Re: SMTP client host name spoofing

2011-04-03 Thread Reindl Harald
Am 04.04.2011 03:08, schrieb Sahil Tandon: > On Mon, 2011-04-04 at 02:38:14 +0200, Reindl Harald wrote: > > [ .. ] > >> now you come even with "direct send from a notebook" >> jesus christ this is really ignorant! > > Please, this is a technical mailing list; let's all try to minimize the > edi

Re: SMTP client host name spoofing

2011-04-03 Thread Sahil Tandon
On Mon, 2011-04-04 at 02:38:14 +0200, Reindl Harald wrote: [ .. ] > now you come even with "direct send from a notebook" > jesus christ this is really ignorant! Please, this is a technical mailing list; let's all try to minimize the editorializing and insults. -- Sahil Tandon

Re: SMTP client host name spoofing

2011-04-03 Thread Reindl Harald
Am 04.04.2011 02:22, schrieb Vincent Lefevre: >> why not? > > Because strictly speaking, due to NAT, the DNS would lie. I mean that > the address would not be the address of the machine sending the mail, > but the address of the router. nobody out there is interested on your NAT the server on th

Re: SMTP client host name spoofing

2011-04-03 Thread Vincent Lefevre
On 2011-04-04 01:53:15 +0200, Reindl Harald wrote: > > But the purpose of having a host in DNS is to be able to resolve it. > > I mean: you can't have a real hostname in the DNS if it is on a private > > network (unreachable because of NAT), can you? Well... I'm not sure. > > See below > > why not

Re: SMTP client host name spoofing

2011-04-03 Thread Reindl Harald
Am 04.04.2011 01:27, schrieb Vincent Lefevre: > On 2011-04-01 23:51:39 +0200, mouss wrote: >> we're not asking them to resolve their hostname. we're only asking them >> to use a "real" name. it's as easy as >> myhostname = joe.example.com >> >> with a "joe.example.com" that exists in DNS. > > But

Re: SMTP client host name spoofing

2011-04-03 Thread Vincent Lefevre
On 2011-04-01 23:51:39 +0200, mouss wrote: > we're not asking them to resolve their hostname. we're only asking them > to use a "real" name. it's as easy as > myhostname = joe.example.com > > with a "joe.example.com" that exists in DNS. But the purpose of having a host in DNS is to be able to res

Re: SMTP client host name spoofing

2011-04-03 Thread Vincent Lefevre
On 2011-04-01 17:45:01 +0200, Reindl Harald wrote: > when the server is down you can not send mails > and you really will not die, I repeat: When the server is down, I may *NEED* to send mail (for various reasons, e.g. to send logs so that things can be fixed, to warn some people that I can no lon

Re: SMTP client host name spoofing

2011-04-01 Thread mouss
Le 01/04/2011 09:47, Vincent Lefevre a écrit : > On 2011-03-31 21:16:16 +0200, Jeroen Geilman wrote: >> HELO checks are the primary defense against backscatter of this sort; I use >> a simple subset of the available options: >> >> smtpd_helo_restrictions = reject_invalid_helo_hostname, >> reject_un

Re: SMTP client host name spoofing

2011-04-01 Thread mouss
Le 01/04/2011 01:25, Stan Hoeppner a écrit : > mouss put forth on 3/31/2011 4:38 PM: >> Le 31/03/2011 17:52, Stan Hoeppner a écrit : >>> >>> Received: from mail-iw0-f176.google.com (biz88.inmotionhosting.com >>> [66.117.14.32]) >>> by greer.hardwarefreak.com (Postfix) with ESMTP id F297D6C12E >

Re: SMTP client host name spoofing

2011-04-01 Thread Reindl Harald
Am 01.04.2011 17:32, schrieb Vincent Lefevre: > On 2011-04-01 17:15:41 +0200, Reindl Harald wrote: >> Am 01.04.2011 17:07, schrieb Vincent Lefevre: >>> Perhaps in your case, but when sending mail directly (i.e. without >>> using SASL), I get a reject only once every few weeks. So, yes, >>> there

Re: SMTP client host name spoofing

2011-04-01 Thread Vincent Lefevre
On 2011-04-01 17:15:41 +0200, Reindl Harald wrote: > Am 01.04.2011 17:07, schrieb Vincent Lefevre: > > Perhaps in your case, but when sending mail directly (i.e. without > > using SASL), I get a reject only once every few weeks. So, yes, > > there is a reason for a fallback to direct SMTP to the de

Re: SMTP client host name spoofing

2011-04-01 Thread Reindl Harald
Am 01.04.2011 17:07, schrieb Vincent Lefevre: > Perhaps in your case, but when sending mail directly (i.e. without > using SASL), I get a reject only once every few weeks. So, yes, > there is a reason for a fallback to direct SMTP to the destination. if you send mail directly you have to make su

Re: SMTP client host name spoofing

2011-04-01 Thread Vincent Lefevre
On 2011-04-01 11:31:43 +0200, Reindl Harald wrote: > > Am 01.04.2011 11:15, schrieb Vincent Lefevre: > > > I could now use SASL (this wasn't possible in the past because I didn't > > have my own server), but there would still be problems to solve: how > > can I use a fallback (on the client side)

Re: SMTP client host name spoofing

2011-04-01 Thread Reindl Harald
Am 01.04.2011 11:15, schrieb Vincent Lefevre: > I could now use SASL (this wasn't possible in the past because I didn't > have my own server), but there would still be problems to solve: how > can I use a fallback (on the client side) to the direct method when for > some reason, the server is not

Re: SMTP client host name spoofing

2011-04-01 Thread Vincent Lefevre
On 2011-04-01 01:01:34 -0700, Murray S. Kucherawy wrote: > Those machines should be talking to a public-facing MTA that > tolerates unqualified names; they shouldn't be talking to the public > Internet with an unqualified name. The main smarthost of my ISP gets blacklisted by some lists each time

Re: SMTP client host name spoofing

2011-04-01 Thread Reindl Harald
Am 01.04.2011 09:47, schrieb Vincent Lefevre: >> Where helo_access contains my own IPs and hostnames. >> >> This setup will reject an AMAZING amount of spam. >> Fair warning: it may also yield the occasional false positive due to a >> misconfigured client mail system! >> The usual warn_if_reject wi

RE: SMTP client host name spoofing

2011-04-01 Thread Murray S. Kucherawy
> -Original Message- > From: owner-postfix-us...@postfix.org > [mailto:owner-postfix-us...@postfix.org] On Behalf Of Vincent Lefevre > Sent: Friday, April 01, 2011 12:47 AM > To: postfix-users@postfix.org > Subject: Re: SMTP client host name spoofing > > I reall

Re: SMTP client host name spoofing

2011-04-01 Thread Vincent Lefevre
On 2011-03-31 21:16:16 +0200, Jeroen Geilman wrote: > HELO checks are the primary defense against backscatter of this sort; I use > a simple subset of the available options: > > smtpd_helo_restrictions = reject_invalid_helo_hostname, > reject_unknown_helo_hostname, reject_non_fqdn_helo_hostname, >

Re: SMTP client host name spoofing

2011-03-31 Thread Stan Hoeppner
mouss put forth on 3/31/2011 4:38 PM: > Le 31/03/2011 17:52, Stan Hoeppner a écrit : >> >> Received: from mail-iw0-f176.google.com (biz88.inmotionhosting.com >> [66.117.14.32]) >> by greer.hardwarefreak.com (Postfix) with ESMTP id F297D6C12E >> for ; Thu, 31 Mar 2011 06:29:19 -0500 >> >>

Re: SMTP client host name spoofing

2011-03-31 Thread mouss
Le 31/03/2011 17:52, Stan Hoeppner a écrit : > > Received: from mail-iw0-f176.google.com (biz88.inmotionhosting.com > [66.117.14.32]) > by greer.hardwarefreak.com (Postfix) with ESMTP id F297D6C12E > for ; Thu, 31 Mar 2011 06:29:19 -0500 > > > biz88.inmotionhosting.com is the reverse

Re: SMTP client host name spoofing

2011-03-31 Thread Stan Hoeppner
Jeroen Geilman put forth on 3/31/2011 2:16 PM: > Backscatter can be a HUGE problem, especially when spammers send you > bounces (with the empty mailer-daemon sender address <>), since you MUST > accept those. Spammers don't send backscatter bounces. The victim MX hosts do, by definition. In thi

Re: SMTP client host name spoofing

2011-03-31 Thread Jeroen Geilman
On 03/31/2011 07:41 PM, Stan Hoeppner wrote: Wietse Venema put forth on 3/31/2011 11:42 AM: Stan Hoeppner: Received: from mail-iw0-f176.google.com (biz88.inmotionhosting.com [66.117.14.32]) by greer.hardwarefreak.com (Postfix) with ESMTP id F297D6C12E for; Thu, 31 Mar

Re: SMTP client host name spoofing

2011-03-31 Thread Victor Duchovni
On Thu, Mar 31, 2011 at 01:01:14PM -0500, Stan Hoeppner wrote: > >Extended-Domain = Domain / > > ( Domain FWS "(" TCP-info ")" ) / > > ( address-literal FWS "(" TCP-info ")" ) > > > >TCP-info = address-literal / ( Domain FWS address-l

Re: SMTP client host name spoofing

2011-03-31 Thread Stan Hoeppner
Victor Duchovni put forth on 3/31/2011 12:44 PM: > On Thu, Mar 31, 2011 at 12:20:58PM -0500, Stan Hoeppner wrote: > >>> No, the "google" name is just the EHLO parameter sent by the client, >>> it is not derived from DNS lookups and not verified. >> >> Thanks for the clarification Viktor. I can't

Re: SMTP client host name spoofing

2011-03-31 Thread Victor Duchovni
On Thu, Mar 31, 2011 at 12:20:58PM -0500, Stan Hoeppner wrote: > > No, the "google" name is just the EHLO parameter sent by the client, > > it is not derived from DNS lookups and not verified. > > Thanks for the clarification Viktor. I can't seem to locate any > documentation on the official Pos

Re: SMTP client host name spoofing

2011-03-31 Thread Stan Hoeppner
Wietse Venema put forth on 3/31/2011 11:42 AM: > Stan Hoeppner: >> Received: from mail-iw0-f176.google.com (biz88.inmotionhosting.com >> [66.117.14.32]) >> by greer.hardwarefreak.com (Postfix) with ESMTP id F297D6C12E >> for ; Thu, 31 Mar 2011 06:29:19 -0500 >> > > The format is: > >

Re: SMTP client host name spoofing

2011-03-31 Thread Stan Hoeppner
Victor Duchovni put forth on 3/31/2011 10:57 AM: > On Thu, Mar 31, 2011 at 10:52:58AM -0500, Stan Hoeppner wrote: > >> Received: from mail-iw0-f176.google.com (biz88.inmotionhosting.com >> [66.117.14.32]) >> by greer.hardwarefreak.com (Postfix) with ESMTP id F297D6C12E >> for ; Thu, 31 M

Re: SMTP client host name spoofing

2011-03-31 Thread Wietse Venema
Stan Hoeppner: > Received: from mail-iw0-f176.google.com (biz88.inmotionhosting.com > [66.117.14.32]) > by greer.hardwarefreak.com (Postfix) with ESMTP id F297D6C12E > for ; Thu, 31 Mar 2011 06:29:19 -0500 > The format is: Received: from helo-hostname (verified-reverse-name [ip-a

Re: SMTP client host name spoofing

2011-03-31 Thread Victor Duchovni
On Thu, Mar 31, 2011 at 10:52:58AM -0500, Stan Hoeppner wrote: > Received: from mail-iw0-f176.google.com (biz88.inmotionhosting.com > [66.117.14.32]) > by greer.hardwarefreak.com (Postfix) with ESMTP id F297D6C12E > for ; Thu, 31 Mar 2011 06:29:19 -0500 > > > biz88.inmotionhosting.co

SMTP client host name spoofing

2011-03-31 Thread Stan Hoeppner
Received: from mail-iw0-f176.google.com (biz88.inmotionhosting.com [66.117.14.32]) by greer.hardwarefreak.com (Postfix) with ESMTP id F297D6C12E for ; Thu, 31 Mar 2011 06:29:19 -0500 biz88.inmotionhosting.com is the reverse name and mail-iw0-f176.google.com is the forward name, c