sqlgrey-users

[Sqlgrey-users] Enhancements planned

[Lionel B. <lio...@bo...>]

Hi sqlgrey-users,

I've just checked postgrey latest version and they did some enhancements 
that I think could be useful :

- add a X-Greylist header describing the treatment received by the 
message. postgrey seems to only flag messages that have been delayed, 
would you be interested by knowing why a message is allowed on first try 
(net whitelisted, address/IP in AWL, domain/IP in AWL) ?

- postgrey isn't using the client_IP by default now, but the class-C 
network instead. I'm not sure it really is useful, but I lack data to 
make up my mind on this. postgrey added a supplementary check that 
compares the IP address with the fqdn to guess if it is a residential 
connection (last numbers of the IP in the fqdn), in this case it apply 
more strict rules (reverting to the client_IP key instead of the 
class-C_net). This latter check might be useful. Something like a 
"residential-reconnect-delay" parameter meant to be higher than the 
default one for example.

- Better VERP cleanups : this will be included in the next SQLgrey 
release (really simple to add, most useful to support some mailing list 
managers),

- There's a reporting tool for postgrey too that reads the log and 
access the DB to report spam attempts (grouped by client_IP, listing 
each sender/recipient pair and allowing to flag client_IPs which are MX 
for the domain in the PTR, ...), this one could be quite a lot of work 
to code but a reporting tool can be quite handy.

If you have enhancements in mind, feel free to discuss them on the 
mailing-list and put a RFE on sourceforge.

Best regards,

Lionel.

Re: [Sqlgrey-users] Enhancements planned

[Klaus A. S. <kse...@gm...>]

Lionel Bouton wrote:

> If you have enhancements in mind, feel free to discuss them on the
> mailing-list and put a RFE on sourceforge.

I find postgrey's postfix_whitelist_clients.local feature highly
useful, especially that I can use regexps to specify allowed clients. 
Should be very easy to implement, I think.

Cheers,

-- 
Klaus Alexander Seistrup
Magnetic Ink, Copenhagen, Denmark
http://www.magnetic-ink.dk/

Re: [Sqlgrey-users] Enhancements planned

[Lionel B. <lio...@bo...>]

Klaus Alexander Seistrup wrote the following on 10/21/04 08:02 :

>Lionel Bouton wrote:
>
>  
>
>>If you have enhancements in mind, feel free to discuss them on the
>>mailing-list and put a RFE on sourceforge.
>>    
>>
>
>I find postgrey's postfix_whitelist_clients.local feature highly
>useful, especially that I can use regexps to specify allowed clients. 
>Should be very easy to implement, I think.
>
>Cheers,
>  
>

Ok. Here's what I have in mind for SQLgrey 1.3 to allow something like 
this :

1/ Group conf in a new /etc/sqlgrey directory

move current /etc/sqlgrey.conf into it.

Add a /etc/sqlgrey/clients_whitelist file that will be distributed with 
future sqlgrey release (not meant to be modified by users but 
submissions of known weird clients wil be encouraged).
Add an empty /etc/sqlgrey/clients_whitelist.local file meant to be set 
up by the local admin.

2/ Format of client_whitelist*

classic '#' comments, spaces ignored, empty lines ignored.

Line format :
# 1 regexp on fqdn
/regexp/ : match the fqdn if Postfix could look it up, the regexp will 
be a case insensitive perl regexp (see man perlre).
/domain.tld$/ : any client with a A record in domain.tld will be 
whitelisted.
/^a.fqdn.tld$/ : a.fqdn.tld will be whitelisted

# 2 IP/net match
aaa.bbb.ccc.ddd
aaa.bbb.ccc        : match the first bytes of the sender's IP address.
I don't think it's a good idea to match against whole class B networks...

3/ Runtime configuration

SQLgrey will monitor the sqlgrey_whitelist_clients.local file by 
stat'ing the file on each request and reloading if the mtime has 
changed. sqlgrey_whitelist_clients won't be checked (don't touch that).

4/ Integration into current SQLgrey

This whitelist will be top priority : the AWL checks will be done 
*after* the whitelist check.
The net_whitelist supported only with PostgreSQL will be deprecated, 
SQLgrey won't create the table anymore, if the table is empty it will 
drop it, if not it will print a big scarry warning advising to move to 
the new whitelist (but will still use it).

Note : regexp matching will be slow because I will need to match against 
each entry, this is an o(n) algorithm -> don't put too much regexps in 
whitelists.
           ip/net whitelist will be quick because it will be based on 2 
hashes (one for the IPs, one for the class C nets) : expect o(log(n)) perfs.

Suggestions welcomed,

Regards,

Lionel.