[alan@SPRI.Levels.UniSA.Edu.Au: [postmaster@sourceware] qmail setup problem for binutils list]

[alan@SPRI.Levels.UniSA.Edu.Au: [postmaster@sourceware] qmail setup problem for binutils list]

[Chris Faylor]

Alan has been seeing this problem for a couple of weeks.  Is it possible
that his theory is correct?

cgf

----- Forwarded message from Alan Modra <alan@SPRI.Levels.UniSA.Edu.Au> -----

From: Alan Modra <alan@SPRI.Levels.UniSA.Edu.Au>
To: postmaster@sourceware.cygnus.com
cc: alan@linuxcare.com.au
Subject: [postmaster@sourceware] qmail setup problem for binutils list
Date: Fri, 28 Jul 2000 12:47:27 +0930 (CST)
Reply-To: alan@linuxcare.com.au

There appears to be a problem with the way qmail is deciding whether mail
is coming from known spammers.  My last few posts from my normal
linuxcare address have been blocked with:

> Hi. This is the qmail-send program at sourceware.cygnus.com.
> I'm afraid I wasn't able to deliver your message to the following
> addresses.
> This is a permanent error; I've given up. Sorry it didn't work out.
> 
> <binutils@sourceware.cygnus.com:
>   
>   In an effort to cut down on our spam intake we block email from
>   certain lists and unfortunately you have just discovered the hard
>   way that sometimes non-spam mail gets caught accidentally.
>   In most cases you can clear this up by an upgrade to your mail
>   server or sometimes by getting an erroneous listing removed.
>   For more information about our use of these lists, see
>         http://sources.redhat.com/lists.html#rbls
>  
>   The IP number that I'm denying mail from is 203.29.91.49
>   The list that you're on is ORBS.  See:
>       http://www.orbs.org/verify.cgi?address=203.29.91.49
>   for more information about this list and why you are on it.

Looking at the above http address says 203.29.91.49 is OK?!  (I'd be
very surprised if linuxcare.com.au was either an open relay or blocking
ORBS probes - and such a situation would be rectified very quickly.)
Is qmail blocking mail if it can't access ORBS for some reason?

Regards, Alan Modra

----- End forwarded message -----

Re: [alan@SPRI.Levels.UniSA.Edu.Au: [postmaster@sourceware] qmail setup problem for binutils list]

[Jim Kingdon]

> Alan has been seeing this problem for a couple of weeks.  Is it possible
> that his theory is correct?

It is an ORBS static listing (lookup enclosed).

<whine>I've explained ORBS static listings many times, including on
the http://sources.redhat.com/lists.html#rbls page</whine>.

    [jkingdon@dhcp-net200-89 jkingdon]$ nslookup
    49.91.29.203.relays.orbs.org
    Server:  ns1.su.valinux.com
    Address:  10.1.0.5

    Non-authoritative answer:
    Name:    49.91.29.203.relays.orbs.org
    Address:  127.0.0.4

Re: [alan@SPRI.Levels.UniSA.Edu.Au: [postmaster@sourceware] qmail setup problem for binutils list]

[Chris Faylor]

On Fri, Jul 28, 2000 at 12:41:14AM -0400, Jim Kingdon wrote:
>> Alan has been seeing this problem for a couple of weeks.  Is it possible
>> that his theory is correct?
>
>It is an ORBS static listing (lookup enclosed).
>
><whine>I've explained ORBS static listings many times, including on
>the http://sources.redhat.com/lists.html#rbls page</whine>.
>
>    [jkingdon@dhcp-net200-89 jkingdon]$ nslookup
>    49.91.29.203.relays.orbs.org
>    Server:  ns1.su.valinux.com
>    Address:  10.1.0.5
>
>    Non-authoritative answer:
>    Name:    49.91.29.203.relays.orbs.org
>    Address:  127.0.0.4

I actually tried this prior to sending my email.  I was going to explain
this to him when I answered his mail.  However, nslookup returned a
"Non-existent host/domain"

*Now* it does work.

This was the random behavior I was referring to.  I thought that the
last time we tried this you couldn't duplicate the succesful nslookup
when you tried this several hours later.  It will be interesting to
see if this happens again.

cgf

Re: [alan@SPRI.Levels.UniSA.Edu.Au: [postmaster@sourceware] qmail setup problem for binutils list]

[Andrew Cagney]

Chris Faylor wrote:
> 
> On Fri, Jul 28, 2000 at 12:41:14AM -0400, Jim Kingdon wrote:
> >> Alan has been seeing this problem for a couple of weeks.  Is it possible
> >> that his theory is correct?
> >
> >It is an ORBS static listing (lookup enclosed).
> >
> ><whine>I've explained ORBS static listings many times, including on
> >the http://sources.redhat.com/lists.html#rbls page</whine>.
> >
> >    [jkingdon@dhcp-net200-89 jkingdon]$ nslookup
> >    49.91.29.203.relays.orbs.org
> >    Server:  ns1.su.valinux.com
> >    Address:  10.1.0.5
> >
> >    Non-authoritative answer:
> >    Name:    49.91.29.203.relays.orbs.org
> >    Address:  127.0.0.4
> 
> I actually tried this prior to sending my email.  I was going to explain
> this to him when I answered his mail.  However, nslookup returned a
> "Non-existent host/domain"
> 
> *Now* it does work.
> 
> This was the random behavior I was referring to.  I thought that the
> last time we tried this you couldn't duplicate the succesful nslookup
> when you tried this several hours later.  It will be interesting to
> see if this happens again.

There is a rumor kicking around that ORBS black listed ``Telstra''. 
Telstra directly or indirectly controls about half of Australia's IP
address space.  Think about this - half of the Australian Internet can't
send e-mail ....

	Andrew

Re: [alan@SPRI.Levels.UniSA.Edu.Au: [postmaster@sourceware] qmail setup problem for binutils list]

[Jason Molenda]

On Fri, Jul 28, 2000 at 03:26:09PM +1000, Andrew Cagney wrote:

> There is a rumor kicking around that ORBS black listed ``Telstra''. 
> Telstra directly or indirectly controls about half of Australia's IP
> address space.  Think about this - half of the Australian Internet can't
> send e-mail ....


Must .. restrain .. self ... must not .. make obvious Aussie jokes ...
Ouch, it hurts to keep it in.


ORBS is pretty straightforward.  If your MTA relays third-party
mail, you get listed.  If you deny the ORBS probes, you get listed.

It doesn't matter if you're a Uni, if you're IBM, if you're all of
Mongolia, if your MTA relays third party mail, your MTA will get
listed.

I won't argue for or against its use on sourceware - it is not for
me to decide.  But by its use, you are saying, "We do not want to
receive mail from any system that allows abuse by spammers, regardless
of who that system is."  By using ORBS, you are saying that the
spam ORBS stops outweighs the legitimate notes that are unnecessarily
denied.

If the sourceware maintainers don't think these trade-offs are
correct any longer, it's entirely within their power to stop using
ORBS.

J

Re: [alan@SPRI.Levels.UniSA.Edu.Au: [postmaster@sourceware] qmail setup problem for binutils list]

[Andrew Cagney]

Jason Molenda wrote:
> 
> On Fri, Jul 28, 2000 at 03:26:09PM +1000, Andrew Cagney wrote:
> 
> > There is a rumor kicking around that ORBS black listed ``Telstra''.
> > Telstra directly or indirectly controls about half of Australia's IP
> > address space.  Think about this - half of the Australian Internet can't
> > send e-mail ....
> 
> Must .. restrain .. self ... must not .. make obvious Aussie jokes ...
> Ouch, it hurts to keep it in.

Don't worry I've plenty of corks for my pop gun ... Fire away...

> ORBS is pretty straightforward.  If your MTA relays third-party
> mail, you get listed.  If you deny the ORBS probes, you get listed.

I don't call:

1.111.15.203.relays.orbs.org.  23h59m59s IN TXT  "Telstra - spam
haveners, refusing to act. "

your typical ORBS entry.  ORBS have stopped playing by their own rules.

	Andrew

Re: [alan@SPRI.Levels.UniSA.Edu.Au: [postmaster@sourceware] qmailsetup problem for binutils list]

[Gerald Pfeifer]

On Fri, 28 Jul 2000, Andrew Cagney wrote:
> I don't call:
> 
> 1.111.15.203.relays.orbs.org.  23h59m59s IN TXT  "Telstra - spam
> haveners, refusing to act. "
> 
> your typical ORBS entry.  ORBS have stopped playing by their own rules.

I'm investigating and will keep you informed.

You know, I have been a strong supporter of ORBS since the very beginning.
Should they, however, really start to completely abandon their rules, I'll
be the first to recommend stopping to use ORBS.

Gerald
-- 
Gerald "Jerry" pfeifer@dbai.tuwien.ac.at http://www.dbai.tuwien.ac.at/~pfeifer/

Re: [alan@SPRI.Levels.UniSA.Edu.Au: [postmaster@sourceware] qmail setup problem for binutils list]

[Ian Lance Taylor]

   Date: Fri, 28 Jul 2000 01:13:48 -0700
   From: Jason Molenda <jason-swarelist@molenda.com>

   ORBS is pretty straightforward.  If your MTA relays third-party
   mail, you get listed.  If you deny the ORBS probes, you get listed.

That is what ORBS used to be, but it has gotten more complicated.

I believe we should only block relays which are shown to relay.  I do
not believe we should block sites which ORBS has put on their static
list.  I believe that ORBS has simply gotten too hard to deal with.
There are legitimate reasons to block ORBS testing: it is, in fact,
spam by any reasonable definition.  I am a domain owner who runs a
mail server and I receive ORBS spam in my mailbox.  Blocking ORBS
testing does not in any way imply that you are an open relay.

I believe there is an RBL address you can use to only test for sites
which have been shown to relay.  I think it is output.orbs.org.  The
ORBS web pages should have the actual information (I'm on the train as
I write this, and for some reason Ricochet is still not selling their
modems).

Ian

Re: [alan@SPRI.Levels.UniSA.Edu.Au: [postmaster@sourceware] qmail setup problem for binutils list]

[Jason Molenda]

On Fri, Jul 28, 2000 at 09:53:16AM -0700, Ian Lance Taylor wrote:

>    Date: Fri, 28 Jul 2000 01:13:48 -0700
>    From: Jason Molenda <jason-swarelist@molenda.com>
> 
>    ORBS is pretty straightforward.  If your MTA relays third-party
>    mail, you get listed.  If you deny the ORBS probes, you get listed.
> 
> That is what ORBS used to be, but it has gotten more complicated.
> 
> I believe we should only block relays which are shown to relay.  

I'd agree with this.  I've seen some sites, like HJ's personal
system, get ORBS-static listed because he was on vacation for a
couple of weeks and turned his computer off.  I think at one point
they used to do some kind of independant checking to see if the
system was actually relaying mail and specifically blocking ORBS,
but the ORBS maintainer may have slacked off on that.

> I believe there is an RBL address you can use to only test for sites
> which have been shown to relay.  I think it is output.orbs.org.  

If anyone feels motivated, rblcheck would need to be recompiled,
there is a config.h type header which hard-codes the RBLs that we
consult.  The sources are undoubtedly in /usr/local/src.

J

PS-  In a shameless note of self-promotion :-), for filtering one's
own mail, Yahoo Mail has an unusually effective spam blocking
mechanism in place, and you can have Y Mail forward you mail to
your own real mailbox (you have to agree to get spammed by Yahoo
about once a week 'cause you won't be looking at our delicious
banner ads), or you can pick it up via POP.  As an added plus,
we've got software from Symantec in the loop which scans and disables
most of those Winblows viruses that people are sending around these
days.

Re: [alan@SPRI.Levels.UniSA.Edu.Au: [postmaster@sourceware] qmail setup problem for binutils list]

[Jim Kingdon]

> I believe there is an RBL address you can use to only test for sites
> which have been shown to relay.  I think it is output.orbs.org.  The

No, outputs.orbs.org is different (as nearly as I could tell, I could
be wrong on that).  As far as I know you need to look at the return
from the DNS lookup and see whether it is 127.0.0.2 or
127.0.0.4.

> ORBS web pages should have the actual information (I'm on the train as
> I write this, and for some reason Ricochet is still not selling their
> modems).

The Ricochet 2 rollout has been full of delays.  I'm writing this on a
Ricochet 1 (which wouldn't work on the train for a variety of reasons)
and I can hardly wait.  My office at VA has lots of bandwidth but it
is pretty much impossible to get work done there (much more hallway
conversation than at Cygnus; and I share an office with 6 other people
so I get the brunt of it).

Re: [alan@SPRI.Levels.UniSA.Edu.Au: [postmaster@sourceware] qmail setup problem for binutils list]

[Ian Lance Taylor]

   Date: Fri, 28 Jul 2000 14:10:56 -0400 (EDT)
   From: Jim Kingdon <kingdon@panix.com>

   > I believe there is an RBL address you can use to only test for sites
   > which have been shown to relay.  I think it is output.orbs.org.  The

   No, outputs.orbs.org is different (as nearly as I could tell, I could
   be wrong on that).  As far as I know you need to look at the return
   from the DNS lookup and see whether it is 127.0.0.2 or
   127.0.0.4.

This has been discussed on the qmail list quite a bit there recently,
and I got the impression that running rblsmtpd on outputs.orbs.org was
the way to go.

According to
    http://www.orbs.org/usingindex.html
outputs.orbs.org is ``inputs plus outputs, automated tester only,
returns 127.0.0.3.''  That is definitely confusing.  But I think it
means ``they accept test mail, and they return test mail, using the
automated tester.''  Those are the hosts we want to block.

I just tested the open relay toad.com, and it is listed in
relays.orbs.org as 127.0.0.2 and in outputs.org.org as 127.0.0.3.
I've now expunged the mail with Alan's IP address; could somebody
please test that against outputs.orgs.org?

Ian

Re: [alan@SPRI.Levels.UniSA.Edu.Au: [postmaster@sourceware] qmail setup problem for binutils list]

[Ian Lance Taylor]

   Date: Fri, 28 Jul 2000 11:05:39 -0700
   From: Jason Molenda <jason-swarelist@molenda.com>

   If anyone feels motivated, rblcheck would need to be recompiled,
   there is a config.h type header which hard-codes the RBLs that we
   consult.  The sources are undoubtedly in /usr/local/src.

FYI, the current ucspi-tcp includes an rblsmtpd program which supports
command line options.

Ian

Re: [alan@SPRI.Levels.UniSA.Edu.Au: [postmaster@sourceware] qmailsetup problem for binutils list]

[Gerald Pfeifer]

On 28 Jul 2000, Ian Lance Taylor wrote:
> I believe there is an RBL address you can use to only test for sites
> which have been shown to relay.  I think it is output.orbs.org.

This looks like a good compromise!

The first is a real open relay, which is indeed listed by outputs

  taygeta[84]:~/x% host -a 16.56.236.132.outputs.orbs.org
  16.56.236.132.outputs.orbs.org  A       127.0.0.3
  16.56.236.132.outputs.orbs.org  TXT     "Open relay output - see....

  taygeta[85]:~/x% host -a 1.111.15.203.outputs.orbs.org
  1.111.15.203.outputs.orbs.org does not exist (Authoritative answer)

  taygeta[87]:~/x% host -a 1.111.15.203.relays.orbs.org
  1.111.15.203.relays.orbs.org    A       127.0.0.4
  1.111.15.203.relays.orbs.org    TXT     "Telstra - spam haveners....

The final two are for the IP that started this thread. It seems this is
the behavior we want..

Gerald
-- 
Gerald "Jerry" pfeifer@dbai.tuwien.ac.at http://www.dbai.tuwien.ac.at/~pfeifer/

Re: [alan@SPRI.Levels.UniSA.Edu.Au: [postmaster@sourceware] qmail setup problem for binutils list]

[Jason Molenda]

On Fri, Jul 28, 2000 at 12:49:42PM -0700, Ian Lance Taylor wrote:

> FYI, the current ucspi-tcp includes an rblsmtpd program which supports
> command line options.

I used to check the RBL's at the SMTP level, but this results in
people not being able to send mail to any addr at sourceware.
People who were RBL'ed couldn't subscribe, unsubscribe, complain
to the list owner, or do anything else @sourceware.  This was
particularly lame for e.g. announce lists -- the people subscribing
will never post a note, so excluding them just because they're
RBL'ed was unnecessary. (incidentally, this was one of the reasons
for leaving the 'sourcemaster' @cygnus.com; people needed some
non-sware addr to complain to)

The check-rbls.sh (or whatever that script is called) being in the
DIR/editor file moves the check down to the point where someone is
trying to post a note to the list.  It also let me customize the
bounce message to provide better explanations about the note was
rejected.  I think the rejection note user used to get had a message
like "400 - Your host is listed in ORBS.".



J

Re: [alan@SPRI.Levels.UniSA.Edu.Au: [postmaster@sourceware] qmail setup problem for binutils list]

[Jason Molenda]

On Fri, Jul 28, 2000 at 11:05:39AM -0700, Jason Molenda wrote:

> PS-  In a shameless note of self-promotion :-), for filtering one's
> own mail, Yahoo Mail has an unusually effective spam blocking
> mechanism in place, and you can have Y Mail forward you mail to
> your own real mailbox (you have to agree to get spammed by Yahoo
> about once a week 'cause you won't be looking at our delicious
> banner ads), or you can pick it up via POP.  As an added plus,
> we've got software from Symantec in the loop which scans and disables
> most of those Winblows viruses that people are sending around these
> days.



BTW I talked to one of the Mail guys and I found out I misunderstood.

You only get the virus filtering if you're using the Yahoo Mail
web interface.  (it gives you an option to check an attachment for
viruses before downloading)

The spam blocking doesn't take place if you're getting your mail
forwarded (when Y Mail receives a note destined for a forwarded
mailbox, it just bounces it over there).

The spam blocker does add a header to the mail note if you're
reading your mail via POP, and you can configure your MUA to toss
the note if that header is present.


Jason

Re: [alan@SPRI.Levels.UniSA.Edu.Au: [postmaster@sourceware] qmail setup problem for binutils list]

[Jim Kingdon]

> This has been discussed on the qmail list quite a bit there recently,
> and I got the impression that running rblsmtpd on outputs.orbs.org was
> the way to go.

Sounds like we can just s/relays/outputs/ then.  I was basing my
comment on the confusing web page, and it seems like people have
tested it and found that outputs in fact is what we want.

Re: [alan@SPRI.Levels.UniSA.Edu.Au: [postmaster@sourceware] qmailsetup problem for binutils list]

[Andrew Cagney]

Gerald Pfeifer wrote:
> 
> On 28 Jul 2000, Ian Lance Taylor wrote:
> > I believe there is an RBL address you can use to only test for sites
> > which have been shown to relay.  I think it is output.orbs.org.
> 
> This looks like a good compromise!
> 
> The first is a real open relay, which is indeed listed by outputs
> 
>   taygeta[84]:~/x% host -a 16.56.236.132.outputs.orbs.org
>   16.56.236.132.outputs.orbs.org  A       127.0.0.3
>   16.56.236.132.outputs.orbs.org  TXT     "Open relay output - see....
> 
>   taygeta[85]:~/x% host -a 1.111.15.203.outputs.orbs.org
>   1.111.15.203.outputs.orbs.org does not exist (Authoritative answer)
> 
>   taygeta[87]:~/x% host -a 1.111.15.203.relays.orbs.org
>   1.111.15.203.relays.orbs.org    A       127.0.0.4
>   1.111.15.203.relays.orbs.org    TXT     "Telstra - spam haveners....
> 
> The final two are for the IP that started this thread. It seems this is
> the behavior we want..

Please do this.

To give this context, black listing telstra is roughly equivalent to
black listing AT&T on the grounds that Tele-marketers use AT&T exchanges
to route their phone calls.

	Andrew

Re: [alan@SPRI.Levels.UniSA.Edu.Au: [postmaster@sourceware] qmail setup problem for binutils list]

[Jim Kingdon]

> I believe there is an RBL address you can use to only test for sites
> which have been shown to relay.  I think it is output.orbs.org.  The

No, outputs.orbs.org is different (as nearly as I could tell, I could
be wrong on that).  As far as I know you need to look at the return
from the DNS lookup and see whether it is 127.0.0.2 or
127.0.0.4.

> ORBS web pages should have the actual information (I'm on the train as
> I write this, and for some reason Ricochet is still not selling their
> modems).

The Ricochet 2 rollout has been full of delays.  I'm writing this on a
Ricochet 1 (which wouldn't work on the train for a variety of reasons)
and I can hardly wait.  My office at VA has lots of bandwidth but it
is pretty much impossible to get work done there (much more hallway
conversation than at Cygnus; and I share an office with 6 other people
so I get the brunt of it).

Re: [alan@SPRI.Levels.UniSA.Edu.Au: [postmaster@sourceware] qmail setup problem for binutils list]

[Ian Lance Taylor]

   Date: Fri, 28 Jul 2000 01:13:48 -0700
   From: Jason Molenda <jason-swarelist@molenda.com>

   ORBS is pretty straightforward.  If your MTA relays third-party
   mail, you get listed.  If you deny the ORBS probes, you get listed.

That is what ORBS used to be, but it has gotten more complicated.

I believe we should only block relays which are shown to relay.  I do
not believe we should block sites which ORBS has put on their static
list.  I believe that ORBS has simply gotten too hard to deal with.
There are legitimate reasons to block ORBS testing: it is, in fact,
spam by any reasonable definition.  I am a domain owner who runs a
mail server and I receive ORBS spam in my mailbox.  Blocking ORBS
testing does not in any way imply that you are an open relay.

I believe there is an RBL address you can use to only test for sites
which have been shown to relay.  I think it is output.orbs.org.  The
ORBS web pages should have the actual information (I'm on the train as
I write this, and for some reason Ricochet is still not selling their
modems).

Ian

Re: [alan@SPRI.Levels.UniSA.Edu.Au: [postmaster@sourceware] qmail setup problem for binutils list]

[Jason Molenda]

On Fri, Jul 28, 2000 at 03:26:09PM +1000, Andrew Cagney wrote:

> There is a rumor kicking around that ORBS black listed ``Telstra''. 
> Telstra directly or indirectly controls about half of Australia's IP
> address space.  Think about this - half of the Australian Internet can't
> send e-mail ....


Must .. restrain .. self ... must not .. make obvious Aussie jokes ...
Ouch, it hurts to keep it in.


ORBS is pretty straightforward.  If your MTA relays third-party
mail, you get listed.  If you deny the ORBS probes, you get listed.

It doesn't matter if you're a Uni, if you're IBM, if you're all of
Mongolia, if your MTA relays third party mail, your MTA will get
listed.

I won't argue for or against its use on sourceware - it is not for
me to decide.  But by its use, you are saying, "We do not want to
receive mail from any system that allows abuse by spammers, regardless
of who that system is."  By using ORBS, you are saying that the
spam ORBS stops outweighs the legitimate notes that are unnecessarily
denied.

If the sourceware maintainers don't think these trade-offs are
correct any longer, it's entirely within their power to stop using
ORBS.

J

Re: [alan@SPRI.Levels.UniSA.Edu.Au: [postmaster@sourceware] qmail setup problem for binutils list]

[Andrew Cagney]

Jason Molenda wrote:
> 
> On Fri, Jul 28, 2000 at 03:26:09PM +1000, Andrew Cagney wrote:
> 
> > There is a rumor kicking around that ORBS black listed ``Telstra''.
> > Telstra directly or indirectly controls about half of Australia's IP
> > address space.  Think about this - half of the Australian Internet can't
> > send e-mail ....
> 
> Must .. restrain .. self ... must not .. make obvious Aussie jokes ...
> Ouch, it hurts to keep it in.

Don't worry I've plenty of corks for my pop gun ... Fire away...

> ORBS is pretty straightforward.  If your MTA relays third-party
> mail, you get listed.  If you deny the ORBS probes, you get listed.

I don't call:

1.111.15.203.relays.orbs.org.  23h59m59s IN TXT  "Telstra - spam
haveners, refusing to act. "

your typical ORBS entry.  ORBS have stopped playing by their own rules.

	Andrew

Re: [alan@SPRI.Levels.UniSA.Edu.Au: [postmaster@sourceware] qmail setup problem for binutils list]

[Jim Kingdon]

> This has been discussed on the qmail list quite a bit there recently,
> and I got the impression that running rblsmtpd on outputs.orbs.org was
> the way to go.

Sounds like we can just s/relays/outputs/ then.  I was basing my
comment on the confusing web page, and it seems like people have
tested it and found that outputs in fact is what we want.

[alan@SPRI.Levels.UniSA.Edu.Au: [postmaster@sourceware] qmail setup problem for binutils list]

[Chris Faylor]

Alan has been seeing this problem for a couple of weeks.  Is it possible
that his theory is correct?

cgf

----- Forwarded message from Alan Modra <alan@SPRI.Levels.UniSA.Edu.Au> -----

From: Alan Modra <alan@SPRI.Levels.UniSA.Edu.Au>
To: postmaster@sourceware.cygnus.com
cc: alan@linuxcare.com.au
Subject: [postmaster@sourceware] qmail setup problem for binutils list
Date: Fri, 28 Jul 2000 12:47:27 +0930 (CST)
Reply-To: alan@linuxcare.com.au

There appears to be a problem with the way qmail is deciding whether mail
is coming from known spammers.  My last few posts from my normal
linuxcare address have been blocked with:

> Hi. This is the qmail-send program at sourceware.cygnus.com.
> I'm afraid I wasn't able to deliver your message to the following
> addresses.
> This is a permanent error; I've given up. Sorry it didn't work out.
> 
> <binutils@sourceware.cygnus.com:
>   
>   In an effort to cut down on our spam intake we block email from
>   certain lists and unfortunately you have just discovered the hard
>   way that sometimes non-spam mail gets caught accidentally.
>   In most cases you can clear this up by an upgrade to your mail
>   server or sometimes by getting an erroneous listing removed.
>   For more information about our use of these lists, see
>         http://sources.redhat.com/lists.html#rbls
>  
>   The IP number that I'm denying mail from is 203.29.91.49
>   The list that you're on is ORBS.  See:
>       http://www.orbs.org/verify.cgi?address=203.29.91.49
>   for more information about this list and why you are on it.

Looking at the above http address says 203.29.91.49 is OK?!  (I'd be
very surprised if linuxcare.com.au was either an open relay or blocking
ORBS probes - and such a situation would be rectified very quickly.)
Is qmail blocking mail if it can't access ORBS for some reason?

Regards, Alan Modra

----- End forwarded message -----

Re: [alan@SPRI.Levels.UniSA.Edu.Au: [postmaster@sourceware] qmail setup problem for binutils list]

[Ian Lance Taylor]

   Date: Fri, 28 Jul 2000 11:05:39 -0700
   From: Jason Molenda <jason-swarelist@molenda.com>

   If anyone feels motivated, rblcheck would need to be recompiled,
   there is a config.h type header which hard-codes the RBLs that we
   consult.  The sources are undoubtedly in /usr/local/src.

FYI, the current ucspi-tcp includes an rblsmtpd program which supports
command line options.

Ian

Re: [alan@SPRI.Levels.UniSA.Edu.Au: [postmaster@sourceware] qmailsetup problem for binutils list]

[Gerald Pfeifer]

On Fri, 28 Jul 2000, Andrew Cagney wrote:
> I don't call:
> 
> 1.111.15.203.relays.orbs.org.  23h59m59s IN TXT  "Telstra - spam
> haveners, refusing to act. "
> 
> your typical ORBS entry.  ORBS have stopped playing by their own rules.

I'm investigating and will keep you informed.

You know, I have been a strong supporter of ORBS since the very beginning.
Should they, however, really start to completely abandon their rules, I'll
be the first to recommend stopping to use ORBS.

Gerald
-- 
Gerald "Jerry" pfeifer@dbai.tuwien.ac.at http://www.dbai.tuwien.ac.at/~pfeifer/

Re: [alan@SPRI.Levels.UniSA.Edu.Au: [postmaster@sourceware] qmail setup problem for binutils list]

[Ian Lance Taylor]

   Date: Fri, 28 Jul 2000 14:10:56 -0400 (EDT)
   From: Jim Kingdon <kingdon@panix.com>

   > I believe there is an RBL address you can use to only test for sites
   > which have been shown to relay.  I think it is output.orbs.org.  The

   No, outputs.orbs.org is different (as nearly as I could tell, I could
   be wrong on that).  As far as I know you need to look at the return
   from the DNS lookup and see whether it is 127.0.0.2 or
   127.0.0.4.

This has been discussed on the qmail list quite a bit there recently,
and I got the impression that running rblsmtpd on outputs.orbs.org was
the way to go.

According to
    http://www.orbs.org/usingindex.html
outputs.orbs.org is ``inputs plus outputs, automated tester only,
returns 127.0.0.3.''  That is definitely confusing.  But I think it
means ``they accept test mail, and they return test mail, using the
automated tester.''  Those are the hosts we want to block.

I just tested the open relay toad.com, and it is listed in
relays.orbs.org as 127.0.0.2 and in outputs.org.org as 127.0.0.3.
I've now expunged the mail with Alan's IP address; could somebody
please test that against outputs.orgs.org?

Ian

Re: [alan@SPRI.Levels.UniSA.Edu.Au: [postmaster@sourceware] qmailsetup problem for binutils list]

[Andrew Cagney]

Gerald Pfeifer wrote:
> 
> On 28 Jul 2000, Ian Lance Taylor wrote:
> > I believe there is an RBL address you can use to only test for sites
> > which have been shown to relay.  I think it is output.orbs.org.
> 
> This looks like a good compromise!
> 
> The first is a real open relay, which is indeed listed by outputs
> 
>   taygeta[84]:~/x% host -a 16.56.236.132.outputs.orbs.org
>   16.56.236.132.outputs.orbs.org  A       127.0.0.3
>   16.56.236.132.outputs.orbs.org  TXT     "Open relay output - see....
> 
>   taygeta[85]:~/x% host -a 1.111.15.203.outputs.orbs.org
>   1.111.15.203.outputs.orbs.org does not exist (Authoritative answer)
> 
>   taygeta[87]:~/x% host -a 1.111.15.203.relays.orbs.org
>   1.111.15.203.relays.orbs.org    A       127.0.0.4
>   1.111.15.203.relays.orbs.org    TXT     "Telstra - spam haveners....
> 
> The final two are for the IP that started this thread. It seems this is
> the behavior we want..

Please do this.

To give this context, black listing telstra is roughly equivalent to
black listing AT&T on the grounds that Tele-marketers use AT&T exchanges
to route their phone calls.

	Andrew

Re: [alan@SPRI.Levels.UniSA.Edu.Au: [postmaster@sourceware] qmail setup problem for binutils list]

[Andrew Cagney]

Chris Faylor wrote:
> 
> On Fri, Jul 28, 2000 at 12:41:14AM -0400, Jim Kingdon wrote:
> >> Alan has been seeing this problem for a couple of weeks.  Is it possible
> >> that his theory is correct?
> >
> >It is an ORBS static listing (lookup enclosed).
> >
> ><whine>I've explained ORBS static listings many times, including on
> >the http://sources.redhat.com/lists.html#rbls page</whine>.
> >
> >    [jkingdon@dhcp-net200-89 jkingdon]$ nslookup
> >    49.91.29.203.relays.orbs.org
> >    Server:  ns1.su.valinux.com
> >    Address:  10.1.0.5
> >
> >    Non-authoritative answer:
> >    Name:    49.91.29.203.relays.orbs.org
> >    Address:  127.0.0.4
> 
> I actually tried this prior to sending my email.  I was going to explain
> this to him when I answered his mail.  However, nslookup returned a
> "Non-existent host/domain"
> 
> *Now* it does work.
> 
> This was the random behavior I was referring to.  I thought that the
> last time we tried this you couldn't duplicate the succesful nslookup
> when you tried this several hours later.  It will be interesting to
> see if this happens again.

There is a rumor kicking around that ORBS black listed ``Telstra''. 
Telstra directly or indirectly controls about half of Australia's IP
address space.  Think about this - half of the Australian Internet can't
send e-mail ....

	Andrew

Re: [alan@SPRI.Levels.UniSA.Edu.Au: [postmaster@sourceware] qmail setup problem for binutils list]

[Chris Faylor]

On Fri, Jul 28, 2000 at 12:41:14AM -0400, Jim Kingdon wrote:
>> Alan has been seeing this problem for a couple of weeks.  Is it possible
>> that his theory is correct?
>
>It is an ORBS static listing (lookup enclosed).
>
><whine>I've explained ORBS static listings many times, including on
>the http://sources.redhat.com/lists.html#rbls page</whine>.
>
>    [jkingdon@dhcp-net200-89 jkingdon]$ nslookup
>    49.91.29.203.relays.orbs.org
>    Server:  ns1.su.valinux.com
>    Address:  10.1.0.5
>
>    Non-authoritative answer:
>    Name:    49.91.29.203.relays.orbs.org
>    Address:  127.0.0.4

I actually tried this prior to sending my email.  I was going to explain
this to him when I answered his mail.  However, nslookup returned a
"Non-existent host/domain"

*Now* it does work.

This was the random behavior I was referring to.  I thought that the
last time we tried this you couldn't duplicate the succesful nslookup
when you tried this several hours later.  It will be interesting to
see if this happens again.

cgf

Re: [alan@SPRI.Levels.UniSA.Edu.Au: [postmaster@sourceware] qmail setup problem for binutils list]

[Jim Kingdon]

> Alan has been seeing this problem for a couple of weeks.  Is it possible
> that his theory is correct?

It is an ORBS static listing (lookup enclosed).

<whine>I've explained ORBS static listings many times, including on
the http://sources.redhat.com/lists.html#rbls page</whine>.

    [jkingdon@dhcp-net200-89 jkingdon]$ nslookup
    49.91.29.203.relays.orbs.org
    Server:  ns1.su.valinux.com
    Address:  10.1.0.5

    Non-authoritative answer:
    Name:    49.91.29.203.relays.orbs.org
    Address:  127.0.0.4

Re: [alan@SPRI.Levels.UniSA.Edu.Au: [postmaster@sourceware] qmail setup problem for binutils list]

[Jason Molenda]

On Fri, Jul 28, 2000 at 09:53:16AM -0700, Ian Lance Taylor wrote:

>    Date: Fri, 28 Jul 2000 01:13:48 -0700
>    From: Jason Molenda <jason-swarelist@molenda.com>
> 
>    ORBS is pretty straightforward.  If your MTA relays third-party
>    mail, you get listed.  If you deny the ORBS probes, you get listed.
> 
> That is what ORBS used to be, but it has gotten more complicated.
> 
> I believe we should only block relays which are shown to relay.  

I'd agree with this.  I've seen some sites, like HJ's personal
system, get ORBS-static listed because he was on vacation for a
couple of weeks and turned his computer off.  I think at one point
they used to do some kind of independant checking to see if the
system was actually relaying mail and specifically blocking ORBS,
but the ORBS maintainer may have slacked off on that.

> I believe there is an RBL address you can use to only test for sites
> which have been shown to relay.  I think it is output.orbs.org.  

If anyone feels motivated, rblcheck would need to be recompiled,
there is a config.h type header which hard-codes the RBLs that we
consult.  The sources are undoubtedly in /usr/local/src.

J

PS-  In a shameless note of self-promotion :-), for filtering one's
own mail, Yahoo Mail has an unusually effective spam blocking
mechanism in place, and you can have Y Mail forward you mail to
your own real mailbox (you have to agree to get spammed by Yahoo
about once a week 'cause you won't be looking at our delicious
banner ads), or you can pick it up via POP.  As an added plus,
we've got software from Symantec in the loop which scans and disables
most of those Winblows viruses that people are sending around these
days.

Re: [alan@SPRI.Levels.UniSA.Edu.Au: [postmaster@sourceware] qmail setup problem for binutils list]

[Jason Molenda]

On Fri, Jul 28, 2000 at 11:05:39AM -0700, Jason Molenda wrote:

> PS-  In a shameless note of self-promotion :-), for filtering one's
> own mail, Yahoo Mail has an unusually effective spam blocking
> mechanism in place, and you can have Y Mail forward you mail to
> your own real mailbox (you have to agree to get spammed by Yahoo
> about once a week 'cause you won't be looking at our delicious
> banner ads), or you can pick it up via POP.  As an added plus,
> we've got software from Symantec in the loop which scans and disables
> most of those Winblows viruses that people are sending around these
> days.



BTW I talked to one of the Mail guys and I found out I misunderstood.

You only get the virus filtering if you're using the Yahoo Mail
web interface.  (it gives you an option to check an attachment for
viruses before downloading)

The spam blocking doesn't take place if you're getting your mail
forwarded (when Y Mail receives a note destined for a forwarded
mailbox, it just bounces it over there).

The spam blocker does add a header to the mail note if you're
reading your mail via POP, and you can configure your MUA to toss
the note if that header is present.


Jason

Re: [alan@SPRI.Levels.UniSA.Edu.Au: [postmaster@sourceware] qmailsetup problem for binutils list]

[Gerald Pfeifer]

On 28 Jul 2000, Ian Lance Taylor wrote:
> I believe there is an RBL address you can use to only test for sites
> which have been shown to relay.  I think it is output.orbs.org.

This looks like a good compromise!

The first is a real open relay, which is indeed listed by outputs

  taygeta[84]:~/x% host -a 16.56.236.132.outputs.orbs.org
  16.56.236.132.outputs.orbs.org  A       127.0.0.3
  16.56.236.132.outputs.orbs.org  TXT     "Open relay output - see....

  taygeta[85]:~/x% host -a 1.111.15.203.outputs.orbs.org
  1.111.15.203.outputs.orbs.org does not exist (Authoritative answer)

  taygeta[87]:~/x% host -a 1.111.15.203.relays.orbs.org
  1.111.15.203.relays.orbs.org    A       127.0.0.4
  1.111.15.203.relays.orbs.org    TXT     "Telstra - spam haveners....

The final two are for the IP that started this thread. It seems this is
the behavior we want..

Gerald
-- 
Gerald "Jerry" pfeifer@dbai.tuwien.ac.at http://www.dbai.tuwien.ac.at/~pfeifer/

Re: [alan@SPRI.Levels.UniSA.Edu.Au: [postmaster@sourceware] qmail setup problem for binutils list]

[Jason Molenda]

On Fri, Jul 28, 2000 at 12:49:42PM -0700, Ian Lance Taylor wrote:

> FYI, the current ucspi-tcp includes an rblsmtpd program which supports
> command line options.

I used to check the RBL's at the SMTP level, but this results in
people not being able to send mail to any addr at sourceware.
People who were RBL'ed couldn't subscribe, unsubscribe, complain
to the list owner, or do anything else @sourceware.  This was
particularly lame for e.g. announce lists -- the people subscribing
will never post a note, so excluding them just because they're
RBL'ed was unnecessary. (incidentally, this was one of the reasons
for leaving the 'sourcemaster' @cygnus.com; people needed some
non-sware addr to complain to)

The check-rbls.sh (or whatever that script is called) being in the
DIR/editor file moves the check down to the point where someone is
trying to post a note to the list.  It also let me customize the
bounce message to provide better explanations about the note was
rejected.  I think the rejection note user used to get had a message
like "400 - Your host is listed in ORBS.".



J