Date: Sun, 20 Jul 2003 21:38:02 +0100 From: Matthew Seaman <m.seaman@infracaninophile.co.uk> To: "Kevin Kinsey, DaleCo, S.P." <kdk@daleco.biz> Cc: questions@freebsd.org Subject: Re: Sendmail reject non-extant hosts? RFC1123 Message-ID: <20030720203802.GA12318@happy-idiot-talk.infracaninophile.co.uk> In-Reply-To: <00c801c34eed$f262e910$0441d5cc@nitanjared> References: <00c801c34eed$f262e910$0441d5cc@nitanjared>
next in thread | previous in thread | raw e-mail | index | archive | help
--sm4nu43k4a2Rpi4c
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
On Sun, Jul 20, 2003 at 01:37:15PM -0500, Kevin Kinsey, DaleCo, S.P. wrote:
> I'm not happy that Sendmail is
> allowing connections from non-
> existent hosts (i.e., spammers...)
>=20
> I run Sendmail more or less straight
> "out of the box" on -stable. I had
> been under the impression that the
> line
>=20
> ALL : PARANOID : RFC931 20 : deny
>=20
> in /etc/hosts.allow would help reject
> some of this stuff. However, as the
> amount of spam in my inbox is
> beginning to attest, this isn't the case.
>=20
> I've been googling and searching the=20
> archives with strings similar to the
> one in the title, and haven't yet grok
> what I'm supposed to do to get this
> to work...
>=20
> So, how do I tell Sendmail that if
> a host doesn't exist, (i.e. d3kr890d.129ddk.org)
> I don't want to talk to it...
The way that sendmail(8) uses tcp wrappers is slightly different to
most daemons. Instead of outright refusing to connect (which would
lead to the other side trying again every half hour or so for the next
five days), it permits the remote side to connect and then issues a
permanent reject code during the SMTP dialogue.
Even without enabling tcp wrappers functionality, sendmail should
still reject egregiously forged addresses. You have to add
FEATURE(`accept_unresolvable_domains')dnl
to your `hostname`.mc file to allow incoming mail from domains without
either A or MX records registered in the DNS.
I find that the DNSBL feature is rather effective at rejecting spam
e-mail. Generally my mailserver gets about 20--30 spam e-mails a
day. Of those, all but 2 or 3 are rejected by the DNSBL, and the rest
are taken out by spamassassin, with perhaps 2 false negatives a week
and no false positives.
I find that the combination of these three blacklists is most effective:
FEATURE(dnsbl, `bl.spamcop.net', `"550 Mail from " $&{client_addr} " re=
jected using spamcop.net DNSBL. See http://spamcop.net/w3m?action=3Dcheckbl=
ock&ip=3D" $&{client_addr}', `')dnl
FEATURE(dnsbl, `relays.osirusoft.com', `"550 Mail from " $&{client_addr=
} " rejected using relays.osirusoft.com DNSBL. See http://relays.osirusoft.=
com/"', `')dnl
FEATURE(`dnsbl', `blackholes.easynet.nl', `"550 5.7.1 ACCESS DENIED to =
"$&{client_name}" by easynet.nl DNSBL (http://blackholes.easynet.nl/errors.=
html)"', `')dnl
Cheers,
Matthew
--=20
Dr Matthew J Seaman MA, D.Phil. 26 The Paddocks
Savill Way
PGP: http://www.infracaninophile.co.uk/pgpkey Marlow
Tel: +44 1628 476614 Bucks., SL7 1TH UK
--sm4nu43k4a2Rpi4c
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (FreeBSD)
iD8DBQE/Gv2qdtESqEQa7a0RAvhUAJ4p4Px8f4054wvym32thOwpcihUxQCgh+p1
0zpoTCaMGDgmNLLjWrzB0g4=
=Y5MC
-----END PGP SIGNATURE-----
--sm4nu43k4a2Rpi4c--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030720203802.GA12318>