From owner-freebsd-questions@FreeBSD.ORG Mon Apr 2 23:36:26 2007 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id E666516A401 for ; Mon, 2 Apr 2007 23:36:26 +0000 (UTC) (envelope-from wblock@wonkity.com) Received: from wonkity.com (wonkity.com [67.158.26.137]) by mx1.freebsd.org (Postfix) with ESMTP id A068513C455 for ; Mon, 2 Apr 2007 23:36:26 +0000 (UTC) (envelope-from wblock@wonkity.com) Received: from wonkity.com (localhost [127.0.0.1]) by wonkity.com (8.13.8/8.13.8) with ESMTP id l32NaP2h035752; Mon, 2 Apr 2007 17:36:25 -0600 (MDT) (envelope-from wblock@wonkity.com) Received: from localhost (wblock@localhost) by wonkity.com (8.13.8/8.13.8/Submit) with ESMTP id l32NaP0k035749; Mon, 2 Apr 2007 17:36:25 -0600 (MDT) (envelope-from wblock@wonkity.com) Date: Mon, 2 Apr 2007 17:36:25 -0600 (MDT) From: Warren Block To: Angelin Lalev In-Reply-To: <0875b56eeca4d320fd9fa7b0d940fce2@uni-svishtov.bg> Message-ID: <20070402172704.K35632@wonkity.com> References: <0875b56eeca4d320fd9fa7b0d940fce2@uni-svishtov.bg> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-3.0 (wonkity.com [127.0.0.1]); Mon, 02 Apr 2007 17:36:25 -0600 (MDT) Cc: freebsd-questions@freebsd.org Subject: Re: advice on anti-spam tools X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 02 Apr 2007 23:36:27 -0000 On Tue, 3 Apr 2007, Angelin Lalev wrote: > My e-mail server is running the latest spamassassin with all of the blacklist enabled and etc. > but I still receive over 20 spam messages a day ("image" spam mostly). > The situation with other users may be worse. That's why I was thinking about some tool that > 1. store incoming email > 2. send request to the sender of the message, requiring to go to some address and enter the numbers (letters) > from image > 3. if the puzzle is solved in time (week or so) deliver the message, otherwise delete it. This is called "challenge-response". The headers of the spam are almost certainly forged and can't be trusted. So it's impossible to really tell the sender of the message. Your "challenge" will be spam sent to an innocent person whose From: address was forged in the original. A quick search of ports doesn't show any obvious challenge-response software. If you're not already using greylisting, consider that. -Warren Block * Rapid City, South Dakota USA