MESSAGE
| DATE | 2010-03-02 |
| FROM | Paul Robert Marino
|
| SUBJECT | Re: [NYLXS - HANGOUT] this should not get through
|
well that's sort of what its designed to do via several mechanisms
one of which is documented here
http://www.postfix.org/BUILTIN_FILTER_README.html
another one commonly used can be found here
http://www.postfix.org/ADDRESS_VERIFICATION_README.html
this one actually attempts to verify that the from email address is
legitimate.
But for the most part its usually done by looping the message through
one or more external filtering applications
http://www.postfix.org/MILTER_README.html
this method is also commonly used filter messages through Clam AV (Anti
Virus)
On 3/2/2010 4:09 PM, Ruben Safir wrote:
> On Mon, Mar 01, 2010 at 11:17:06AM -0500, Paul Robert Marino wrote:
>
>> the most efficient way to do it is in postfix prior to the delivery to
>> the mailing list server.
>> there are many anti-spoofing plugins you can use to attempt to detect
>> and block it.
>>
>>
>
> How is postifx going to do this unless it opens the mail and parses it.
> You don't want postfix to do that.
>
> Ruben
>
>
>>
>> On 2/26/2010 7:40 PM, Ron Guerin wrote:
>>
>>> Ruben Safir wrote:
>>>
>>>
>>>> I'm sorry, I missunderstood you. Your saying that the mbox client, for
>>>> lack of a better term, creates the From line in the mbox format from the
>>>> envelope, and that it isn't strictly a header?
>>>>
>>>> I think your right about that. I seem to remember reading that.
>>>>
>>>> That is a problem though. I can spoof any From: header with mutt in a
>>>> second and so can any spammer. How the heck can you protect the mailing
>>>> list?
>>>>
>>>>
>>>>
>>> You can spoof the entire contents of an email including the envelope.
>>> Nothing new there. I don't know much about Majordomo, but unless it has
>>> native anti-abuse features or a plugin architecture to add them
>>> yourself, this is all beside the point. By the time the message gets to
>>> Majordomo, the question of whether or not to accept it has already been
>>> made. You need to insert something in front of it, just like I'm
>>> finding myself doing with GNU Mailman.
>>>
>>> GNU Mailman happens to have a very nice integrated feature for dealing
>>> with list spam. But it doesn't apply that to mail that's just "passing
>>> through" to the administrative addresses. So in order to spare myself
>>> and everyone else who looks after the list from all the spam that tries
>>> to get sent to those addresses, I have to intercept the mail before it
>>> hits Mailman. That's what you're going to have to do as well in the
>>> absense of any internal anti-abuse functionality in Majordomo.
>>>
>>> But for the sake of completeness, I'm now going to reverse gears and
>>> assume that Majordomo does have internal anti-abuse features. If it
>>> does, and all it bases its decisions on is who the mail appears to be
>>> from, it's never going to be very useful because that's really the least
>>> useful thing for determining what's spam and what's not. Trust no one,
>>> analyze everything. Spam is still spam even when your mother sends it
>>> to you.
>>>
>>> - Ron
>>>
>>>
>>
|
|
