Re: [Declude.JunkMail] DSN:Tarpitting and declude firewall integration integration

2003-06-16 Thread Rifat Levis
Hi Bill ,

I wrote a small VB program .
--
Here is more details about the system.

I am using the KIWI syslog server software to send the logs to the SQL
You can specify in IMAIL  syslogs server ip address .(IF you run KIWI on the
same machine ,you have to stop IMAIL syslog )

I have wrote a small Visual Basic Program which scan the SQL database for 
ERR  INVALID USER  lines every 2 min.

And my little program Open a telnet connection to the firewall ADD the ip
address to block .
Then the program remove the ip address after 1 hour.

On my firewall i wrote a global policie group to deny access to port 25
So the software add the ip address and specify that it belong to that group
lls.

I decided also to integrate DECLUDE JUNKMAIL with my firewall.
For weight over 20 i will block for 1 hour
For weight over 30 will block for 2 hour
And so on.

Rifat





- Original Message - 
From: Bill B. [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Monday, June 16, 2003 3:11 PM
Subject: Re: [Declude.JunkMail] DSN:Tarpitting and declude firewall
integration integration


Rifat,

What software are you using to do the tarpitting?  Are you running it on the
same server as IMail, or on a separate box?

Bill


-Original Message-
From: Rifat Levis
Sent: Mon, 16 Jun 2003 02:01:45 +0300
Subject: [Declude.JunkMail] DSN:Tarpitting and declude firewall integration



People intersted in tarpitting and Declude firewall integration can read
this.



I just finished the tarpitting protection for my IMAIL server
I am sending logs to the kiwi syslog server and forwarding it to SQL to
analyse data

When in a 2 min period a single ip send mail to more than 5 unknown account
I am blocking the ip address on my netscreen firewall for 1 hour.


The next step of this is to integrate Declude to the firewall

I have 3 weight
weight 10 warn
weight 15 warn
weight 20 delete

Instead of deleting weight 20 i will forward it to an account to send data
to SQL analyse it and then block it for 1 hour .

NOTE : I am sure that KAMI will be interested :)

Best Regards
Rifat Levis

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] DSN:Tarpitting and declude firewall integration integration

2003-06-16 Thread Jason Newland
Sorry to burst your bubble, but that's not a tarpit.


You have a dynamic IP blocker.  Tarpitting doesn't block, it slows the
attack down, consuming more of their resources, and making their connection
seem like it is stuck in a pit of tar (hence the name)


Jason

- Original Message -
From: Rifat Levis [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Monday, June 16, 2003 7:51 AM
Subject: Re: [Declude.JunkMail] DSN:Tarpitting and declude firewall
integration integration


 Hi Bill ,

 I wrote a small VB program .
 --
 Here is more details about the system.

 I am using the KIWI syslog server software to send the logs to the SQL
 You can specify in IMAIL  syslogs server ip address .(IF you run KIWI on
the
 same machine ,you have to stop IMAIL syslog )

 I have wrote a small Visual Basic Program which scan the SQL database for

 ERR  INVALID USER  lines every 2 min.

 And my little program Open a telnet connection to the firewall ADD the ip
 address to block .
 Then the program remove the ip address after 1 hour.

 On my firewall i wrote a global policie group to deny access to port 25
 So the software add the ip address and specify that it belong to that
group
 lls.

 I decided also to integrate DECLUDE JUNKMAIL with my firewall.
 For weight over 20 i will block for 1 hour
 For weight over 30 will block for 2 hour
 And so on.

 Rifat





 - Original Message -
 From: Bill B. [EMAIL PROTECTED]
 To: [EMAIL PROTECTED]
 Sent: Monday, June 16, 2003 3:11 PM
 Subject: Re: [Declude.JunkMail] DSN:Tarpitting and declude firewall
 integration integration


 Rifat,

 What software are you using to do the tarpitting?  Are you running it on
the
 same server as IMail, or on a separate box?

 Bill


 -Original Message-
 From: Rifat Levis
 Sent: Mon, 16 Jun 2003 02:01:45 +0300
 Subject: [Declude.JunkMail] DSN:Tarpitting and declude firewall
integration



 People intersted in tarpitting and Declude firewall integration can read
 this.



 I just finished the tarpitting protection for my IMAIL server
 I am sending logs to the kiwi syslog server and forwarding it to SQL to
 analyse data

 When in a 2 min period a single ip send mail to more than 5 unknown
account
 I am blocking the ip address on my netscreen firewall for 1 hour.


 The next step of this is to integrate Declude to the firewall

 I have 3 weight
 weight 10 warn
 weight 15 warn
 weight 20 delete

 Instead of deleting weight 20 i will forward it to an account to send data
 to SQL analyse it and then block it for 1 hour .

 NOTE : I am sure that KAMI will be interested :)

 Best Regards
 Rifat Levis

 ---
 [This E-mail was scanned for viruses by Declude Virus
 (http://www.declude.com)]

 ---
 This E-mail came from the Declude.JunkMail mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.JunkMail.  The archives can be found
 at http://www.mail-archive.com.



 ---
 [This E-mail was scanned for viruses by Declude Virus
 (http://www.declude.com)]

 ---
 This E-mail came from the Declude.JunkMail mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.JunkMail.  The archives can be found
 at http://www.mail-archive.com.

 ---
 [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

 ---
 This E-mail came from the Declude.JunkMail mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.JunkMail.  The archives can be found
 at http://www.mail-archive.com.


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] DSN:Tarpitting and declude firewall integration integration integration integrationintegration integration integration integration

2003-06-16 Thread Bill B.

 (or be run on a mail gateway that sits in front of the IMail/Declude server).

Thats what TarProxy sort of does.  TarProxy accepts the inbound SMTP connections and 
relays them to a backend SMTP host (imail's smtpd).  What I'm saying would be great, 
is if TarProxy could call Declude-like tests during the SMTP session... before Imail 
gets its hands on the email.

If Declude could be called as an external test by a 3rd party app, it might even be 
possible.  Declude would just have to return a return value (ie: the weight), instead 
of handing off to smtp32.exe after its done.

Bill



-Original Message-
From: Bill Landry
Sent: Mon, 16 Jun 2003 06:22:04 -0700
Subject: Re: [Declude.JunkMail] DSN:Tarpitting and declude firewall integration 
integration integration integration


Tarpitting can't be integrated with Declude because Declude does not answer
the client SMTP connection, IMail does (SMTPD).  Only after IMail has
received the message does it get delivered to Declude.  So, any tarpitting
would have to be integrated with IMail, not Declude (or be run on a mail
gateway that sits in front of the IMail/Declude server).

Bill
- Original Message - 
From: Bill B. [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Monday, June 16, 2003 6:02 AM
Subject: Re: [Declude.JunkMail] DSN:Tarpitting and declude firewall
integration integration integration integration


Cool.  We've been playing around with a few methods of tarpitting.  Check
out TarProxy by Marty Lamb (http://www.martiansoftware.com/tarproxy/)...
this tool seems to have alot of promise.  It allows you to hook into each
stage of the SMTP session and apply incremental delays or drop the
connection based on external tests.

Wouldn't it be great if we could integrate Declude with a tool like this!

Bill



-Original Message-
From: Rifat Levis
Sent: Mon, 16 Jun 2003 15:51:52 +0300
Subject: Re: [Declude.JunkMail] DSN:Tarpitting and declude firewall
integration integration


Hi Bill ,

I wrote a small VB program .
--
Here is more details about the system.

I am using the KIWI syslog server software to send the logs to the SQL
You can specify in IMAIL  syslogs server ip address .(IF you run KIWI on the
same machine ,you have to stop IMAIL syslog )

I have wrote a small Visual Basic Program which scan the SQL database for 
ERR  INVALID USER  lines every 2 min.

And my little program Open a telnet connection to the firewall ADD the ip
address to block .
Then the program remove the ip address after 1 hour.

On my firewall i wrote a global policie group to deny access to port 25
So the software add the ip address and specify that it belong to that group
lls.

I decided also to integrate DECLUDE JUNKMAIL with my firewall.
For weight over 20 i will block for 1 hour
For weight over 30 will block for 2 hour
And so on.

Rifat





- Original Message - 
From: Bill B. [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Monday, June 16, 2003 3:11 PM
Subject: Re: [Declude.JunkMail] DSN:Tarpitting and declude firewall
integration integration


Rifat,

What software are you using to do the tarpitting?  Are you running it on the
same server as IMail, or on a separate box?

Bill


-Original Message-
From: Rifat Levis
Sent: Mon, 16 Jun 2003 02:01:45 +0300
Subject: [Declude.JunkMail] DSN:Tarpitting and declude firewall integration



People intersted in tarpitting and Declude firewall integration can read
this.



I just finished the tarpitting protection for my IMAIL server
I am sending logs to the kiwi syslog server and forwarding it to SQL to
analyse data

When in a 2 min period a single ip send mail to more than 5 unknown account
I am blocking the ip address on my netscreen firewall for 1 hour.


The next step of this is to integrate Declude to the firewall

I have 3 weight
weight 10 warn
weight 15 warn
weight 20 delete

Instead of deleting weight 20 i will forward it to an account to send data
to SQL analyse it and then block it for 1 hour .

NOTE : I am sure that KAMI will be interested :)

Best Regards
Rifat Levis

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail

Re: [Declude.JunkMail] DSN:Tarpitting and declude firewall integration integration integration integration integration integration integration integration

2003-06-16 Thread Smart Business Lists
Bill,

Monday, June 16, 2003 you wrote:
BB Thats what TarProxy sort of does.  TarProxy accepts the
BB inbound SMTP connections and relays them to a backend SMTP
BB host (imail's smtpd).  What I'm saying would be great, is if
BB TarProxy could call Declude-like tests during the SMTP
BB session... before Imail gets its hands on the email.

Well why not just go with IMGATE and Postfix - already does all
that and much, much more.



Terry Fritts


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] DSN:Tarpitting and declude firewall integration integration

2003-06-16 Thread Rifat Levis
 i am trying to explain what i did in a simple way.

n fact
On my firewall i am not really blocking but reducing the bandwith for the
specified ip address
to 33.6 Kb /sec like a dial-up connection speed .
So my Server spend more cpu time to real user than spammers.

This is a tarpitting.

I have also made some more complex setup ,but it is useless to say it here.

In the future i will also reduce the bandwith for those who have weights
over 10 and 15.

I think that IDS (intrusion detection systems) type approach is a good start
to protect the server.

Declude is the key to decide what to do with the firewall

Rifat



- Original Message - 
From: Jason Newland [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Monday, June 16, 2003 4:04 PM
Subject: Re: [Declude.JunkMail] DSN:Tarpitting and declude firewall
integration integration


Sorry to burst your bubble, but that's not a tarpit.


You have a dynamic IP blocker.  Tarpitting doesn't block, it slows the
attack down, consuming more of their resources, and making their connection
seem like it is stuck in a pit of tar (hence the name)


Jason

- Original Message -
From: Rifat Levis [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Monday, June 16, 2003 7:51 AM
Subject: Re: [Declude.JunkMail] DSN:Tarpitting and declude firewall
integration integration


 Hi Bill ,

 I wrote a small VB program .
 --
 Here is more details about the system.

 I am using the KIWI syslog server software to send the logs to the SQL
 You can specify in IMAIL  syslogs server ip address .(IF you run KIWI on
the
 same machine ,you have to stop IMAIL syslog )

 I have wrote a small Visual Basic Program which scan the SQL database for

 ERR  INVALID USER  lines every 2 min.

 And my little program Open a telnet connection to the firewall ADD the ip
 address to block .
 Then the program remove the ip address after 1 hour.

 On my firewall i wrote a global policie group to deny access to port 25
 So the software add the ip address and specify that it belong to that
group
 lls.

 I decided also to integrate DECLUDE JUNKMAIL with my firewall.
 For weight over 20 i will block for 1 hour
 For weight over 30 will block for 2 hour
 And so on.

 Rifat





 - Original Message -
 From: Bill B. [EMAIL PROTECTED]
 To: [EMAIL PROTECTED]
 Sent: Monday, June 16, 2003 3:11 PM
 Subject: Re: [Declude.JunkMail] DSN:Tarpitting and declude firewall
 integration integration


 Rifat,

 What software are you using to do the tarpitting?  Are you running it on
the
 same server as IMail, or on a separate box?

 Bill


 -Original Message-
 From: Rifat Levis
 Sent: Mon, 16 Jun 2003 02:01:45 +0300
 Subject: [Declude.JunkMail] DSN:Tarpitting and declude firewall
integration



 People intersted in tarpitting and Declude firewall integration can read
 this.



 I just finished the tarpitting protection for my IMAIL server
 I am sending logs to the kiwi syslog server and forwarding it to SQL to
 analyse data

 When in a 2 min period a single ip send mail to more than 5 unknown
account
 I am blocking the ip address on my netscreen firewall for 1 hour.


 The next step of this is to integrate Declude to the firewall

 I have 3 weight
 weight 10 warn
 weight 15 warn
 weight 20 delete

 Instead of deleting weight 20 i will forward it to an account to send data
 to SQL analyse it and then block it for 1 hour .

 NOTE : I am sure that KAMI will be interested :)

 Best Regards
 Rifat Levis

 ---
 [This E-mail was scanned for viruses by Declude Virus
 (http://www.declude.com)]

 ---
 This E-mail came from the Declude.JunkMail mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.JunkMail.  The archives can be found
 at http://www.mail-archive.com.



 ---
 [This E-mail was scanned for viruses by Declude Virus
 (http://www.declude.com)]

 ---
 This E-mail came from the Declude.JunkMail mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.JunkMail.  The archives can be found
 at http://www.mail-archive.com.

 ---
 [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

 ---
 This E-mail came from the Declude.JunkMail mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.JunkMail.  The archives can be found
 at http://www.mail-archive.com.


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can

Re: [Declude.JunkMail] DSN:Tarpitting and declude firewall integration integration

2003-06-16 Thread Rifat Levis
Markus ,

I started already doing this ,but the problem here is that when you have a
dynamic IP list
You can not change it on IMAIL on the fly
You have to stop and restart The smtp services
Thats Why i am using a firewall here.

Rifat



- Original Message - 
From: Markus Gufler [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Monday, June 16, 2003 4:37 PM
Subject: RE: [Declude.JunkMail] DSN:Tarpitting and declude firewall
integration integration


At the moment we've running hourly a scheduled vb-script that filters
out any error lines of the imail logfile and send it via email to the
postmaster

For example:
==
FROM TO
[EMAIL PROTECTED] [EMAIL PROTECTED]
[EMAIL PROTECTED] [EMAIL PROTECTED]
[EMAIL PROTECTED] [EMAIL PROTECTED]
[EMAIL PROTECTED] [EMAIL PROTECTED]
==

So we can see which of our customers has forgot to activate the
SMTP-Authentication (if outgoing), or which delivery attempts failed (if
incomming).


But back to the idea of blocking incomming smtp-connections of known
spammer-IP's:

Wouldn't it be great if someone writes a small tool with the following
function:
1.) gathers all Sender-IP's from the declude logfile with a certain
weight. (for example 200% of the hold value)
2.) maintains a list of this IP-Adresses and removes them after a
certain time that no new spam with the same IP was catched
3.) creates a IP-blocklist for Imail so that it can block any furter
smtp-connection attempt from this spamming IP's

Markus




 -Original Message-
 From: [EMAIL PROTECTED]
 [mailto:[EMAIL PROTECTED] On Behalf Of Rifat Levis
 Sent: Monday, June 16, 2003 2:52 PM
 To: [EMAIL PROTECTED]
 Subject: Re: [Declude.JunkMail] DSN:Tarpitting and declude
 firewall integration integration


 Hi Bill ,

 I wrote a small VB program .
 --
 Here is more details about the system.

 I am using the KIWI syslog server software to send the logs
 to the SQL You can specify in IMAIL  syslogs server ip
 address .(IF you run KIWI on the same machine ,you have to
 stop IMAIL syslog )

 I have wrote a small Visual Basic Program which scan the SQL
 database for  ERR  INVALID USER  lines every 2 min.

 And my little program Open a telnet connection to the
 firewall ADD the ip address to block . Then the program
 remove the ip address after 1 hour.

 On my firewall i wrote a global policie group to deny access
 to port 25 So the software add the ip address and specify
 that it belong to that group lls.

 I decided also to integrate DECLUDE JUNKMAIL with my
 firewall. For weight over 20 i will block for 1 hour For
 weight over 30 will block for 2 hour And so on.

 Rifat





 - Original Message - 
 From: Bill B. [EMAIL PROTECTED]
 To: [EMAIL PROTECTED]
 Sent: Monday, June 16, 2003 3:11 PM
 Subject: Re: [Declude.JunkMail] DSN:Tarpitting and declude
 firewall integration integration


 Rifat,

 What software are you using to do the tarpitting?  Are you
 running it on the same server as IMail, or on a separate box?

 Bill


 -Original Message-
 From: Rifat Levis
 Sent: Mon, 16 Jun 2003 02:01:45 +0300
 Subject: [Declude.JunkMail] DSN:Tarpitting and declude
 firewall integration



 People intersted in tarpitting and Declude firewall
 integration can read this.



 I just finished the tarpitting protection for my IMAIL server
 I am sending logs to the kiwi syslog server and forwarding it
 to SQL to analyse data

 When in a 2 min period a single ip send mail to more than 5
 unknown account I am blocking the ip address on my netscreen
 firewall for 1 hour.


 The next step of this is to integrate Declude to the firewall

 I have 3 weight
 weight 10 warn
 weight 15 warn
 weight 20 delete

 Instead of deleting weight 20 i will forward it to an account
 to send data to SQL analyse it and then block it for 1 hour .

 NOTE : I am sure that KAMI will be interested :)

 Best Regards
 Rifat Levis

 ---
 [This E-mail was scanned for viruses by Declude Virus
 (http://www.declude.com)]

 ---
 This E-mail came from the
 Declude.JunkMail mailing list.  To unsubscribe, just send an
 E-mail to [EMAIL PROTECTED], and type unsubscribe
 Declude.JunkMail.  The archives can be found at
 http://www.mail-archive.com.



 ---
 [This E-mail was scanned
 for viruses by Declude Virus (http://www.declude.com)]

 ---
 This E-mail came from the Declude.JunkMail mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.JunkMail.  The archives can be
 found at http://www.mail-archive.com.

 ---
 [This E-mail was scanned for viruses by Declude Virus
 (http://www.declude.com)]

 ---
 This E-mail came from the
 Declude.JunkMail mailing list.  To unsubscribe, just send an
 E-mail to [EMAIL PROTECTED], and type unsubscribe
 Declude.JunkMail.  The archives can be found at
 http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com

Re: [Declude.JunkMail] DSN:Tarpitting and declude firewall integration integration integration integration integration integration integration integrationintegration integration integration integration integration integrationintegration integration

2003-06-16 Thread Bill B.
This approach is a bit different than IMGate because it creates a dynamic tarpit, 
based on the spamminess of the email.  The more tests it fails, the slower the 
connection gets...IN REAL TIME!  Thats that cool part.  From what I understand, IMGate 
can only drop the connection...it cannot slow the connection down.

With TarProxy, spam tests can be run at each stage of the SMTP session, before the 
next stage begins.  For example...

EVENT: Remote Host Connects - dnsbl tests are executed and incremental delays are 
applied or connection is dropped.

EVENT: Remote Host sends EHLO - HELO-based tests are executed and incremental delays 
are applied or connection is dropped.

EVENT: Remote Host sends MAIL FROM - Domain-based tests are executed and incremental 
delays are applied or connection is dropped.

EVENT: Remote Host sends RCPT TO - Recipient-based tests are executed and incremental 
delays are applied or connection is dropped.

EVENT: Remote Host sends DATA - Content filtering is executed and incremental delays 
are applied or connection is dropped.



-Original Message-
From: Smart Business Lists
Sent: Mon, 16 Jun 2003 08:42:56 -0500
Subject: Re: [Declude.JunkMail] DSN:Tarpitting and declude firewall integration 
integration integration integration integration integration integration integration


Bill,

Monday, June 16, 2003 you wrote:
BB Thats what TarProxy sort of does.  TarProxy accepts the
BB inbound SMTP connections and relays them to a backend SMTP
BB host (imail's smtpd).  What I'm saying would be great, is if
BB TarProxy could call Declude-like tests during the SMTP
BB session... before Imail gets its hands on the email.

Well why not just go with IMGATE and Postfix - already does all
that and much, much more.



Terry Fritts


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] DSN:Tarpitting and declude firewall integration integration integration integration integration integration integration integration integration integration integration integration integration integration integration integration

2003-06-16 Thread Smart Business Lists
Bill,

Monday, June 16, 2003 you wrote:
BB The more tests it fails, the
BB slower the connection gets...IN REAL TIME!  

I see now, thanks for the reply.

XMAIL has a setting like this with its CustMapsList and its
SMTP-RDNSCheck.  I've used both but I didn't find it very useful.

In CustMapsList I can list however many rbl's I want it to check and
then specify whether to drop the connection or delay it -S seconds
between SMTP commands.

Then with SMTP-RDNSCheck I can either drop or set a delay of -S
seconds between commands.

I used the delay when I first established XMAIL but finally decided it
was pointless to make the server work so hard. So now I only put in
CustMapsList the rbl tests I intend to use to drop the connection. I
stopped using the RDNSCheck as I just found it slowed down the SMTP
dialogue too much. Besides even if the message passed I still was
going to check in the Queue for other spam tests and it seems a lot of
spammers actually have RDNS.

Terry Fritts


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] DSN:Tarpitting and declude firewall integration integration

2003-06-16 Thread Markus Gufler
 I started already doing this ,but the problem here is that 
 when you have a dynamic IP list You can not change it on 
 IMAIL on the fly You have to stop and restart The smtp 
 services Thats Why i am using a firewall here.


:-|
Hmmm, I understand.
Far from be realtime-friendly...

Markus




---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] DSN:Tarpitting and declude firewall integration integration

2003-06-16 Thread Markus Gufler
 ... While i am preparing delude weights and 
 firewall blocking , i can have a look for information about 
 your device also .

Looks like there is a command line interface. I will ask the support and
you will hear from me.


 I am really sorry for my BAD English ,
 This is my 3rd language ,

Welcome in the club!  :-)
My mothers language is german, and I live in Italy.

Markus


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.