headers
Delahunty, Mark | 1 Feb 2011 13:23
Picon

Sendmail local recipients

Hi

I have users in sendmail's virtusertable. The domains of these user's
addresses are also in sendmail's local-host-names file.

If I'm understanding this right, this makes sendmail treat these
recipients as "local".

I'm thinking of getting mimedefang to log some stats on distributed
dictionary attacks. But as far as I can see, filter_recipient() does not
get called or see the recipient if sendmail rejects an unknown local
user.

I suppose I could get the details from sendmail's logs, but if we want
to do anything with dictionary attacks as they're happening I'd want to
do it in mimedefang.

Any ideas?

Mark
Permalink | Reply | 2 comments |
headers
David F. Skoll | 1 Feb 2011 14:52
Favicon

Re: Sendmail local recipients

On Tue, 1 Feb 2011 12:23:00 -0000
"Delahunty, Mark" <MDelahunty <at> cc.ucc.ie> wrote:

> I'm thinking of getting mimedefang to log some stats on distributed
> dictionary attacks. But as far as I can see, filter_recipient() does
> not get called or see the recipient if sendmail rejects an unknown
> local user.

It should be unless you use the "-N" flag with mimedefang.  (I assume
here Sendmail 8.14.x)

Regards,

David.
Permalink | Reply | 1 comment |
headers
Les Mikesell | 1 Feb 2011 16:50
Picon

milter recipient check?

Is there a way to hook a milter to check recipients only after sendmail 
has already rejected anyone that is not a local or virtual user or 
alias?  I have a steady stream of dictionary attack addresses and have 
set up virtualusers with default rejects for the domains so sendmail can 
reject them quickly.  But now I'm trying to run milter-greylist ahead of 
MimeDefang and it wants to process all the messages.  I can configure it 
to also have a specific list of addresses to process but would like to 
know if there is a better way.  Can the greylisting be done with 
MimeDefang alone in later processing steps, or is there a way to hook 
milter-greylist to run after sendmail has already rejected recipients 
that don't exist?

--

-- 
   Les Mikesell
    lesmikesell <at> gmail.com
Permalink | Reply | 5 comments |
headers
kd6lvw | 2 Feb 2011 03:36
Picon
Favicon

Re: milter recipient check?

--- On Tue, 2/1/11, Les Mikesell <lesmikesell <at> gmail.com> wrote:
> Is there a way to hook a milter to
> check recipients only after sendmail has already rejected
> anyone that is not a local or virtual user or alias?  I
> have a steady stream of dictionary attack addresses and have
> set up virtualusers with default rejects for the domains so
> sendmail can reject them quickly.  But now I'm trying
> to run milter-greylist ahead of MimeDefang and it wants to
> process all the messages.  I can configure it to also
> have a specific list of addresses to process but would like
> to know if there is a better way.  Can the greylisting
> be done with MimeDefang alone in later processing steps, or
> is there a way to hook milter-greylist to run after sendmail
> has already rejected recipients that don't exist?

I read your prior post - but my response is still "Why?"

If sendmail has already determined that the recipient be rejected, what is the purpose of calling an
additional FILTER to make a determination?

What you want is LOGGING, not filtering.  The milter interface for filtering is NOT the place to do that. 
Logging is easy.  Append to the M4 code for check_recipient a map call to syslog with the appropriate
information and reason.  [Then, read the logs.]

This is not a MimeDefang problem.
Permalink | Reply | 4 comments |
headers
Les Mikesell | 2 Feb 2011 05:36
Picon

Re: milter recipient check?

On 2/1/11 8:36 PM, kd6lvw <at> yahoo.com wrote:
> --- On Tue, 2/1/11, Les Mikesell<lesmikesell <at> gmail.com>  wrote:
>> Is there a way to hook a milter to
>> check recipients only after sendmail has already rejected
>> anyone that is not a local or virtual user or alias?  I
>> have a steady stream of dictionary attack addresses and have
>> set up virtualusers with default rejects for the domains so
>> sendmail can reject them quickly.  But now I'm trying
>> to run milter-greylist ahead of MimeDefang and it wants to
>> process all the messages.  I can configure it to also
>> have a specific list of addresses to process but would like
>> to know if there is a better way.  Can the greylisting
>> be done with MimeDefang alone in later processing steps, or
>> is there a way to hook milter-greylist to run after sendmail
>> has already rejected recipients that don't exist?
>
> I read your prior post - but my response is still "Why?"
>
> If sendmail has already determined that the recipient be rejected, what is the purpose of calling an
additional FILTER to make a determination?

The problem is that the way milter-greylist hooks in, it runs before sendmail 
rejects unknown users.   And unless I maintain another copy of the valid user 
list in it's config, it won't be able to keep up with the bazillion messages to 
unknown users.

> What you want is LOGGING, not filtering.

No, I want greylisting - there is still a substantial amount of spam to the 
valid addresses that greylisting will stop.   But I don't want to waste time
(Continue reading)

Permalink | Reply | 3 comments |
headers
Delahunty, Mark | 2 Feb 2011 12:20
Picon

Re: Sendmail local recipients

David said:

> > as far as I can see, filter_recipient() does
> > not get called or see the recipient if sendmail rejects an unknown
> > local user.
> 
> It should be unless you use the "-N" flag with mimedefang.  (I assume
> here Sendmail 8.14.x)

It's 8.14.4.

I added some debugging output at the end of filter_sender()

   md_graphdefang_log_once("filter_sender_done", "Sender:[$sender],
ip:[$ip], hostname:[$hostname] helo:[$helo]") ; # if $UCCdebug ;
   return ('CONTINUE', "ok");
}  ################### End of filter_sender
################################

..and at the start of filter_recipient() :

sub filter_recipient {
    my ($recipient, $sender, $ip, $hostname, $first, $helo) =  <at> _;
    md_graphdefang_log_once("filter_recipient", "Recipient:[$recipient]
Sender:[$sender], ip:[$ip], hostname:[$hostname] first:[$first]
helo:[$helo]") ; 

Now when I send to an unknown user I get this:

Feb  2 10:31:34 mailX mimedefang.pl[4201]:
(Continue reading)

Permalink | Reply | 0 comments |
headers
David F. Skoll | 2 Feb 2011 13:02
Favicon

Re: milter recipient check?

On Tue, 01 Feb 2011 22:36:25 -0600
Les Mikesell <lesmikesell <at> gmail.com> wrote:

> The question is, can MimeDefang do the greylisting better by itself
> in a later operation?

MIMEDefang can do anything you program it to do.  Our commercial product
does greylisting from within the MIMEDefang filter.

(Sorry, I can't post code.  And anyway, it's heavily dependent on the
rest of our commercial code and rather hard to remove.)

But it's not very hard to code up a good greylisting implementation in Perl.

Regards,

David.
Permalink | Reply | 2 comments |
headers
Delahunty, Mark | 2 Feb 2011 13:52
Picon

Re: milter recipient check?

David said:
> 
> But it's not very hard to code up a good greylisting implementation in
Perl.
>

I'm considering using John Kirkland's code at
http://www.bl.org/~jpk/md-greylist/

It uses mysql, so I'd put the greylist database on one mail gateway and
get the other servers to query it there.

Mark
Permalink | Reply | 0 comments |
headers
Petra Humann | 2 Feb 2011 13:51
Picon

Re: milter recipient check?

Hello,

http://lists.roaringpenguin.com/pipermail/mimedefang/2010-March/035662.html

Regards.
Petra Humann

Am 02.02.2011 um 13:02 schrieb David F. Skoll:

> On Tue, 01 Feb 2011 22:36:25 -0600
> Les Mikesell <lesmikesell <at> gmail.com> wrote:
>
>> The question is, can MimeDefang do the greylisting better by itself
>> in a later operation?
>
> MIMEDefang can do anything you program it to do.  Our commercial  
> product
> does greylisting from within the MIMEDefang filter.
>
> (Sorry, I can't post code.  And anyway, it's heavily dependent on the
> rest of our commercial code and rather hard to remove.)
>
> But it's not very hard to code up a good greylisting implementation  
> in Perl.
>
> Regards,
>
> David.
> _______________________________________________
> NOTE: If there is a disclaimer or other legal boilerplate in the above
(Continue reading)

Permalink | Reply | 0 comments |
headers
David F. Skoll | 8 Feb 2011 00:50
Favicon

Heads up: MIME::tools 5.500 has problems...

Hi,

I'm not sure if anyone on this list is using MIME::tools 5.500.  It's
not a good idea. :(

We accepted a patch at https://rt.cpan.org/Public/Bug/Display.html?id=63739
and it turns out that patch broke things rather badly.

I'm working on a fix; you can follow the progress at
https://rt.cpan.org/Public/Bug/Display.html?id=65162

A final fix will involve quite a lot of change to MIME::WordDecoder
and the general MIME::Decoder mechanism (which all is garbage and
should be nuked anyway! :))

If there are adventurous admins on this list, please try MIME::tools 5.500
plus the latest patches on https://rt.cpan.org/Public/Bug/Display.html?id=65162
and let me know how it goes.  I don't want to make a new release until
my patch has been tested fairly widely.

Regards,

David.
Permalink | Reply | 4 comments |

Gmane