- NZNOG - lists.nznog.org

Re: [nznog] [Fwd: Re: [Fwd: [Computer-support] Greylisting - one day after]
by Russell Fulton 15 Nov '06

15 Nov '06

> > -------- Original Message -------- > Subject: Re: [nznog] [Fwd: [Computer-support] > Greylisting - one day after] > Date: Thu, 16 Nov 2006 14:08:46 +1300 > From: Jasper Bryant-Greene <jasper(a)albumltd.co.nz> > Organisation: Album Limited > To: Richard <richard(a)alternativeuniverse.net> > CC: Russell Fulton <r.fulton(a)auckland.ac.nz>, > nznog(a)list.waikato.ac.nz > References: <2.1.1-1800921-393-A-OEWW(a)222.154.242.106> > > > > Question around this - we are currently looking at > implementing it, but > we have three mail servers behind a load balancer. The software we're > looking at is postgrey (as we use Postfix), but it uses BDB database > files... > > Which means each server has an individual greylisting > database, and mail > could potentially (worst case) be bounced three times before getting > through. Has anyone solved this problem already? With BDB database files you really don't have a lot (any?) options. You could put the file on a NFS share and let all 3 servers use it, but locking issues and overall BDB speed would probably impact your performance greatly. The best solution in this case would be to bring a new server that will run a real database (MySQL, Oracle). If you use a greylisting package that supports these databases (gld does), you can have all servers point to this server and use one central greylisting database. Of course, this way you have a single point of failure (while gld will allow e-mails to flow if the database is not available, you loose greylisting, of course). We at the moment have local MySQL databases on each server. This means that the greylisting delay could be longer, but as we don't have real load balancer but use DNS only, so far this hasn't been the case. As far as I can see, actually, remote MTAs always came back to exactly the same server they were originally greylisted on, probably due to DNS caching on their side. Bojan

2 1

Notification of NZRR Database changes
by NZRR Database Notifications 15 Nov '06

15 Nov '06

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- PREVIOUS OBJECT: route-set: AS9439:RS-ROUTES:AS23754 descr: advertised to AS9439 by CityLink - AS23754 members: 198.48.0.0/22^22-29, 202.8.44.0/22^22-29, 198.32.71.0/24^24-29, 203.118.144.0/24^24-29, 202.7.4.32/28^28-29, 202.7.7.88/29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc(a)citylink.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20050926 source: NZRR REPLACED BY: route-set: AS9439:RS-ROUTES:AS23754 descr: advertised to AS9439 by CityLink - AS23754 members: 198.48.0.0/22^22-29, 202.8.44.0/22^22-29, 202.7.6.0/23^23-29, 97.64.46.0/24^24-29, 198.32.71.0/24^24-29, 202.7.5.0/24^24-29, 203.118.144.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: asjl(a)citylink.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20061116 source: NZRR

1 0

Notification of NZRR Database changes
by NZRR Database Notifications 15 Nov '06

15 Nov '06

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- PREVIOUS OBJECT: route-set: AS9560:RS-ROUTES:AS23754 descr: advertised to AS9560 by CityLink - AS23754 members: 198.48.0.0/22^22-29, 202.8.44.0/22^22-29, 202.7.6.0/23^23-29, 198.32.71.0/24^24-29, 202.7.5.0/24^24-29, 203.118.144.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: asjl(a)citylink.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20050624 source: NZRR REPLACED BY: route-set: AS9560:RS-ROUTES:AS23754 descr: advertised to AS9560 by CityLink - AS23754 members: 198.48.0.0/22^22-29, 202.8.44.0/22^22-29, 202.7.6.0/23^23-29, 97.64.46.0/24^24-29, 198.32.71.0/24^24-29, 202.7.5.0/24^24-29, 203.118.144.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: asjl(a)citylink.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20061116 source: NZRR

1 0

[Fwd: [Computer-support] Greylisting - one day after]
by Russell Fulton 15 Nov '06

15 Nov '06

Hi Folks, This might be of interest to NZNOG members -- we have just implemented grey listing for some addresses and the results have been dramatic to say the least... Russell -------- Original Message -------- Subject: [Computer-support] Greylisting - one day after Date: Thu, 16 Nov 2006 10:50:26 +1300 From: Bojan Zdrnja <b.zdrnja(a)auckland.ac.nz> To: Computer Support <computer-support(a)list.auckland.ac.nz> Hi All, Yesterday at 12:00 (mid day) I enabled greylisting on our e-mail cluster. At the moment we are greylisting only machines that don't have reverse DNS entries, or match one of our predefined name regular expressions (these are matching on modem/dialup/cable/adsl machines). The results of this has been amazing - we are seeing a dramatic decrease in processed spam (almost 10 times!). I'm hoping that you are seeing effects of this in your mailboxes as well - there should be overall less spam (marked and unmarked). I'm attaching two graphs that are showing this. The first graph (total-messages.PNG) shows total messages received after I turned on greylising. Green are legitimate messages, blue is spam, red are infected messages. The second graph (CPU-groucho.PNG) shows CPU utilization on groucho (smtpa - the first SMTP machine). For some reason spammers like to hit this machine the most so you can see last 7 days. Now, this works great at the moment but spammers will adapt and improve their software. My wild guess is that this will help for maybe 6 months to a year, but it will definitely give us some time to prepare for future spam waves. Bojan

2 1

Re: [nznog] [Fwd: [Computer-support] Greylisting - one day after]
by Mark Seward 15 Nov '06

15 Nov '06

On 11/16/06, Daniel <daniel(a)fx.net.nz> wrote: > > Which means each server has an individual greylisting database, and mail > > could potentially (worst case) be bounced three times before getting > > through. Has anyone solved this problem already? .. > http://sqlgrey.sourceforge.net/ We have postfix+sqlgrey deployed across several mail hosts. It would be nice to have a replicated postgres behind it but otherwise it does the job very nicely. Also seen here: Similar dramatic reduction in inbound crap and recent increase in abuse of relays behind legit whitelisted hosts. Cheers, Mark.

1 0

Inbound mail filtering at Ihug
by Martin Kealey 14 Nov '06

14 Nov '06

Hi folks, Just a heads-up: We've recently tightened up the reverse & forward DNS tests applied by our inbound SMTP servers (zuul.ihug.co.nz); sending hosts with mismatched DNS entries are now likely to have all messages rejected. If you need an exception to this rule please let us know (presumably by phone...) -Martin Kealey (Systems Engineer, ihüg)

3 2

Re: [nznog] Inbound mail filtering at Ihug
by Martin Kealey 14 Nov '06

14 Nov '06

Ok, before I get a complete deluge of replies... Personally I agree that dropping connections without explanation is, to say the least, unhelpful. I only started here on Monday so some things might take longer than you'd expect, but I'm already looking into this and other outstanding email issues. -Martin

1 0

Invite to IPV6 Industry Update
by Martyn Pratt (marpratt) 14 Nov '06

14 Nov '06

Hi all, for those with an interest in IPv6, Tony Hain co-chair of the IETF working group developing IPv6 Transition tools will be speaking in Wellington and Auckland, please see below for more details . If anyone would like more info please feel free to contact me directly. Cheers Martyn Industry Update-IPV6 Please join us for an informative update from visiting Cisco Senior Technical Leader Tony Hain on IPV6 Developments and Trends Wellington Event When: Friday 1st December Where: Hotel Intercontinental, Thordon Room, Grey Street What Time: 9am to 10.30am RSVP: Trafong(a)cisco.com Please reply by Tuedsay 21st Nov and advise city in response Auckland Event When: Tuesday 28th November Where: Cisco Auckland Boardroom, L25 ASB Building, 135 Albert St What Time: 3pm- 4pm RSVP: Trafong(a)cisco.com Please reply by Tuedsay 21st Nov and advise city in response More about Tony Hain Tony is currently the Senior Technical Leader, IPv6 technologies with Cisco Systems. In addition to providing guidance to the various internal product teams, he was also co-chair of the IETF working group developing IPv6 Transition tools. His IETF participation since 1987 includes a term on the Internet Architecture Board from 1997 - 2001. Named an IPv6 Forum Fellow in 2004, he is currently serving as Technology Director on the forum's North American IPv6 task force steering committee ________________________________ <http://www.cisco.com/> Martyn Pratt Systems Engineer, New Zealand Cisco Systems, Inc. ________________________________ Contact Information: e-mail: Phone: DDI: Mobile: Web: martyn.pratt(a)cisco.com +64 9 355 1950 +64 9 355 1975 +64 21 504 632 www.cisco.com ________________________________

1 0

Speedtest for every ISP for ispmap.co.nz
by Barry Murphy 14 Nov '06

14 Nov '06

Howdy, Could someone from each ISP send me a link to a speedtest on one of your servers, that is if you have a speed test site for your ISP, this will be linked from http://www.ispmap.co.nz/searchisp.php to your speed test site. Secondly if you have tr.php (from http://tr.meta.net.nz) please advise the link at the same time so we can do something like http://www.ispmap.co.nz/yourIP.php (the traceroute to your IP) from each ISP's page. The idea is to allow users to speed test their connection and run traceroute tests to themselves from multiple providers. To make like easier for myself, please reply with the following: ISP Name: Speedtest URL: Traceroute URL: Are these run by the ISP (yes) or a third party (no): Please reply offlist. Thanks Regards Barry Murphy -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0

ihug email issues
by Quintin Russ 13 Nov '06

13 Nov '06

Hi, Can someone from ihug please contact me offlist regarding ihug mail servers dropping connection from our servers. Thanks, Quintin

2 2