This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Double Greylisting in Astaro V8.1

Right now i have greylisting turned off..and am using the "recommended" rbl's(along with a couple of my own).  If you also turn on the greylisting checkbox you WILL be doing double greylisting.

2011:02:24-13:31:06 firewall exim[12271]: 2011-02-24 13:31:06 H=nm6.bullet.mail.ne1.yahoo.com [98.138.90.69]:44528 Warning: faithsbc.org profile excludes greylisting: Skipping greylisting for this message
2011:02:24-13:31:06 firewall exim[12271]: 2011-02-24 13:31:06 id="1003" severity="info" sys="SecureMail" sub="smtp" name="email rejected" srcip="98.138.90.69" from="****@yahoo.com" to="*******@faithsbc.org" size="-1" reason="rbl" extra="grey.rbl.ctipd.astaro.local"
2011:02:24-13:31:06 firewall exim[12271]: 2011-02-24 13:31:06 H=nm6.bullet.mail.ne1.yahoo.com [98.138.90.69]:44528 F= temporarily rejected RCPT : Delivery from 98.138.90.69 is deferred. Send again or check at Check IP Reputation | Commtouch - Internet Security Solutions. Reference code: tid=0001.0A020302.4D66A23D.0140
2011:02:24-13:31:06 firewall exim[12271]: 2011-02-24 13:31:06 SMTP connection from nm6.bullet.mail.ne1.yahoo.com [98.138.90.69]:44528 closed by QUIT
2011:02:24-13:33:52 firewall exim[6576]: 2011-02-24 13:33:52 SMTP connection from [151.80.204.105]:2013 (TCP/IP connection count = 1)

This is a legit e-mail from a legit user(i had the user e-mail something to our pastor while i watched the live log).  The response means the recommended rbl's employ greylisting.  This means if you enable greylisting in the field with rbl helo/rdns..etc etc you will be doing double greylisting..and this breaks many mailservers that ARE operating correctly.  Astaro needs to either remove the grey from the commtouch rbl's OR remove the greylist checkbox at the bottom of the anti-spam field or disable the greylisting checkbox at the bottom if the recommended rbl's are being used.

So folks here's the workaround:
if you use the recommended rbl's do NOT tick the greylisting box at the bottom.  If you want to use greylisting(to bypass the inaccurate commtouch greylist) you need to uncheck use recommended rb's and then put in your own rbl's into the box.  I use spamhaus xen the the brbl(barbell) list form barracude networks.  xen is free within limits and the brbl is free with registration.

I will be filing a bug report on this one.

This thread was automatically locked due to age.

0 William Warren over 14 years ago

I will enable greylisting tomorrow when staff are not in to confirm my findings again. I went on this project because when i ahd the recommended rbl's AND greylisting enabled my mail stopped...completely.

Owner: Emmanuel Technology Consulting

http://etc-md.com

Former Sophos SG(Astaro) advocate/researcher/Silver Partner

PfSense w/Suricata, ntopng,

Other addons to follow
Cancel
Vote Up 0 Vote Down

Cancel
0 Billybob over 14 years ago in reply to William Warren

This is not a greylisting issue but the grey.rbl.ctipd.astaro.local which I first thought was an astaro rbl when first introduced in v8. I am glad someone else besides me is finally going to complain as I have banged my head against the wall multiple times starting with v8 beta. Also if you notice the greylisted mails are counted in your spams under daily executive reports skewing the reports.

https://community.sophos.com/products/unified-threat-management/astaroorg/f/102/t/69628

https://community.sophos.com/products/unified-threat-management/astaroorg/f/102/t/69786
and finally again in v8.1 beta but still broken.
https://community.sophos.com/products/unified-threat-management/astaroorg/f/109/t/70093
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 14 years ago

if you read hte log entry it is a temp rejection..i forgot to get the subsequent entry where it gets allowed..that's greylisting. Because grey.x.x.local acts that way..and says it's that...it's greylisting..and so my statements above stand..[:)]

Owner: Emmanuel Technology Consulting

http://etc-md.com

Former Sophos SG(Astaro) advocate/researcher/Silver Partner

PfSense w/Suricata, ntopng,

Other addons to follow
Cancel
Vote Up 0 Vote Down

Cancel
0 Billybob over 14 years ago in reply to William Warren

I am glad your statement is still standing for a problem that is more than a year old. Sometimes I wonder why I even bother with certain people.
Peace
Bill.
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 14 years ago

if you don't want to bother with "some" people..like evidently myself..put "those people" on your ignore list..then you don't have to bother..

Owner: Emmanuel Technology Consulting

http://etc-md.com

Former Sophos SG(Astaro) advocate/researcher/Silver Partner

PfSense w/Suricata, ntopng,

Other addons to follow
Cancel
Vote Up 0 Vote Down

Cancel
0 Billybob over 14 years ago in reply to William Warren

Right now i have greylisting turned off..and am using the "recommended" rbl's(along with a couple of my own). If you also turn on the greylisting checkbox you WILL be doing double greylisting.

This statement is not true. You are misleading the general public by making a broad statement. The astaro rbl grey.rbl.ctipd.astaro.local does not grey list everything so how is it double greylisting. The things that it greylists have been documented in various betas and I even added the links to make you better informed, but you stubbornly keep on pushing the issue without even doing a little background reading to atleast understand the origin/cause of the problem before you go on a general rant.

if you don't want to bother with "some" people..like evidently myself..put "those people" on your ignore list..then you don't have to bother..

Ironic that you managed to read that one line real quick and had a quick come back but didn't spend a single click on my multiple links that would have shed some light on your epiphany of the day.[:D]

See ya
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 14 years ago

hey you weren't supposed to be bothering with me remember?..

Owner: Emmanuel Technology Consulting

http://etc-md.com

Former Sophos SG(Astaro) advocate/researcher/Silver Partner

PfSense w/Suricata, ntopng,

Other addons to follow
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 14 years ago

temporarily rejected RCPT

that's greylisting. My statement stands as true. If it's restricted to yahoo and hotmail then yes that's in issue with commtouch..but for hotmail and yahoo that sitll counts as double greylisting if you enable greylisting as well..sincet a temp reject is being done by the commtouch engine..that's a greylist..then it'll get rejected again by the actual grey listing engine..that's going to cause issues.

Owner: Emmanuel Technology Consulting

http://etc-md.com

Former Sophos SG(Astaro) advocate/researcher/Silver Partner

PfSense w/Suricata, ntopng,

Other addons to follow
Cancel
Vote Up 0 Vote Down

Cancel
0 Billybob over 14 years ago in reply to William Warren

This is not limited to hotmail and yahoo. I mostly made most of my noise for those two services since I get a lot of mail from them. A recent snippet from my 8.102 log
2011:02:14-06:19:31 gatekeeper exim[11900]: 2011-02-14 06:19:31 H=smtp154.sms.ac [208.69.101.154]:46412 F= temporarily rejected RCPT : Delivery from 208.69.101.154 is deferred. Send again or check at Check IP Reputation | Commtouch - Internet Security Solutions. Reference code: tid=******.00EC
2011:02:24-19:19:31 gatekeeper exim[11989]: 2011-02-14 06:19:31 SMTP connection from smtp154.sms.ac [208.69.101.154]:46412 closed by QUIT

Other people had issues with other domains also.

From what I gather, commtouch has positive spam sending IPs and then there are some that are sometimes used to send spam. Its the second category that gets greylisted.

Hopefully with you making the noise they will do something about it. Hey you got the local content filter database done almost single handedly. I never thought that was going to happen either.[;)]
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 14 years ago in reply to Billybob

This is not limited to hotmail and yahoo. I mostly made most of my noise for those two services since I get a lot of mail from them. A recent snippet from my 8.102 log

Other people had issues with other domains also.

From what I gather, commtouch has positive spam sending IPs and then there are some that are sometimes used to send spam. Its the second category that gets greylisted.

Hopefully with you making the noise they will do something about it. Hey you got the local content filter database done almost single handedly. I never thought that was going to happen either.[;)]

I'm going to watch my logs and see if commtouch greys anything else. this is a major issue though becuase if the commtouch greys something then it passes then it's going to get greyed again once the asl's greylisting kicks in. I know my mail traffic came to a halt..NO e-mail for 3 hours...it prompted a call from church staff wondering what happened to the e-mail. Once i turned off greylisting in the anti-spam area things started flowing again once the retransmits kicked in about 5 minutes later. I knew there was something weird with the greylisting going on but since i was able to work around it quickly I did not investigate it further..yet. I then saw this thread while i was studying for my HAM radio license and too a gander at things. That's when i figured out the greylisting issues. I'm glad i don't have grey listing on the mail server itself turned on..i wouldn't get mail for months!!!

Owner: Emmanuel Technology Consulting

http://etc-md.com

Former Sophos SG(Astaro) advocate/researcher/Silver Partner

PfSense w/Suricata, ntopng,

Other addons to follow
Cancel
Vote Up 0 Vote Down

Cancel