Re: Whitelist IP Address

[Mikael Hakman]

Of course Matt, any decent SMTP server allows you to configure it so that it 
refuses or lets through mail sent directly from certain IP hosts or subnets 
with addresses being taken from communication level (source of TCP connect 
request incoming to the server). When it comes to IP subnets of relays 
farther back in the chain you have to look at the headers. In simple words, 
when going backwards in the chain you need to find first relay that is 
"economical with the truth" as far as "Received from" header concerns, or 
refuses to cooperate. Then you want to blacklist it or its whole subnet if 
they are constantly moving the offender. I have yet to read whether this can 
be done at the user level.

However, in my previous comment, I didn't express myself precisely enough. I 
didn't mean "block" or "let through" rather "execute test and set specified 
score if the test turns true" so that the final decision what to do with the 
mail could be affected by the other tests. Very often you also want to do 
something else than the simple block or pass, such as repackage and mark, 
give the user a hint but let him decide. AFAIK this you cannot do in an SMTP 
server. You also want to gather together all spam related work in one place.

----- Original Message ----- 
From: "Matt Kettler" <[EMAIL PROTECTED]>
To: "Mikael Hakman" <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]>; 
<users@spamassassin.apache.org>
Sent: Thursday, March 10, 2005 5:25 PM
Subject: Re: Whitelist IP Address


At 05:39 AM 3/10/2005, Mikael Hakman wrote:
Wouldn't you all agree that blocking or letting through emails sent from 
or relayed by specified IP addresses and subnets is quite a basic 
functionality? In a sense it is more basic than doing the same with DNS 
names and SMTP addresses because all those names ultimately resolve to IP 
numbers. All communication (routing) on the Internet is done by numbers 
not by names.
Yes, so basic I would expect it to be implemented in whatever tool you're 
using to call spamassassin in the first place.

MailScanner does it, Procmail can do it...
Then why can't we have such a generic rule built-in into SA?
I don't see why not. However, IMO all of the whitelisting features built 
into SA are bordering on being a hack anyway. They have their uses, but 
there's often better ways.

1) SA doesn't have good reliable access to envelope information, it relies 
on the MTA inserting clues and hints into the headers. Most tools that 
call SA have access to the envelope directly.

2) if you whitelist at a higher layer you have the option of not calling 
SA at all, in which case you save CPU.
__________ NOD32 1.1022 (20050309) Information __________

This message was checked by NOD32 antivirus system.
 part000.txt - is OK
http://www.nod32.com