Re: Fork server

2004-03-19 Thread Tim Meadowcroft
On Friday 19 March 2004 07:49, Robert Spier wrote: However please send patches if you find things missing. It's performing extremely well for me. And for me too. I'm testing it (in production). It's definitely performing faster and lighter than pperl. Now if only I could convince

Re: General denial question (tarpitting)

2004-03-24 Thread Tim Meadowcroft
On Wednesday 24 March 2004 22:12, David Nicol wrote: it used to be that if you gave yahoo an address in a SMTP transaction that did not have brackets around it you would very shortly thereafter receive a ping flood. Just another example of Yahoo doing things right, I thought. Ho ho ho...

Re: General denial question (tarpitting)

2004-03-25 Thread Tim Meadowcroft
On Thursday 25 March 2004 01:20, Guillaume Filion wrote: Tim Meadowcroft wrote: I started off thinking that I'd suggest adding basic tar-pitting (http://www.gordano.com/kb.htm?q=1112) to selected plugins[...] About tarpitting. It seems to me that any half technical spammer will use

Re: General denial question (tarpitting)

2004-03-25 Thread Tim Meadowcroft
On Thursday 25 March 2004 20:50, Charlie Brady wrote: If you are going to undertake the noble task of sucking up their bandwidth, then I'd suggest that you do the job thoroughly, and make sure that their TCP stack decides to retransmit as many packets as possible. Use iptables (for instance)

Re: General denial question (tarpitting)

2004-03-26 Thread Tim Meadowcroft
On Friday 26 March 2004 16:58, John Peacock wrote: If you (and others in your position) would do this (block outbound SMTP), you would be doing the Internet as a whole an immense service. As long as you make it an easy webform and advertise it well in advance of implementation, your

Re: General denial question (tarpitting)

2004-03-26 Thread Tim Meadowcroft
[Getting dangerously off-topic here, sorry if it offends anyone] On Friday 26 March 2004 19:24, Bryan Scott wrote: This isn't about protecting users (per se). It's about keeping the ISP networks out of the blacklists and reducing network saturation from illegal proxy traffic. That, IMHO, is

Re: General denial question (tarpitting)

2004-03-27 Thread Tim Meadowcroft
On Saturday 27 March 2004 06:41, Andrew Pam wrote: On Sat, Mar 27, 2004 at 04:20:44AM -, James Craig Burley wrote: No. That's one less port he can use to connect to you (on any given destination port). He can still use the same source port to connect to others. TCP connections are

Summary: General denial question (tarpitting)

2004-03-29 Thread Tim Meadowcroft
OK, by way of maybe tying up this thread (which has wandered OT but in interesting ways for me) I'd like to summarise what has been said and then talk about where it goes next. But first, to tie up a loose end: loose_end On Sunday 28 March 2004 11:25, Peter J. Holzer wrote: Yes, but that's

Re: Broken Vaccuum plugin (was Re: General denial question (tarpitting))

2004-03-29 Thread Tim Meadowcroft
On Monday 29 March 2004 16:11, Bryan Scott wrote: One question that didn't get touched on is how to determine who to add to the tarpit. Is that something generally left up to the individual mail admin, or would/should it be keyed off other plugins (perhaps via transaction notes)? Once it's

Re: cvs commit: qpsmtpd/lib/Qpsmtpd Constants.pm SMTP.pm

2004-06-11 Thread Tim Meadowcroft
On Friday 11 Jun 2004 18:27, Andrew Pam wrote: Maybe the *HARD ones should be renamed to s/HARD/DISCONNECT/ -- that'd be a bit less confusing. We can leave DENYHARD in but add DENYDISCONNECT with the same code. I second this, but how about DENYDISC as an abbreviation? I third it

Re: How are you running qpsmtpd?

2004-06-11 Thread Tim Meadowcroft
On Monday 24 May 2004 17:35, John Peacock wrote: Can I get a show of hands for how people are running qpsmtpd? Sorry my reply is a bit late, but I've been rejigging my email after planning and finally changing my distro. I was running with tcpserver and delivering to qmail, but I'm now

Re: Spam Assassin Plugin Problem

2004-06-18 Thread Tim Meadowcroft
On Friday 18 Jun 2004 18:07, Devin Carraway wrote: On Fri, Jun 18, 2004 at 09:53:03AM -0700, Lincoln Turner wrote: The problem is that the qpsmtpd plugin only seems to read the FIRST headers, hence it passes the email through as ham. (disclaimer: I have nothing to do with the spamassassin

Re: Spam Assassin Plugin Problem

2004-06-19 Thread Tim Meadowcroft
On Saturday 19 Jun 2004 11:19, Peter J. Holzer wrote: PS: I find that bug fixes are often only posted on the mailing-list but never added to the CVS, so that a few months later they are discovered by somebody else. Can we do something to improve this (rather sad) situation? I used your patch

Re: Spam Assassin Plugin Problem

2004-06-19 Thread Tim Meadowcroft
On Saturday 19 Jun 2004 14:53, Matt Sergeant wrote: The best long term solution is to get RT or Bugzilla setup for the project. True, but it can take a while to do so (setting up the components and sub-component lists etc.), and unless it's actually tied in to the CM system then it still

qpsmtpd, xinetd and warn() messages

2004-10-22 Thread Tim Meadowcroft
Peter J. Holzer submitted a nice series of patches for getting qpsmtpd working with xinetd rather than tcpserver, but I've just noticed that the default entries cause a few problems: run.xi (the file xinetd calls when it answers a connect on port 25) is: #!/bin/sh # Script to run smtpd

Suggested change to check_badrcptto

2005-02-20 Thread Tim Meadowcroft
check_badrcptto replies with an error on bad recipients, but doesn't do anything else much as it stands (and luckily it only reads the first word of each line of its config file badrcptto). I have a couple of email addresses that are ONLY used by spammers - if one of these is quoted as a

Re: Suggested change to check_badrcptto

2005-02-20 Thread Tim Meadowcroft
On Sunday 20 Feb 2005 19:35, Robert Spier wrote: I'd suggest if a name is followed by an exclamation mark, this means do a DENYHARD, otherwise it does a plain DENY (ie tim - will reject this recipient, tim ! will reject all emails that include tim amongst the recipients). I think it

Re: Suggested change to check_badrcptto

2005-02-20 Thread Tim Meadowcroft
On Sunday 20 Feb 2005 23:53, Devin Carraway wrote: Not crazy about the bang as an errorcode selector, though. If a line in badrcptto is doing to trigger a DENYHARD, it may as well say DENYHARD (or DENY or DISCONNECT or whatever) and eliminate the uncertainty. I agree, but as an extra field

Re: article contra spf

2005-02-23 Thread Tim Meadowcroft
On Wednesday 23 Feb 2005 15:53, John Peacock wrote: Charlie Brady wrote: I spot a logical fallacy in your argument. It doesn't matter how many men of straw there are. What matters is whether there are any men not of straw. Not really. I have to agree with Ask on the link's usefulness.

Re: fuzzy honeypot detects dictionary spam

2005-02-25 Thread Tim Meadowcroft
On Friday 25 Feb 2005 01:03, John Peacock wrote: Bob wrote: Is there an existing filter that could determine if a username@ is 60% or more mis-spelled as compared to real usernames? 60% is arbitrary and would be configurable. If so, that would serve to make a fuzzy honeypot filter for

Re: fuzzy honeypot detects dictionary spam

2005-02-25 Thread Tim Meadowcroft
On Friday 25 Feb 2005 13:35, Bryan Scott wrote: I had thought about a similar thing, but in my more earnest programming days ended up temporarily blacklisting those who error out five or more times in a row. Those who show up on the temporary blacklist 20 or so times within a given time

Re: fuzzy honeypot detects dictionary spam

2005-02-26 Thread Tim Meadowcroft
On Saturday 26 Feb 2005 07:18, Peter J. Holzer wrote: On 2005-02-25 22:28:32 -0700, Bryan Scott wrote: Are you suggesting that you *have* to accept email from even if the recipient doesn't exist? That sounds like a pretty gross black hole to me... It would be if it was true. Of course

Multiple sets of plugins

2005-04-08 Thread Tim Meadowcroft
I'm running my qpsmtpd on quite and old and slow machine, and I was thinking it might be an idea to run different sets of plugins depending on the source IP - trusted senders (my internal network) can be sent without spamassassin and clamav and the rest, where mail from external IP's still

Re: Multiple sets of plugins

2005-04-11 Thread Tim Meadowcroft
On Friday 08 Apr 2005 15:14, John Peacock wrote: This is, indeed, probably the easiest and best way to handle it (it requires the fewest changes).  Using qpsmtpd-forkserver is actually fairly efficient in terms of CPU (if not of RAM), so the age of your hardware shouldn't be a big deal.  

Re: Multiple sets of plugins

2005-04-14 Thread Tim Meadowcroft
On Wednesday 13 Apr 2005 13:16, Gavin Carr wrote: I've been using multiple configs for a while and really like it. I'm using it a couple of ways: - to run two instances of qpsmtpd (one small and aggressive, one large and conservative) off of the same code base. It's easier to upgrade

Re: forkserver: config/plugin options

2005-04-19 Thread Tim Meadowcroft
On Tuesday 19 Apr 2005 19:33, Ask Bjørn Hansen wrote: I like the qmail-ish layout with everything under one directory, but adding support for FHS would be great. As a relatively recent convert to gentoo, I'd noticed that qpsmtpd is one of the few software packages that doesn't yet seem to

Re: Apache::Qpsmtpd

2006-04-06 Thread Tim Meadowcroft
On Monday 03 April 2006 21:08, Ask Bjørn Hansen wrote: I am not sure there's a significant performance difference between driving qpsmtpd with forkserver or with apache.Also keep in mind that if a lot of your mails make it to spamassassin or virus scanning, then those processes will

Re: Spam bounce problem

2006-10-21 Thread Tim Meadowcroft
On Friday 20 October 2006 21:14, Kjetil Kjernsmo wrote: The easiest short-term solution is to use the check_badrcptto plugin   to block the undeliverable addresses at SMTP time.  If [EMAIL PROTECTED] gets joe-jobbed he will still get the bounces,   but at least you won't get the

Re: plugin to block unknown connection attempts

2007-02-20 Thread Tim Meadowcroft
On Tuesday 20 February 2007 21:01, Charles Butcher wrote: In the end I tweaked spamassassin to give a high score (3.0) to anything without a PTR. That has worked like a charm because if a message is even slightly dodgy it will go over the threshold score, but there's still some headroom to

Re: plugin to block unknown connection attempts

2007-02-21 Thread Tim Meadowcroft
On Wednesday 21 February 2007 00:48, Charles Butcher wrote: On 21/02/2007, at 09:48, Tim Meadowcroft wrote: On Tuesday 20 February 2007 21:01, Charles Butcher wrote: And that's the type of rule that frustrates me... I operate on a dynamic IP, but have an MX record that points

Re: Dumb plugin question

2007-03-12 Thread Tim Meadowcroft
On Monday 12 March 2007 01:48, Matt Sergeant wrote: Is there a simple rcpt plugin to check against the qmail aliases directory and the qmail virtualdomains file? This is my check_goodrcptto that reads the assign file (typically /var/qmail/users/assign) and allows for non-alias addresses in

Re: Filter bounce mails with forged domains

2007-04-18 Thread Tim Meadowcroft
On Wednesday 18 April 2007 16:18, Mark Farver wrote: [EMAIL PROTECTED] wrote: The spammers who take my domain name in vain tend to use a random username for the emails, so I reject bounces sent to non-existent users with a special message that says Looks like you're bouncing a mail witha

Re: Filter bounce mails with forged domains

2007-04-19 Thread Tim Meadowcroft
On Thu, Apr 19, 2007 at 09:17:26AM +0200, Werner Fleck wrote: [EMAIL PROTECTED] schrieb: [...] The spammers who take my domain name in vain tend to use a random username for the emails, so I reject bounces sent to non-existent users I'm using a different email address for almost every

Re: Dealing with joe-job attacks?

2009-05-13 Thread Tim Meadowcroft
On Tuesday 12 May 2009 22:16:14 Steve Kemp wrote: I wonder how people on the list deal with joe job attacks? Right now I accept all incoming messages which are addressed to valid recipients on the domains I host *AND* all incoming bounces. Personally (and this is a private domain) I

Re: check_badrcptto, to prevent backscatter

2011-03-09 Thread Tim Meadowcroft
On Sunday 06 March 2011 06:42:50 Robert Spier wrote: Todd Brunhoff wrote: Your scripts look like they have a good deal of qmail sophistication. Some years ago I ran qmail 1.0.3, after each major system crash, I would revisit whether to use qmail, and eventually decided to switch

Re: check_badrcptto, to prevent backscatter

2011-03-10 Thread Tim Meadowcroft
On Thursday 10 March 2011 18:06:04 Robert Spier wrote: Ask Bjørn Hansen wrote: On Mar 10, 2011, at 6:49, Matt Sergeant wrote: Should we have plugins/qmail and plugins/postfix dirs? I like that idea. I'm not sure I do. The existing directories don't really line up that way, and I

Re: check_badrcptto, to prevent backscatter

2011-03-11 Thread Tim Meadowcroft
On Friday 11 March 2011 03:41:03 Chris Lewis wrote: I think we'd be better served by coming up with, for example, a qpsmtpd way of doing this sort of thing. For example: for basic RCPT TO functionality, have a basic RCPT time plugin that can handle aliasing, allowable domain relays, lists