Re: LPRng: LPRng mailing list under SPAM attack
From [EMAIL PROTECTED] Tue Jun 29 13:40:07 2004 Date: Tue, 29 Jun 2004 06:15:37 +0200 From: Willi Burmeister [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Re: LPRng: LPRng mailing list under SPAM attack Hi Patrick, Well, apparently the Spammers have caught on to this type of thing. I have just found that our secondary mail server is getting about 10 times the mail that the actual mail server is. We have installed milter-sender on both primary and secondary MX. milter-sender on secondaries can than be configured to ask the primary for real accounts. This works great. G I have spent more time on mail issues in the last month than any other professional activity. Fight against spam is really time consuming these days. I'm spending 20%-30% of my daily time on mail related works :-( Willi I just peeked at it: http://www.snert.com/Software/milter-sender/ It looks pretty good as well. I will install this and give it a try. Patrick - YOU MUST BE A LIST MEMBER IN ORDER TO POST TO THE LPRng MAILING LIST The address you post from or your Reply-To address MUST be your subscription address If you need help, send email to [EMAIL PROTECTED] (or lprng-requests or lprng-digest-requests) with the word 'help' in the body. To subscribe to a list with name LIST, send mail to [EMAIL PROTECTED] with: | example: subscribe LIST mailaddr | subscribe lprng-digest [EMAIL PROTECTED] unsubscribe LIST mailaddr | unsubscribe lprng [EMAIL PROTECTED] If you have major problems, call Patrick Powell or one of the friendly staff at Astart Technologies for help. Astart also does support for LPRng. Also, check the Web Page at: http://www.lprng.com for any announcements. Astart Technologies (LPRng - Print Spooler http://www.lprng.com) 6741 Convoy Court San Diego, CA 92111 858-874-6543 FAX 858-751-2435 -
Re: LPRng: LPRng mailing list under SPAM attack
Hi Patrick, Well, apparently the Spammers have caught on to this type of thing. I have just found that our secondary mail server is getting about 10 times the mail that the actual mail server is. We have installed milter-sender on both primary and secondary MX. milter-sender on secondaries can than be configured to ask the primary for real accounts. This works great. G I have spent more time on mail issues in the last month than any other professional activity. Fight against spam is really time consuming these days. I'm spending 20%-30% of my daily time on mail related works :-( Willi - YOU MUST BE A LIST MEMBER IN ORDER TO POST TO THE LPRng MAILING LIST The address you post from or your Reply-To address MUST be your subscription address If you need help, send email to [EMAIL PROTECTED] (or lprng-requests or lprng-digest-requests) with the word 'help' in the body. To subscribe to a list with name LIST, send mail to [EMAIL PROTECTED] with: | example: subscribe LIST mailaddr | subscribe lprng-digest [EMAIL PROTECTED] unsubscribe LIST mailaddr | unsubscribe lprng [EMAIL PROTECTED] If you have major problems, call Patrick Powell or one of the friendly staff at Astart Technologies for help. Astart also does support for LPRng. Also, check the Web Page at: http://www.lprng.com for any announcements. Astart Technologies (LPRng - Print Spooler http://www.lprng.com) 6741 Convoy Court San Diego, CA 92111 858-874-6543 FAX 858-751-2435 -
Re: LPRng: LPRng mailing list under SPAM attack
At 02:45 PM 6/28/04 -0700, Patrick Powell wrote: Well, apparently the Spammers have caught on to this type of thing. I have just found that our secondary mail server is getting about 10 times the mail that the actual mail server is. The secondary will accept the mail then send it to the mail server, which bounces it. The secondary will then try to send a bounce message back to the (non-existent, of course) spammer. Postfix 2.1 includes the verify daemon that solves this problem. Before accepting an email, it can be configured to connect to the destination mail server and probe to see if an email sent to the recipient's address will be accepted. It caches the responses, so only needs to re-probe for new addresses (also, the good addresses are likely to be cached, so no problems with legitimate email if the primary is down). It can also be configured to: Test the sender's address Reject with a 4xx or 5xx code I just configured my email relays to use it because one of my domains has been under sustained dictionary attacks and I wanted to reduce backscatter. Simon G I have spent more time on mail issues in the last month than any other professional activity. Patrick --- -- YOU MUST BE A LIST MEMBER IN ORDER TO POST TO THE LPRng MAILING LIST The address you post from or your Reply-To address MUST be your subscription address If you need help, send email to [EMAIL PROTECTED] (or lprng-requests or lprng-digest-requests) with the word 'help' in the body. To subscribe to a list with name LIST, send mail to [EMAIL PROTECTED] with: | example: subscribe LIST mailaddr | subscribe lprng-digest [EMAIL PROTECTED] unsubscribe LIST mailaddr | unsubscribe lprng [EMAIL PROTECTED] If you have major problems, call Patrick Powell or one of the friendly staff at Astart Technologies for help. Astart also does support for LPRng. Also, check the Web Page at: http://www.lprng.com for any announcements. Astart Technologies (LPRng - Print Spooler http://www.lprng.com) 6741 Convoy Court San Diego, CA 92111 858-874-6543 FAX 858-751-2435 --- -- - YOU MUST BE A LIST MEMBER IN ORDER TO POST TO THE LPRng MAILING LIST The address you post from or your Reply-To address MUST be your subscription address If you need help, send email to [EMAIL PROTECTED] (or lprng-requests or lprng-digest-requests) with the word 'help' in the body. To subscribe to a list with name LIST, send mail to [EMAIL PROTECTED] with: | example: subscribe LIST mailaddr | subscribe lprng-digest [EMAIL PROTECTED] unsubscribe LIST mailaddr | unsubscribe lprng [EMAIL PROTECTED] If you have major problems, call Patrick Powell or one of the friendly staff at Astart Technologies for help. Astart also does support for LPRng. Also, check the Web Page at: http://www.lprng.com for any announcements. Astart Technologies (LPRng - Print Spooler http://www.lprng.com) 6741 Convoy Court San Diego, CA 92111 858-874-6543 FAX 858-751-2435 -
Re: LPRng: LPRng mailing list under SPAM attack
On Mon, 28 Jun 2004, Patrick Powell wrote: G I have spent more time on mail issues in the last month than any other professional activity. Just like everyone of us. I spend an average of 4 hours per day sorting out spam issues. And then they say it doesn't cost anything. My ass. - YOU MUST BE A LIST MEMBER IN ORDER TO POST TO THE LPRng MAILING LIST The address you post from or your Reply-To address MUST be your subscription address If you need help, send email to [EMAIL PROTECTED] (or lprng-requests or lprng-digest-requests) with the word 'help' in the body. To subscribe to a list with name LIST, send mail to [EMAIL PROTECTED] with: | example: subscribe LIST mailaddr | subscribe lprng-digest [EMAIL PROTECTED] unsubscribe LIST mailaddr | unsubscribe lprng [EMAIL PROTECTED] If you have major problems, call Patrick Powell or one of the friendly staff at Astart Technologies for help. Astart also does support for LPRng. Also, check the Web Page at: http://www.lprng.com for any announcements. Astart Technologies (LPRng - Print Spooler http://www.lprng.com) 6741 Convoy Court San Diego, CA 92111 858-874-6543 FAX 858-751-2435 -
Re: Re: LPRng: LPRng mailing list under SPAM attack
hi patric, i am not a spam expert but why not 'whitelist' (hope this is the term) the lprng ML members and add new members manualy only. robots that subscribe to the ml can be cauth that way (hopefully no idea who there mails look to humans, perhaps you can add a line like what is your main interesse ? (other ppl stay out of cause). regards, walter - - - - - - - - - - - - - - Original Message - - - - - - - - - - - - - - From: Patrick Powell [EMAIL PROTECTED] Subject: Re: LPRng: LPRng mailing list under SPAM attack Date: 06/28/04 23:45 From [EMAIL PROTECTED] Thu Jun 24 07:12:25 2004 Date: Thu, 24 Jun 2004 07:03:36 +0200 From: Willi Burmeister [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Re: LPRng: LPRng mailing list under SPAM attack Hi Patrick, Any other suggestions? Greylisting on the incoming mail server. I wonder what other email lists are doing to control Spam attacks? we have installed greylisting in the incoming mail server, and our spam rate has changed from nearly 80% to under 5% Take a look at this URLs: - http://projects.puremagic.com/greylisting/ - http://www.snert.com/Software/milter-sender/index.shtml Willi Well, apparently the Spammers have caught on to this type of thing. I have just found that our secondary mail server is getting about 10 times the mail that the actual mail server is. The secondary will accept the mail then send it to the mail server, which bounces it. The secondary will then try to send a bounce message back to the (non-existent, of course) spammer. G I have spent more time on mail issues in the last month than any other professional activity. Patrick - YOU MUST BE A LIST MEMBER IN ORDER TO POST TO THE LPRng MAILING LIST The address you post from or your Reply-To address MUST be your subscription address If you need help, send email to [EMAIL PROTECTED] (or lprng-requests or lprng-digest-requests) with the word 'help' in the body. To subscribe to a list with name LIST, send mail to [EMAIL PROTECTED] with: | example: subscribe LIST mailaddr | subscribe lprng-digest [EMAIL PROTECTED] unsubscribe LIST mailaddr | unsubscribe lprng [EMAIL PROTECTED] If you have major problems, call Patrick Powell or one of the friendly staff at Astart Technologies for help. Astart also does support for LPRng. Also, check the Web Page at: http://www.lprng.com for any announcements. Astart Technologies (LPRng - Print Spooler http://www.lprng.com) 6741 Convoy Court San Diego, CA 92111 858-874-6543 FAX 858-751-2435 - - YOU MUST BE A LIST MEMBER IN ORDER TO POST TO THE LPRng MAILING LIST The address you post from or your Reply-To address MUST be your subscription address If you need help, send email to [EMAIL PROTECTED] (or lprng-requests or lprng-digest-requests) with the word 'help' in the body. To subscribe to a list with name LIST, send mail to [EMAIL PROTECTED] with: | example: subscribe LIST mailaddr | subscribe lprng-digest [EMAIL PROTECTED] unsubscribe LIST mailaddr | unsubscribe lprng [EMAIL PROTECTED] If you have major problems, call Patrick Powell or one of the friendly staff at Astart Technologies for help. Astart also does support for LPRng. Also, check the Web Page at: http://www.lprng.com for any announcements. Astart Technologies (LPRng - Print Spooler http://www.lprng.com) 6741 Convoy Court San Diego, CA 92111 858-874-6543 FAX 858-751-2435 -
Re: LPRng: LPRng mailing list under SPAM attack
From [EMAIL PROTECTED] Thu Jun 24 07:12:25 2004 Date: Thu, 24 Jun 2004 07:03:36 +0200 From: Willi Burmeister [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Re: LPRng: LPRng mailing list under SPAM attack Hi Patrick, Any other suggestions? Greylisting on the incoming mail server. I wonder what other email lists are doing to control Spam attacks? we have installed greylisting in the incoming mail server, and our spam rate has changed from nearly 80% to under 5% Take a look at this URLs: - http://projects.puremagic.com/greylisting/ - http://www.snert.com/Software/milter-sender/index.shtml Willi Well, apparently the Spammers have caught on to this type of thing. I have just found that our secondary mail server is getting about 10 times the mail that the actual mail server is. The secondary will accept the mail then send it to the mail server, which bounces it. The secondary will then try to send a bounce message back to the (non-existent, of course) spammer. G I have spent more time on mail issues in the last month than any other professional activity. Patrick - YOU MUST BE A LIST MEMBER IN ORDER TO POST TO THE LPRng MAILING LIST The address you post from or your Reply-To address MUST be your subscription address If you need help, send email to [EMAIL PROTECTED] (or lprng-requests or lprng-digest-requests) with the word 'help' in the body. To subscribe to a list with name LIST, send mail to [EMAIL PROTECTED] with: | example: subscribe LIST mailaddr | subscribe lprng-digest [EMAIL PROTECTED] unsubscribe LIST mailaddr | unsubscribe lprng [EMAIL PROTECTED] If you have major problems, call Patrick Powell or one of the friendly staff at Astart Technologies for help. Astart also does support for LPRng. Also, check the Web Page at: http://www.lprng.com for any announcements. Astart Technologies (LPRng - Print Spooler http://www.lprng.com) 6741 Convoy Court San Diego, CA 92111 858-874-6543 FAX 858-751-2435 -
Re: LPRng: LPRng mailing list under SPAM attack
On Mon, Jun 28, 2004 at 02:45:39PM -0700, Patrick Powell wrote: Well, apparently the Spammers have caught on to this type of thing. I have just found that our secondary mail server is getting about 10 times the mail that the actual mail server is. The secondary will accept the mail then send it to the mail server, which bounces it. The secondary will then try to send a bounce message back to the (non-existent, of course) spammer. G I have spent more time on mail issues in the last month than any other professional activity. Do you really need a secondary mail server? As you note, since the filtering rules on your secondary don't match your primary, a 'backdoor' for spam is created. Most senders' mail servers will queue mail for hours (if not days). So, even if your primary mail server goes down for a little while, you should be OK. Just a thought, Luca -- Luca Filipozzi, ECE Dept. IT Manager, University of British Columbia - YOU MUST BE A LIST MEMBER IN ORDER TO POST TO THE LPRng MAILING LIST The address you post from or your Reply-To address MUST be your subscription address If you need help, send email to [EMAIL PROTECTED] (or lprng-requests or lprng-digest-requests) with the word 'help' in the body. To subscribe to a list with name LIST, send mail to [EMAIL PROTECTED] with: | example: subscribe LIST mailaddr | subscribe lprng-digest [EMAIL PROTECTED] unsubscribe LIST mailaddr | unsubscribe lprng [EMAIL PROTECTED] If you have major problems, call Patrick Powell or one of the friendly staff at Astart Technologies for help. Astart also does support for LPRng. Also, check the Web Page at: http://www.lprng.com for any announcements. Astart Technologies (LPRng - Print Spooler http://www.lprng.com) 6741 Convoy Court San Diego, CA 92111 858-874-6543 FAX 858-751-2435 -
Re: LPRng: LPRng mailing list under SPAM attack
On Mon, 21 Jun 2004, Patrick Powell wrote: Just for your interest, there were 11121 spam attack messages sent to the LPRng mailing list since about 3:00 pm PST on Friday and 7:15 am PST on Monday. And the scumbags who spew out all this crap, when they're defending themselves (in or out of court), act all innocent and say I didn't harm anyone Gr! The total cost must be in the billions! I am installing SpamAssassin as a first line defence against this. Any other suggestions? I wonder what other email lists are doing to control Spam attacks? Sorry you're having to put up with this just to run a mailing list. I don't have anything useful to add to what others have already replied. -Dan -- Daniel E. Singer, System Administrator Dept. of Computer Science, Duke University, Durham NC 27708 USA - YOU MUST BE A LIST MEMBER IN ORDER TO POST TO THE LPRng MAILING LIST The address you post from or your Reply-To address MUST be your subscription address If you need help, send email to [EMAIL PROTECTED] (or lprng-requests or lprng-digest-requests) with the word 'help' in the body. To subscribe to a list with name LIST, send mail to [EMAIL PROTECTED] with: | example: subscribe LIST mailaddr | subscribe lprng-digest [EMAIL PROTECTED] unsubscribe LIST mailaddr | unsubscribe lprng [EMAIL PROTECTED] If you have major problems, call Patrick Powell or one of the friendly staff at Astart Technologies for help. Astart also does support for LPRng. Also, check the Web Page at: http://www.lprng.com for any announcements. Astart Technologies (LPRng - Print Spooler http://www.lprng.com) 6741 Convoy Court San Diego, CA 92111 858-874-6543 FAX 858-751-2435 -
Re: LPRng: LPRng mailing list under SPAM attack
Patrick Powell wrote: Just for your interest, there were 11121 spam attack messages sent to the LPRng mailing list since about 3:00 pm PST on Friday and 7:15 am PST on Monday. I am installing SpamAssassin as a first line defence against this. Any other suggestions? SpamAssassin is about the best option. If you turn on the bayesian filtering and RBL tests, and train the bayes engine with a suitable amount of spam and ham, it's very effective. At my site I drop connections at the gateway for IP addresses in sbl-xbl.spamhaus.org, scan mail with ClamAV and reject viruses/worms in the SMTP phase, and then run everything that's left through SpamAssassin with network tests and bayesian checking. This eliminates over 99% of it, but getting rid of the last bit is always the hardest. Integrating Razor/DCC with SpamAssassin may also pay dividends. I wonder what other email lists are doing to control Spam attacks? One list I'm on greylists people using GNU SAUCE. Any mail received by the MTA is rejected with a 450 temporary failure. If the sending system retries a few times, the mail is allowed through, and the sender address is added to a whitelist. Senders on the whitelist are not delayed in future. Spammers pretty much never retry, so this effectively cleans the list, at the price of delaying legitimate mail from first time posters by a couple of hours. I personally don't really like the approach, but spam is becoming such a blight that these things are getting more necessary. Various other bits of software are also offering greylisting these days. Mike. - YOU MUST BE A LIST MEMBER IN ORDER TO POST TO THE LPRng MAILING LIST The address you post from or your Reply-To address MUST be your subscription address If you need help, send email to [EMAIL PROTECTED] (or lprng-requests or lprng-digest-requests) with the word 'help' in the body. To subscribe to a list with name LIST, send mail to [EMAIL PROTECTED] with: | example: subscribe LIST mailaddr | subscribe lprng-digest [EMAIL PROTECTED] unsubscribe LIST mailaddr | unsubscribe lprng [EMAIL PROTECTED] If you have major problems, call Patrick Powell or one of the friendly staff at Astart Technologies for help. Astart also does support for LPRng. Also, check the Web Page at: http://www.lprng.com for any announcements. Astart Technologies (LPRng - Print Spooler http://www.lprng.com) 6741 Convoy Court San Diego, CA 92111 858-874-6543 FAX 858-751-2435 -
Re: LPRng: LPRng mailing list under SPAM attack
Hi Patrick, Any other suggestions? Greylisting on the incoming mail server. I wonder what other email lists are doing to control Spam attacks? we have installed greylisting in the incoming mail server, and our spam rate has changed from nearly 80% to under 5% Take a look at this URLs: - http://projects.puremagic.com/greylisting/ - http://www.snert.com/Software/milter-sender/index.shtml Willi - YOU MUST BE A LIST MEMBER IN ORDER TO POST TO THE LPRng MAILING LIST The address you post from or your Reply-To address MUST be your subscription address If you need help, send email to [EMAIL PROTECTED] (or lprng-requests or lprng-digest-requests) with the word 'help' in the body. To subscribe to a list with name LIST, send mail to [EMAIL PROTECTED] with: | example: subscribe LIST mailaddr | subscribe lprng-digest [EMAIL PROTECTED] unsubscribe LIST mailaddr | unsubscribe lprng [EMAIL PROTECTED] If you have major problems, call Patrick Powell or one of the friendly staff at Astart Technologies for help. Astart also does support for LPRng. Also, check the Web Page at: http://www.lprng.com for any announcements. Astart Technologies (LPRng - Print Spooler http://www.lprng.com) 6741 Convoy Court San Diego, CA 92111 858-874-6543 FAX 858-751-2435 -
LPRng: LPRng mailing list under SPAM attack
Just for your interest, there were 11121 spam attack messages sent to the LPRng mailing list since about 3:00 pm PST on Friday and 7:15 am PST on Monday. I am installing SpamAssassin as a first line defence against this. Any other suggestions? I wonder what other email lists are doing to control Spam attacks? Patrick Powell - YOU MUST BE A LIST MEMBER IN ORDER TO POST TO THE LPRng MAILING LIST The address you post from or your Reply-To address MUST be your subscription address If you need help, send email to [EMAIL PROTECTED] (or lprng-requests or lprng-digest-requests) with the word 'help' in the body. To subscribe to a list with name LIST, send mail to [EMAIL PROTECTED] with: | example: subscribe LIST mailaddr | subscribe lprng-digest [EMAIL PROTECTED] unsubscribe LIST mailaddr | unsubscribe lprng [EMAIL PROTECTED] If you have major problems, call Patrick Powell or one of the friendly staff at Astart Technologies for help. Astart also does support for LPRng. Also, check the Web Page at: http://www.lprng.com for any announcements. Astart Technologies (LPRng - Print Spooler http://www.lprng.com) 6741 Convoy Court San Diego, CA 92111 858-874-6543 FAX 858-751-2435 -
