Menu
▾
▴
sqlgrey-users — Users of SQLgrey
You can subscribe to this list here.
| 2004 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
(10) |
Nov
(37) |
Dec
(66) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2005 |
Jan
(52) |
Feb
(136) |
Mar
(65) |
Apr
(38) |
May
(46) |
Jun
(143) |
Jul
(60) |
Aug
(33) |
Sep
(79) |
Oct
(29) |
Nov
(13) |
Dec
(14) |
| 2006 |
Jan
(25) |
Feb
(26) |
Mar
(4) |
Apr
(9) |
May
(29) |
Jun
|
Jul
(9) |
Aug
(11) |
Sep
(10) |
Oct
(9) |
Nov
(45) |
Dec
(8) |
| 2007 |
Jan
(82) |
Feb
(61) |
Mar
(39) |
Apr
(7) |
May
(9) |
Jun
(16) |
Jul
(2) |
Aug
(22) |
Sep
(2) |
Oct
|
Nov
(4) |
Dec
(5) |
| 2008 |
Jan
|
Feb
|
Mar
(5) |
Apr
(2) |
May
(8) |
Jun
|
Jul
(10) |
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
| 2009 |
Jan
|
Feb
|
Mar
|
Apr
(32) |
May
|
Jun
(7) |
Jul
|
Aug
(38) |
Sep
(3) |
Oct
|
Nov
(4) |
Dec
|
| 2010 |
Jan
(36) |
Feb
(32) |
Mar
(2) |
Apr
(19) |
May
|
Jun
(1) |
Jul
|
Aug
|
Sep
|
Oct
(6) |
Nov
(8) |
Dec
|
| 2011 |
Jan
(3) |
Feb
|
Mar
(5) |
Apr
|
May
(2) |
Jun
(1) |
Jul
|
Aug
(3) |
Sep
|
Oct
|
Nov
|
Dec
(6) |
| 2012 |
Jan
|
Feb
|
Mar
(2) |
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
(2) |
Oct
|
Nov
|
Dec
|
| 2013 |
Jan
|
Feb
|
Mar
|
Apr
|
May
(1) |
Jun
|
Jul
|
Aug
(1) |
Sep
(1) |
Oct
|
Nov
(6) |
Dec
(10) |
| 2014 |
Jan
(8) |
Feb
|
Mar
|
Apr
|
May
|
Jun
(3) |
Jul
(34) |
Aug
(6) |
Sep
|
Oct
(1) |
Nov
|
Dec
|
| 2015 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
(18) |
Jul
(13) |
Aug
(30) |
Sep
(4) |
Oct
(1) |
Nov
|
Dec
(4) |
| 2016 |
Jan
(2) |
Feb
(10) |
Mar
(3) |
Apr
|
May
|
Jun
(11) |
Jul
|
Aug
|
Sep
(2) |
Oct
|
Nov
|
Dec
|
| 2017 |
Jan
(1) |
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
| 2018 |
Jan
|
Feb
|
Mar
(2) |
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
| 2019 |
Jan
|
Feb
(1) |
Mar
|
Apr
|
May
|
Jun
(1) |
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
|
From: Benjamin C. <bco...@ta...> - 2006-05-16 13:52:12
|
Firstly: Ray, you ask why I want to change it over; It was because I thought that if the same server sent me two messages its a lot more likely to be diffrent subjects than diffrent recepients. I'm not running a big mail server, its just for me. Guess its not a good idea though judging from the rest of your responces, thanks. -----Fight back spam! Download the Blue Frog.http://www.bluesecurity.com/register/s?user=VG9ydGFuaWNr Send instant messages to your online friends http://uk.messenger.yahoo.com |
|
From: Dan F. <da...@ha...> - 2006-05-14 12:09:37
|
Benjamin Confiino wrote: > Personally I think that having from-subject-IP would > be more usefull than from-to-IP is there some way to > change it over Cant be done.. Sqlgrey does its rejection upon recieving MAIL FROM. At this point no subject has been transmitted, as the subject is part of the "mail-data", not the Envelope. As sqlgrey is a postfix-policy daemon, and AFAIK policy-deamons cannot read the mail-content, which is basically what you want. And besides that, i cant really see why youd want greylisting on subject. It kinda defeats the purpose of a greylist. If a spammer is transmitting a big batch of mails, all using the same subject, he would get 4xx for 5 minutes and then get whitelisted, thus letting the remaining 5million mails through.. even though he didnt retransmit any of the original mails, since youd only check the subject. - Dan |
|
From: Ray B. <rj_...@rj...> - 2006-05-14 09:46:07
|
Benjamin Confiino wrote: > Personally I think that having from-subject-IP would > be more usefull than from-to-IP is there some way to > change it over? > > -----Fight back spam! Download the Blue Frog.http://www.bluesecurity.com/register/s?user=VG9ydGFuaWNr > > Send instant messages to your online friends http://uk.messenger.yahoo.com > > > ------------------------------------------------------- > Using Tomcat but need to do more? Need to support web services, security? > Get stuff done quickly with pre-integrated technology to make your job easier > Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo > http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 > _______________________________________________ > Sqlgrey-users mailing list > Sql...@li... > https://lists.sourceforge.net/lists/listinfo/sqlgrey-users > Can I ask why you think that? If I receive emails from people with differing subjects you want to greylist initially? -- Ray Booysen rj_...@rj... |
|
From: Lionel B. <lio...@bo...> - 2006-05-14 09:44:17
|
Benjamin Confiino wrote the following on 14.05.2006 08:53 : > Personally I think that having from-subject-IP would > be more usefull than from-to-IP is there some way to > change it over? > Not with the current postfix policy service interface (we don't have access to the subject). The more we know about the message, the better we can match against a previous attempt but the more data we must accept from the origin. In the past I thought about using the HELO/EHLO string but server pools won't like it if each server presents a different string :-( Lionel. |
|
From: Michel B. <mi...@bo...> - 2006-05-14 07:08:10
|
Le Dimanche 14 Mai 2006 08:53, Benjamin Confiino a =E9crit : > Personally I think that having from-subject-IP would > be more usefull than from-to-IP Definitely *not* a good idea IMHO, for quite a number of reasons that I h= ave=20 no time to detail right now (but that also have to do with helping people= =20 which server doesn't retry [such as some old broke NT servers] or retry w= ith=20 a too long delay to bypass greylisting by sending a 2nd message to the sa= me=20 recipient. Experience shows that if they "send again" their 1st message, the subject= will=20 often have changed with an added "Fwd:" or "Re:" etc. Regards. --=20 Michel Bouissou <mi...@bo...> OpenPGP ID 0xDDE8AC6E |
|
From: Benjamin C. <bco...@ta...> - 2006-05-14 06:53:30
|
Personally I think that having from-subject-IP would be more usefull than from-to-IP is there some way to change it over? -----Fight back spam! Download the Blue Frog.http://www.bluesecurity.com/register/s?user=VG9ydGFuaWNr Send instant messages to your online friends http://uk.messenger.yahoo.com |
|
From: Lionel B. <lio...@bo...> - 2006-05-13 14:01:44
|
Dan Faerch wrote the following on 13.05.2006 13:55 : > I am afraid i dont have access to the whiteliste, as it isnt hosted on > sourceforge.. That would have been a nice solution but IIRC it goes against sourceforge policy (I've seen other projects been told to remove automatic updates from their SF web spaces). Anyway if I fail to maintain the whitelists, you only need to setup another site and tell users to modify the "whitelists_host" entry in the configuration file. > So far ive seen 2 requests for whitelisting since Lionel has been gone: > > cacert.org > metmailout1.tmr3.com & metmailout8.tmr3.com I just added cacert.org to the whitelists but not tmr3.com. tmr3.com looks suspicious to me: - From the site : Marketing Automation : Deliver email messages and text messages to drive customer acquisition, retention and loyalty) - From the log excerpts, the servers tried to deliver 5 times in only 25 seconds. This doesn't look like a well-behaved MTA... I'll wait for at least another report on tmr3.com before adding them to the whitelists. Lionel |
|
From: Dan F. <da...@ha...> - 2006-05-13 11:55:23
|
I am afraid i dont have access to the whiteliste, as it isnt hosted on sourceforge.. So far ive seen 2 requests for whitelisting since Lionel has been gone: cacert.org metmailout1.tmr3.com & metmailout8.tmr3.com So far i think we should just add them manually to our .local whitelists. Ill keep a note of all whitelist requests, and if it grows or it becomes a real problem ill figure something out. Since we dont know when Lionel will be back, lets just do it like this for the time being. I mean, if eg. he's already back within, say 14 days, theres really no need to rush into alternate update url's and such. But if it becomes a problem, ill make a solution. Promise :) - Dan Andrew Diederich wrote: > CAcert is a free certificate authority (http://www.cacert.org). They > send out email pings when you want to register a new email address or > domain. However, they don't use a real outgoing mailserver, just > connect out once in some sort of script. Greylisting then effectively > permanently blocks the email. They workaround is to send an email > ping twice. > > Would you add *.cacert.org to the whitelist? > |
|
From: Andrew D. <and...@gm...> - 2006-05-12 18:11:07
|
CAcert is a free certificate authority (http://www.cacert.org). They send out email pings when you want to register a new email address or domain. However, they don't use a real outgoing mailserver, just connect out once in some sort of script. Greylisting then effectively permanently blocks the email. They workaround is to send an email ping twice. Would you add *.cacert.org to the whitelist? --=20 Andrew Diederich |
|
From: Dan F. <da...@ha...> - 2006-05-12 16:02:39
|
Dan Faerch wrote: > Steve Heaven wrote: >> Can someone post a patch to filter out invalid chars from the recipient >> address. >> > > I downloaded 1.7 to make a patch for you, when i noticed that 1.7.3 > actually seem to correct handling of this issue.. Maybe upgrading to > 1.7.3 an isnt an option for you? > > If not, then ive made a quick fix for you against 1.7.1: Did either of these solutions solve your problem? - Dan |
|
From: Lionel B. <lio...@bo...> - 2006-05-09 23:27:22
|
Hi, sorry for the lack of contributions for the last months. I've had some personal problems to deal with and some more are yet to be fully resolved. Dan Faerch proposed to help. I just gave him write access to the CVS and he can do file releases too. Hopefully this will help with the lack of updates. I hope I'll soon find the motivation needed to help him. Best regards, Lionel |
|
From: Dan F. <da...@ha...> - 2006-05-09 18:13:55
|
Steve Heaven wrote: > Can someone post a patch to filter out invalid chars from the recipient > address. > I downloaded 1.7 to make a patch for you, when i noticed that 1.7.3 actually seem to correct handling of this issue.. Maybe upgrading to 1.7.3 an isnt an option for you? If not, then ive made a quick fix for you against 1.7.1: --- sqlgrey.org 2006-05-09 20:12:12.000000000 +0200 +++ sqlgrey 2006-05-09 20:12:37.000000000 +0200 @@ -994,7 +994,7 @@ $rcpt =~ s/\./\[\.\*-\]+/g; my ($rcpt_lhs, $rcpt_rhs) = split /\@/, $rcpt, 2; # BATV implementations use third or first alternative (first by abuse.net) - my $pat = qr/$rcpt_lhs[=\?\*~\.]+?$rcpt_rhs|$rcpt_rhs[=\?\*~\.]+?$rcpt_lhs|$rcpt_lhs/; + my $pat = qr/\Q$rcpt_lhs\E[=\?\*~\.]+?\Q$rcpt_rhs\E|\Q$rcpt_rhs\E[=\?\*~\.]+?\Q$rcpt_lhs\E|\Q$rcpt_lhs\E/; # replace address with capital RCPT to be save with deletes $user =~ s/(.+[\*=-])$pat(.*)/$1RCPT$2/; |
|
From: Steve H. <st...@th...> - 2006-05-09 09:33:45
|
I think I have found it. After each 'fatal' log entry is one like this: May 9 09:05:51 frigga postfix/smtpd[10624]: NOQUEUE: reject: RCPT from nt03araq.keele.netcentral.co.uk[212.57.235.2]: 450 Server configuration problem; from=<He...@re...> to=<*sc...@sm...> proto=ESMTP helo=<nt03araq.keele.netcentral.co.uk> Note the recipient address of *sc...@sm.... It looks like the * in the user part is causing the problem Can someone post a patch to filter out invalid chars from the recipient address. -- thorNET Internet Services, Consultancy & Training www.thornet.co.uk |
|
From: Urban, F. <Fra...@co...> - 2006-05-09 09:28:40
|
that was the reason why we went back to 1.6.... The downgrade was no problem _____ Von: sql...@li... [mailto:sql...@li...] Im Auftrag von Steve Heaven Gesendet: Dienstag, 9. Mai 2006 11:25 An: sql...@li... Betreff: Re: [Sqlgrey-users] sqlgrey dies - MORE It's now done it twice more: May 9 09:05:50 frigga sqlgrey: fatal: Quantifier follows nothing in regex; marked by <-- HERE in m/* <-- HERE scole[=\?\*~\.]+?smtp1[.*-]+thornet[.*-]+co[.*-]+uk|smtp1[.*-]+thornet[.*-]+ co[.*-]+uk[=\?\*~\.]+?*scole|*scole/ at /usr/sbin/sqlgrey line 997. May 9 10:09:46 frigga sqlgrey: fatal: Quantifier follows nothing in regex; marked by <-- HERE in m/* <-- HERE scole[=\?\*~\.]+?smtp1[.*-]+thornet[.*-]+co[.*-]+uk|smtp1[.*-]+thornet[.*-]+ co[.*-]+uk[=\?\*~\.]+?*scole|*scole/ at /usr/sbin/sqlgrey line 997. Does anyone know what's causing this? Thanks Steve -- thorNET Internet Services, Consultancy & Training www.thornet.co.uk |
|
From: Steve H. <st...@th...> - 2006-05-09 09:25:15
|
It's now done it twice more: May 9 09:05:50 frigga sqlgrey: fatal: Quantifier follows nothing in regex; marked by <-- HERE in m/* <-- HERE scole[=\?\*~\.]+?smtp1[.*-]+thornet[.*-]+co[.*-]+uk|smtp1[.*-]+thornet[.*-]+co[.*-]+uk[=\?\*~\.]+?*scole|*scole/ at /usr/sbin/sqlgrey line 997. May 9 10:09:46 frigga sqlgrey: fatal: Quantifier follows nothing in regex; marked by <-- HERE in m/* <-- HERE scole[=\?\*~\.]+?smtp1[.*-]+thornet[.*-]+co[.*-]+uk|smtp1[.*-]+thornet[.*-]+co[.*-]+uk[=\?\*~\.]+?*scole|*scole/ at /usr/sbin/sqlgrey line 997. Does anyone know what's causing this? Thanks Steve -- thorNET Internet Services, Consultancy & Training www.thornet.co.uk |
|
From: Steve H. <st...@th...> - 2006-05-09 08:21:40
|
We have been running v 1.7.1 for several months with no problems. However yesterday the sqlgrey daemon died twice with this in the logs: May 8 14:48:17 frigga sqlgrey: fatal: Quantifier follows nothing in regex; marked by <-- HERE in m/* <-- HERE scole[=\?\*~\.]+?smtp1[.*-]+thornet[.*-]+co[.*-]+uk|smtp1[.*-]+thornet[.*-]+co[.*-]+uk[=\?\*~\.]+?*scole|*scole/ at /usr/sbin/sqlgrey line 997. May 8 16:57:00 frigga sqlgrey: fatal: Quantifier follows nothing in regex; marked by <-- HERE in m/* <-- HERE scole[=\?\*~\.]+?smtp1[.*-]+thornet[.*-]+co[.*-]+uk|smtp1[.*-]+thornet[.*-]+co[.*-]+uk[=\?\*~\.]+?*scole|*scole/ at /usr/sbin/sqlgrey line 997. Does anyone know why ? Thanks Steve -- thorNET Internet Services, Consultancy & Training www.thornet.co.uk |
|
From: Andrew D. <and...@gm...> - 2006-04-27 22:35:27
|
Because of the sqlgrey memory leak with postgresql I began restarting sqlgrey every two hours. Unfortunately, when sqlgrey is down all mail is rejected: Apr 25 22:14:19 tango postfix/smtpd[1448]: NOQUEUE: reject: RCPT from smtp-02.sc8.finance.lycos.com[209.202.214.112]: 450 Server configuration problem; from=3D<Por...@sm...> to=3D<in...@ne...> proto=3DSMTP helo=3D<smtp-02.sc8.finance.lycos.com> Does anyone know of a postfix config option to make this a "DUNNO" if sqlgrey is off? I've implemented sqlgrey in smptd_policy_restrictions (check_policy_service inet:127.0.0.01:2501 ) like this: smtpd_recipient_restrictions =3D reject_non_fqdn_recipient reject_non_fqdn_sender reject_unknown_recipient_domain permit_mynetworks permit_tls_clientcerts permit_sasl_authenticated reject_unauth_destination reject_unauth_pipelining reject_invalid_hostname check_recipient_access hash:/etc/postfix/oldusers check_policy_service inet:127.0.0.01:2501 check_recipient_access hash:/etc/postfix/roleaccount_exceptions reject_non_fqdn_hostname check_sender_mx_access cidr:/etc/postfix/bogus_mx check_sender_access hash:/etc/postfix/rhsbl_sender_exceptions reject_rbl_client cbl.abuseat.org warn_if_reject reject_rbl_client dul.dnsbl.sorbs.net reject_rbl_client bl.spamcop.net reject_rbl_client sbl-xbl.spamhaus.org warn_if_reject reject_rbl_client list.dsbl.org warn_if_reject reject_rbl_client dnsbl.njabl.org warn_if_reject reject_rhsbl_sender dsn.rfc-ignorant.org permit -- Andrew Diederich |
|
From: Andrew D. <and...@gm...> - 2006-04-26 14:51:40
|
On 4/25/06, Fra...@co... <Fra...@co...> wrote= : > > > Sorry about that. SuSE 10.0 and postfix 2.2.5. PEBKAC. > > What db version are you using? > buildin mysql 4.1.13 Since you're using mysql, there could be an issue with postgreSQL then, since that's a big difference between our setups. I'm delaying between 1,500 to 2,500 mails a day, as comparison. Has anyone else run into issues with 1.6.7 and postgreSQL? -- Andrew Diederich |
|
From: <Fra...@co...> - 2006-04-26 05:40:24
|
> Sorry about that. SuSE 10.0 and postfix 2.2.5. PEBKAC. > What db version are you using? buildin mysql 4.1.13 > You're running pre-1.6.7, then? It came out in October. At the beginning we used Suse 9.2 with sqlgrey 7.x version. Then I learned that the 7.x tree is a development tree and we switched to 1.6.7 Also Suse 10.0 is not running since June on our servers ;) The last update was done at the end of march. Frank |
|
From: Dan M. <dan...@da...> - 2006-04-25 20:37:50
|
On Tue, Apr 25, 2006 at 02:57:02PM -0500, Dan Mason wrote: > Attached is a Perl script to replace sqlgrey's "update_sqlgrey_config". Sorry for following up to my own post, but I saw a post-lunch error. The error did not inhibit the script's functionality, but it bothered me. Anyhow, the script is attached. Dan -- A solution can be technically correct given certain assumptions, but if it ignores known details, it is not worthy of discussion. Maybe as technologists we want so much to believe that every problem has a solution, that sometimes we overlook the obvious. Maybe there are so many details to consider that we get confused. Maybe after a while we just stop caring. --Unknown |
|
From: Andrew D. <and...@gm...> - 2006-04-25 20:24:50
|
On 4/25/06, Urban, Frank <Fra...@co...> wrote: > postfix 2.5????? > Suse 8.0.3???? > Whats that.... > I think the newest postfix Version is 2.3 and there was never a Suse 8.0.= 3 > Version Sorry about that. SuSE 10.0 and postfix 2.2.5. PEBKAC. What db version are you using? > We are using Suse 10.0 with the buildin postfix 2.2 an everythink ist > running well since last June. Sqlgrey has rejected arround 43.000.000 Mai= ls > in this time. There was never a memory problem. You're running pre-1.6.7, then? It came out in October. -- Andrew Diederich |
|
From: Urban, F. <Fra...@co...> - 2006-04-25 19:57:56
|
postfix 2.5?????=20 Suse 8.0.3???? Whats that.... I think the newest postfix Version is 2.3 and there was never a Suse = 8.0.3 Version We are using Suse 10.0 with the buildin postfix 2.2 an everythink ist running well since last June. Sqlgrey has rejected arround 43.000.000 = Mails in this time. There was never a memory problem. Frank > -----Urspr=FCngliche Nachricht----- > Von: sql...@li...=20 > [mailto:sql...@li...] Im Auftrag=20 > von Andrew Diederich > Gesendet: Dienstag, 25. April 2006 17:10 > An: sql...@li... > Betreff: [Sqlgrey-users] Memory leak in 1.6.7? >=20 > My setup is postfix 2.5, sqlgrey 1.6.7, postgres 8.0.3 on SuSE 8.0.3. = > When I left work last night postgres' postmaster was 50mb of=20 > RAM, sqlgrey 24mb. This morning postmaster was 106mb,=20 > sqlgrey 44mb. I restarted sqlgrey and postgres and sqlgrey=20 > dropped way down in memory usage. >=20 > Are there any known memory issues with SQLgrey 1.6.7? Is=20 > there anything I can give you to help debug this? Thanks for=20 > the help. >=20 > -- > Andrew Diederich >=20 >=20 > ------------------------------------------------------- > Using Tomcat but need to do more? Need to support web=20 > services, security? > Get stuff done quickly with pre-integrated technology to make=20 > your job easier Download IBM WebSphere Application Server=20 > v.1.0.1 based on Apache Geronimo > http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D120709&bid=3D263057& > dat=3D121642 > _______________________________________________ > Sqlgrey-users mailing list > Sql...@li... > https://lists.sourceforge.net/lists/listinfo/sqlgrey-users >=20 |
|
From: Dan M. <dan...@da...> - 2006-04-25 19:57:05
|
Attached is a Perl script to replace sqlgrey's "update_sqlgrey_config". The sqlgrey included "update_sqlgrey_config" is dependent on bash, wget, and md5sum. Instead, my attached Perl script uses Digest::MD5 and LWP::UserAgent. Pick your poison. :) This Perl script is of course distributed under the terms of the GNU General Public License. I'd appreciate comments or criticism! Dan -- A solution can be technically correct given certain assumptions, but if it ignores known details, it is not worthy of discussion. Maybe as technologists we want so much to believe that every problem has a solution, that sometimes we overlook the obvious. Maybe there are so many details to consider that we get confused. Maybe after a while we just stop caring. --Unknown |
|
From: Andrew D. <and...@gm...> - 2006-04-25 15:09:47
|
My setup is postfix 2.5, sqlgrey 1.6.7, postgres 8.0.3 on SuSE 8.0.3.=20 When I left work last night postgres' postmaster was 50mb of RAM, sqlgrey 24mb. This morning postmaster was 106mb, sqlgrey 44mb. I restarted sqlgrey and postgres and sqlgrey dropped way down in memory usage. Are there any known memory issues with SQLgrey 1.6.7? Is there anything I can give you to help debug this? Thanks for the help. -- Andrew Diederich |
|
From: Andrew D. <and...@gm...> - 2006-04-24 18:51:58
|
It looks like IBM sends email from a big bank of sendmail servers.=20 When my SQL Grey 1.6.7 setup receives new messaegs from them, it properly temporarily rejects the mail. When IBM reconnects, it tends to send from a different mail server, repeating the process. Just when I thought it had sent from enough mail servers, SQL Grey has labeled the mail "spam". How can I better allow the mail through?=20 Here's an example set of transactions from IBM. I get an initial contact from smtp server A, a reconnect from B, another reconnect from B, then the mail goes through. An issue is the server at A is then listed as spam. **** IBMuser connects from 32.97.182.142 to send an email to three users. **** Apr 21 16:57:11 tango sqlgrey: grey: new: 32.97.182(32.97.182.142), IB...@ca... -> us...@pa... Apr 21 16:59:44 tango postfix/smtpd[19663]: NOQUEUE: reject: RCPT from e2.ny.us.ibm.com[32.97.182.142]: 450 <us...@pa...>: Recipient address rejected: Greylisted for 5 minutes; from=3D<IB...@ca...> to=3D<us...@pa...> proto=3DESMTP helo=3D<e2.ny.us.ibm.com> Apr 21 16:59:44 tango sqlgrey: grey: new: 32.97.182(32.97.182.142), IB...@ca... -> us...@pa... Apr 21 17:00:44 tango postfix/smtpd[19663]: NOQUEUE: reject: RCPT from e2.ny.us.ibm.com[32.97.182.142]: 450 <us...@pa...>: Recipient address rejected: Greylisted for 5 minutes; from=3D<IB...@ca...> to=3D<us...@pa...> proto=3DESMTP helo=3D<e2.ny.us.ibm.com> Apr 21 17:00:44 tango sqlgrey: grey: new: 32.97.182(32.97.182.142), IB...@ca... -> us...@pa... Apr 21 17:01:44 tango postfix/smtpd[19663]: NOQUEUE: reject: RCPT from e2.ny.us.ibm.com[32.97.182.142]: 450 <us...@pa...>: Recipient address rejected: Greylisted for 5 minutes; from=3D<IB...@ca...> to=3D<us...@pa...> proto=3DESMTP helo=3D<e2.ny.us.ibm.com> Apr 21 17:01:46 tango postfix/smtpd[19663]: disconnect from e2.ny.us.ibm.com[32.97.182.142] **** 49 minutes later, reconnect from another smtp server, 32.97.110.157. **** Apr 21 17:50:17 tango postfix/smtpd[19957]: connect from over.co.us.ibm.com[32.97.110.157] Apr 21 17:50:17 tango sqlgrey: grey: new: 32.97.110(32.97.110.157), IB...@ca... -> us...@pa... Apr 21 17:51:52 tango postfix/smtpd[19957]: NOQUEUE: reject: RCPT from over.co.us.ibm.com[32.97.110.157]: 450 <us...@pa...>: Recipient address rejected: Greylisted for 5 minutes; from=3D<IB...@ca...> to=3D<us...@pa...> proto=3DESMTP helo=3D<over.co.us.ibm.com> Apr 21 17:51:52 tango sqlgrey: grey: new: 32.97.110(32.97.110.157), IB...@ca... -> us...@pa... Apr 21 17:52:51 tango postfix/smtpd[19957]: NOQUEUE: reject: RCPT from over.co.us.ibm.com[32.97.110.157]: 450 <us...@pa...>: Recipient address rejected: Greylisted for 5 minutes; from=3D<IB...@ca...> to=3D<us...@pa...> proto=3DESMTP helo=3D<over.co.us.ibm.com> Apr 21 17:52:51 tango sqlgrey: grey: new: 32.97.110(32.97.110.157), IB...@ca... -> us...@pa... Apr 21 17:53:51 tango postfix/smtpd[19957]: NOQUEUE: reject: RCPT from over.co.us.ibm.com[32.97.110.157]: 450 <us...@pa...>: Recipient address rejected: Greylisted for 5 minutes; from=3D<IB...@ca...> to=3D<us...@pa...> proto=3DESMTP helo=3D<over.co.us.ibm.com> Apr 21 17:54:51 tango postfix/smtpd[19957]: disconnect from over.co.us.ibm.com[32.97.110.157] **** 10 minutes later, reconnects from 2nd IP, 32.97.110.157. This matches the awl (automatic white list) this time. Mail goes through. **** Apr 21 22:05:21 tango postfix/smtpd[20734]: connect from unknown[32.97.110.= 157] Apr 21 22:05:22 tango sqlgrey: grey: from awl match: updating 32.97.110.157(32.97.110.157), IB...@ca...(IB...@ca...) Apr 21 22:07:57 tango postfix/smtpd[20734]: 18495227AC: client=3Dunknown[32.97.110.157] Apr 21 22:07:57 tango sqlgrey: grey: from awl match: updating 32.97.110.157(32.97.110.157), IB...@ca...(IB...@ca...) Apr 21 22:08:57 tango sqlgrey: grey: from awl match: updating 32.97.110.157(32.97.110.157), IB...@ca...(IB...@ca...) Apr 21 22:09:57 tango postfix/cleanup[20775]: 18495227AC: message-id=3D<OFBFA42EA8.85BBA81B-ON85257157.007D7EE3-85257157.007DE4C0@ca.= ibm.com> Apr 21 22:09:57 tango postfix/qmgr[16223]: 18495227AC: from=3D<IB...@ca...>, size=3D8863, nrcpt=3D3 (queue active) Apr 21 22:10:03 tango postfix/smtp[20776]: DF3A119AEA: to=3D<us...@pa...>, relay=3Dmail.patronsystems.net[66.150.96.252], delay=3D6, status=3Dsent (25= 0 Message queued) Apr 21 22:10:03 tango postfix/smtp[20776]: DF3A119AEA: to=3D<us...@pa...>, relay=3Dmail.patronsystems.net[66.150.96.252], delay=3D6, status=3Dsent (25= 0 Message queued) Apr 21 22:10:03 tango postfix/smtp[20776]: DF3A119AEA: to=3D<us...@pa...>, relay=3Dmail.patronsystems.net[66.150.96.252], delay=3D6, status=3Dsent (25= 0 Message queued) **** Next Day. Mail from the original IP, listed as spam. These come in fairly l= arge chunks. Is this reporting, not connections? **** Apr 22 17:01:07 tango sqlgrey: spam: 32.97.182: IB...@ca... -> us...@pa... at 2006-04-21 16:57:11.103509 Apr 22 17:01:07 tango sqlgrey: spam: 32.97.182: IB...@ca... -> us...@pa... at 2006-04-21 16:59:44.681969 Apr 22 17:01:07 tango sqlgrey: spam: 32.97.182: IB...@ca... -> us...@pa... at 2006-04-21 17:00:44.782274 -- Andrew Diederich |
18 messages has been excluded from this view by a project administrator.
