greylisting proxies?

Hi all,

I'm currently stuck with my decision to run qmail in many
places. 

I really want to give greylisting a try since I'm seeing an
average of 
80-85% of all mail is spam and the less cpu/disk/network I
can spend 
processing this junk the better.

So far none of the qmail implementations (all 2 of them)
look very good.

Has anyone had any experience with the following smtp
proxies?

http://assp.sourceforge.
net/
http://spey.sourceforge.
net/
http://www.network-theory.co.uk/articles/smtpwrap.html

I'm not real crazy about any of those really either.  Looks
like none can 
deal with SSL+SMTP-AUTH.

I wonder how hard it would be to stick Postfix in front of
Qmail?

http://www.greylisting.org/implementations/postfix.shtml


Lots of nice solutions there...

Any ideas or opinions on all this?

Thanks,

Charles
_______________________________________________
% NYC*BUG talk mailing list
http://
lists.nycbug.org/mailman/listinfo/talk
%Be sure to check out our Jobs and NYCBUG-announce lists
%We meet the first Wednesday of the month

On Oct 1, 2006, at 12:04 AM, Charles Sprickman wrote:

> I'm currently stuck with my decision to run qmail in
many places. 
HA HA

> So far none of the qmail implementations (all 2 of
them) look very  
> good.
What have you looked at?

Have you seen this:
	
http://projects.puremagic.com/greylisting/links.html

googling it, i found about 5.

anyways....

> I'm not real crazy about any of those really either. 
Looks like  
> none can
> deal with SSL+SMTP-AUTH.
>
> I wonder how hard it would be to stick Postfix in front
of Qmail?

I'm not sure about Postfix instead of qmail... but it would
be very  
easy to stick Exim in front of qmail.  Googling this, I
actually  
found a few people talking about using Exim in front of
Postfix to  
get greylisting done.

There are about 6 greylisting implementations in Exim in
various  
stages of stability.  Some are in C, while others make use
of the  
embedded perl/python interpreter options.  Some use external
 DBs  
(well 'real' dbs like pg, which you can have several boxes
connect to  
in a cluster ) , while others use  local dbs ( bdb / dbm /
etc )

I came across Exim a few years ago by chance- I knew
postfix, Bob  
knew qmail , he said "lets both try something
new".  He was my boss,  
so we did.

I love exim.  Its a great app: small , fast, and as secure
as the  
rest.  It's the most (and easiest) configurable by far, and
has  
plenty of hooks to run c filters, pipe to scripts/daemons ,
and the  
option to embed perl/python.  It's also ridiculously well
maintained,  
and I can't remember when there was a critical security
issue or  
bug.  The main disadvantage to running exim is that it is
designed  
for immediate delivery, not queued mail -- but since you'd
be using  
it as a proxy, you should never run into that.

_______________________________________________
% NYC*BUG talk mailing list
http://
lists.nycbug.org/mailman/listinfo/talk
%Be sure to check out our Jobs and NYCBUG-announce lists
%We meet the first Wednesday of the month

On Sun 2006.10.01 at 00:04 -0400, Charles Sprickman wrote:
> Hi all,
> 
> I'm currently stuck with my decision to run qmail in
many places. 
> 
> I really want to give greylisting a try since I'm
seeing an average of 
> 80-85% of all mail is spam and the less
cpu/disk/network I can spend 
> processing this junk the better.
> 
> So far none of the qmail implementations (all 2 of
them) look very good.

[snip]

> Any ideas or opinions on all this?

you can run spamd(8) in front of any mta; either on the same
box or in
front.
_______________________________________________
% NYC*BUG talk mailing list
http://
lists.nycbug.org/mailman/listinfo/talk
%Be sure to check out our Jobs and NYCBUG-announce lists
%We meet the first Wednesday of the month

On Sun, Oct 01, 2006 at 12:48:39PM -0400, Okan Demirmen
wrote:
>On Sun 2006.10.01 at 00:04 -0400, Charles Sprickman
wrote:
>> Hi all,
>> 
>> I'm currently stuck with my decision to run qmail
in many places. 
>> 
>> I really want to give greylisting a try since I'm
seeing an average of 
>> 80-85% of all mail is spam and the less
cpu/disk/network I can spend 
>> processing this junk the better.

and greylisting purges 97% of of them, with low (0?) false
positives.

>you can run spamd(8) in front of any mta; either on the
same box or in
>front.

also known as pfspamd, so as not to confuse with
spamassassin's spamd.

// George


-- 
George Georgalis, systems architect, administrator
<IXOYE><
_______________________________________________
% NYC*BUG talk mailing list
http://
lists.nycbug.org/mailman/listinfo/talk
%Be sure to check out our Jobs and NYCBUG-announce lists
%We meet the first Wednesday of the month

On Sun, Oct 01, 2006 at 02:00:34PM -0400, George Georgalis
wrote:
> On Sun, Oct 01, 2006 at 12:48:39PM -0400, Okan Demirmen
wrote:
> >On Sun 2006.10.01 at 00:04 -0400, Charles Sprickman
wrote:
> >> Hi all,
> >> 
> >> I'm currently stuck with my decision to run
qmail in many places. 
> >> 
> >> I really want to give greylisting a try since
I'm seeing an average of 
> >> 80-85% of all mail is spam and the less
cpu/disk/network I can spend 
> >> processing this junk the better.
> 
> and greylisting purges 97% of of them, with low (0?)
false positives.

Well, no.  There are some badly configured MTAs that either
use
pools (Google) or give up after one try.

-Ray-
_______________________________________________
% NYC*BUG talk mailing list
http://
lists.nycbug.org/mailman/listinfo/talk
%Be sure to check out our Jobs and NYCBUG-announce lists
%We meet the first Wednesday of the month

On Sun, Oct 01, 2006 at 02:25:52PM -0401, Ray Lai wrote:
>On Sun, Oct 01, 2006 at 02:00:34PM -0400, George
Georgalis wrote:
>> On Sun, Oct 01, 2006 at 12:48:39PM -0400, Okan
Demirmen wrote:
>> >On Sun 2006.10.01 at 00:04 -0400, Charles
Sprickman wrote:
>> >> Hi all,
>> >> 
>> >> I'm currently stuck with my decision to
run qmail in many places. 
>> >> 
>> >> I really want to give greylisting a try
since I'm seeing an average of 
>> >> 80-85% of all mail is spam and the less
cpu/disk/network I can spend 
>> >> processing this junk the better.
>> 
>> and greylisting purges 97% of of them, with low
(0?) false positives.
>
>Well, no.  There are some badly configured MTAs that
either use
>pools (Google) or give up after one try.

It suprises me how bad google does mail.... I just accept
everything from their subnets, 'cause their headers are so
broke
I get false positives with spamassassin, never noticed a
'pool'
problem.  Don't get spam from them though...

What MTA fails on one try?

<rant> the worse mta is verizon -- hard to deliver to.
</rant>

// George


-- 
George Georgalis, systems architect, administrator
<IXOYE><
_______________________________________________
% NYC*BUG talk mailing list
http://
lists.nycbug.org/mailman/listinfo/talk
%Be sure to check out our Jobs and NYCBUG-announce lists
%We meet the first Wednesday of the month

On Oct 1, 2006, at 2:49 PM, George Georgalis wrote:
> What MTA fails on one try?
>
> <rant> the worse mta is verizon -- hard to
deliver to. </rant>

in my experience:
	verizon's ( at least occasionally )
	90% of microsoft mta installs ( actually has nothing to do
with the  
software, but braindead corporate it staff with a
certificate from  
some technical school they once saw an informercial for  )

the biggest issue with verizon in my experience is that they
don't do  
rfc 1413 right.  you can usually save yourself a ton of
hassle by  
using a dumbed down ruleset for the verizon mta ip blocks. 
they also  
do address verification on incoming mail - which isn't a bad
thing.   
some mta's don't handle that right , and some users will do
made up  
aliases or spoof their own address through a different mta (
ie:  
useremail.com sends a message through useraltemail.com  with the  
same from ), which can bump up your blacklist rating for the
server  
mail was sent through.


// Jonathan Vanasco

| - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- - - - -  
- - - - - - - - - - - - - - - -
| FindMeOn.com - The cure for Multiple Web Personality
Disorder
| Web Identity Management and 3D Social Networking
| - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- - - - -  
- - - - - - - - - - - - - - - -
| RoadSound.com - Tools For Bands, Stuff For Fans
| Collaborative Online Management And Syndication Tools
| - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- - - - -  
- - - - - - - - - - - - - - - -


_______________________________________________
% NYC*BUG talk mailing list
http://
lists.nycbug.org/mailman/listinfo/talk
%Be sure to check out our Jobs and NYCBUG-announce lists
%We meet the first Wednesday of the month

On Sun 2006.10.01 at 14:49 -0400, George Georgalis wrote:
> On Sun, Oct 01, 2006 at 02:25:52PM -0401, Ray Lai
wrote:
> >On Sun, Oct 01, 2006 at 02:00:34PM -0400, George
Georgalis wrote:
> >> On Sun, Oct 01, 2006 at 12:48:39PM -0400, Okan
Demirmen wrote:
> >> >On Sun 2006.10.01 at 00:04 -0400, Charles
Sprickman wrote:
> >> >> Hi all,
> >> >> 
> >> >> I'm currently stuck with my decision
to run qmail in many places. 
> >> >> 
> >> >> I really want to give greylisting a
try since I'm seeing an average of 
> >> >> 80-85% of all mail is spam and the
less cpu/disk/network I can spend 
> >> >> processing this junk the better.
> >> 
> >> and greylisting purges 97% of of them, with
low (0?) false positives.
> >
> >Well, no.  There are some badly configured MTAs
that either use
> >pools (Google) or give up after one try.
> 
> It suprises me how bad google does mail.... I just
accept
> everything from their subnets, 'cause their headers are
so broke
> I get false positives with spamassassin, never noticed
a 'pool'
> problem.  Don't get spam from them though...
> 
> What MTA fails on one try?

i use this as a starting point: http://grey
listing.org/whitelisting.shtml
_______________________________________________
% NYC*BUG talk mailing list
http://
lists.nycbug.org/mailman/listinfo/talk
%Be sure to check out our Jobs and NYCBUG-announce lists
%We meet the first Wednesday of the month

On Sun, 1 Oct 2006, Jonathan wrote:

> On Oct 1, 2006, at 12:04 AM, Charles Sprickman wrote:
>
>> I'm currently stuck with my decision to run qmail
in many places. 
> HA HA
>
>> So far none of the qmail implementations (all 2 of
them) look very
>> good.
> What have you looked at?
>
> Have you seen this:
> 	
http://projects.puremagic.com/greylisting/links.html
>
> googling it, i found about 5.

Oops.  I was looking at another list that claimed to be
"authoritative" 
and all it had were some nasty perl implementations.  This
one look 
promising.  It doesn't do the triplet thing, but it is
simple and his 
example shows that it works with qmail+vpopmail, which is a
requirement 
for me.  It also does not entail patching qmail:

http://oss.al
bawaba.com/cqgreylist.html

This one might be promising as well:

http://qgreyl
ist-pgsql.sourceforge.net/

I am looking at moving vpopmail to using pgsql for the
backend instead of 
mysql because mysql keeps biting me in the ass on FreeBSD.

Thanks for pointing me to the puremagic site, not sure how I
missed it. 
I'm going to start fiddling with cqgreylist on my personal
mailserver this 
week.

> anyways....
>
>> I'm not real crazy about any of those really
either.  Looks like
>> none can
>> deal with SSL+SMTP-AUTH.
>>
>> I wonder how hard it would be to stick Postfix in
front of Qmail?
>
> I'm not sure about Postfix instead of qmail... but it
would be very
> easy to stick Exim in front of qmail.  Googling this, I
actually
> found a few people talking about using Exim in front of
Postfix to
> get greylisting done.

Interesting, but my mind is too full of other junk
("jack of all trades, 
master of none").  I have trouble right now going back
and forth between 
mysql and pgsql.  

Thanks for the input, it's very much appreciated.

Charles

>
> _______________________________________________
> % NYC*BUG talk mailing list
> http://
lists.nycbug.org/mailman/listinfo/talk
> %Be sure to check out our Jobs and NYCBUG-announce
lists
> %We meet the first Wednesday of the month
>
_______________________________________________
% NYC*BUG talk mailing list
http://
lists.nycbug.org/mailman/listinfo/talk
%Be sure to check out our Jobs and NYCBUG-announce lists
%We meet the first Wednesday of the month

On Sun, 1 Oct 2006, Okan Demirmen wrote:

> [snip]
>
>> Any ideas or opinions on all this?
>
> you can run spamd(8) in front of any mta; either on the
same box or in
> front.

That was actually my first thought, but all the boxes I'm
dealing with are 
FreeBSD 4.x, so no pf+spamd is available.  I run a backup
mxer at home 
however and it's behind a pfsense box, so I may try spamd
there since it's 
available as a pfsense "package".

Thanks,

Charles

> _______________________________________________
> % NYC*BUG talk mailing list
> http://
lists.nycbug.org/mailman/listinfo/talk
> %Be sure to check out our Jobs and NYCBUG-announce
lists
> %We meet the first Wednesday of the month
>
_______________________________________________
% NYC*BUG talk mailing list
http://
lists.nycbug.org/mailman/listinfo/talk
%Be sure to check out our Jobs and NYCBUG-announce lists
%We meet the first Wednesday of the month