Dan Hollis <goemon@...> wrote: [Honeypots] ... Yes, DST (Distributed Spam Traps) already does all of this. But there is no doc written yet, and the...
29
manu@...
May 26, 2004 7:27 pm
... I'm pretty convinced it's a real mail server that relayed the virus. I suspect it just accepted the virus from its internal domain and propagates it...
28
manu@...
May 26, 2004 7:26 pm
... Not yet. The addr clause only works with netblocks. It's probably the next big feature to add. -- Emmanuel Dreyfus Il y a 10 sortes de personnes dans le...
27
Dan Hollis
goemon667
May 26, 2004 7:09 pm
... In order for honeypot to be useful it needs to be easy to deploy, like milter-greylist. E.g. not these spaghetti mess of other honeypot software. Hopefully...
26
Dan Hollis
goemon667
May 26, 2004 7:08 pm
... This is really it. He's thinking that his IP has been blacklisted in some RBL so he's trying again from another IP hoping that not all of them are ...
25
Dan Hollis
goemon667
May 26, 2004 6:56 pm
Is it possible to add wildcard support in the addr clause? E.g. addr *.someisp.com Adding some 100's of addr clauses to cover all the dialup IP blocks we have...
24
Matthias Scheler
tron@...
May 26, 2004 6:29 pm
... SPF records are not widely-used at moment. And my proposal would provide the same functionality with requiring SPF records. Kind regards -- Matthias...
23
Cyril Guibourg
cg+milter-greylist@...
May 26, 2004 5:28 pm
... How do you tell this *is* a virus and *not* some MTA trying to deliver some infected message ? $ telnet vserver-raccourci.nexen.net 25 Trying...
22
milter@...
May 26, 2004 5:09 pm
... This kind of DoS occurs not only with grey-listing but also with use of blacklists at the sendmail level. Now some spammers seems to do retry from other...
21
Jacques Beigbeder
jacques.beigbeder@...
May 26, 2004 4:18 pm
... Everything, including spams and virus. ... I don't agree. I estimated 100 MORE connections per day per user. 5000 users = 500.000 more SMTP connections. ...
20
Emmanuel Dreyfus
manu@...
May 26, 2004 3:55 pm
... When you count 200k connections per day, do you count everything, or everything minus spam and viruses? If it's everything, then most of your connections...
19
Jacques Beigbeder
jacques.beigbeder@...
May 26, 2004 3:43 pm
... May be but... If I look at my setting, I estimate there are 100 more SMTP connections per user per day due to greylisting. For a site with 5000 users (my ...
18
Emmanuel Dreyfus
manu@...
May 26, 2004 2:42 pm
... I can see only one explanation for that: it beileived x.x.x.x/0 was whitelisted. We could probably have a particular test to catch that, because nobody...
17
Matthieu Herrb
matthieu.herrb@...
May 26, 2004 2:37 pm
... I've seen that too. I've ended up with dnl Max connexions par secondes define(confCONNECTION_RATE_THROTTLE,`10') in my sendmail.mc to limit the impact of...
16
Matthieu Herrb
matthieu.herrb@...
May 26, 2004 2:36 pm
... [...] ... Make the config file parser a bit more robust. I got caught a couple of times after manually adding a whitelist entry with a (unwanted) syntax ...
15
Emmanuel Dreyfus
manu@...
May 26, 2004 2:04 pm
... Well this seems to be the kind of problem why SPF was created for, wasn't it? -- Emmanuel Dreyfus manu@......
14
Matthias Scheler
tron@...
May 26, 2004 1:45 pm
... What about auto MX whitelisting: If "host.foo.bar" delivers an e-mail from "user@..." an "host.foo.bar" is listed in the MX records of "do.main" don't...
13
Cyril Guibourg
cg+milter-greylist@...
May 26, 2004 12:36 pm
... Run ! run !!! ;^)...
12
Emmanuel Dreyfus
manu@...
May 26, 2004 12:08 pm
... That's fine for me provided I remain ahead of the spammers during that process :) -- Emmanuel Dreyfus manu@......
11
Cyril Guibourg
cg+milter-greylist@...
May 26, 2004 12:01 pm
... This is clearly an escalation process. ... Once I am done with the milter-greylist FreeBSD port I will be glad to play with it....
10
Emmanuel Dreyfus
manu@...
May 26, 2004 11:56 am
... That's why I think this is just some evil assault which is not related to spam. I already saw floods of messages that knocked down my servers, and...
9
Emmanuel Dreyfus
manu@...
May 26, 2004 11:53 am
... (snip) ... Surely this is a DDOS, but it is not especially aimed at greylisting. With greylisting, it eats your memory, and if you use SpamAssassin, it...
8
Cyril Guibourg
cg+milter-greylist@...
May 26, 2004 11:51 am
... This can be controlled by fixing the max number of childs and combined with connection refuse on high LA values you can dramaticaly mitigate any risk of...
7
Jacques Beigbeder
jacques.beigbeder@...
May 26, 2004 11:31 am
Hello, Last week, I installed milter-greylist for some email addresses. ... [ .... ] 222.136.25.31 <virginia@...> <xxxx.xxxxxxxx@...>...
6
Cyril Guibourg
cg+milter-greylist@...
May 26, 2004 10:07 am
... Oooops, that make sense. I was into another galaxy when I wrote it, I'm going to drink another coffee ;^) ... Yep, it's nice. ... Why not, I agree with the...
5
Emmanuel Dreyfus
manu@...
May 26, 2004 9:52 am
... It would just not whitelist, and the message would go through greylisting. Not something really horrible. ... Oh, yes, good idea. In fact, per-user config...
4
Cyril Guibourg
cg+milter-greylist@...
May 26, 2004 9:46 am
... Hello, ... Imho this could end into another issue if for some reason reverse resolution is broken for a while (NXDOMAIN ?) how would whitelist code react...
3
Emmanuel Dreyfus
manu@...
May 26, 2004 9:40 am
Hi Now that the scallability problem has been somewhat handled, I think about pushing a new stable release. Of course this means testing latest 1.3.x code a...
2
Cyril Guibourg
cg+milter-greylist@...
May 25, 2004 5:08 pm
... Salut Manu, One thing I know about yahoogroups is that if their servers encounter few bounces your addy is wiped out of the list very quickly: around three...
1
Emmanuel Dreyfus
manu@...
May 25, 2004 3:45 pm
Hello everybody First I'd like to thank Dan Hollis for taking care of this list, I'm sure it will be a usefull place for improving milter-greylist. ...
