From owner-freebsd-stable@FreeBSD.ORG Tue Dec 19 12:40:38 2006 Return-Path: X-Original-To: freebsd-stable@FreeBSD.ORG Delivered-To: freebsd-stable@FreeBSD.ORG Received: from mx1.FreeBSD.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 180D316A415 for ; Tue, 19 Dec 2006 12:40:38 +0000 (UTC) (envelope-from olli@lurza.secnetix.de) Received: from lurza.secnetix.de (lurza.secnetix.de [83.120.8.8]) by mx1.FreeBSD.org (Postfix) with ESMTP id 0729C43CA5 for ; Tue, 19 Dec 2006 12:39:00 +0000 (GMT) (envelope-from olli@lurza.secnetix.de) Received: from lurza.secnetix.de (wdixgp@localhost [127.0.0.1]) by lurza.secnetix.de (8.13.4/8.13.4) with ESMTP id kBJCRSsV054428; Tue, 19 Dec 2006 13:27:37 +0100 (CET) (envelope-from oliver.fromme@secnetix.de) Received: (from olli@localhost) by lurza.secnetix.de (8.13.4/8.13.1/Submit) id kBJCRRLJ054427; Tue, 19 Dec 2006 13:27:27 +0100 (CET) (envelope-from olli) Date: Tue, 19 Dec 2006 13:27:27 +0100 (CET) Message-Id: <200612191227.kBJCRRLJ054427@lurza.secnetix.de> From: Oliver Fromme To: freebsd-stable@FreeBSD.ORG, chris@vindaloo.com In-Reply-To: X-Newsgroups: list.freebsd-stable User-Agent: tin/1.8.2-20060425 ("Shillay") (UNIX) (FreeBSD/4.11-STABLE (i386)) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-2.1.2 (lurza.secnetix.de [127.0.0.1]); Tue, 19 Dec 2006 13:27:37 +0100 (CET) Cc: Subject: Re: OpenBSD's spamd. X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: freebsd-stable@FreeBSD.ORG, chris@vindaloo.com List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Dec 2006 12:40:38 -0000 Christopher Hilton wrote: > Between OpenBSD 3.7 and 3.8 spamd gained the ability to tarpit or > stutter at all connections for a configurable period of time. I > understand that stuttering for the first few seconds of the SMTP dialog > causes many spammers to go away before even generating a greylisting > tuple. What does stuttering mean? Is it similar to sendmail's "greet_pause" feature? The greet_pause feature is quite useful. It causes sendmail to wait for a configurable amount of time (5 seconds is a good value) between accepting the connection and sending its initial SMTP greeting line. If it receives _anything_ from the remote side during that time, no mail is accepted from this connection. Many spammers use botnets with very simple software that doesn't really speak SMTP, but simply opens connections to port 25 and sends fixed strings without paying attention to what the server responds. Those are catched and disabled by the "great_pause" feature. Indeed, no greylisting tuples are generated because no MAIL/RCPT is accepted from the connection. > It's something I'd like to try and see for myself and it will be > fairly easy since my primary MX is behind an OpenBSD firewall. However, > my secondary MX is a FreeBSD box with no such protection and I fear that > the spammers will just take advantage of the fact that my secondary MX > has weaker protections than my primary. In fact, it seems that spammers prefer sending to secondary MX servers because they assume that they're less protected that the primary MX servers. For that reason you should always put the same protection on both primary and secondary servers. If you use a backup MX that doesn't do greylisting, then spam will leak through it to your primary (which has to trust the secondaries). Best regards Oliver -- Oliver Fromme, secnetix GmbH & Co. KG, Marktplatz 29, 85567 Grafing Dienstleistungen mit Schwerpunkt FreeBSD: http://www.secnetix.de/bsd Any opinions expressed in this message may be personal to the author and may not necessarily reflect the opinions of secnetix in any way. "FreeBSD is Yoda, Linux is Luke Skywalker" -- Daniel C. Sobral