Re: Relation bettwen MAIL FROM: <> and From:

2009-11-13 Thread hamann . w
>> >> Hi All, >> >> I'm wondering if some know is this is possible to stop using SA. Look. >> >> [r...@cyrus postfix]# telnet localhost 25 >> Trying 127.0.0.1... >> Connected to cyrus.sat.gob.mx (127.0.0.1). >> Escape character is '^]'. >> 220 mx2.sat.gob.m

Re: Good reasons to dont use RBLs

2009-11-13 Thread Marc Perkel
Luis Daniel Lucio Quiroz wrote: Hi all, Again me, Well, in the security scope i use a principle that states that you souldnt use a lower layer solution to fix a higher one. So SPAM is a Layer 7 problem that is used to fixed with a Layer 3 solution (RBL). I'd like a brainstorm to convinc

New image spam

2009-11-13 Thread Alex
Hi all, Has anyone else seen an increase in image spam lately? http://pastebin.com/m47617898 The LOC_IMGSPAM is a local rule I created that simply checks for /inline/ content disposition. I've changed the @ to # to pass the pastebin filters. Any ideas what I could be missing on catching this on

Re: Apparently, we're talking about non-Windows viruses now...

2009-11-13 Thread Ted Mittelstaedt
Adam Katz wrote: There are several academic viruses for non-Windows systems out there, plus maybe a few actual ones. The rest are all just exploits and root-kits that typically don't fall into the "virus" category. Non-Windows-based worms are almost exclusive to Apache (and within that category,

Re: use passwd file to control senders

2009-11-13 Thread Mike Cappella
FYI: On 11/13/2009 12:22 PM, Martin Gregorie wrote: However, the docs don't say whether its checking the envelope sender and/or the From: header. man 5 access: DESCRIPTION This document describes access control on remote SMTP client information: host names, network addresses

Re: use passwd file to control senders

2009-11-13 Thread Martin Gregorie
On Fri, 2009-11-13 at 13:58 -0600, David B Funk wrote: > On Fri, 13 Nov 2009, John Hardin wrote: > > > Is there a way to configure sendmail to also validate both the envelope > > sender and message From: header against the local passwd file? > > Checking the envelope sender (for local domain addr

Re: use passwd file to control senders

2009-11-13 Thread John Hardin
On Fri, 13 Nov 2009, David B Funk wrote: On Fri, 13 Nov 2009, John Hardin wrote: Is there a way to configure sendmail to also validate both the envelope sender and message From: header against the local passwd file? Checking the envelope sender (for local domain addresses) against the local

Re: use passwd file to control senders

2009-11-13 Thread David B Funk
On Fri, 13 Nov 2009, John Hardin wrote: > Is there a way to configure sendmail to also validate both the envelope > sender and message From: header against the local passwd file? Checking the envelope sender (for local domain addresses) against the local passwd file is straightforward. Checking t

Re: [Fwd: Re: Getting off the "Cloudmark" formerly "spamnet" blacklist]

2009-11-13 Thread Martin Gregorie
On Fri, 2009-11-13 at 17:26 +, haman...@t-online.de wrote: I've only used Red Hat flavours of Linux since RH 6.2 so I can't speak for other distros, but here's my experience. > Where IPs looked like machines in a computer center, I occasionally > had a closer look and found newly created site

Re: use passwd file to control senders

2009-11-13 Thread Terry Carmen
LuKreme wrote: If user foo exists but user fbaz does not, you should expect that an MTA will reject fbaz but deliver that same message to foo. I'm talking about a way to cause SpamAssassin (or something else, whatever) to note the fact that a *different* recipient, fbaz, doesn't exist, and to re

Re: [Fwd: Re: Getting off the "Cloudmark" formerly "spamnet" blacklist]

2009-11-13 Thread Benny Pedersen
On fre 13 nov 2009 18:26:07 CET, wrote One admin admitted that they were hacked through login guest / pass guest and this is a real hack :) -- xpoint

Re: [Fwd: Re: Getting off the "Cloudmark" formerly "spamnet" blacklist]

2009-11-13 Thread hamann . w
>> >> Caveats such as week passwords, open ports and advertising insecure services >> are the domain of poor administration and understanding - they are not >> Operating >> System dependent. >> >> Exempting organised spam gangs and their infrastructure, it's probably fair >> to say that >> most

Re: use passwd file to control senders

2009-11-13 Thread John Hardin
On Fri, 13 Nov 2009, Terry Carmen wrote: Adam Katz wrote: Martin Gregorie wrote: > Do we know the OIP is using sendmail? Yes. Here's a quote: > > I'm using SpamAssassin 3.2.3, milter-limit and sendmail > Postfix checks local recipients Folks, we're losing sight of the OP's request.

Re: use passwd file to control senders

2009-11-13 Thread LuKreme
On 13-Nov-2009, at 10:00, Terry Carmen wrote: >> To: Foo Bar >> Cc: Foo Baz >> >> If user foo exists but user fbaz does not, you should expect that an >> MTA will reject fbaz but deliver that same message to foo. I'm >> talking about a way to cause SpamAssassin (or something else, >> whatever

Re: use passwd file to control senders

2009-11-13 Thread Terry Carmen
Adam Katz wrote: Martin Gregorie wrote: Do we know the OIP is using sendmail? Yes. Here's a quote: I'm using SpamAssassin 3.2.3, milter-limit and sendmail Postfix checks local recipients against /etc/passwd and /etc/aliases by default. It can also be configured to app

Re: Getting off the "Cloudmark" formerly "spamnet" blacklist

2009-11-13 Thread rich...@buzzhost.co.uk
On Fri, 2009-11-13 at 11:40 +0100, Matus UHLAR - fantomas wrote: > Am I the only one who thints that issues clearly off-topic should be sent > off-list? > Your response was to correct an onlist reply to an onlist remark. Is there some reason why you would feel it appropriate to off-list that? AF

Re: [Fwd: Re: Getting off the "Cloudmark" formerly "spamnet" blacklist]

2009-11-13 Thread Chris Hoogendyk
rich...@buzzhost.co.uk wrote: On Fri, 2009-11-13 at 09:12 +0100, Matus UHLAR - fantomas wrote: On 12.11.09 13:55, Chris Hoogendyk wrote: I don't know about Linux viruses; BUT, I do remember less than ten years ago when it was virtually impossible to build a Linux box with a hot onl

Re: Getting off the "Cloudmark" formerly "spamnet" blacklist

2009-11-13 Thread Matus UHLAR - fantomas
> > Since I didn't clearly write the part you are reacting on, it would be nice > > from you to remove my name from the begin, as you removed the rest of > > e-mail. On 13.11.09 10:24, rich...@buzzhost.co.uk wrote: > Matus has emailed me *off list* and asked me to point out that there is an > err

Re: Getting off the "Cloudmark" formerly "spamnet" blacklist

2009-11-13 Thread rich...@buzzhost.co.uk
On Fri, 2009-11-13 at 10:58 +0100, Matus UHLAR - fantomas wrote: > > On Fri, 2009-11-13 at 09:12 +0100, Matus UHLAR - fantomas wrote: > > > On 12.11.09 13:55, Chris Hoogendyk wrote: > > > > I don't know about Linux viruses; BUT, I do remember less than ten > > > > years > > > > ago when it was

Re: Good reasons to dont use RBLs

2009-11-13 Thread Raymond Dijkxhoorn
Hi! I reject the notion that spam is a L7 problem. It is more of a L8 problem... money. Warren Or L9, users. In the end :) Bye, Raymond.

Re: Good reasons to dont use RBLs

2009-11-13 Thread Raymond Dijkxhoorn
Hi! Again me, Well, in the security scope i use a principle that states that you souldnt use a lower layer solution to fix a higher one. So SPAM is a Layer 7 problem that is used to fixed with a Layer 3 solution (RBL). I'd like a brainstorm to convince that a RBL solution is not the best stop

Re: Good reasons to dont use RBLs

2009-11-13 Thread Benny Pedersen
On fre 13 nov 2009 04:41:36 CET, Luis Daniel Lucio Quiroz wrote I'd like a brainstorm to convince that a RBL solution is not the best stoping SPAM, and we should look for L7 solution such as Bayes. and ip's is not part of bayes db ... -- xpoint

Re: [Fwd: Re: Getting off the "Cloudmark" formerly "spamnet" blacklist]

2009-11-13 Thread rich...@buzzhost.co.uk
On Fri, 2009-11-13 at 09:12 +0100, Matus UHLAR - fantomas wrote: > On 12.11.09 13:55, Chris Hoogendyk wrote: > > I don't know about Linux viruses; BUT, I do remember less than ten years > > ago when it was virtually impossible to build a Linux box with a hot > > online connection, because you w

Re: [Fwd: Re: Getting off the "Cloudmark" formerly "spamnet" blacklist]

2009-11-13 Thread Matus UHLAR - fantomas
On 12.11.09 13:55, Chris Hoogendyk wrote: > I don't know about Linux viruses; BUT, I do remember less than ten years > ago when it was virtually impossible to build a Linux box with a hot > online connection, because you would get hacked before you could even > download the patches. I had a f