Linode Forum
https://forum.linode.com/

Anti-SPAM Revisited
https://forum.linode.com/viewtopic.php?f=11&t=2122		 Page 2 of 2
Author:  cherring [ Wed Mar 01, 2006 11:41 pm ]
Post subject: 
I have tried installing postgrey, but it just appears to be blocking all access to my server, is there a good howto anywhere on how to install postgrey with postfix? Or does anyone have any tips?

Cheers.
Author:  tony [ Thu Mar 02, 2006 3:57 am ]
Post subject: 
cherring wrote:
I have tried installing postgrey, but it just appears to be blocking all access to my server, is there a good howto anywhere on how to install postgrey with postfix? Or does anyone have any tips?


Well, it does work by blocking e-mails, just not blocking them forever... so maybe you just need to wait a lil bit longer before you see it working as it should. Just a thought.

Or maybe the database's corrupted, try to delete it and start over.

Or use the perl at the end of this page to write your own solution:
http://www.postfix.org/SMTPD_POLICY_README.html
Author:  cherring [ Thu Mar 02, 2006 4:57 am ]
Post subject: 
Well I'm not sure what it was doing but I am trying to get it going from scratch again. Does postgrey do any logging that I can check to see exactly how it is handling the incoming mail, I am handling it on a tcp port, do I need to open a port on my firewall?

Cheers.

EDIT:

Decided against postgrey in favour of sqlgrey and am very impressed, easy to configure and get running, only problem was it isn't part of gentoo portage, but there is a link to an ebuild on the sqlgrey website and the gentoo wiki has a great sqlgrey howto.

Highly Recommended :D

Cheers Guys.
Author:  gyver [ Sat Mar 04, 2006 7:06 am ]
Post subject: 
cherring wrote:
[...]
Decided against postgrey in favour of sqlgrey and am very impressed, easy to configure and get running, only problem was it isn't part of gentoo portage, but there is a link to an ebuild on the sqlgrey website and the gentoo wiki has a great sqlgrey howto.

Highly Recommended :D

Cheers Guys.


Thanks :-) Just do a "tcptraceroute sqlgrey.bouton.name 80" to look up where SQLgrey default whitelists are hosted :-)

Nice to read that on the forum.

gyver, SQLgrey's dev.
Author:  cherring [ Sat Mar 04, 2006 7:33 am ]
Post subject: 
gyver wrote:
Thanks :-) Just do a "tcptraceroute sqlgrey.bouton.name 80" to look up where SQLgrey default whitelists are hosted :-)

Nice to read that on the forum.

gyver, SQLgrey's dev.


Mate it's a pleasure to give something a rap when it's been so helpful. I detest spam and was receiving enough for SpamAssassin to take up a lot of resources. Sqlgrey is blocking heaps of spam so spam assassin only has to scan the stuff that passes grey lisiting, but not much does, freed up tons of resources.

I am highly Impressed and would recommend to it to anyone.

Cheers. :D
Author:  areider1 [ Sun Mar 05, 2006 12:49 pm ]
Post subject:  Re: Anti-SPAM Revisited
untitled9 wrote:
I know there are a number of old forum discussions about preferred anti-spam measures, but I thought I'd just see what the current anti-spam flavor of the month is.


My flavor of the month is DEA (Disposable Email Addresses). Never use your real email address for anything, and it will never get any spam. Front your REA with DEA's and delete them if and when they start forwarding spam to your REA.

As its creator, I'm naturally partial to www.e4ward.com. (And it's got a great host provider:)
Author:  tony [ Sun Mar 05, 2006 3:20 pm ]
Post subject:  Re: Anti-SPAM Revisited
areider1 wrote:
My flavor of the month is DEA (Disposable Email Addresses). Never use your real email address for anything, and it will never get any spam.


Just use a strange enough looking address to avoid dictionary-attacks and it works, but that "solution" just doesn't work if you want to build some sort of e-life... spend years on mailinglists, have friends contact you even though you haven't talked online for months or years... or get updates regarding software that you use and so on...

Sure, it's possible to use different e-mailaddresses at all the places, only kill the ones that start to get spam; but in the long run it's just so much easier to get a good spamfilter set up and then use the same address year after year after year without worring if the spammers are going to get it or not.
Author:  rvassar [ Wed Mar 28, 2007 9:50 am ]
Post subject:  Get rid of them early...
I find the key is to get rid of them as early in the transaction as possible. Running Postfix, I have the following:

In /etc/postfix/helo_checks:

<my domain> REJECT You are not in <my domain>

# Somebody HELO'ing with our IP address?
<My IP Address> REJECT You are not <my IP address>

# Somebody HELO'ing as "localhost?" Impossible, we're "localhost"
localhost REJECT You are not me


Judging from the logs, this catches almost a third of my spam.


Add to that a couple specific offshore ISP blocks ending in .tw and .pl, and I've tossed a large fraction before I even get to the RBL's.


I get a couple pump and dump stock spams a week. I'm still hunting for a good solution to these. The multipart ones that include the ad in text or html are relatively easy. You can block those with a body check like:

/Recommendation.*[B,b][u,U][Y,y]/ REJECT Stock Spam.
/5 Day Target price\:/ REJECT Stock Spam.

But this is an expensive filter, and not real accurate. The gibberish with the ad as a gif is tough. You need to OCR it to inspect the content, and you're already way late in the transaction. You've already received it, taken the bandwidth hit, and now you're consuming CPU/memory on it.
Author:  OverlordQ [ Sun Apr 08, 2007 6:11 am ]
Post subject: 
Postgrey works wonders.
Author:  zoot [ Tue Apr 10, 2007 8:57 am ]
Post subject: 
I use the following.

- qmail supervised under daemontools
- Clamav (clamdscan+qscanq)
- RBL: sbl-xbl.spamhaus.org
- Drop connections from hosts with no PTR record and warn with a URL
- Delay connections from hosts sending mail with bare LFs.
- DSPAM for spam filtering (very, very effective)
Author:  dogzilla [ Wed Jun 20, 2007 8:34 pm ]
Post subject: 
I'm not sure if self promotion is allowed around these 'ere parts so feel free to slap me otherwise.

I have an extremely efficient spam detection setup and i recently came to Linode as many of my customers were asking about dedicated spam setups. Well most dont do enough e-mail volume to require their own dedicated server so hence why i'm at Linode.com

It seems like SPAM is a big problem for alot of people here so I'm offering a deal for Linode users. £5/month to scan 1 domain, regardless of users or mail volume. If that sounds expensive well my smallest customer is paying me 25 times that to scan 200 mail boxes. Why? Because it works and cuts almost 100% of spam with 0 false positives!

If you want a free trial feel free to PM me and i can set you up for a couple weeks for free, all you have to do is point your MX record towards my server and give me the IP you want clean spam to go to.
Page 2 of 2 All times are UTC-04:00
Powered by phpBB® Forum Software © phpBB Group
http://www.phpbb.com/