Re: [Assp-user] SMTP-logfile / Mailheaders (was: RE: [Assp-user] ASSP and source ip in headers)

[John H. <jh...@cp...>]

Rainer, Thanks. This is a good idea for servers that log NOOPs. I'm
including it in the 0.1.5 release which should be out later today.

john
----- Original Message -----
From: "Rainer Schuetz" <ass...@ra...>
To: <ass...@li...>
Sent: Tuesday, March 25, 2003 12:22 AM
Subject: FW: [Assp-user] SMTP-logfile / Mailheaders (was: RE: [Assp-user]
ASSP and source ip in headers)



Hi Eric,

wow, I thought I made the whole work only for myself....
(Okay, that's what I actually did ;-) but I'd be happy if it could have been
useful for others.)

Here's the original mail.

/Don't forget to adapt the path to config.pl in line 16!!!/



Have a nice day, Rainer



-----Original Message-----
From: Rainer [mailto:ass...@ra...]
Sent: Monday, March 17, 2003 9:47 AM
To: ass...@li...
Subject: RE: [Assp-user] SMTP-logfile / Mailheaders



Hi list, hi John,

here's another enhancement:
it writes a line "NOOP Connection from: x.x.x.x, 17 Mar 03 00:29:16 -0000
relayed by ASSP-nospam" to the server(logs) before the EHLO/HELO command. It
also handles the unexpected "250 OK" response to that command (shouldn't be
seen by client).
The readability of the logfiles is nearly as w/o ASSP. See example below.

This enhancement is fully RFC compliant as it uses the NOOP command.



The additions are on line(s) 267-282, 284, 319, 320 and 486-494. I marked
these lines with "##rsc2" at the end of the line(s).



All the best to you,

Rainer



P.S. John, please please add that too :-)
Feedback again welcome.






Example:
old:  --> you have /no/ chance to find out who was that (except with my
first enhancement) as maillog.txt only logs received mails, not trials
T 20030317 012916 3e746cfe Connection from 127.0.0.1
T 20030317 012916 3e746cfe EHLO client
T 20030317 012916 3e746cfe MAIL FROM: <badspammer@youdon'tseemyIP.com>
T 20030317 012916 3e746cfe RCPT TO: <un...@wh...>
E 20030317 012917 3e746cfe 550 5.7.1 <un...@wh...>... Relaying
denied.
.
.
.
T 20030317 012917 3e746cfe RSET
T 20030317 012917 3e746cfe QUIT

new: IP address of offender is logged directly
T 20030317 012916 3e746cfe Connection from 127.0.0.1
T 20030317 012916 3e746cfe NOOP Connection from: 217.162.76.7, 17 Mar 03
00:29:16 -0000     relayed by ASSP-nospam
T 20030317 012916 3e746cfe EHLO client
T 20030317 012916 3e746cfe MAIL FROM: <badspammer@youdon'tseemyIP.com>
T 20030317 012916 3e746cfe RCPT TO: <un...@wh...>
E 20030317 012917 3e746cfe 550 5.7.1 <un...@wh...>... Relaying
denied..
.
.
T 20030317 012917 3e746cfe RSET
T 20030317 012917 3e746cfe QUIT


> -----Original Message-----
> From: ass...@li...
> [mailto:ass...@li...]On Behalf Of Eric
> Appelboom
> Sent: Tuesday, March 25, 2003 7:30 AM
> To: ass...@li...
> Subject: [Assp-user] ASSP and source ip in headers
>
>
> Hi all,
>
> Rainer could you post your assp.pl again I didn't see it in archives.
>
> Could someone help to customise the assp.pl and config.pl just to accept
> a connection and forward to a mailserver
> Just adding the source ip in headers and keeping current headers.
>
> We have a upstream mail proxy (Trend VirusWall) that removes the last
> header thus it removes the origional ip of the mail sender.
> This makes it a bit difficult when dealing with spam complaints.
>
> We are not interested at actually blocking spam or doing any filtering
> just to stamp mail and forward without any disk i/o
> Involvement so now queues can develop on filesystem.
>
> Help pretty please?
>
> Eric
> (South Africa)
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by:
> The Definitive IT and Networking Event. Be There!
> NetWorld+Interop Las Vegas 2003 -- Register today!
> http://ads.sourceforge.net/cgi-bin/redirect.pl?keyn0001en
> _______________________________________________
> Assp-user mailing list
> Ass...@li...
> https://lists.sourceforge.net/lists/listinfo/assp-user
>