On Sun, Jul 20, 2003 at 01:37:15PM -0500, Kevin Kinsey, DaleCo, S.P. wrote: > I'm not happy that Sendmail is > allowing connections from non- > existent hosts (i.e., spammers...) > > I run Sendmail more or less straight > "out of the box" on -stable. I had > been under the impression that the > line > > ALL : PARANOID : RFC931 20 : deny > > in /etc/hosts.allow would help reject > some of this stuff. However, as the > amount of spam in my inbox is > beginning to attest, this isn't the case. > > I've been googling and searching the > archives with strings similar to the > one in the title, and haven't yet grok > what I'm supposed to do to get this > to work... > > So, how do I tell Sendmail that if > a host doesn't exist, (i.e. d3kr890d.129ddk.org) > I don't want to talk to it...
The way that sendmail(8) uses tcp wrappers is slightly different to
most daemons. Instead of outright refusing to connect (which would
lead to the other side trying again every half hour or so for the next
five days), it permits the remote side to connect and then issues a
permanent reject code during the SMTP dialogue.
Even without enabling tcp wrappers functionality, sendmail should
still reject egregiously forged addresses. You have to add
FEATURE(`accept_unresolvable_domains')dnl
to your `hostname`.mc file to allow incoming mail from domains without
either A or MX records registered in the DNS.
I find that the DNSBL feature is rather effective at rejecting spam
e-mail. Generally my mailserver gets about 20--30 spam e-mails a
day. Of those, all but 2 or 3 are rejected by the DNSBL, and the rest
are taken out by spamassassin, with perhaps 2 false negatives a week
and no false positives.
I find that the combination of these three blacklists is most effective:
FEATURE(dnsbl, `bl.spamcop.net', `"550 Mail from " $&{client_addr} " rejected
using spamcop.net DNSBL. See http://spamcop.net/w3m?action=checkblock&ip=";
$&{client_addr}', `')dnl
FEATURE(dnsbl, `relays.osirusoft.com', `"550 Mail from " $&{client_addr} "
rejected using relays.osirusoft.com DNSBL. See http://relays.osirusoft.com/";', `')dnl
FEATURE(`dnsbl', `blackholes.easynet.nl', `"550 5.7.1 ACCESS DENIED to
"$&{client_name}" by easynet.nl DNSBL (http://blackholes.easynet.nl/errors.html)"',
`')dnl
Cheers,
Matthew
--
Dr Matthew J Seaman MA, D.Phil. 26 The Paddocks
Savill Way
PGP: http://www.infracaninophile.co.uk/pgpkey Marlow
Tel: +44 1628 476614 Bucks., SL7 1TH UK
pgp00000.pgp
Description: PGP signature
