# [EMAIL PROTECTED] / 2003-01-03 20:48:18 -0500:
> we're having a problem with some cracker using addresses
> harvested from whois and the "abuse/www/webmaster" with
> domains they get from the database. The mail appears to
> come from us but it cannot as the addresses are oneway incoming
> only.
> the subject is always
> "XXX templates"

    filtering on subject might help in short term, but it's not the
    right answer IMO.
> It claims its advertising for www.liquid2d.com,
> their website says:
> "
> Liquid 2D is being attacked by a group calling itself the 'asian WAREZ
> crackers' who are trying to disrupt our business. They are sending out
> massive amounts of spam mail to anger people and are using open mail
> servers to send it out.

    your email mentions at least three hooks that are better suited for
    weeding out spam, and will help you generally, not just against
    these losers.

    Also, I don't use Sendmail, so you'll have to transform this into
    the m4 configuration; Postfix configuration is very readable.

    1. it's not clear whether "The mail appears to come from us" means
    that the envelope sender address has your domain or it's just the
    From: header. If it's the latter you can employ some header check,
    which means you'll have to accept the message first, but envelope
    sender check are easy:

    smtpd_sender_restrictions =
        check_sender_access hash:/usr/local/etc/postfix/spammers

    /usr/local/etc/postfix/spammers contains (among others):

    bellavista.cz                 554 Stick it up your nostril, liar

    2. the statement you cited says the spammers abuse open relays.
    you probably don't want to accept any mail from such MTAs anyway:

    maps_rbl_domains =

    smtpd_client_restrictions =

    3. while you might not want to use this for your regular (business
    related) user accounts, addresses like hostmaster@ can be quite
    easily protected from spam by TMDA or qsecretary.

If you cc me or remove the list(s) completely I'll most likely ignore
your message.    see http://www.eyrie.org./~eagle/faqs/questions.html

To Unsubscribe: send mail to [EMAIL PROTECTED]
with "unsubscribe freebsd-questions" in the body of the message

Reply via email to