topic Re: blocking spam with spam..... in Operating System - Linux

blocking spam with spam.....

K.C. Chan — Mon, 15 Nov 2004 09:35:56 GMT

All,
I am having some problem with filtering out spam, even though the spam level is high enough on this message to identify it as spam, but since it my "xyz.com" domain is in the the white list, it is ignore. How would I handle this. I noticed it's not really comming from "xyz.com", which is my domain. The return path suggests it's comming from "trcox2@internet-chicago.com". Thanks.

Return-Path:
Received: from OL168-16.fibertel.com.ar (OL168-16.fibertel.com.ar [24.232.16.168]) by mail1.xyz.com (8.11.6/8.11.6) with SMTP id iAF1DT231465 for ; Sun, 14 Nov 2004 20:13:30 -0500
Date: Sun, 14 Nov 2004 20:13:30 -0500
X-Message-Info: 63hNZpenD0GHMq82aquHAZhsWBN7DM446mcsSMYmD27
Received: from dns133hotmail.com (126.171.75.128) by g70-k72.hotmail.com with Microsoft SMTPSVC(5.0.2195.6824); Sun, 14 Nov 2004 23:02:05 -0200
Received: from hotmail.com (127.0.0.1) by dnshotmail.com (SMTPD32-7.12 ) id MEF6AGV70; Sun, 14 Nov 2004 17:58:05 -0700
Subject: Ahead of The Street MicroCap
From: Elizabeth@mx01.mediaguide.com
To: webmaster@mediaguide.com
Message-Id: <57723189176.J237@hotmail.com>
Content-Type: multipart/alternative; boundary="--1618792634296636"
X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on mail1.xyz.com
X-Spam-Status: No, hits=8.0 required=8.0 tests=FORGED_HOTMAIL_RCVD, MIME_HEADER_CTYPE_ONLY,NO_REAL_NAME autolearn=no version=2.63
X-Spam-Level: ********
Status:
X-Evolution-Source: pop://whatever@localhost
Mime-Version: 1.0

Re: blocking spam with spam.....

Oskar Teran — Mon, 15 Nov 2004 22:04:18 GMT

what's your MTA?
spamassassin is adjustable, but you may also want to look into greylisting.
This is a relatively new weapon against spam and it's been very effective.

Of course, if you're running sendmail or postfix, you can also do header checks with regex.

By the time you get this deep, it's best to join the lists for sendmail and/or postfix as well as spamassassin/greylisting.

good luck,
Oskar

Re: blocking spam with spam.....

K.C. Chan — Tue, 16 Nov 2004 09:32:17 GMT

My mta is sendmail, how would I do header check, could you give an example? You mention greylisting, give you give some url for it; I would like to know more about it. Thanks.

Re: blocking spam with spam.....

Jerome Henry — Tue, 16 Nov 2004 10:31:00 GMT

Hi,
A few pointers :
header check (not sure it'll fit your needs) :
http://people.freenet.de/slgig/cfreadme_en/anti_spam.html

greylisting :
a good place to start :
http://greylisting.org/implementations/
and there (by Evan Haris, creator of spamassassin and greylisting idea) :
http://projects.puremagic.com/greylisting/

hth

J

Re: blocking spam with spam.....

Steven E. Protter — Tue, 16 Nov 2004 11:13:21 GMT

spamassin is an open source add in product that lets your users adjust to spam. It has some degree of intelligence built in and tries to learn what kind of messages are spam.

I have some hpux utilities, ported from Linux that can provide good blocking to fixed point spammers.

Its based on creating a user called spam, and forwarding all offending messages to that account.

A cron job filters those messages and takes all IP addressed from the message. It checks a database of good inhouse ip addressed that you don't want to block.

In essence it creates an access.db database that bounces messages from known spammers back. It relies on sendmail.mc macro databases. I'm attaching a link to my production script to build the database. All you'd need after that is my script that reads the spamlist and updates the databases.

I am linking to the macro build script and attaching a linux copy of the build script. In my operation a Linux box builds the access database and distributes it to mail servers via scp.

I know what needs to be changed in the Linux script, the shell and the echo commands everything else will work. Possible issues with the full path of commands but easily remedied.

http://www.hpux.ws/buildmail.hpux.text

spamlist is attached.

SEP