HOWTO: Spam control for POSTFIX

[crypted]

drewb0y have you thought about modifying the postgrey information script in my second or third post? Instead of having it email, you could have it out to a file and parse to count recurrences.

Maybe an if/then that 5+ occurrences in a day = ipfilter rule?

[edge]

I'm using fail2ban to block spammers.
(rule: postfix-spamers550)

http://www.howtoforge.com/forums/showthread.php?t=28781

[drewb0y]

Thanks Edge, I just implemented that and within the first 5 minutes it banned 14 different IP addresses.I still plan to implement the country blocking somehow, but this should help for a while.

I did increase the fail2ban timeout to 20 minutes instead of 10 as well.

Originally Posted by edge

I'm using fail2ban to block spammers.
(rule: postfix-spamers550)

http://www.howtoforge.com/forums/showthread.php?t=28781

[drewb0y]

That has definite possibilities, but I would have no idea how to implement that. My programming skills basically extend as far as copying something already done and modifying it for my situation.

Originally Posted by crypted

drewb0y have you thought about modifying the postgrey information script in my second or third post? Instead of having it email, you could have it out to a file and parse to count recurrences.

Maybe an if/then that 5+ occurrences in a day = ipfilter rule?

[crypted]

I completely forgot about fail2ban, thanks Edge.

I'll add that to my list of things to add to a new HOWTO in the near future.

Thankfully, we have a great group of us here to throw things around to build the best (free) method for fighting spam on our ISPCONFIG-based servers.

[drewb0y]

I totally agree with you crypted. Working on solutions together is fantastic.

I implemented IPtables blocking by country now and posted a how to on it separately here.

HOWTO: Implement iptables blocking by Country

[Turbanator]

My spam has greatly dropped but I still get hit each night...(I swear my users sign up on spam lists just to piss me off) Even though we move a ton of email into the Junk folder and train SA each night, plenty of spam still gets through. It seems many are those damned image spam.

I think there is an image spam filter, (without setting up an awesome spamsnake), has anyone implemented that in our setup here (not spamsnake) on a "perfect server".

I'm curious about the extra server load and how well it works.

Also, I beleive spamassassin is updated when ispconfig is, so I haven't upgraded to the newest SA yet and waiting for the next ispc release. Is everyone using the default with ispc (3.2.5) or has anyone gone past what is installed and is running the latest SA 3.3.1?

[crypted]

Can you post the header and content of a few of those emails as CODE?

[Turbanator]

HEre is on sample that isn't an image spam, but it does represent a huge number that get through...notice the spam tag. And I'll get a bunch in a row from the same fake domain. We manually move these into junk folders and "learn" nightly but I don't think there is enough info for SA to learn anything.

If you want, PM me, and I'll forward one directly to you to see if yours filters.

+OK 2628 octets follow.
Return-Path: <MAILER-DAEMON>
Delivered-To: me@here.com
Received: from localhost (localhost [127.0.0.1])
	by ns1.heredns.com (Postfix) with ESMTP id BBAFE10B42DC
	for <me@here.com>; Tue, 15 Feb 2011 07:36:41 -0800 (PST)
X-Virus-Scanned: Debian amavisd-new at ns1.heredns.com
X-Spam-Flag: NO
X-Spam-Score: -2.499
X-Spam-Level: 
X-Spam-Status: No, score=-2.499 tagged_above=-100 required=2.88
	tests=[BAYES_00=-2.599, RDNS_NONE=0.1]
Received: from ns1.heredns.com ([127.0.0.1])
	by localhost (ns1.heredns.com [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id BwsAmpARgQ1p for <me@here.com>;
	Tue, 15 Feb 2011 07:36:41 -0800 (PST)
Received: by ns1.heredns.com (Postfix, from userid 5000)
	id 9A56110B42D8; Tue, 15 Feb 2011 07:36:41 -0800 (PST)
Delivered-To: me@here.com
Received: from localhost (localhost [127.0.0.1])
	by ns1.heredns.com (Postfix) with ESMTP id 8FB5310B42DC
	for <me@here.com>; Tue, 15 Feb 2011 07:36:41 -0800 (PST)
X-Virus-Scanned: Debian amavisd-new at ns1.heredns.com
Received: from ns1.heredns.com ([127.0.0.1])
	by localhost (ns1.heredns.com [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id 4hB6JyN8jwL9 for <me@here.com>;
	Tue, 15 Feb 2011 07:36:41 -0800 (PST)
X-Greylist: delayed 604 seconds by postgrey-1.31 at ns1.heredns.com; Tue, 15 Feb 2011 07:36:41 PST
Received: from gqep.proulseraw.com (unknown [174.36.86.118])
	by ns1.heredns.com (Postfix) with ESMTP id 2766010B42D8
	for <me@here.com>; Tue, 15 Feb 2011 07:36:41 -0800 (PST)
Message-ID: <383399536@gqep.proulseraw.com>
Date: Tue, 15 Feb 2011 09:20:59 -0600
To: <me@here.com>
From: "Karen Miller" <winn@proulseraw.com>
Mime-Version: 1.0
Subject: Earn your share of this $59 billion industry
User-Agent: Cert - OutMode/2.0 tigww/2.73b3
X-Mailer: Firefox / 3.2
Accept-Language: en - us
Content-Language: en - us
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 8bit
Content-Disposition: inline
X-EsetId: 06519D20EC8831375713

Internet Job Locator: #1 site for online jobs


For more information and to view positions click here:
http://gqep.proulseraw.com/2438b36396769379324611396256dab50136a9



Thank you for visiting the Locator















Unsubscribe: http://gqep.proulseraw.com/2438b36396769379324612396256dab50136a9
or send mail to: unsubscribe
2764 N. Green Valley Pkwy Suite 394
Henderson, NV 89014

Click this link to unsubscribe: http://gqep.proulseraw.com/396256dab50136a912438b36396769379

I'll look for an image one and post here as well.

[crypted]

It's been complete hell here, so sorry for not responding for so long but I didn't forget! Are you still having image spam problems?

I'm working on a new mixed guide to integrate several types of protection against bad robots, email harvesters, and so forth into Apache. Testing out each piece of the puzzle one by one on my end before I finish the HOWTO and distribute it.