MESSAGE
| DATE | 2010-03-02 |
| FROM | Paul Robert Marino
|
| SUBJECT | Re: [NYLXS - HANGOUT] this should not get through
|
oh by the way this doc http://www.postfix.org/BACKSCATTER_README.html
covers exactly what you were originally talking about
On 3/2/2010 4:39 PM, Paul Robert Marino wrote:
> well that's sort of what its designed to do via several mechanisms
> one of which is documented here
> http://www.postfix.org/BUILTIN_FILTER_README.html
>
> another one commonly used can be found here
> http://www.postfix.org/ADDRESS_VERIFICATION_README.html
> this one actually attempts to verify that the from email address is
> legitimate.
>
>
> But for the most part its usually done by looping the message through
> one or more external filtering applications
> http://www.postfix.org/MILTER_README.html
> this method is also commonly used filter messages through Clam AV
> (Anti Virus)
>
> On 3/2/2010 4:09 PM, Ruben Safir wrote:
>> On Mon, Mar 01, 2010 at 11:17:06AM -0500, Paul Robert Marino wrote:
>>> the most efficient way to do it is in postfix prior to the delivery to
>>> the mailing list server.
>>> there are many anti-spoofing plugins you can use to attempt to detect
>>> and block it.
>>>
>>
>> How is postifx going to do this unless it opens the mail and parses it.
>> You don't want postfix to do that.
>>
>> Ruben
>>
>>>
>>> On 2/26/2010 7:40 PM, Ron Guerin wrote:
>>>> Ruben Safir wrote:
>>>>
>>>>> I'm sorry, I missunderstood you. Your saying that the mbox
>>>>> client, for
>>>>> lack of a better term, creates the From line in the mbox format
>>>>> from the
>>>>> envelope, and that it isn't strictly a header?
>>>>>
>>>>> I think your right about that. I seem to remember reading that.
>>>>>
>>>>> That is a problem though. I can spoof any From: header with mutt
>>>>> in a
>>>>> second and so can any spammer. How the heck can you protect the
>>>>> mailing
>>>>> list?
>>>>>
>>>>>
>>>> You can spoof the entire contents of an email including the envelope.
>>>> Nothing new there. I don't know much about Majordomo, but unless
>>>> it has
>>>> native anti-abuse features or a plugin architecture to add them
>>>> yourself, this is all beside the point. By the time the message
>>>> gets to
>>>> Majordomo, the question of whether or not to accept it has already
>>>> been
>>>> made. You need to insert something in front of it, just like I'm
>>>> finding myself doing with GNU Mailman.
>>>>
>>>> GNU Mailman happens to have a very nice integrated feature for dealing
>>>> with list spam. But it doesn't apply that to mail that's just
>>>> "passing
>>>> through" to the administrative addresses. So in order to spare myself
>>>> and everyone else who looks after the list from all the spam that
>>>> tries
>>>> to get sent to those addresses, I have to intercept the mail before it
>>>> hits Mailman. That's what you're going to have to do as well in the
>>>> absense of any internal anti-abuse functionality in Majordomo.
>>>>
>>>> But for the sake of completeness, I'm now going to reverse gears and
>>>> assume that Majordomo does have internal anti-abuse features. If it
>>>> does, and all it bases its decisions on is who the mail appears to be
>>>> from, it's never going to be very useful because that's really the
>>>> least
>>>> useful thing for determining what's spam and what's not. Trust no
>>>> one,
>>>> analyze everything. Spam is still spam even when your mother sends it
>>>> to you.
>>>>
>>>> - Ron
>>>>
>
|
|
