Re: Need advice on new mailserver and spam

From: Alexander Dalloz (ad+lists_at_uni-x.org)
Date: 06/06/05

  • Next message: Robin Laing: "Re: Multi Track Recording on fedora 4;" 
    To: For users of Fedora Core releases <fedora-list@redhat.com>
Date: Mon, 06 Jun 2005 17:35:15 +0200

    Am Mo, den 06.06.2005 schrieb Bob Brennan um 17:22:

    > I've been called in to solve some massive email problems in a company
    > that has about 30 employees and an external mailserver. They receive
    > on average about 100 legitimate emails per day and 3000+ spams plus
    > the usual virus and worm attacks.
    >
    > I am of course recommending FC with Sendmail, Procmail, SpamAssasin
    > and ClamAV on an inhouse mailserver, all of which I've had experience
    > and spectacular results with.

    Me too.

    > Their spam problem, IMHO, comes from the mailserver they currently use
    > accepting all non-mailbox email into a postmaster@domain.com account
    > which has a quota of 1000 emails, which then sends over-quota
    > rejection notices to senders for all @domain.com incoming; effectively
    > shutting down all incoming email. My theory is that the reject notices
    > are taken as replies by spambots and encourages even more spam.
    > Short-term measures include emptying postmaster@ every 10 minutes and
    > filtering for valid mis-addressed emails, but even with that the
    > volume of incoming spam seriously slows down the service.
    >
    > My question is - long term - is it better to set up the mailserver to
    > reject all non-mailbox emails to cut down on the incoming processing
    > load; or to filter and bit-bucket the spam in the hopes that the
    > volume will decrease over time with no responses to the spam? Or any
    > other techniques any of you are using for such problems?
    >
    > Thanks in advance for opinions/suggestions,
    > bob

    Nowadays it isn't wise to use a catch-all directing to the postmaster.
    You are right that you should only accept mail to existing mail
    addresses and reject non existing addresses as soon as possible in the
    smtp stream. Legitimate senders will read the DSN mail they get when
    they i.e. have misspelled a mail recipient address (you can customize
    the rejection message Sendmail sends the sending MTA if you want to be
    more clear to senders than "user unknown"). They can correct and resend.
    Worms and trojans don't care. I am very sure you take much of the
    pressure from the current mail server after you changed that basic
    setup.

    I too recommend to make use of the feature greet_pause which came with
    Sendmail 8.13.x. Set it to 3000 (milliseconds) and observe the maillog.
    You may whitelist some regular sending hosts which don't spam.

    Alexander 

    -- 
Alexander Dalloz | Enger, Germany | GPG http://pgp.mit.edu 0xB366A773
legal statement: http://www.uni-x.org/legal.html
Fedora Core 2 GNU/Linux on Athlon with kernel 2.6.11-1.27_FC2smp 
Serendipity 17:27:18 up 13 days, 16:04, load average: 0.11, 0.11, 0.09 



    


    -- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
  • Next message: Robin Laing: "Re: Multi Track Recording on fedora 4;"

    Relevant Pages

    • Need advice on new mailserver and spam
      ... that has about 30 employees and an external mailserver. ... on average about 100 legitimate emails per day and 3000+ spams plus ... Their spam problem, IMHO, comes from the mailserver they currently use ... shutting down all incoming email. ...
      (Fedora)
    • RE: OMA and Outgoing Spam
      ... Someone hacked a user account and use it to spam emails; ... Your Exchange server is open relaying emails;(You have checked it ... Your server is under RNDR Attack. ... Microsoft is providing this information as a convenience to you. ...
      (microsoft.public.windows.server.sbs)
    • Re: A flood of spams - another virus on the way?
      ... You would need to totally redesign TCPIP and SMTP with security in mind. ... You can block viruses at the mailhub level the problem is what you then do. ... Spam is a worse problem. ... >number of emails they will be sending out in any one day. ...
      (comp.os.vms)
    • Re: Exchange Weird Issue
      ... Emails are from different external users, ... involved in a conversation with the intended recipient. ... So I don't think it's a spam or open relay issue... ... Your server is open relaying emails. ...
      (microsoft.public.windows.server.sbs)
    • Worm.Automat.AHB Worm (also perhaps known as W32.Swen.A@mm
      ... My NAV shows updated through 9/18/03. ... Yet each time these emails come in, ... the criteria of the worm, ... >with the SP3 Security update handled the infection by ...
      (microsoft.public.security.virus)