qmail.org · Domains · Slashdot Mirror

How I blocked 90% of my spam using qmail by embo · 2001-08-31 07:03 · Score: 2, Interesting · on Spammers Stoop To New Low

Disclaimer: I admin a qmail box, so unless you have qmail as your mail server, this probably won't work. (But you really should get it, because it rocks big time, even if you can't stand DJB)

You will need to have DJB's mess822 package installed as well. That said, I put these lines in my .qmail file (which directs how mail is delivered):

|condredirect username-safe@mydomain.com /usr/local/bin/iftocc
|condredirect username-safe@mydomain.net sh -c 'echo $SENDER | grep -f bccexempt > /dev/null'
|/var/qmail/bin/preline -df /bin/sed "s/^S[Uu][Bb][Jj][Ee][Cc][Tt]:/Subject: THISISSPAM ($SENDER) /" | qmail-inject -a username-safe@mydomain.com

Line 1: Delivers any email where my address is in the To: or Cc: lines, and exits. Otherwise, it falls through to...
Line 2: Delivers any email where my address is in the Bcc: line, PROVIDED that the FROM address is listed in a special file in my home directory, called bccexempt. This way, it denies ANY bcc delivery to my address, unless I explicitly list the from address in my bccexempt file. It will then exit if it passes this test. Otherwise, it falls through to...
Line 3: Injects the phrase "THISISSPAM" into the subject line. This way, I can filter on the subject line in virtually ANY email reader on the planet. Another option would be to simply throw it into /dev/null, but this way I can adjust my bccexempt filter if I need to, because it also lists the FROM address in the subject if it's marked as spam. I just have my email reader filter for THISISSPAM in the subject line, and if it finds it, it marks it as read and dumps it into a separate folder away from my Inbox where I don't have to look at it, or even know it's there. Once every 2 or 3 weeks, I quickly browse through the list of spam addresses, and if I find any legitimate emails, I add the sender to my bccexempt list so the mail will be delivered into my Inbox.

Then I created a .qmail-safe file to handle the forwards where the legit email really gets sent to, and I have that dump into ./Maildir/ to deliver normally.

The first month I had this in place, I received nearly 200 spams, and approximately 12 of those actually made it into my Inbox. This works so well because most spammers use BCC to send out their spam. This filter gives you control over who can BCC you. I know this doesn't stop spam at the source. I know it doesn't cut down on bandwidth usage. I know they can bypass it by mailing me directly. But I also know that there were 200 spams the first month that never entered my inbox.

-D

Re:go with qmail by Balinares · 2001-08-27 04:06 · Score: 2 · on Sendmail On IBM Mainframes Running GNU/Linux

No, no, no.
If you want to go the "Sendmail is buggy" way, well, at least, try to be informative where the alternatives are concerned.

For those who wish to try another MTA, the three big ones, not counting Sendmail, are Exim (small and easy, good for your home net), Qmail, and Postfix (fast and powerful, my personal fav). All four have their good points, and all four are certainly worth checking before you decide on one.

See? I mean, if Sendmail is still so widely used, there is a reason, you know... :)

Re:You know what would be good? by 3247 · 2001-07-21 20:39 · Score: 1 · on Unsafe At Any Runlevel

There are a lot of another security problems than buffer overflows and format-string bugs:

Calling shells with untested user-provided parameters (e.g. 'filename; rm -rf /').
Constructing filenames out of untested user-provided parameters (e.g. ' ../etc/passwd' - there should be more of '../' but Slashdot does not like that).
Providing access to other users' data (e.g. relying on users not doing URL hacking).
Not limiting ressources (=> DoS Attacks); note that 'secure' languages are much more prone to that error because programmers usually don't care sbout size...
Trigger bugs in the environment (interpreter, compiler's RTL).
Scripting languages: Constructing programme code including user-provided data (e.g. with perl's eval statement).

Now if these programmes even run as root because 'they are secure anyway'...

The real solutions have to be different:

Divide everything into small programmes that do simple tasks.
Run every task in a sandbox (chroot environment, user account,...) that gives no more access than absolutely necessary.
Don't trust input be it from the user or another part of the system.
...
And finally:
Be paranoid!

For example, look at qmail's secutiry scheme.

pop on smtp by sagi · 2001-07-20 23:27 · Score: 1 · on Verizon Email Restrictions

My ISP (012.net) does that for a while now.. It's really annoying, but we solved after enabling pop on smtp on the remote mail server.

We're using QMail+VPOPMail for that, and it works very nice.

MAPS did change my behavior by fetta · 2001-07-13 00:10 · Score: 1 · on Last Month for Free MAPS

A few years ago, I went to work for a small company as a "jack of all trades" network admin. Closing the open relay on one of the mail servers was pretty low on my priority list - I had a lot of other things to look at (like the web servers) and wasn't even aware that we had an open relay.

Well, once we started getting blocked I had to track down the problem when some of our clients couldn't receive email from us. The end result was that I migrated us to a qmail based system (great mail server) and learned a bit about controlling SPAM. Admittedly, at the time it was a royal pain, but looking back I see the utility of their system. It took a couple of days to resolve, but the whole process had the desired effect - we closed our open relay.

I understand the reasons its going commercial, but I think that they will marginalize themselves as a result. All in all, I think that's a shame.

Re:So they wont be hypocrites.. by sammy+baby · 2001-05-10 04:54 · Score: 2 · on Red Hat: Who Needs Netscape?

I wasn't aware (read: didn't care) that RedHat was involved in any hullabaloo regarding qmail & djbdns. However:

Qmail and djbdns are each distributed under licenses which basically prohibit you from distributing modified binaries. You can redistribute the source, you can write patches for (and redistribute) it, you can distribute binaries. You may not redistribute patched binaries or directly modified source. The full text is here

This makes GPL die-hards pretty upset. If I'm reading this correctly, some folks petitioned RedHat to include both qmail and djbdns in their distribution, and RedHat balked because of license issues. The thing is, they already were distributing Netscape, so the license argument sounded kind of lame.

Re:Efficiency, Flames... by MikeBabcock · 2001-02-05 03:38 · Score: 2 · on What Mailbox Format Do You Use And Why?

Even with ReiserFS, there is some overhead of space and time involved in managing files. Each file has a directory entry and an inode or two; while ReiserFS may unambiguously improve the time efficiency, that does not result in the space overhead falling to zero.

This is very true, although I was more concerned with time than space at the current price of a few hundred GB of disk space.

If he tried to find some places for agreement, his software would probably get used more.

This, and providing "--help" options to his programs I suggested as being helpful ... right before the deluge of hate-mail ...

He thinks about the notion of proving correct behaviour

He never did reply to my philosophical statement that his famous statement, "profile, don't speculate" was incorrect since speculation is scientifically required for eventual proofs to happen.

Qmail and Dnscache are still personal favorite pieces of software for servers, although there are many things they could do much better than they do. Luckily, Dan seems to attract a large number of patch-writers and individuals who kindly host useful websites like qmail.org and djbdns.org.

Re:how many more buffer overflows is it going to t by Saucepan · 2001-02-01 01:15 · Score: 2 · on BIND Security Info For "Members Only"?

It's possible to avoid the high-risk areas of C--the standard libraries in particular--while still enjoying the benefits of it's simplicity, speed, and ubiquity.

If you are worried about null-terminated strings, perhaps in light of Theo de Raadt's estimate that half of all calls to stncpy() and strncat() were botched, there are alternative representations available that are easy to use correctly and have withstood extensive real-world testing.

Re:Sneakemail by embo · 2001-01-15 22:03 · Score: 1 · on Norway Bans Spam

You can already do this yourself if your ISP uses qmail and allows you to edit your own .qmail files. (Pay attention to Section 4.1.5 on extension addresses)

Oh, no! Not acne-faced part-time HS students! by Brett+Glass · 2000-12-25 11:34 · Score: 1 · on Stopping Spam And Trojan Horses With BSD

But if you have an acne faced part-time high school student doing your sys admin work with sendmail--you are in big trouble.

If you're in this situation, you're in big trouble no matter what MTA you're using.

Sendmail's code isn't as bad as you paint it, though. Thousands of pairs of experienced eyes have pored over it -- certainly more than for any other MTA.

If you really are concerned about Sendmail, wrap it with smtpd or use qmail. Warning: you'll still need to understand the underlying principles to control relaying and block spam and malware. And don't assume that it will necessarily be that much easier. as this FAQ explains, using spam prevention tools such as DNS blacklists with qmail is more complex than doing it with Sendmail (which requires only one line per blacklist in your .mc file).

--Brett

Re:Heh. After 7 years in the slammer... by electricmonk · 2000-12-12 05:04 · Score: 2 · on Spammer Pleads Guilty

I think millions of mail system administrators and mail users everywhere have just been avenged...

*sigh*... You and other system administrators wouldn't have to worry about getting vengence on spammers in the first place if you use an MTA like PostFix or qmail. They're a lot easier to configure to filter out all the crap. They're pretty secure, too.

Re: Would this work? (this might) by Axemaster · 2000-12-10 09:04 · Score: 2 · on Verizon Clogged With Tons Of Spam

I've used tarpitting to reduce the flow of spam through my mailserver, and it seems to work pretty well. There are patches out there for QMail (awesome) that seem to do the trick. There are other various recipes and such for procmail that work well. If you're looking to poison their spamlists, take a look at sugarplum, a spamlist poisoner for webservers. On a totally unrelated note, but on the same vein (poisonbots), take a look at peachpit, a censorware spider trap.