On 05/12/04 at 18:15, 'twas brillig and Kevin A. McGrail scrobe:
> After thinking about how to solve the problem, I decided that users that
> have authenticated to send email should be exempted from SA checks. This
> may not scale for everyone but all our users are not going to send spam. We
> still check for virii though. *I very much want comments on this line of
> thought*
> [...]
Kevin -
I actually just implemented some of these things, starting
with your ideas and going from there. I have some comments on the code
itself, but first let me remark on the paragraph above... I still run
mail through SA if it has site-local origin (although I disable
network SA tests for such mail) because if someone within my network
is contributing to the delinquency of the 'net I want to know about
it. (One of my first experiences as a postmaster, seven or eight years
ago, was that of finding that one of "my" grad students was spamming
the entire university from her SGI workstation, to advertise the
continuing-ed course she was teaching, for which she received
per-student fees. You'd think a CS grad student studying networking
wouldn't need an exhaustive explanation of the logic behind the phrase
"spam is BAD"...)
> Anyway, our system uses pop before smtp authentication to prevent SPAM from
> relaying so I've modded my filter to read the popauth database to see if we
> can bypass SpamAssassin altogether (see above).
[...]
> sub filter_initialize {
> #SETUP A TIE TO THE POP BEFORE SMTP AUTH DATABASE
> use DB_File;
>
> our ($popauthdbfile, $popauthdb);
> $popauthdbfile = "/etc/mail/popauth.db";
>
> $popauthdb = &opendb_read($popauthdbfile);
> }
Problem? AIUI, filter_initialize is called only once in the
life of a slave, and DB_File doesn't check the timestamp of the
on-disk DB when you use the contents of the hash. If a slave takes
half an hour to process its allotted number of messages, then
$popauthdb will be a half-hour out of date by the time the last
message is processed, unless you are calling opendb_read before every
check (in which case, why bother calling it in filter_init?) This
means that someone potentially has to wait some non-trivial amount of
time after checking mail to be sure of sending it without some risk of
incurring the SA penalties you are trying to avoid. Maybe not a big
deal, but probably not what you wanted.
[...]
> These function will allow your mimedefang filter to detect whether an email
> was sent using POP Before SMTP
> Authentication. I then used that information to add a header to the email
> and to set a variable $popauth
> to true in my filter_end routine.
[...]
> Now, I use the existence of this header to bypass calling SpamAssassin. If
> you are calling SpamAssassin
> from your filter, simply add a check for the variable $popauth:
So you're setting $popauth in filter_end() and using it in
filter() ? Or is "your filter" above intended to refer loosely to the
entire thing, with the understanding that you're calling SA from
filter_end() also? Because mimedefang-filter(5) says:
The following list describes the lifetime of global
variables (thanks to Tony Nugent for providing this documentation.)
If you set a global variable:
[...]
In filter_end
Available within filter_end
So here's what I do... (feel free to tear it apart :-) my
comments interspersed in brackets.
# the DB used for popauth relay authentication
# MUST BE READABLE BY THE DEFANG USER (try
# "chgrp defang /etc/mail/access.db")
$popauthdbfile = "/etc/mail/access.db";
<we have a homegrown pop-before-smtp solution # dating from before
drac et al were available>
sub filter_initialize () {
use DB_File;
# build our static spamassassin objects
if ($Features{"SpamAssassin"}) {
spam_assassin_init()->compile_now(1) if defined(spam_assassin_init());
spam_assassin_init_net()->compile_now(1) if defined(spam_assassin_init_net());
}
}
<my opendb_read and closedb are stolen line-for-line from KAM>
sub popauthget ($) {
# read sendmail's access.db and look for ip RELAY
my ($ip) [EMAIL PROTECTED];
my $popauthdb = &opendb_read($popauthdbfile);
if ($popauthdb->{$ip} =~ /RELAY/) {
&closedb($popauthdb);
return "popauth";
}
return 0;
}
sub authget () {
# return 0 if not authenticated, authid otherwise
# see http://lists.roaringpenguin.com/pipermail/mimedefang/2003-November/018351.html
open(COMM, "<./COMMANDS") or return 0;
while(<COMM>) {
if (/^=auth_authen\s+(\w+)/) {
close(COMM);
return $1;
}
}
close(COMM);
return 0;
}
<then, in filter_sender(), I use these for allowing bogus HELOs from
client MUAs -- if I wanted to use them for other purposes, I guess I'd
write a file in WORKDIR rather than doing the DB lookup again.>
sub filter_sender ($$$$) {
my ($envfrom, $ip, $hname, $helo) = @_;
# match someone who's pretending to be us or HELOing one of "our" IPs
# -- legit MTAs should never do this, some ratware does
if ($helo =~ /^($ThisHost)$|^\w*\.cs\.umass\.edu$|^128.119.(24\d|4[012])\.\d+$/i ) {
if ($ip !~ /^128\.119\.(24\d|4[012])\.\d+|^127\.0\.0\.1/) {
if (my $luser = (authget or popauthget($ip))) {
md_syslog('warning', "forged_helo_auth: Host $ip ($hname)
authenticated by $luser said HELO $helo with ENVFROM of \'$envfrom\'");
return ('CONTINUE', "ok");
} else {
md_syslog('warning', "forged_helo: Host $ip ($hname) said HELO
$helo with ENVFROM of \'$envfrom\'");
return("REJECT", "Invalid SMTP transaction");
}
} else {
if ($ip !~ /127\.0\.0\.1|128\.119\.243\.168/ and $helo =~
/^$ThisHost.*|^128.119.243.168/) {
md_syslog('warning', "forged_helo_local: Onsite host $ip ($hname)
said HELO $helo with ENVFROM of \'$envfrom\'");
}
}
}
return ('CONTINUE', "ok");
}
Cheers,
Ole
--
Ole Craig * UNIX, linux, SMTP-ninja; news, web; SGI martyr * CS Computing
Facility, UMass * <www.cs.umass.edu/~olc/pgppubkey.txt> for public key
Where are the missing deficit-reduction program-related activities?
_______________________________________________
Visit http://www.mimedefang.org and http://www.canit.ca
MIMEDefang mailing list
[EMAIL PROTECTED]
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
