Having spent an interesting evening chatting with Dave from MailChannels, I’ve now spent well over a week traffic shaping SMTP for some 200k connections and it’s time for a few observations:
I’ve a hunch that most of these issues come down to bulkers postmasters setting short timeouts and increasing parallelism to get the greatest bang-for-the-buck-come-instant-gratification from their listservs in the zero hour. Postfix and qmail come with excellent defaults that cope with sods like me greylisitng or traffic shaping spammers connections – don’t fuck with them eh? This is after all my personal mailhost, it runs a few small spamtraps and a bunch of mailboxes but not scientific empirical datasets. My mailbox has been hard to manage this week and I’m not aware of anything out of the ordinary happening. My public self seeding site is getting more english junk: This week then the same week last month. Pure observation but interesting none the less. If I had to sum it up: At the moment, I’m sorry to say it’s not as effective as the decent greylisting implementation I was running, it appears to be FP’ing more but nevertheless it has far fewer drawbacks in normal use since the delays appear more usual than the arbitrary 3rd party retry timeouts greylisting causes. It could be excellent. (Edit: added the dot. Is anyone else trying it? ) The Granddaddy of rejections was very interesting though natwest.co(m|.uk) WTF is going on with all that phish?  Comments: 2 Comments
|
I love the idea of abusing the fact that spammers are in a hurry. Traffic Control checks all the geeky check-boxes of a SMTP proxy I should take a closer look at. Exhibit #1 – License snippet : 17.Feedback. The Software may periodically submit statistics about its Exhibit #2 – Stream capture : feedback.mailchannels.com port 25 gets sent a log line per email as a http post. rd.42946-feedback.mailchannels.com.00025: POST /et/capture HTTP/1.1 CR’s added for readability I completely understand why they want the spy-in-the-box (having worked with Justin I know the possibilities are endless) but that license is a bit too lax for me. It’s just a niggle but I’d feel more comfortable if it was defined explicitly, and explained in full and have the option to disable it on privacy grounds. You need to disable SPF in your mailserver too, since the postfix sees the proxy ip, spf hard fails result in a reject … I should have thought of that Just in case Ken reads this..
Being a typical old school QA guy I’ve a heap of suggestions, but for the time being this image of my mailbox shows the performance in the first hour or two with the default config. E&OE plus the fact I’m in a rotten mood, I’m blaming the prescription(s) Comments: 3 Comments
|
I looked at the MailChannels “free beer” edition yesterday and decided that 10k/day is not enough for my personal mailhost.
...and yesterday wasn’t a busy day either. IMHO it’d have much better adoption if it had been free for non-commercial use like MT Etc. since it has wide appeal to the hobbyist lower middle class sysadmin type. Tried it at home and bought it for work isn’t a bad sales model after all for geeks. I wonder if they cope with PayPals’ silly/borked SPF records? Comments: 2 Comments
|
Here is a sneak peek at the next tool in the rrd-client suite. A daemon that monitors your MTA’s logs real-time and feeds stats into rrd-server. Not sending all that mail through spamassassin is really helping my CPU usage too. This is really going to help when I get my colo box next week. Comments: None
|
It would appear that some 3-4 hours of spam was cluelessly sent with a fake from address aimed at me, but this time there was no grief with it unlike the last big last time. This attack was about half the size of the awesome flood a year ago.
So this gave me an excellent opportunity to test out many mail servers sending me ‘ham’ via the greylist service (set to accept after 40 seconds). So here is a small random selection: X-Greylist: delayed 1107 seconds (postfix) So a revisit time of 580-620 seconds might be worth a spamassassin point or two. One observation that also caught my eye is that yahoo are sending a lot of user-unknown messages out of the SMTP session. Yahoo are whitelisted on postgrey and hence have no greylist header added (though I wish it would with the reasoning) so I caught a lot of their blow-back for user unknown errors. Thats just wrong Y! guys! Comments: None
|
With nothing better to do on a dull/hungover Sunday morning I thought I’d investigate a rumor I’d heard in the week regarding greylisting. sudo apt-get install postgreyThen a quick edit of postfix’s main.cf. At this time I also reduced the timeout from 5 minutes to 40 seconds since all I’m interested in is if they come back at all. At the same time I deliberately turned off all rbl’s so that I’d get a big & fair dataset on the trap server. Then all I had to do is sit and watch. Now of course this let through all the spam being sent via ISP’s relays but looking for direct sending bots running on DSL’s is pretty easy because they don’t have Wanadoo/Orange or Tiscali in the headers X-Greylist: delayed 651 seconds by postgrey; <image /knob pills X-Greylist: delayed 602 seconds by postgrey; <PDF X-Greylist: delayed 602 seconds by postgrey; <Ecard X-Greylist: delayed 605 seconds by postgrey; <Image/knob pills X-Greylist: delayed 608 seconds by postgrey; <PDF X-Greylist: delayed 604 seconds by postgrey; <Stock X-Greylist: delayed 685 seconds by postgrey; <Ecard X-Greylist: delayed 603 seconds by postgrey; <StockThese were all definitely dialup/dsl pools. The interesting thing is how long they all took to come back but nevertheless it shows that at least some bots are well wise to greylisting. Comments: None
|
I was taking a look at lighthouse just now as a lightweight task tracker. Functional, attractive and tight email integration all looked good until I stumbled upon their spam problem. Gah, that almost put me off. Comments: 1 Comment
|
“You’ve been spotted using your mobile phone whilst driving and you have been traced through your car registration” Sounds like the usual prank calls but they usually involve a premium rate number, and that’s what got me wondering, could this be the start of mobile DID scams? Comments: None
|
I know it’s old but I can’t resist a reminder of the Anti-Spam anthem. Enjoy! Comments: None
|
So I’ve just read this bug (way too late I know..) and wondered why I think about these things a bit differently. Maybe it’s a good thing, maybe it’s bad but this has been killing the badsite*foo.tld spam since day 1 one for me, about 5 days now IIRC. The idea is that is spots any weirdness in a URL before the domain name terminator (or end of the string if one is not present). Adjust your score as you see fit. It will FP on IDNs and such. Feel free to drop me your masses results for it in a comment. Comments: 2 Comments
|
| previous posts » |
