From: Steve Simon <steve@quintile.net>
To: 9front@9front.org
Subject: Re: [9front] dns tools
Date: Tue, 31 Jan 2023 07:58:39 +0000 [thread overview]
Message-ID: <7C2D6F4D-43C7-4414-AB27-355251682286@quintile.net> (raw)
In-Reply-To: <8D9D9A9B7E2B716DB457719182D5271D@thinktankworkspaces.com>
there is also greylisting in smtpd which can put off some bots.
if its a small selection of ip addresses, smtpd can be told to silently drop ip connections from these.
i have a modified ratfs which checks the remote dns name and rejects based on a pattern match. i also added a hex digit pattern (%). the idea was to reject all email from rdns names like:
line.%.%-adsl.verizon-west.com
this helped with everything else, but sadly i have (after about 15 years) given up receiving email on plan9 and use my isp. $work and kids don't leave enough time to fight the good email fight
-Steve
> On 31 Jan 2023, at 6:44 am, william@thinktankworkspaces.com wrote:
>
> ratfs seems to be working. I'm not getting the mail locally, but they still keep trying
>
> maat Jan 30 21:37:52 ehlo from 185.24.233.112 as ADMIN
> maat Jan 30 21:37:52 Hung up on 185.24.233.112; claimed to be ADMIN
> maat Jan 30 21:45:59 ehlo from 185.24.233.112 as ADMIN
> maat Jan 30 21:45:59 Hung up on 185.24.233.112; claimed to be ADMIN
> maat Jan 30 21:49:44 ehlo from 81.161.229.226 as WIN-CLJ1B0GQ6JP
> maat Jan 30 21:49:44 Hung up on 81.161.229.226; claimed to be WIN-CLJ1B0GQ6JP
> maat Jan 30 21:54:12 ehlo from 185.24.233.112 as ADMIN
> maat Jan 30 21:54:12 Hung up on 185.24.233.112; claimed to be ADMIN
>
> I could probably look into scanmail. I might also try blocking from linode, maybe look at some firewall features from
> the provider.
>
> Quoth Stanley Lieber <sl@stanleylieber.com>:
>>> On Jan 29, 2023, at 11:14 PM, william@thinktankworkspaces.com wrote:
>>>
>>> Do we have any firewall tools? I would like to block some connections.
>>>
>>> I know you can tweak routing by messing with /net/ipifc/clone
>>>
>>> Just wanted to know if we have any other ways to block conncetions?
>>>
>>>
>>>
>>> Quoth Stanley Lieber <sl@stanleylieber.com>:
>>>> check out iwhois (documented in the tel man page).
>>>>
>>>> also: lookman dns.
>>>>
>>>> the existing tools are fairly manual and rudimentary.
>>>>
>>>> sl
>>
>> there’s no generic firewall, but upas has some filtering options. smtpd(8) reads the file /mail/blocked for blocked addresses, and has the -k flag to block ip addresses manually. the validatesender script (called by upas) checks for a spamhaus file at /mail/lib/spamhaus. there are also ratfs(4) and scanmail(8), which provide more complex filtering mechanisms.
>>
>> sl
>>
>>
>>
>
prev parent reply other threads:[~2023-01-31 8:02 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-01-30 1:52 william
2023-01-30 2:10 ` Stanley Lieber
2023-01-30 4:11 ` william
2023-01-30 4:59 ` Stanley Lieber
2023-01-30 5:27 ` Jacob Moody
2023-01-31 6:41 ` william
2023-01-31 7:58 ` Steve Simon [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=7C2D6F4D-43C7-4414-AB27-355251682286@quintile.net \
--to=steve@quintile.net \
--cc=9front@9front.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).