Ebroch at 17:08, 30 March 2024

2024-03-30T17:08:39Z

← Older revision		Revision as of 11:08, 30 March 2024
Line 1:		Line 1:
			[[User_Tips_%26_Tricks#Anti_Spam\|Back]]<br>
	'''How to prevent spam from a spoofed local account.'''		'''How to prevent spam from a spoofed local account.'''

Ebroch: Created page with "'''How to prevent spam from a spoofed local account.''' Example SMTP Log: 08-27 05:54:35 CHKUSER accepted sender: from remote <[113.22.203.172]:unknown:113.22.203.172> rcpt <> : sender accepted 08-27 05:54:35 CHKUSER accepted rcpt: from remote <[113.22.203.172]:unknown:113.22.203.172> rcpt : found existing recipient 08-27 05:54:35 policy_check: local valid.email@account.no -> local valid...."

2024-03-16T16:41:52Z

Created page with "'''How to prevent spam from a spoofed local account.''' Example SMTP Log: 08-27 05:54:35 CHKUSER accepted sender: from <valid.email@account.no::> remote <[113.22.203.172]:unknown:113.22.203.172> rcpt <> : sender accepted 08-27 05:54:35 CHKUSER accepted rcpt: from <valid.email@account.no::> remote <[113.22.203.172]:unknown:113.22.203.172> rcpt <valid.email@account.no> : found existing recipient 08-27 05:54:35 policy_check: local valid.email@account.no -> local valid...."

New page

'''How to prevent spam from a spoofed local account.'''

Example SMTP Log:

08-27 05:54:35 CHKUSER accepted sender: from <valid.email@account.no::> remote <[113.22.203.172]:unknown:113.22.203.172> rcpt <> : sender accepted
08-27 05:54:35 CHKUSER accepted rcpt: from <valid.email@account.no::> remote <[113.22.203.172]:unknown:113.22.203.172> rcpt <valid.email@account.no> : found existing recipient
08-27 05:54:35 policy_check: local valid.email@account.no -> local valid.email@account.no (UNAUTHENTICATED SENDER)
08-27 05:54:35 policy_check: policy allows transmission
08-27 05:54:35 spamdyke[28493]: ALLOWED from: valid.email@account.no to: valid.email@account.no origin_ip: 113.22.203.172 origin_rdns: (unknown) auth: (unknown) encryption: (none)
08-27 05:54:39 simscan:[28494]:CLEAN (7.90/12.00):3.1911s:***SPAM*** Hi recipient, be our guest. 70% off for you.. on is the:113.22.203.172:valid.email@account.no:valid.email@account.no

* Use spamdyke, and blacklist your local domain(s). This is counter intuitive, but works great. In the <pre>/etc/spamdyke/blacklist_senders</pre> file, add: <pre>@mydomain.com</pre>

* All of your domains' submissions must be authenticated for this to work. If you have some web apps (for instance) that submit w/out authenticating (you have them approved for relay in tcp.smtp) then you can't use this method. My suggestion in this case is to modify the web app to authenticate.

* Webmail should be configured to authenticate, in which case you don't need the 127.: line in tcp.smtp. This is a trivial change in <pre>/etc/squirrelmail/local_config.php:
:$smtpServerAddress = 'localhost';
:$smtpPort = 587;
:$smtp_auth_mech = 'login';</pre>

(reference [http://www.mail-archive.com/qmailtoaster-list@qmailtoaster.com/msg29093.html email list archive])

Prevent Spam from valid sender/recipient - Revision history

Ebroch at 17:08, 30 March 2024