[vchkpw] bounce maybe used to relay spam

2004-01-27 Thread Tom Jackson
I'm seeing a number of emails like [EMAIL PROTECTED] coming in to my
server. They are from different users. Since the local user doesn't
exist, qmail is attempting to bounce the message back to the sender.
Most of these are failing, the messages are obviously spam.

I'm running vpopmail on the domains in question. Is there any way to
configure vpopmail or qmail to reject email if the local address doesn't
exist, or to silently trash the email?

TIA

tom jackson





Re: [vchkpw] bounce maybe used to relay spam

2004-01-28 Thread Tom Jackson
On Tue, 2004-01-27 at 23:02, Jeremy Kitchen wrote:

> checkuser patch uses vpopmail calls.  the domain would have to be in 
> vpopmail on the other server and/or would require some more advanced
> configuration.

I ran into another problem. My mx server, which really shouldn't have
email addresses is listed in defaultdomain, rcpthosts and
virtualdomains. However I never added it as a domain. I discovered that
qmail was trying to deliver to a box in this domain (which didn't
exist). So I tried to add the domain and got a segfault. 

Some how I got it into a state where trying to delete the domain give
"Domain doesn't exist" and trying to add it returns "Domain already
exists". 

Have I totally screwed up here? How can I recover this install?

Any help is greatly appreciated.

tom jackson



Re: [vchkpw] possible to refine local domains to local addresses?

2004-02-01 Thread Tom Jackson
On Sat, 2004-01-31 at 21:58, Kurt Bigler wrote:

> Actually what I see are double bounces, and I make the inference about what
> would have happenned if the from address of the original message accepted by
> my SMTP had actually existed.  Please correct me if that inference is wrong.

Combining the fact of a double bounce, with a local account which
doesn't exist (like [EMAIL PROTECTED]), along with a conclusion that
the email is spam, indicates to me that the bounce is the intended
target of the email. Sometimes the email is not valid, so you get double
bounces as well. Otherwise, if the target exists, it gets relayed as a
bounce. A failure notice might even have a higher change that the user
will read it, just to make sure one of their emails didn't bounce. 

I discovered this last week. I decided to delete the email instead of
refusing it. This gives the spammer no information on whether the email
address is valid or not.

As suggested by Ken Jones:

Set your bounce option to delete. The .qmail-default file will look like
| /home/vpopmail/bin/vdelivermail '' delete

tom jackson