. I suppose this isn't hitting all the SpamAssassin hand-made keywords or the Bayesian filters, and while I

Re: Multiple sets of plugins

2005-04-11 Thread Tim Meadowcroft
On Friday 08 Apr 2005 15:14, John Peacock wrote: > This is, indeed, probably the easiest and best way to handle it (it > requires the fewest changes).  Using qpsmtpd-forkserver is actually > fairly efficient in terms of CPU (if not of RAM), so the age of your > hardware shouldn't be a big deal.  D

Multiple sets of plugins

2005-04-08 Thread Tim Meadowcroft
I'm running my qpsmtpd on quite and old and slow machine, and I was thinking it might be an idea to run different sets of plugins depending on the source IP - trusted senders (my internal network) can be sent without spamassassin and clamav and the rest, where mail from external IP's still need

Re: fuzzy honeypot detects dictionary spam

2005-02-26 Thread Tim Meadowcroft
On Saturday 26 Feb 2005 07:18, Peter J. Holzer wrote: > On 2005-02-25 22:28:32 -0700, Bryan Scott wrote: > > Are you suggesting that you *have* to accept email from <> even if the > > recipient doesn't exist? That sounds like a pretty gross black hole to > > me... > > It would be if it was true.

Re: fuzzy honeypot detects dictionary spam

2005-02-25 Thread Tim Meadowcroft
On Friday 25 Feb 2005 13:35, Bryan Scott wrote: > I had thought about a similar thing, but in my more earnest programming > days ended up temporarily blacklisting those who error out five or more > times in a row. Those who show up on the temporary blacklist 20 or so > times within a given time f

Re: fuzzy honeypot detects dictionary spam

2005-02-25 Thread Tim Meadowcroft
On Friday 25 Feb 2005 01:03, John Peacock wrote: > Bob wrote: > > Is there an existing filter that could determine if a username@ > > is 60% or more mis-spelled as compared to real usernames? > > 60% is arbitrary and would be configurable. If so, that would > > serve to make a fuzzy honeypot filter

Re: article contra spf

2005-02-23 Thread Tim Meadowcroft
On Wednesday 23 Feb 2005 15:53, John Peacock wrote: > Charlie Brady wrote: > > I spot a logical fallacy in your argument. It doesn't matter how many men > > of straw there are. What matters is whether there are any men not of > > straw. > > Not really. I have to agree with Ask on the link's usefu

Re: Suggested change to check_badrcptto

2005-02-20 Thread Tim Meadowcroft
On Sunday 20 Feb 2005 23:53, Devin Carraway wrote: > Not crazy about the bang as an errorcode selector, though. If a line in > badrcptto is doing to trigger a DENYHARD, it may as well say DENYHARD (or > DENY or DISCONNECT or whatever) and eliminate the uncertainty. I agree, but as an extra field

Re: Suggested change to check_badrcptto

2005-02-20 Thread Tim Meadowcroft
On Sunday 20 Feb 2005 19:35, Robert Spier wrote: > > I'd suggest if a name is followed by an exclamation mark, this means do a > > DENYHARD, otherwise it does a plain DENY (ie "tim" - will reject this > > recipient, "tim !" will reject all emails that include "tim" amongst the > > recipients). > >

Suggested change to check_badrcptto

2005-02-20 Thread Tim Meadowcroft
check_badrcptto replies with an error on bad recipients, but doesn't do anything else much as it stands (and luckily it only reads the first word of each line of its config file badrcptto). I have a couple of email addresses that are ONLY used by spammers - if one of these is quoted as a recip

Re: Mail front?

2004-11-22 Thread Tim Meadowcroft
On Monday 22 Nov 2004 12:57, John Peacock wrote: > I have to say that this is completely daft (IMNSHO). This is yet another > precarious layer to the house of cards that people have made DNS (c.f. all > the arguments about SPF), for no good reason. The mere presence of a cache > does not mean th

Re: qpsmtpd, xinetd and warn() messages

2004-10-24 Thread Tim Meadowcroft
On Saturday 23 Oct 2004 08:32, Peter J. Holzer wrote: > Is this from one of my mails to this list? Because in the version on my > web site this script reads: > > #!/bin/sh > dir=`dirname $0` > today=`date '+%Y-%m-%d'` > cd $dir && ( ( ./qpsmtpd >&3 ) 2>&1 | /usr/local/bin/ts >> log/$today ) > 3>&

qpsmtpd, xinetd and warn() messages

2004-10-22 Thread Tim Meadowcroft
Peter J. Holzer submitted a nice series of patches for getting qpsmtpd working with xinetd rather than tcpserver, but I've just noticed that the default entries cause a few problems: run.xi (the file xinetd calls when it answers a connect on port 25) is: #!/bin/sh # Script to run smtpd whe

Re: Spam Assassin Plugin Problem

2004-06-19 Thread Tim Meadowcroft
On Saturday 19 Jun 2004 14:53, Matt Sergeant wrote: > The best long term solution is to get RT or Bugzilla setup for the > project. True, but it can take a while to do so (setting up the components and sub-component lists etc.), and unless it's actually tied in to the CM system then it still re

Re: Spam Assassin Plugin Problem

2004-06-19 Thread Tim Meadowcroft
On Saturday 19 Jun 2004 11:19, Peter J. Holzer wrote: > PS: I find that bug fixes are often only posted on the mailing-list but > never added to the CVS, so that a few months later they are discovered > by somebody else. Can we do something to improve this (rather sad) > situation? I used your pa

Re: Spam Assassin Plugin Problem

2004-06-18 Thread Tim Meadowcroft
On Friday 18 Jun 2004 18:07, Devin Carraway wrote: > On Fri, Jun 18, 2004 at 09:53:03AM -0700, Lincoln Turner wrote: > > The problem is that the qpsmtpd plugin only seems to read the FIRST > > headers, hence it passes the email through as ham. > > (disclaimer: I have nothing to do with the spamassa

Re: How are you running qpsmtpd?

2004-06-11 Thread Tim Meadowcroft
On Monday 24 May 2004 17:35, John Peacock wrote: > Can I get a show of hands for how people are running qpsmtpd? Sorry my reply is a bit late, but I've been rejigging my email after planning and finally changing my distro. I was running with tcpserver and delivering to qmail, but I'm now runni

Re: cvs commit: qpsmtpd/lib/Qpsmtpd Constants.pm SMTP.pm

2004-06-11 Thread Tim Meadowcroft
On Friday 11 Jun 2004 18:27, Andrew Pam wrote: > > Maybe the *HARD ones should be renamed to s/HARD/DISCONNECT/ -- that'd > > be a bit less confusing. > > > > We can leave DENYHARD in but add DENYDISCONNECT with the same code. > > I second this, but how about DENYDISC as an abbreviation? I third

Re: Broken Vaccuum plugin (was Re: General denial question (tarpitting))

2004-03-29 Thread Tim Meadowcroft
On Monday 29 March 2004 16:11, Bryan Scott wrote: > One question that didn't get touched on is how to determine who to add > to the tarpit. Is that something generally left up to the individual > mail admin, or would/should it be keyed off other plugins (perhaps via > transaction notes)? Once it

Summary: General denial question (tarpitting)

2004-03-29 Thread Tim Meadowcroft
OK, by way of maybe tying up this thread (which has wandered OT but in interesting ways for me) I'd like to summarise what has been said and then talk about where it goes next. But first, to tie up a loose end: On Sunday 28 March 2004 11:25, Peter J. Holzer wrote: > Yes, but that's only beca

Re: General denial question (tarpitting)

2004-03-27 Thread Tim Meadowcroft
On Saturday 27 March 2004 06:41, Andrew Pam wrote: > On Sat, Mar 27, 2004 at 04:20:44AM -, James Craig Burley wrote: > > >No. That's one less port he can use to connect to you (on any given > > >destination port). He can still use the same source port to connect to > > >others. TCP connections

Re: General denial question (tarpitting)

2004-03-26 Thread Tim Meadowcroft
[Getting dangerously off-topic here, sorry if it offends anyone] On Friday 26 March 2004 19:24, Bryan Scott wrote: > This isn't about protecting users (per se). It's about keeping the ISP > networks out of the blacklists and reducing network saturation from > "illegal" proxy traffic. That, IMHO

Re: General denial question (tarpitting)

2004-03-26 Thread Tim Meadowcroft
On Friday 26 March 2004 16:58, John Peacock wrote: > If you (and others in your position) would do this (block outbound SMTP), > you would be doing the Internet as a whole an immense service. As long as > you make it an easy webform and advertise it well in advance of > implementation, your custo

Re: General denial question (tarpitting)

2004-03-25 Thread Tim Meadowcroft
On Thursday 25 March 2004 20:50, Charlie Brady wrote: > If you are going to undertake the noble task of sucking up their > bandwidth, then I'd suggest that you do the job thoroughly, and make sure > that their TCP stack decides to retransmit as many packets as possible. > Use iptables (for instanc

Re: General denial question (tarpitting)

2004-03-25 Thread Tim Meadowcroft
On Thursday 25 March 2004 01:20, Guillaume Filion wrote: > Tim Meadowcroft wrote: > > I started off thinking that I'd suggest adding basic tar-pitting > > (http://www.gordano.com/kb.htm?q=1112) to selected plugins[...] > > About tarpitting. It seems to me that any h

Re: General denial question (tarpitting)

2004-03-24 Thread Tim Meadowcroft
On Wednesday 24 March 2004 22:12, David Nicol wrote: > it used to be that if you gave yahoo an address in a SMTP transaction > that did not have brackets around it you would very shortly thereafter > receive a ping flood. Just another example of Yahoo doing things right, > I thought. Ho ho ho...

General denial question (tarpitting)

2004-03-24 Thread Tim Meadowcroft
Hi all, So I've been happily running qpsmtp for a few weeks, and I'm tempted to do some hacking, (er ... suggest some changes) but thought I'd ask for comments before starting. I started off thinking that I'd suggest adding basic tar-pitting (http://www.gordano.com/kb.htm?q=1112) to selected

Re: Fork server

2004-03-19 Thread Tim Meadowcroft
On Friday 19 March 2004 07:49, Robert Spier wrote: > > However please send patches if you find things missing. It's performing > > extremely well for me. > > And for me too. > > I'm testing it (in production). It's definitely performing faster and > lighter than pperl. > > Now if only I could con