procmail
[Top] [All Lists]

Re: Orbs type filtering at a system level

2001-11-20 12:42:25

On Tue, Nov 20, 2001 at 12:34:12PM -0500, Matthew G. Saroff wrote:

Hi,
      My ISP has instituted an ORBS-type (actually ORBZ) 
filtering system, which dumps everything that comes from 
bad IPs.  They have Procmail installed as an MDA.
      As I deal with thousands of potential email contacts,
this means that I could miss emails are legitimately intended
for me (I typically see about a 3% false positive rate).
      Is there a way at the system level to allow individual
users to opt out?

Your ISP will have to remove the MTA-based ORBZ blocking in order for
any mail to hit your procmail recipes.

Note that having procmail do dnsbl processing will cause a MUCH heavier
load on your ISP's mail server than having the filters in the MTA, and
your ISP may not like that.

      I am assuming that one could test for the presense of a
file that a user could put in his home directory before dumping
this stuff to /dev/null, but I would not know how to implement
this on a system wide .procmailrc file?
      What would be the technique?  I'm assuming that it would
be something like this:

:0h:
! ? test -r $HOME/.deleteorbs
[a script using nslookup or a regularly updated list of IP numbers]

Check out http://www.waltdnes.org for some good recipes for reversing a
dotted quad.  With those recipes, if you just want to toss the mail, you
could probably do something like:

:0h
* ! ? test -f $HOME/.markorbz
* ! ? host ${REVERSED}.outputs.orbz.org >/dev/null 2>/dev/null
/dev/null

This would obviously require a 'host' command which would return(0) on
a successful lookup and return something else on a failure.  The 'host'
command in FreeBSD does this; YMMV.

Also check out Catherine Hampton's http://www.spambouncer.org/.

-- 
  Paul Chvostek                                             
<paul(_at_)it(_dot_)ca>
  Operations / Development / Abuse / Whatever       vox: +1 416 598-0000
  IT Canada                                            http://www.it.ca/

_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail

<Prev in Thread] Current Thread [Next in Thread>