22 Mar
2007
22 Mar
'07
6:18 p.m.
I've got a problem, and am wondering if anyone has any advice as to what I
can do.
I run my own private mailserver on my OpenVMS 7.3-2 system. Only a few
people know how to get ahold of me, and it's basically used to communicate
with my family. Someone started sending out spam yesterday that appears to
be coming from my IP address and domain name based on the email headers, yet
I've verfied the messages aren't originating from my network.
As a result of this my VMS server has been thrashing, the B******* are using
a fake account name that is 14 characters long, so OpenVMS won't
automatically reject it, but instead bounces the bounces, then accepts the
bounce backs.
Last night I finally shut down SMTP on my VMS server, and am blocking all
incoming SMTP connections at my firewall. I've also alerted my ISP as to
the problem.
Is there anything I can do about this?
My one thought is to do an "emergency" upgrade to OpenVMS V8.3 as it will
reject email to invalid accounts that are 13+ characters in length, and then
turn SMTP back on. I've been meaning to do the upgrade, but haven't had
time yet.
Zane
23 Mar
23 Mar
4:26 a.m.
I run my own private mailserver on my OpenVMS 7.3-2
system. [...]
Someone started sending out spam yesterday that [is resulting in
bounces hammering this machine]
I don't know whether there's any way you can use it, but I wrote an
SMTP front-end that was designed for precisely this kind of situation -
to turn away invalid-local-part mail very very cheaply (and it does
that spectacularly well in my experience).
Unless your VMS machine has a C compiler setup that supports sockets
and a few other Unixisms, it won't run there, though; you'd need
something a bit more Unixy. If you have one and can use it to front
for your VMS box, I'll be happy to help you set up my shim on it.
(I've never heard of anyone else trying it, so it probably has some
local idioms I'm not aware of in it and you may well need a hand with
them.)
/~\ The ASCII der Mouse
\ / Ribbon Campaign
X Against HTML mouse at rodents.montreal.qc.ca
/ \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B
11:51 a.m.
"Zane H. Healy" wrote:
Is there anything I can do about this?
Originally I moved from sendmail to qmail with magic-smtpd because it
allowed me to filter at the SMTP level inbound names (and reject them before
a bounce was generated).
http://www.linuxmagic.com/opensource/magicmail/magic-smtpd/
I thought someone here wrote a proxy to do that also (not sure)
I've since moved to postfix with "grey listing" using postgrey, which seems
to work pretty well.
I think until you turn on grey listing you're going to be unhappy. I
seem long, relentless streams of bogus connections and bogus names all
day long... At a minimum you need to be filtering names at the SMTP
connection time. (translation - put something in front of openvms and relay)
-brad
4:50 p.m.
I used to run my own mailserver, albeit on FreeBSD. The sheer
quantity of SPAM and other junk addressed to, and from, my domains was
astounding. From was worse, as I got all the bounces, which are
technically legitimate messages. It was a constant battle. I gave up
in the end and pointed the MX over to google-apps-for-domains. The
spam-filter seems pretty good, and it's not sucking up my bandwidth.
(And at least with google you don't have to transfer the whole DNS
like some hositng providers want.)
If you are sure you want to run your own mailserver, I'd agree - put
something in front. If you haven't got a UNIX or Linux box already on
your network, you should be able to find a cheap Linux based router
you can put your choice of MTA on..
Rob
On 23/03/07, Brad Parker <brad at heeltoe.com> wrote:
"Zane H. Healy" wrote:
Is there anything I can do about this?
Originally I moved from sendmail to qmail with magic-smtpd because it
allowed me to filter at the SMTP level inbound names (and reject them before
a bounce was generated).
http://www.linuxmagic.com/opensource/magicmail/magic-smtpd/
I thought someone here wrote a proxy to do that also (not sure)
I've since moved to postfix with "grey listing" using postgrey, which
seems
to work pretty well.
I think until you turn on grey listing you're going to be unhappy. I
seem long, relentless streams of bogus connections and bogus names all
day long... At a minimum you need to be filtering names at the SMTP
connection time. (translation - put something in front of openvms and relay)
-brad
5:35 p.m.
At 6:51 AM -0400 3/23/07, Brad Parker wrote:
I think until you turn on grey listing you're going
to be unhappy. I
seem long, relentless streams of bogus connections and bogus names all
day long... At a minimum you need to be filtering names at the SMTP
connection time. (translation - put something in front of openvms and relay)
I'm now able to check and reject emails with invalid usernames 12
characters or less, AND 13 characters or more (what I was unable to
do). Of course this required an emergency upgrade last night to
OpenVMS V8.3, and staying up to 1am. I'm more than a little ticked
HP didn't consider this a bug, and didn't fix it (I already was even
prior to this).
The Good:
I now have a current tape backup of my system disk
I'm back on a smaller system disk (18Gb vs 36Gb)
I've finally gotten the upgrade to 8.3 done, and fully patched
I've cut my problems from spam down to stuff sent to the postmaster
account (I'd actually disabled this email address but re-enabled it
last night, as if I'm ever going to get valid email to it, now is
probably the time).
The Bad:
Still getting quite a bit of activity, though it doesn't seem to be a
continuous flood like last night
I have to upgrade Oracle RDB to a version that will run on VMS 8.3
Thoughts:
HP's tying TCPIP upgrades to VMS upgrades is a problem. I was
perfectly happy on 7.3-2 (which will continue to be a fully supported
version for quite some time), and this gives me even more reason to
consider ripping out HP TCPIP and installing Process Software's
Multinet stack, which will likely be coupled with PMDF and their
Anti-Spam solution.
Question:
How common is it to see problems where a spammer is apparently
spoofing both the domain name and the IP address?
Zane
--
| Zane H. Healy | UNIX Systems Administrator |
| healyzh at aracnet.com (primary) | OpenVMS Enthusiast |
| MONK::HEALYZH (DECnet) | Classic Computer Collector |
+----------------------------------+----------------------------+
| Empire of the Petal Throne and Traveller Role Playing, |
| PDP-10 Emulation and Zane's Computer Museum. |
| http://www.aracnet.com/~healyzh/ |
6623
days inactive
6624
days old
4 comments
4 participants
participants (4)
-
brad＠heeltoe.com -
healyzh＠aracnet.com -
mouse＠Rodents.Montreal.QC.CA -
robert＠irrelevant.com