This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Double Greylisting in Astaro V8.1

Right now i have greylisting turned off..and am using the "recommended" rbl's(along with a couple of my own).  If you also turn on the greylisting checkbox you WILL be doing double greylisting.

2011:02:24-13:31:06 firewall exim[12271]: 2011-02-24 13:31:06 H=nm6.bullet.mail.ne1.yahoo.com [98.138.90.69]:44528 Warning: faithsbc.org profile excludes greylisting: Skipping greylisting for this message
2011:02:24-13:31:06 firewall exim[12271]: 2011-02-24 13:31:06 id="1003" severity="info" sys="SecureMail" sub="smtp" name="email rejected" srcip="98.138.90.69" from="****@yahoo.com" to="*******@faithsbc.org" size="-1" reason="rbl" extra="grey.rbl.ctipd.astaro.local"
2011:02:24-13:31:06 firewall exim[12271]: 2011-02-24 13:31:06 H=nm6.bullet.mail.ne1.yahoo.com [98.138.90.69]:44528 F= temporarily rejected RCPT : Delivery from 98.138.90.69 is deferred. Send again or check at Check IP Reputation | Commtouch - Internet Security Solutions. Reference code: tid=0001.0A020302.4D66A23D.0140
2011:02:24-13:31:06 firewall exim[12271]: 2011-02-24 13:31:06 SMTP connection from nm6.bullet.mail.ne1.yahoo.com [98.138.90.69]:44528 closed by QUIT
2011:02:24-13:33:52 firewall exim[6576]: 2011-02-24 13:33:52 SMTP connection from [151.80.204.105]:2013 (TCP/IP connection count = 1)

This is a legit e-mail from a legit user(i had the user e-mail something to our pastor while i watched the live log).  The response means the recommended rbl's employ greylisting.  This means if you enable greylisting in the field with rbl helo/rdns..etc etc you will be doing double greylisting..and this breaks many mailservers that ARE operating correctly.  Astaro needs to either remove the grey from the commtouch rbl's OR remove the greylist checkbox at the bottom of the anti-spam field or disable the greylisting checkbox at the bottom if the recommended rbl's are being used.

So folks here's the workaround:
if you use the recommended rbl's do NOT tick the greylisting box at the bottom.  If you want to use greylisting(to bypass the inaccurate commtouch greylist) you need to uncheck use recommended rb's and then put in your own rbl's into the box.  I use spamhaus xen the the brbl(barbell) list form barracude networks.  xen is free within limits and the brbl is free with registration.

I will be filing a bug report on this one.

This thread was automatically locked due to age.

Parents

0 William Warren over 14 years ago

temporarily rejected RCPT

that's greylisting. My statement stands as true. If it's restricted to yahoo and hotmail then yes that's in issue with commtouch..but for hotmail and yahoo that sitll counts as double greylisting if you enable greylisting as well..sincet a temp reject is being done by the commtouch engine..that's a greylist..then it'll get rejected again by the actual grey listing engine..that's going to cause issues.

Owner: Emmanuel Technology Consulting

http://etc-md.com

Former Sophos SG(Astaro) advocate/researcher/Silver Partner

PfSense w/Suricata, ntopng,

Other addons to follow
Cancel
Vote Up 0 Vote Down

Cancel
0 Billybob over 14 years ago in reply to William Warren

This is not limited to hotmail and yahoo. I mostly made most of my noise for those two services since I get a lot of mail from them. A recent snippet from my 8.102 log
2011:02:14-06:19:31 gatekeeper exim[11900]: 2011-02-14 06:19:31 H=smtp154.sms.ac [208.69.101.154]:46412 F= temporarily rejected RCPT : Delivery from 208.69.101.154 is deferred. Send again or check at Check IP Reputation | Commtouch - Internet Security Solutions. Reference code: tid=******.00EC
2011:02:24-19:19:31 gatekeeper exim[11989]: 2011-02-14 06:19:31 SMTP connection from smtp154.sms.ac [208.69.101.154]:46412 closed by QUIT

Other people had issues with other domains also.

From what I gather, commtouch has positive spam sending IPs and then there are some that are sometimes used to send spam. Its the second category that gets greylisted.

Hopefully with you making the noise they will do something about it. Hey you got the local content filter database done almost single handedly. I never thought that was going to happen either.[;)]
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 14 years ago in reply to Billybob

This is not limited to hotmail and yahoo. I mostly made most of my noise for those two services since I get a lot of mail from them. A recent snippet from my 8.102 log

Other people had issues with other domains also.

From what I gather, commtouch has positive spam sending IPs and then there are some that are sometimes used to send spam. Its the second category that gets greylisted.

Hopefully with you making the noise they will do something about it. Hey you got the local content filter database done almost single handedly. I never thought that was going to happen either.[;)]

I'm going to watch my logs and see if commtouch greys anything else. this is a major issue though becuase if the commtouch greys something then it passes then it's going to get greyed again once the asl's greylisting kicks in. I know my mail traffic came to a halt..NO e-mail for 3 hours...it prompted a call from church staff wondering what happened to the e-mail. Once i turned off greylisting in the anti-spam area things started flowing again once the retransmits kicked in about 5 minutes later. I knew there was something weird with the greylisting going on but since i was able to work around it quickly I did not investigate it further..yet. I then saw this thread while i was studying for my HAM radio license and too a gander at things. That's when i figured out the greylisting issues. I'm glad i don't have grey listing on the mail server itself turned on..i wouldn't get mail for months!!!

Owner: Emmanuel Technology Consulting

http://etc-md.com

Former Sophos SG(Astaro) advocate/researcher/Silver Partner

PfSense w/Suricata, ntopng,

Other addons to follow
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 William Warren over 14 years ago in reply to Billybob

This is not limited to hotmail and yahoo. I mostly made most of my noise for those two services since I get a lot of mail from them. A recent snippet from my 8.102 log

Other people had issues with other domains also.

From what I gather, commtouch has positive spam sending IPs and then there are some that are sometimes used to send spam. Its the second category that gets greylisted.

Hopefully with you making the noise they will do something about it. Hey you got the local content filter database done almost single handedly. I never thought that was going to happen either.[;)]

I'm going to watch my logs and see if commtouch greys anything else. this is a major issue though becuase if the commtouch greys something then it passes then it's going to get greyed again once the asl's greylisting kicks in. I know my mail traffic came to a halt..NO e-mail for 3 hours...it prompted a call from church staff wondering what happened to the e-mail. Once i turned off greylisting in the anti-spam area things started flowing again once the retransmits kicked in about 5 minutes later. I knew there was something weird with the greylisting going on but since i was able to work around it quickly I did not investigate it further..yet. I then saw this thread while i was studying for my HAM radio license and too a gander at things. That's when i figured out the greylisting issues. I'm glad i don't have grey listing on the mail server itself turned on..i wouldn't get mail for months!!!

Owner: Emmanuel Technology Consulting

http://etc-md.com

Former Sophos SG(Astaro) advocate/researcher/Silver Partner

PfSense w/Suricata, ntopng,

Other addons to follow
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data