23 messages in net.sourceforge.lists.courier-usersRe: [courier-users] Deactivate tarpit...
FromSent OnAttachments
niclasNov 10, 2007 6:41 am 
Sam VarshavchikNov 10, 2007 7:11 am 
Bernd WurstNov 10, 2007 7:15 am 
Bernd WurstNov 10, 2007 7:29 am 
Alessandro VeselyNov 10, 2007 9:00 am 
Bernd WurstNov 10, 2007 9:09 am 
niclasNov 10, 2007 6:12 pm 
Alessandro VeselyNov 11, 2007 3:05 am 
niclasNov 11, 2007 3:38 am 
Bernd WurstNov 11, 2007 4:01 am 
niclasNov 11, 2007 5:19 am 
Bernd WurstNov 11, 2007 6:32 am 
Alessandro VeselyNov 11, 2007 10:54 pm 
niclasNov 12, 2007 3:49 am 
Gordon MessmerNov 12, 2007 10:50 am 
Dirk KulmseeNov 13, 2007 10:13 am 
Sam VarshavchikNov 13, 2007 4:00 pm 
Dirk KulmseeNov 13, 2007 4:28 pm 
Sam VarshavchikNov 13, 2007 4:42 pm 
Dirk KulmseeNov 13, 2007 5:03 pm 
Sam VarshavchikNov 13, 2007 6:15 pm 
Dirk KulmseeNov 13, 2007 7:08 pm 
Sam VarshavchikNov 13, 2007 7:17 pm 
Actions with this message:
Paste this link in email or IM:
Paste this link in email or IM:
Atom feed for this thread
Paste this URL into your reader:
Subject:Re: [courier-users] Deactivate tarpitting?Actions...
From:Dirk Kulmsee (kulm@netgroup.de)
Date:Nov 13, 2007 7:08:44 pm
List:net.sourceforge.lists.courier-users

Yes Sam! That is exactly the point which hurts. Being a proxy ASSP "tunnels" the connection from the sending mail server to my receiving Courier. Courier does the ESMTP dialog.

The bright side: if I set up all MXs as ASSP filters then all MXs will check with the mailbox server if the recipient exists and spammers' strategy to pour in junk on the 2nd MX which often has no knowledge of the existing mailboxes is rendered useless without me having to set up LDAP or the like.

The dark side: while checking for existing recipients the spam filtering machine _will_ produce errors on bad mail. Will it get

punished?

If you are talking about individual proxied TCP connections, only each individual connection gets 'punished'. Courier will tarpit whichever TCP connection is causing errors; other concurrent TCP connections -- even from the same host -- are unaffected.

However there are other negative reasons for this setup. One of the available defenses is an overall per-IP address (or /24 netblock) connection limit. This normally prevents a hostile attacker from flooding your server with thousands of connections and keeping it from accepting mail from anyone else. This works hand in hand with tarpitting; a hostile attacker is confined to a limited number of connections, all others in excess are dropped, and the remaining connections are tarpitted at the first sign of trouble.

That is true, but ASSP has an own setting for limiting simultaneous connections from the same IP.

connections originate from the same IP address as far as Courier is concerned, and there is no way to discriminate between different sending IP addresses -- and you are vulnerable to being bombed, unless your proxy has the ability to restrict the maximum number of open connections from the same source that it will forward.

Except from flooding, does the proxying through the same IP mean Courier will learn the IP "in the middle" as bad?