procmail
[Top] [All Lists]

Re: Dealing with spam/UBE (no longer a summary)

1998-02-26 01:11:52
At 07:04 PM 2/25/98 -0800, Nick Halloway wrote:

I have an accept list of addresses that get to me.  When I post on Usenet,
I use my Subject: line keyword so that email replies get to me.  

Of course, you have to MODIFY subjects when you're following up to
others...  Good idea otherwise (though I'd still use a separate mail alias
for this -- if not a REAL alias, then at least a plussed address if you
have them).

Alternatively one could just put the subject of any posting one
participates in or responds to in one's .procmailrc so it will land in
the mailbox.

Don't modify your .procmailrc all the time, instead, do something like this:

# I do this, and several other key headers in my base .procmailrc:
SUBJECT=`formail -xSubject: `

# Is it to my submission address?
# Copy subject line as-is
# You might also want to dictate that this must be FROM you as well.
:0
* ^TO(_dot_)*YourAddress\+SECRETPlussedSubmitString(_at_)yourdomain
{
        LOG="SPAM: SubjectSubmit: added $SUBJECT$TWITVER"

        :0:
        |echo $SUBJECT >> YourOKSubjectsFile
}


# Modify this to work within the framework of however you do your
# OK subjects handling:
:0
* ! $? $FORMAIL -xSubject: | $FGREP -i -f YourOKSubjectsFile
{
        LOG="SPAM: Subject doesn't appear in subjectsfile$TWITVER"

        :0:
        |gzip -9fc>>$MAILDIR/twits.gz
}


The above isn't tested (as I don't use OK subject filtering), but it is
loosely based on some similar filters I have (REJECT subject filtering),
which work fine.  All you have to do is resend the message to yourself (but
nix the body), and it'll be added for you.  You could modify the add recipe
to scan for the submission address in the received headers, and BCC the
original message to yourself, provided that your local server adds the
envelope TO address into the received headers (and that you don't
clear-copy yourself or anyone else on your own server).

Mailing lists are not a problem -- for all the mailing lists I use, 
it's possible to tell from the header which mailing list it is and 
put the mail in the right folder.

Uhm, except that you need to receive list mail BEFORE you can determine
what in the list you need to filter on.  One could assume from your other
comments then, that right after you subscribe to a list, that you'll send
at least ONE "add 123" message to the list, or to whoever posts the first
few messages you get from the list before you add it to your filters.  To
whoever gets that first automessage, you look like a net.goon.  Bummer.

You don't need to let spammers drive you off the net :(  I like this
method much better than forging one's posting address, too -- that
requires work for the person responding and prevents software from knowing
who 
is posting.  If the news server were temporarily not working and one 
posts from a fake address, you'd never hear back about it.

As far as failure messages, that is true, but I think this news failure
problem isn't common enough to worry about such failures too much.

The following only applies to those with some semblance of control over
their mail server - that is, admin privledges, not just a user or virtual
domain on someone else's server:

I've had good results with adding a bogus subdomain into my usenet posts.
Since my usenet messages tend to be for discussion ON usenet, and not OFF
usenet (aka "post and run"), I rarely get email replies to begin with.  But
I do see a fair number of messages to my (now-decomissioned) old usenet
posting address - every last one of them spam.  The occasional message
coming through to the usenet address after the bogus subdomain has been
removed (easy edit -- deleting characters in one stream, not transposition
or adding anything), have always been valid.  My server doesn't even see
the messages addressed to the bogus subdomain, since that is MX'd to
somewhere else (a spammer's server, actually).  Now, if I wanted to, I
could add some sendmail rules to take the bogus usenet subdomains and
reject mail with specific failure codes.  Actually, I've got something
similar already set up for some addresses in sendmail, using the
virtusertable feature:

        fusenet(_at_)mail(_dot_)professional(_dot_)org          ERROR: 550 SPAM 
is not accepted at
professional.org


This results in the sender getting a message as follows:

        Subject: Returned mail: User unknown
[snip]
   ----- Transcript of session follows -----
.... while talking to mail.professional.org.:
RCPT To:<fusenet(_at_)mail(_dot_)professional(_dot_)org>
<<< 553 <fusenet(_at_)mail(_dot_)professional(_dot_)org>... SPAM is not 
accepted at
professional.org
550 <fusenet(_at_)mail(_dot_)professional(_dot_)org>... User unknown

Now, I could make the ERROR returned more descriptive - such as noting to
read the instructions on the original post before resending.  This address
happens to be completely decomissioned (this predates my use of a bogus
subdomain), so it doesn't matter here.  The beauty of this is that this is
rejected at the time of message transfer, not sometime later (such as in
procmail).

Digging through the sendmail batbook would probably expose a few alternate
ways of doing this.

---
 Please DO NOT carbon me on list replies.  I'll get my copy from the list.

 Sean B. Straw / Professional Software Engineering
 Post Box 2395 / San Rafael, CA  94912-2395

<Prev in Thread] Current Thread [Next in Thread>