Milter-greylist

On Tue, Apr 22, 2008 at 5:51 PM, Chris Hoogendyk
<hoogendyk@...> wrote:
> We're running milter-greylist 4.0 out of Sendmail 8.14.2 (we also have a
>  number of other tools in the mix) on Solaris 9, SPARC.
>
>  1) Am I right in guessing that I needed to restart milter-greylist? Is
>  this just proper SOP? Or might there be a bug where it isn't
>  straightening out what it has in memory when it gets a change like this
>  in the greylist.conf on the fly?

I use milter-greylist from Blastwave on Solaris 10 with SMF support so
it takes care of restarting milter-greylist if needed. I also use a
small cron script to check for excessive memory use (it always leaks
memory) and restarts it if needed, use the pmap command if you want to
check the memory use. You can trim overall memory use by looking over
the time you keep tuples and how long you autowhitelist. I only keep
tuples for 1d instead of the default 5d.

http://www.blastwave.org/packages.php/miltergreylist (note that it
runs on Solaris 8 and higher both Sparc and i386)

>  3) My boss is talking like milter-greylist may have outlived its
>  usefulness. It does cause headaches for lots of users who don't want
>  mail delayed even if it is attributable to the other side being
>  misconfigured. And, over the past year or so, it seems like more and
>  more spammers have implemented resending (anyone tracking this have
>  statistics?). Meanwhile, we have adopted a number of other mechanisms,
>  including settings in sendmail.cf (by way of config.mc), that seem to be
>  more effective, blocking things before they even get to milter-greylist.
>  I know I'm asking the choir to commit blasphemy ;-) , but I thought
>  perhaps others on this list might have comments on this.

I also used to get a lot of complaints and requests to statically
whitelist this and that until I started to use dnswl.org, after that
it's a lot smoother. I also greylist hits from SORBS DUL for 3h to
combat resends. Look in the wiki for a few setup examples:
http://milter-greylist.wikidot.com/. I have a lot more filtering after
the greylisting but I can't think of going back to not using it, after
all it reduces the load with something like 80%.

-- 
/peter