Topic: smtpd_check_rules question

[Tom Carroll]

I have read over Darrell May's how-to for restricting certain sites from my mail server, but it is not working for me.

I created the 10denylist template as shown in the how-to, but it is still allowing the site to send mail to my system.

I would rather not create a bounce message, I just want to stop the server from ever getting a response other than something to the effect of "buzz off spammer!" without anything else - shuts them down at the door.

Here is what I have for my 10denylist template fragment:

# Block access to the SMTP server from:
deny:lotsofmoney4me.com:ALL:ALL
deny:networkpromotion.com:ALL:ALL
deny:xmm.networkpromotion.com:ALL:ALL
deny:xmmtracking.networkpromotion.com:ALL:ALL
deny:64.5.230.0:ALL:ALL

However, this is inserted at the top of the expanded template which is then overridden later on down the template by allowing the spammer to send to anyone at my domain.  According to my logs I can see that mail is allowed by line 38 of smtpd_check_rules from this spammer (line 38 is near the bottom where it allows all mail to *@myserver.com), which then creates a circular bounce message because qmail is trying to respond to a non-existant mail server with the bounce message.

I looked at and installed Darrell's contrib RPM so qmail will not allow spammers to e-mail non-existant accounts if I choose to do that, but I would much rather shut them down at the door instead of providing a bounce telling the spammer that user does not exist and then get a circular problem again when the qmail responses bounces back to me via the admin account.

I have two motives here:  1) Be as rude as possible to spammers and their own mail servers (or their victum mail servers), and 2) To prevent spammers from mining my system to find valid accounts to spam.

Do I need to change the number of the template file to something like 99zdenylist to ensure it goes at the bottom of the template?

Thanks for your help,

Tom Carroll
Dataware Computers

[Karl Ponsonby]

Tom,
I had the same issues, in that it would still allow mail through
I changed the template to read " noto " instead of deny, at it seems
to work at this stage.
Hope this helps,
Karl

[Tom Carroll]

Karl Ponsonby wrote:
>
> Tom,
> I had the same issues, in that it would still allow mail
> through
> I changed the template to read " noto " instead of deny, at
> it seems
> to work at this stage.
> Hope this helps,

Thanks Karl.  I will give that a try.  It looks like another one made it through, or caused the circular problem as mentioned before even after installing Darrell's contrib RPM.  I will keep an eye on it.

Tom

[stephen noble]

if you use multidrop smtpd_check_rules don't work very well
as all mail comes from 127.0.0.1 , most mail is allowed

i've found my dungog-pkg-multidrop works for blocking mail to users,
as well as by subject or sender. mail is deleted from the pop server before it hits your server.

ref. http://www.dungog.net/sme/howto/pop.html

or if you want to do it the hard way
http://sourceforge.net/projects/mailfilter/

regards
stephen noble


[root@sme5 /root]# tail -f /var/log/mailfilter

mailfilter: Deleted spotlight-reply@50megs.com: Introducing 50megs Premium Member Area!, Thu, 28 Feb 2002 05:14:20 -0700
. [Applied filter: '^From:.*@50megs.com']

mailfilter: Deleted stephen noble : 2 has fruit , Thu, 14 Mar 2002 12:09:00 -0000. [Applied filter:'^Subject:.*fruit']

mailfilter: Deleted =?iso-8859-1?q?stephen=20noble?= : 3, Thu, 14 Mar 2002 12:10:40 +0000 (GMT).
 [Applied filter: '^To:.*daniel@mydungog.net']

[Tom Carroll]

stephen noble wrote:
> if you use multidrop smtpd_check_rules don't work very well
> as all mail comes from 127.0.0.1 , most mail is allowed
>
> i've found my dungog-pkg-multidrop works for blocking mail to
> users,
> as well as by subject or sender. mail is deleted from the pop
> server before it hits your server.
>
> ref. http://www.dungog.net/sme/howto/pop.html
>
> or if you want to do it the hard way
> http://sourceforge.net/projects/mailfilter/

I do not use multi-drop.  The setting is set to standard.


Tom Carroll
Dataware Computers