Larry Ozeran wrote:
> Hi,
>
> I have used a web host based in North Carolina for many years. I recently
> upgraded from a shared server to a dedicated server and I was hoping to be
> able to install some SPAM fighting tools. The SPAM software they provide is
> limited to white listing and black listing and I am now receiving huge
> volumes of it. I am a part time programmer, not familiar with networks or
> email servers, but I am tired of huge volumes of SPAM. I reviewed various
> sites and felt that installing postgrey might give me substantial SPAM
> reduction with minimal challenges. When I asked my host about installing it,
> I was told:
> "After further investigation I was able to verify that the request was denied.
> It was specified that this software would be unsafe to run on the server
> environments run within our network.
> This is per our Systems Administrators."
>
> After going around with them twice, I don't have what I feel is an adequate
> answer. Any thoughts on why someone might think that postgrey is "unsafe"?
> Better yet, any strategies for countering this thinking?
>
> = = system info - yes the versions are old, but that's not my host's excuse
> for the denial and they can be updated now that I am on a dedicated server
> Operating System: Redhat Linux Kernel Version: 2.4.26
> Apache/PHP Version: Apache/1.3.34 (Unix) filter/1.0 PHP/4.4.4
> Perl Version: v5.6.0
> MySQL Version: 3.23.33
> Send Mail Version: 8.12.10
>
> Thanks for any suggestions or clarifications.
I did a could of quick searches and found a couple of things.
There was a security DoS (Denial of Service) issue in the 2006
time frame using Postgray 1.21. On Debian systems there was a
patch which fixed the problem (I did not see any patch for
Red Hat).
The current version of Postgrey is 1.31 with a timestamp of
9/2007.
With the above it would be a good chance the DoS issue has
been solved.
Now lets quickly take a look at how Postgrey works. If the
message the SMTP server receive is the first connection of
a message it is TEMPFAIL rejected (meaning it must be attempted
to send again before the message is accepted).
Now one might ask why do this? At one time some of the spammers
would only attempt to send a message once and if they received
a TEMPFAIL they would drop the message, thus reducing the
amount of SPAM a site might received from a spammer.
PLEASE NOTE: This was before the use of zombie networks. Now
they have the zombies send the message and they don't care if
the zombies have a TEMPFAIL as the message is not sitting on
the spammer machine but maybe on the zombie system but more
likely it is setting on the ISP of the witless user of the
zombie system.
So the bottom line is, using Postgrey now is just a waste of
computer resources and time. As fir it currently being a
security issue, I can't find anything to suggest this is
still true. But your ISP may be using it as an excuse to
not waste their time setting it up, or they may not be using
Postfix (which is required for Postgrey). They could be using
Sendmail, Qmail or Exim.
Is there better solutions? I know a lot of people are using
mimedefang + SpamAssassin + ClamAV to reduce the amount of
SPAM and viruses. Can you stop all SPAM using these methods?
NO. Can you reduce the SPAM yes. Are there other things which
can be done also? Yes you can use DNS blacklist such as
Spamhaus and SpamCop. Again these only help to reduce the
SPAM.
The only way to possible stop SPAM is to rewrite all of the
RFC dealing with mail and require each clients to certify who
they are so the true path can not be hidden and the spammers
could be trace. Note: This really would not fully solve the
problem but would allow the message to be traced back to the
zombie system a lot faster. But zombie networks could still be
used. It would just require a new one to be set-up which would
take time. I also make note of a news article from last year
(sorry I don't have the link any more) where a System installer
who worked out of the US setting up systems for the customers
of the company he worked for (kind of like the Geek Squad of
Best Buy) where he installed the software to turn the systems
into zombie servers.
I hope this gives you some more info.
Tony
_______________________________________________
vox-tech mailing list
[email protected]
http://lists.lugod.org/mailman/listinfo/vox-tech
