ALT Linux sysadmins discussion
 help / color / mirror / Atom feed
From: "Shcherbina N. Timur" <timur@hlbprime.com>
To: "'ALT Linux sysadmin discuss'" <sysadmins@lists.altlinux.org>
Subject: Re: [Sysadmins] Борьба со спамом!!!
Date: Tue, 4 Mar 2008 11:52:23 +0300
Message-ID: <005301c87dd5$104dcf60$30e96e20$@com> (raw)
In-Reply-To: <f041fbd00803040019j1ad2443dyd72459a018162a5a@mail.gmail.com>

Mail.ru для меня сказка, с ним spamassasin вполне справляется, а так как
домен .com, то проблематично с предложениями увеличению органов и продажей
виагры, причем замечена одна закономерность, а именно:

Вот часть main.cf
smtpd_client_restrictions = permit_sasl_authenticated, permit_mynetworks,
check_client_access hash:/etc/postfix/client_access, check_client_access
regexp:/etc/postfix/dul_checks, reject_rbl_client bl.spamcop.net,
reject_rbl_client cbl.abuseat.org, reject_rbl_client list.dsbl.org, permit

smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated,
check_helo_access hash:/etc/postfix/helo-access, check_helo_access
regexp:/etc/postfix/helo-regexp, reject_invalid_hostname,
reject_non_fqdn_hostname, reject_unknown_hostname, permit

smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks,
reject_unlisted_recipient, reject_unauth_destination, permit

smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks,
check_sender_access regexp:/etc/postfix/sender_access,
reject_non_fqdn_sender, reject_unknown_sender_domain, permit

Файл /etc/postfix/dul_checks
/([0-9]*-){3}[0-9]*(\..*){2,}/i            553 SPAM_ip-add-rr-ess_networks
/([0-9]*\.){4}(.*\.){3,}.*/i               553 SPAM_ip-add-rr-ess_networks

Файл /etc/postfix/helo-regexp
/([0-9]{1,3}(\.|-)){3}[0-9]{1,3}/i      REJECT IP-able helo SPAM

Вообщем весь этот конфиг говорит о том что запрещаем ИП-адрес в качестве
HELO.

Но каким то чудным образом пролезают письма с таким заголовком(см. ниже),
проанализировав логи и заголовки, пришел к выводу что с данного ИП создается
максимальное кол-во подключений и во всех практически заголовках первый
Received: from ИП (HELO ИП), также при анализе понял, что такие письма
проходят тока на алиасы, в примере внизу admin это алиас timur@hlbprime.com:

Mar  3 19:33:45 post postfix/anvil[12847]: statistics: max connection rate
7/60s for (smtp:190.50.106.101) at Mar  3 19:30:31


Received: by post.hlbprime.com (Postfix, from userid 121)
	id 157842000342; Mon,  3 Mar 2008 19:30:03 +0300 (MSK)
X-Spam-Checker-Version: SpamAssassin 3.2.1 (2007-05-02) on post.hlbprime.com
X-Spam-Level: **
X-Spam-Status: No, score=2.2 required=7.0 tests=AWL,HTML_EXTRA_CLOSE,
	HTML_MESSAGE,RCVD_FORGED_WROTE2,RDNS_NONE autolearn=no version=3.2.1
Received: from ps-av.com (unknown [190.50.106.101])
	by post.hlbprime.com (Postfix) with SMTP id 7EF16200034E
	for <admin@hlbprime.com>; Mon,  3 Mar 2008 19:29:54 +0300 (MSK)
Received: from 67.39.166.4 (HELO nospam.ivnet.com)
     by hlbprime.com with esmtp ({nChar[8-12]} {nChar[4-6]})
     id GEJkZB-VhSSrV-7l
     for admin@hlbprime.com; Mon, 03 Mar 2008 14:31:59 -0300







  reply	other threads:[~2008-03-04  8:52 UTC|newest]

Thread overview: 25+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2008-03-04  7:18 ` Максим Иванов
2008-03-04  7:32   ` ABATAPA
2008-03-04  7:46     ` Maks Re
2008-03-04  8:06       ` Shcherbina N. Timur
2008-03-04  8:19         ` Maks Re
2008-03-04  8:52           ` Shcherbina N. Timur [this message]
2008-03-04  8:32         ` Sergey
2008-03-04 11:55           ` Nikolay
2008-03-04 12:06             ` Shcherbina N. Timur
2008-03-04  8:40   ` Alexey Morsov
2008-03-04  8:53   ` Maxim Tyurin
2008-03-04 14:15     ` Максим Иванов
2008-03-04 14:33       ` ua2fgb
2008-03-04 14:45         ` Shcherbina N. Timur
2008-03-04 14:37       ` Shcherbina N. Timur
2008-03-04 15:05         ` Sergey
2008-03-04 15:33           ` Shcherbina N. Timur
2008-03-05  7:13             ` Sergey
2008-03-07  9:04         ` Максим Иванов
2008-03-07  9:07           ` Алексей Шенцев
2008-03-07  9:09           ` ua2fgb
2008-03-05  7:16     ` Sergey
2008-03-06 12:21       ` Maxim Tyurin
2008-03-04  8:34 ` Alexander Volkov
2008-03-04  9:12   ` Shcherbina N. Timur

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='005301c87dd5$104dcf60$30e96e20$@com' \
    --to=timur@hlbprime.com \
    --cc=sysadmins@lists.altlinux.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

ALT Linux sysadmins discussion

This inbox may be cloned and mirrored by anyone:

	git clone --mirror http://lore.altlinux.org/sysadmins/0 sysadmins/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 sysadmins sysadmins/ http://lore.altlinux.org/sysadmins \
		sysadmins@lists.altlinux.org sysadmins@lists.altlinux.ru sysadmins@lists.altlinux.com
	public-inbox-index sysadmins

Example config snippet for mirrors.
Newsgroup available over NNTP:
	nntp://lore.altlinux.org/org.altlinux.lists.sysadmins


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git