Thread: [Sqlgrey-users] How can I tell that local whitelists are being used

Brought to you by: gyver, ludvigm, rebum

sqlgrey-users

[Sqlgrey-users] How can I tell that local whitelists are being used

From: Douglas M. <do...@im...> - 2010-11-17 21:33:16

Besides making a connection attempt from a whitelisted IP/FQDN & watching the sqlgrey logging, is there any way that I can simply query the locally loaded whitelist for the IP/FQDN in question, or have it output the entire currently loaded whitelist to the console or logging?

Thanks,
-
Doug Mortensen
Network Consultant
Impala Networks Inc
CCNA, MCSA, Security+, A+
Linux+, Network+, Server+
.
www.impalanetworks.com
P: (505) 327-7300
F: (505) 327-7545

Re: [Sqlgrey-users] How can I tell that local whitelists are being used

From: Karl O. P. <ko...@me...> - 2010-11-17 21:43:13

On 11/17/2010 03:32:05 PM, Douglas Mortensen wrote:
> Besides making a connection attempt from a whitelisted IP/FQDN &
> watching the sqlgrey logging, is there any way that I can simply 
> query
> the locally loaded whitelist for the IP/FQDN in question, or have it
> output the entire currently loaded whitelist to the console or
> logging?

All the data's in postgresql.  Use psql to write an sql query,
connecting as the postgresql user or some other user with
rights.  




Karl <ko...@me...>
Free Software:  "You don't pay back, you pay forward."
                 -- Robert A. Heinlein

Re: [Sqlgrey-users] How can I tell that local whitelists are being used

From: Bruce B. <bb...@bo...> - 2010-11-17 22:15:07

Doug,

On Nov 17, 2010, at 3:32 PM, Douglas Mortensen wrote:

> Besides making a connection attempt from a whitelisted IP/FQDN &  
> watching the sqlgrey logging, is there any way that I can simply  
> query the locally loaded whitelist for the IP/FQDN in question, or  
> have it output the entire currently loaded whitelist to the console  
> or logging?

Have you had a look at the "Sqlgrey WebInterface" sgwi?   http://www.vanheusden.com/sgwi/ 
    You can also see a screenshot here: www.beebeec.nl/sgwi/

B. Bodger

Re: [Sqlgrey-users] How can I tell that local whitelists are being used

From: Dan F. <da...@ha...> - 2010-11-18 07:17:48

Its possible to test sqlgrey by talking to it like posfix does, using
telnet or netcat

Example:
$ nc localhost 2501
request=smtpd_access_policy
protocol_state=RCPT
protocol_name=SMTP
client_address=66.102.13.104
client_name=unknown
reverse_client_name=ez-in-f104.1e100.net
helo_name=ez-in-f104.1e100.net
sender=te...@ez...
recipient=te...@ez...
< hit return to add a blank line >

And the server will respond with its verdict:
action=451 Greylisted for 1 minutes (10)

It should be fairly easy to use this to validate a whitelist entry.
Simply modify the appropriate fields in the above and paste it to the
sqlgrey port. Hit return once more to make a blank line at the end and
read the output. Additional information may also be in the log,
depending on your loglevel.

- Dan Faerch
-- 
http://www.phpappwall.com

On 2010-11-17 22:32, Douglas Mortensen wrote:
> Besides making a connection attempt from a whitelisted IP/FQDN & watching the sqlgrey logging, is there any way that I can simply query the locally loaded whitelist for the IP/FQDN in question, or have it output the entire currently loaded whitelist to the console or logging?
>
> Thanks,
> -
> Doug Mortensen
> Network Consultant
> Impala Networks Inc
> CCNA, MCSA, Security+, A+
> Linux+, Network+, Server+
> .
> www.impalanetworks.com
> P: (505) 327-7300
> F: (505) 327-7545
>
>
> ------------------------------------------------------------------------------
> Beautiful is writing same markup. Internet Explorer 9 supports
> standards for HTML5, CSS3, SVG 1.1,  ECMAScript5, and DOM L2 & L3.
> Spend less time writing and  rewriting code and more time creating great
> experiences on the web. Be a part of the beta today
> http://p.sf.net/sfu/msIE9-sfdev2dev
> _______________________________________________
> Sqlgrey-users mailing list
> Sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlgrey-users

Re: [Sqlgrey-users] How can I tell that local whitelists are being used

From: Michal L. <ml...@lo...> - 2010-11-18 07:24:02

  On 11/18/2010 08:02 PM, Dan Faerch wrote:
> Its possible to test sqlgrey by talking to it like posfix does, using
> telnet or netcat
>
> Example:
> $ nc localhost 2501
> request=smtpd_access_policy
> protocol_state=RCPT
> protocol_name=SMTP
> client_address=66.102.13.104
> client_name=unknown
> reverse_client_name=ez-in-f104.1e100.net
> helo_name=ez-in-f104.1e100.net
> sender=te...@ez...
> recipient=te...@ez...
> <  hit return to add a blank line>
>
> And the server will respond with its verdict:
> action=451 Greylisted for 1 minutes (10)
>
Actually there is a "tester.pl" script in the GIT repo for doing exactly 
this :)

~/src/sqlgrey-work.git> ./tester.pl --help
Test tool for SQLgrey daemon.
Author: Michal Ludvig <ml...@lo...> (c) 2009
         http://www.logix.net.nz
Usage: tester.pl --client-ip <address> [--options]
         --host          address to talk to (default: 127.0.0.1)
         --port          TCP port SQLgrey daemon listens on (2501)
         --client-ip     IP or IPv6 address of the 'client' (Required).
         --client-fqdn   Domain name corresponding to --ip
         --sender / --from
                         Envelop MAIL FROM value
         --recipient / --to
                         Envelop RCPT TO value

Michal

[Sqlgrey-users] Odd characters causing db crash

From: Steve H. <st...@th...> - 2011-01-20 07:31:05

Early this morning our Postgres db crashed and restarted several times.
In the logs I found this:

Jan 20 03:43:53 frigga sqlgrey: grey: from awl match: updating
71.81.141.83(71.81.141.83),
s�nc...@18...(s�nc...@18...) 
Jan 20 03:43:53 frigga sqlgrey: dbaccess: warning: couldn't do query:
UPDATE from_awl SET last_seen = NOW(), first_seen = first_seen WHERE
sender_name = 's�nchez85' AND sender_domain = '1800hurt911.com' AND src
= '71.81.141.83': ERROR:  invalid byte sequence for encoding "UTF8":
0xe16e63 HINT:  This error can also happen if the byte sequence does not
match the encoding expected by the server, which is controlled by
"client_encoding". , reconnecting to DB 
Jan 20 03:43:53 frigga sqlgrey: warning: Use of uninitialized value in
concatenation (.) or string at /usr/sbin/sqlgrey line 1154. 
Jan 20 03:43:53 frigga sqlgrey: dbaccess: error: couldn't access
from_awl table:  

It looks like it crashed because the email address had a non UTF8
character. What should the 'client_encoding' be set to?

We are running  sqlgrey 1.7.6 and postgresql  8.1.11

Thanks

Steve

-- 
thorNET 
Internet Services, Consultancy &Training
www.thornet.co.uk

Re: [Sqlgrey-users] Odd characters causing db crash

From: Kenneth M. <kt...@ri...> - 2011-01-20 14:07:36

On Thu, Jan 20, 2011 at 07:06:43AM +0000, Steve Heaven wrote:
> Early this morning our Postgres db crashed and restarted several times.
> In the logs I found this:
> 
> Jan 20 03:43:53 frigga sqlgrey: grey: from awl match: updating
> 71.81.141.83(71.81.141.83),
> s???nc...@18...(s???nc...@18...) 
> Jan 20 03:43:53 frigga sqlgrey: dbaccess: warning: couldn't do query:
> UPDATE from_awl SET last_seen = NOW(), first_seen = first_seen WHERE
> sender_name = 's???nchez85' AND sender_domain = '1800hurt911.com' AND src
> = '71.81.141.83': ERROR:  invalid byte sequence for encoding "UTF8":
> 0xe16e63 HINT:  This error can also happen if the byte sequence does not
> match the encoding expected by the server, which is controlled by
> "client_encoding". , reconnecting to DB 
> Jan 20 03:43:53 frigga sqlgrey: warning: Use of uninitialized value in
> concatenation (.) or string at /usr/sbin/sqlgrey line 1154. 
> Jan 20 03:43:53 frigga sqlgrey: dbaccess: error: couldn't access
> from_awl table:  
> 
> It looks like it crashed because the email address had a non UTF8
> character. What should the 'client_encoding' be set to?
> 
> We are running  sqlgrey 1.7.6 and postgresql  8.1.11
> 
> Thanks
> 
> Steve
> 

You will need to use SQL_ASCII or C encoding for the database
in initdb. Been there, done that, have the crash dump... :)

Ken