Re: Email whitelist - how would you do it?

magnate :
> I've decided to bite the spam bullet and set up a whitelist on my mail
> server. So only people I have personally added to the whitelist will be
> able to send me mail, and all spam will be rejected. I have a couple of
..........................^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

No, *everything* from non-whitelisted senders will be rejected. Job
offers, requests for help, secondary accounts (yahoo, hotmail) of
whitelisted senders, etc.

> questions about this:
>
> 1. I currently use exim4 as my MTA - it looks possible to configure a
> whitelist using exim4 alone. Is there any advantage to installing and
> configuring spamassassin as well? Many people swear by spamassassin,

Not much unless your whitelisted senders send you spam, or you get
spam that forges their address as the From: address. I get lots of
spam that says it was sent by me.

> 2. Are whitelists fooled by spam which fakes its source? I mean,

Obviously. However, depending on what you use to implement
whitelisting, it could be simple or complex. For instance, mine goes
so far as to look at originating IP in Received: lines. If that
doesn't match where that whitelisted sender usually sends from,
/dev/null (Spamfile, actually).

> wondered if anyone here knew how effective they were. Is spamassassin
> less easily fooled than exim4?

?!?

Spamassassin is trainable, has many, many tests which it uses to
decide, and lets you decide what score defines good mail and what
UCE/UBE.

Exim has filters, yes? What else? I imagine Exim can be set up to
use spamassassin to do the tests. However, that's not exactly
whitelisting.

A much better place to ask these questions is comp.mail.misc.

[Followups set: comp.mail.misc]


--
Any technology distinguishable from magic is insufficiently advanced.
(*) http://www.spots.ab.ca/~keeling Linux Counter #80292
- - http://www.faqs.org/rfcs/rfc1855.html
Spammers! http://www.spots.ab.ca/~keeling/emails.html

Re: Email whitelist - how would you do it?

s. keeling wrote:
> A much better place to ask these questions is comp.mail.misc.

Thanks for the tip. I'll ask there.

CC

Re: Email whitelist - how would you do it?

s. keeling wrote:
> magnate :
> > I've decided to bite the spam bullet and set up a whitelist on my mail
> > server. So only people I have personally added to the whitelist will be
> > able to send me mail, and all spam will be rejected. I have a couple of
> .........................^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>
> No, *everything* from non-whitelisted senders will be rejected. Job
> offers, requests for help, secondary accounts (yahoo, hotmail) of
> whitelisted senders, etc.

That's right. I'm willing to put all the secondary accounts of my
personal contacts onto the whitelist (only a tiny fraction are geeky
enough to use more than one account). I'm willing to forego job offers
and other unsolicited non-spam. Those people can contact me via my web
site, or various kinds of instant messaging. If it's not spam, they'll
read a politely worded rejection which points them to these alternative
ways of contacting me.

> > questions about this:
> >
> > 1. I currently use exim4 as my MTA - it looks possible to configure a
> > whitelist using exim4 alone. Is there any advantage to installing and
> > configuring spamassassin as well? Many people swear by spamassassin,
>
> Not much unless your whitelisted senders send you spam, or you get
> spam that forges their address as the From: address. I get lots of
> spam that says it was sent by me.

That's what I was worried about.

> > 2. Are whitelists fooled by spam which fakes its source? I mean,
>
> Obviously. However, depending on what you use to implement
> whitelisting, it could be simple or complex. For instance, mine goes
> so far as to look at originating IP in Received: lines. If that
> doesn't match where that whitelisted sender usually sends from,
> /dev/null (Spamfile, actually).

Right. So it is surely possible to check the originating IP against the
DNS record of the claimed hostname, yes? That should get around simple
hostname faking, leaving only the trickier IP faking.

> > wondered if anyone here knew how effective they were. Is spamassassin
> > less easily fooled than exim4?
>
> ?!?
>
> Spamassassin is trainable, has many, many tests which it uses to
> decide, and lets you decide what score defines good mail and what
> UCE/UBE.

I'm not convinced that any machine can accurately judge the content of
mail. I want something which will simply judge the sender, and veto or
allow accordingly.

> Exim has filters, yes? What else? I imagine Exim can be set up to
> use spamassassin to do the tests. However, that's not exactly
> whitelisting.

Indeed not. So if I'm going to use a whitelist, I definitely don't need
spamassassin - thanks for helping me clear that up in my head. The
question remains, am I going to use a whitelist or not. I might try it
for a while and see how it goes.

Still very interested to hear from anyone else here who runs one.

CC

Re: Email whitelist - how would you do it?

On comp.mail.misc, in , "s. keeling" wrote:
> Path: text.usenetserver.com!atl-c01.usenetserver.com!news.usenetse rver.com!atl-c03.usenetserver.com!news.usenetserver.com!bigf eed3.bellsouth.net!news.bellsouth.net!newsfeed2.telusplanet. net!newsfeed.telus.net!edtnps90.POSTED!53ab2750!not-for-mail
> Newsgroups: comp.os.linux.setup,comp.mail.misc
> From: "s. keeling"
> Subject: Re: Email whitelist - how would you do it?
> References: <1152198448.060037.97470@m38g2000cwc.googlegroups.com>
> Reply-To: keeling@spots.ab.ca
> Followup-To: comp.mail.misc
> X-UCE: I forward UCE/spam with ALL headers to abuse@your.isp UNREAD!

If you can find the spammer's ISP, which you usually can't.

DUH

> X-UCE2: Wow, are spammers ever stoopid!

Really? They get spam in your mail boxes all the time.

And are never punished for it.

> X-PGP-Key: GPG key: http://keyserver.noreply.org:11371/pks/lookup?op=vindex&sear ch=0x48EE77B1AC94E4B7

Those are worthless unless they are _very_ carefully
investigated.

All of the worst spammers and crackers and cyberstalkers have
one or more psuedo-identities with PGP/GPG sigs/keys. Some run
their own keyservers to make it easy...

> Message-ID:
> User-Agent: slrn/0.9.8.1 (Debian)
> Lines: 51
> Date: Thu, 06 Jul 2006 15:28:42 GMT
> NNTP-Posting-Host: 209.115.174.241
> X-Trace: edtnps90 1152199722 209.115.174.241 (Thu, 06 Jul 2006 09:28:42 MDT)
> NNTP-Posting-Date: Thu, 06 Jul 2006 09:28:42 MDT
> Xref: usenetserver.com comp.os.linux.setup:407409 comp.mail.misc:159821
> X-Received-Date: Thu, 06 Jul 2006 11:28:42 EDT (text.usenetserver.com)