Developer discussion about milter-greylist ()

manu | 20 May 2013 06:37

milter-greylist-4.5.1 is available

Here is milter-greylist-4.5.1
http://ftp.espci.fr/pub/milter-greylist/milter-greylist-4.5.1.tgz
MD5 (milter-greylist-4.5.1.tgz) = e0149825bd2912e20a57f70539b00427

Changes sinces 4.4.3:
        DNS update support
        make clean clears milter-greylist.spec
        Use ZZ for unknown GeoIP country
        Add IPv6 support for MX sync (Hajimu UMEMOTO)

A note for DNS update: it is automatically enabled at configure time if
your resolver supports it. configure tries to link a test progrem with
res_nupdate() for that. Here is an example configuration and usage to
create your own DNSRBL:

  sig "dns-update" "hmac-md5" "1B2M2Y8AsgTpgAmY7PhCfg=="
  nsupdate "bl.example.net" { rname  "%j.bl.example.net"  rvalue 
       "127.0.0.2" tsig "dns-update" }

  racl blacklist rcpt spamtrap@... nsupdate "bl.example.net"

NB: %j is the reversed sender IP address. e.g.: 192.0.2.1 becomes
1.2.0.192

On the DNS server side, iff you run BIND, you are going to have
something like this:

key "dns-update" {
        algorithm hmac-md5;
        secret "1B2M2Y8AsgTpgAmY7PhCfg==;

(Continue reading)

headers

manu | 19 May 2013 07:13

nsupdate support

Hi 

I am working on nsupdate support in milter-greylist, so that an action
clause in an ACL can trigger a DNS update, which enables milter-greylist
to feed a DNSRBL based on ACL conditions.

That first part works fine, but I thought about handling expiration of
added DNS record. It seems there is no way to tell the DNS that an added
entry should expire. That would suggest milter-greylist sould manage it,
which leads to a lot of complexity. 

What people think about it? Is expiration actually useful, and how to
implement it?

--

-- 
Emmanuel Dreyfus
http://hcpnet.free.fr/pubz
manu@...

------------------------------------

Yahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/milter-greylist/

<*> Your email settings:
    Individual Email | Traditional

<*> To change settings online go to:

(Continue reading)

headers

Thomas Cameron | 8 Apr 2013 05:20

Determining how successful milter-greylist is?

Howdy -

I've just implemented milter-greylist again, and I was curious as to 
whether there is any reporting available. I'd like to know how many or 
what percentage of messages get dumped by milter-greylist.

Anyone got any tips or tricks for doing that?

Thanks!
TC

------------------------------------

Yahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/milter-greylist/

<*> Your email settings:
    Individual Email | Traditional

<*> To change settings online go to:
    http://groups.yahoo.com/group/milter-greylist/join
    (Yahoo! ID required)

<*> To change settings via email:
    milter-greylist-digest@... 
    milter-greylist-fullfeatured@...

<*> To unsubscribe from this group, send an email to:

(Continue reading)

headers

Florin Grosu | 28 Mar 2013 12:00

how to activate geoip under debian

Hello,

I recently transferred milter-greylist from fedora11 server (installed from sources) to a debian squeeze server and I installed it from debian packages (apt-get). The version on debian is 4.3.7.
I had milter-greylist with geoip option, but this option doesn't seems to work with debian squeeze. I installed some libgeoip from packages, but I couldn't make it work with milter-greylist. And I didn't find how to do it. I remember seeing that it works with debian wheezy (starting with milter-greylist 4.3.9), but wheezy is not officially released yet... So the question is : do you know how can I activate this option on squeeze?

Thank you,
Florin

__._,_.___

Your email settings: Individual Email|Traditional
Change settings via the Web (Yahoo! ID required)
Change settings via email: Switch delivery to Daily Digest | Switch to Fully Featured
Visit Your Group | Yahoo! Groups Terms of Use | Unsubscribe

__,_._,___

headers

Bruncsak, Attila | 26 Mar 2013 13:23

cleaning of milter-greylist.spec

Hello,

I think the "clean" or "realclean" target of the make
should remove the milter-greylist.spec since it is
generated from milter-greylist.spec.in.

Bests,
Attila

------------------------------------

Yahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/milter-greylist/

<*> Your email settings:
    Individual Email | Traditional

<*> To change settings online go to:
    http://groups.yahoo.com/group/milter-greylist/join
    (Yahoo! ID required)

<*> To change settings via email:
    milter-greylist-digest@... 
    milter-greylist-fullfeatured@...

<*> To unsubscribe from this group, send an email to:
    milter-greylist-unsubscribe@...

<*> Your use of Yahoo! Groups is subject to:
    http://docs.yahoo.com/info/terms/

headers

Kouhei Sutou | 22 Mar 2013 15:23

[PATCH] fix a crash bug by chown socket without group [1 Attachment]

<*>[Attachment(s) from Kouhei Sutou included below]

Hi,

I attach a patch that fixes a crash.

The crash can reproduce with the following greylist.conf:

  ...
  socket "inet:30025"
  user "nobody"
  ...

Run milter-greylist as root user:

  % sudo milter-greylist

milter-greylist will be crashed.

Points:

  * "socket" is not file path. (e.g. inet:XXX, unix:XXX and so on)
  * "user" has only user. Group should not be included like
  * Run milter-greylist as root user.

Cause:

If we run milter-greylist as root user and "user"
parameter value is specified, "socket" parameter value
is chown-ed to "user" parameter value. If "socket"
parameter value is not path like "inet:30025", chown()
is always failed. And error message is logged by the
following code:

  mg_log(LOG_WARNING, "%s: cannot change \"%s\""
      " ownership to %s/%s: %s", argv[0], 
      conf.c_socket, pw->pw_name, gr->gr_name,
      strerror(errno));

"gr->gr_name" is a problem. "gr" is NULL when "user"
parameter value doesn't have group such as "nobody".

Solutions:

  (a) Don't chown() when "socket" parameter value has scheme
      such as "inet", "inet6", "unix" and "local".
  (b) Set "gr" even if "user" parameter value doesn't have
      group. (The attached patch uses this solution.)

I think that we should apply both solutions but I attach
only (b) solution. Because (b) solves more effected
problem. "gr" is used other location too. (See
code around chown(conf.c_pidfile, ...).) (a) doesn't solve
the problem.

So I think that (b) should be fixed at first. I will send a
patch for (a) after this patch is applied.

Thanks,
--
kou

<*>Attachment(s) from Kouhei Sutou:

<*> 1 of 1 File(s)
http://groups.yahoo.com/group/milter-greylist/attachments/folder/1126162638/item/list 
  <*> milter-greylist-4.4.3-fix-crash-by-chown-without-group.diff

------------------------------------

Yahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/milter-greylist/

<*> Your email settings:
    Individual Email | Traditional

<*> To change settings online go to:
    http://groups.yahoo.com/group/milter-greylist/join
    (Yahoo! ID required)

<*> To change settings via email:
    milter-greylist-digest@... 
    milter-greylist-fullfeatured@...

<*> To unsubscribe from this group, send an email to:
    milter-greylist-unsubscribe@...

<*> Your use of Yahoo! Groups is subject to:
    http://docs.yahoo.com/info/terms/

headers

Hajimu UMEMOTO | 14 Mar 2013 07:11

syncsrcaddr for IPv6 [1 Attachment]

<*>[Attachment(s) from Hajimu UMEMOTO included below]

Hi,

The syncsrcaddr does not work for IPv6.  So, I made a patch.

Sincerely,

<*>Attachment(s) from Hajimu UMEMOTO:

<*> 1 of 1 File(s)
http://groups.yahoo.com/group/milter-greylist/attachments/folder/74068139/item/list 
  <*> patch-sync.c

------------------------------------

Yahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/milter-greylist/

<*> Your email settings:
    Individual Email | Traditional

<*> To change settings online go to:
    http://groups.yahoo.com/group/milter-greylist/join
    (Yahoo! ID required)

<*> To change settings via email:
    milter-greylist-digest@... 
    milter-greylist-fullfeatured@...

<*> To unsubscribe from this group, send an email to:
    milter-greylist-unsubscribe@...

<*> Your use of Yahoo! Groups is subject to:
    http://docs.yahoo.com/info/terms/


--
Hajimu UMEMOTO
ume@...  ume <at> {,jp.}FreeBSD.org
http://www.mahoroba.org/~ume/

headers

Emmanuel Dreyfus | 7 Mar 2013 14:34

milter-greylist 4.4.3 is available

Here is milter-greylist 4.4.3
http://ftp.espci.fr/pub/milter-greylist/milter-greylist-4.4.3.tgz
MD5 (milter-greylist-4.4.3.tgz) = 19cf27dc8077a01d103fcf2f367e9509

Changes sinces 4.4.2:
        More Solaris build fixes (Jim Klimov)
        Use ZZ for unknown GeoIP country
        Fix swapped %f and %r for stat example in default greylist.conf
        Support p0f v3.06 and up with --with-p0f-src or --enable-p0f306

I will update the web page later today, so if you are paranoid, consider 
this as a phishing since the main is not in sync with the web site 

-- 
Emmanuel Dreyfus
manu@...

------------------------------------

Yahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/milter-greylist/

<*> Your email settings:
    Individual Email | Traditional

<*> To change settings online go to:
    http://groups.yahoo.com/group/milter-greylist/join
    (Yahoo! ID required)

<*> To change settings via email:
    milter-greylist-digest@... 
    milter-greylist-fullfeatured@...

<*> To unsubscribe from this group, send an email to:
    milter-greylist-unsubscribe@...

<*> Your use of Yahoo! Groups is subject to:
    http://docs.yahoo.com/info/terms/

headers

abcde fgh | 6 Mar 2013 14:38

Graylisting failing in some cases

System :

Linux mail-2012.trezor 2.6.32-220.17.1.el6.i686 #1 SMP Thu Apr 26 13:37:46 EDT 2012 i686 i686 i386 GNU/Linux

I am using : sendmail-8.14.4-8.el6.i686, milter-greylist-4.2.7-1.el6.rf.i686, MailWatch Version = 1.2.0, MailScanner Version = 4.84.5, PHP Version = 5.3.3, MySQL Version = 5.1.61

And it generally works.

BUT the last few days my server is relaying mail from China IP addressess.

I have checkjed it, but all checks say that it is not a open relay (IP : 195.88.12.36, you can check too).

Characteristical for mails is this from logs :

“skipping greylist because this is the default action”

Please help!

Velda

__._,_.___

Your email settings: Individual Email|Traditional
Change settings via the Web (Yahoo! ID required)
Change settings via email: Switch delivery to Daily Digest | Switch to Fully Featured
Visit Your Group | Yahoo! Groups Terms of Use | Unsubscribe

__,_._,___

headers

Juan Carlos Sanchez | 1 Feb 2013 14:23

ratelimit feature mx sync

Hello:

I am using ratelimit feature to try to limit the amount of recipients a user may send (and this way trying to minimize spam sent through compromised accounts)

Our mail service is separated in two servers under a hardware balancer, and both servers are MX Sync'ed under milter-greylist config file.

But it looks like info about recipients sent by a user is not shared between servers, unless until the limit is reached in one of them.

I'd like to fix 500 recipients / day in both servers and apply blacklist in case the users sends more than 500 recipients adding both balanced servers
¿Is this possible? ¿maybe I'm doing sth. wrong?

A piece of my config (same in both servers):

-------------
peer xxx.xxx.xxx.xxx

list "testingip" addr { \
<one ip here> \
}

ratelimit "redrcpt" rcpt 500 / 1d key "%f%i"
racl blacklist list "testingip" ratelimit "redrcpt" msg "You have exceeded the number of messages per day limit"
--------------------

Thanks in advance.

Best regards.

-- ------------------------------------------------------ Juan Carlos Sanchez Hernandez Responsable de Seguridad y Correo Electronico Servicio de Planificacion Informatica y Comunicaciones Universidad Politecnica de Madrid Rectorado Avda. Ramiro de Maeztu 7 28040 Madrid ------------------------------------------------------

__._,_.___

Your email settings: Individual Email|Traditional
Change settings via the Web (Yahoo! ID required)
Change settings via email: Switch delivery to Daily Digest | Switch to Fully Featured
Visit Your Group | Yahoo! Groups Terms of Use | Unsubscribe

__,_._,___

headers

Frantisek Hanzlik | 26 Jan 2013 20:00

Re: GeoIP failed to lookup ip 'PRIVATE_IP'

Emmanuel Dreyfus wrote:
>> Using (nonexisting) "ZZ" country code as alias for "IP isn't" in
>> GeoIP DB"? It is IMO good solution and maybe should be taken as
>> documented official new value for testing. And maybe when there
>> would be another pseudocode for private address space, then we got
>> two additional country values for testing.
> 
> Well, if  GeoIP fail reports ZZ, then you can have acl to test local
> network without acl to test country code, no need to hardcode the logic.
> 
> Z1 and Z2 are invalid ISO 3166-1 country code, by the way.

Of course invalid, I was thinking when it should be used only for
milter internal purposes, then it is suitable - it will not interfere
with real country codes.
But I'll leave it up to Your deliberation.

Thanks, Franta Hanzlik

------------------------------------

Yahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/milter-greylist/

<*> Your email settings:
    Individual Email | Traditional

<*> To change settings online go to:
    http://groups.yahoo.com/group/milter-greylist/join
    (Yahoo! ID required)

<*> To change settings via email:
    milter-greylist-digest@... 
    milter-greylist-fullfeatured@...

<*> To unsubscribe from this group, send an email to:
    milter-greylist-unsubscribe@...

<*> Your use of Yahoo! Groups is subject to:
    http://docs.yahoo.com/info/terms/

14	May 2013
10	April 2013
25	March 2013
6	February 2013
31	January 2013
13	October 2012
16	September 2012
11	June 2012
38	May 2012
11	March 2012
47	February 2012
3	January 2012
4	November 2011
1	October 2011
9	September 2011
40	August 2011
25	July 2011
4	June 2011
5	May 2011
37	April 2011
19	March 2011
12	February 2011
52	January 2011
4	December 2010
10	November 2010
9	October 2010
30	September 2010
17	August 2010
45	July 2010
35	June 2010
21	May 2010
17	April 2010
23	March 2010
74	February 2010
18	December 2009
15	November 2009
58	October 2009
55	September 2009
15	August 2009
39	July 2009
21	June 2009
73	May 2009
14	April 2009
39	March 2009
99	February 2009
91	January 2009
13	December 2008
29	November 2008
93	October 2008
167	September 2008
53	August 2008
58	July 2008
36	June 2008
42	May 2008
63	April 2008
112	March 2008
69	February 2008
27	January 2008
30	December 2007
69	November 2007
128	October 2007
99	September 2007
72	August 2007
32	July 2007
39	June 2007
71	May 2007
75	April 2007
79	March 2007
192	February 2007
146	January 2007
160	December 2006
45	November 2006

Mon	Tue	Wed	Thu	Fri	Sat	Sun

		1	2	3	4	5
6	7	8	9	10	11	12
13	14	15	16	17	18	19
20	21	22	23	24	25	26
27	28	29	30	31