Milter-greylist

I'm trying to add some whitelist regex matching and it isn't working.

I've tried adding these to my greylist.conf file and none are working:

acl whitelist domain /*apache\.org/
acl whitelist domain /*apache.org/
acl whitelist domain apache.org

What am I doing wrong?

Also, gmail isn't working correctly either.  Clearly this is an issue with
google using a farm of servers with different ips.  I understand the I can
use SPF to get around this, but I believe the current spf libraries to be
somewhat unstable...is this true?

One other way, I thought, of getting around this was to add "-L24" to the
startup parameters of the command that invokes milter...sadly, milter throws
and error when I do this.

Any ideas for "fixing" gmail?

------------------------------
Mike Loiterman
grantADLER
Tel: 630-302-4944
Fax: 773-442-0992
Email: mike@...
PGP Key: 0xD1B9D18E

Mike Loiterman wrote on Tue, 13 Dec 2005 15:14:12 -0600:

> acl whitelist domain apache.org 

Do you want to whitelist mailing lists coming from there? I didn't whitelist 
apache.org, but I get the lists from there. It passed the SPF-Check.

>  
> What am I doing wrong? 

Not sure, I expect "apache.org" to work for "hermes.apache.org" as well.
However, these *can't* work:
acl whitelist domain /*apache\.org/ 
acl whitelist domain /*apache.org/ 
These are globs, not regexes. Use
acl whitelist domain /.*\.apache\.org/


>  
> Also, gmail isn't working correctly either.  Clearly this is an issue with 
> google using a farm of servers with different ips.  I understand the I can 
> use SPF to get around this, but I believe the current spf libraries to be 
> somewhat unstable...is this true? 

I have milter-greylist mit libspf2 runing for a week or ten days now. No 
problems at all. Actually it's one of the programs with the shortest learning 
curve and with a very very good cost:benefit ratio.

>  
> One other way, I thought, of getting around this was to add "-L24" to the 
> startup parameters of the command that invokes milter...sadly, milter throws 
> and error when I do this. 

-L 24 and you can just do this in greylist.conf, no need for command line.

>  
> Any ideas for "fixing" gmail?

Yes, use libspf2, really!



Kai

-- 
Kai Sch\ufffdtzl, Berlin, Germany
Get your web at Conactive Internet Services: http://www.conactive.com

On Wed, Dec 14, 2005 at 01:31:23AM +0100, Kai Schaetzl wrote:
> > Also, gmail isn't working correctly either.  Clearly this is an issue with 
> > google using a farm of servers with different ips.  I understand the I can 
> > use SPF to get around this, but I believe the current spf libraries to be 
> > somewhat unstable...is this true? 
> 
> I have milter-greylist mit libspf2 runing for a week or ten days now. No 
> problems at all. Actually it's one of the programs with the shortest learning 
> curve and with a very very good cost:benefit ratio.

Everything depends on the DNS resolver. If it's thread safe, milter-greylist
will work with SPF without any trouble. If the DNS resolver is not thread-safe,
it will crash and burn.

-- 
Emmanuel Dreyfus
manu@...

Well, most of the previous entries that I was going to setup regexs for are
no longer needed due to how well SPF is working.

Still...

If I wanted to white list ANYONE@... would this be the correct regex:

acl whitelist domain /.*domain\.com/

------------------------------
Mike Loiterman
grantADLER
Tel: 630-302-4944
Fax: 773-442-0992
Email: mike@...
PGP Key: 0xD1B9D18E

Mike Loiterman <mike@...> wrote:

> If I wanted to white list ANYONE@... would this be the correct regex:
> acl whitelist domain /.*domain\.com/

I'd do 
acl whitelist domain /.*@domain\.com/

-- 
Emmanuel Dreyfus
http://hcpnet.free.fr/pubz
manu@...

> I have milter-greylist mit libspf2 runing for a week or ten days now. No 
> problems at all. Actually it's one of the programs with the shortest learning 
> curve and with a very very good cost:benefit ratio.
> 

I'm new to all this so forgive me if this is a silly question. I googled libspf2
and I'm not sure which or what I should be downloading.

Where do I find the version you are using?

Thanks,

Mike

Mike McMullen wrote on Wed, 14 Dec 2005 00:30:00 -0800:

> I'm new to all this so forgive me if this is a silly question. I googled libspf2 
> and I'm not sure which or what I should be downloading.

Surprise: www.libspf2.org ;-)

Kai

-- 
Kai Sch\ufffdtzl, Berlin, Germany
Get your web at Conactive Internet Services: http://www.conactive.com

wrote on Wed, 14 Dec 2005 08:44:13 +0100:

> I'd do 
> acl whitelist domain /.*@domain\.com/

That's not how it is explained in greylist.conf:

# It is also possible to whitelist sender
# machines using their DNS names.
#acl whitelist domain example.net

# You can avoid greylisting by filtering on the sender
# envelope address, but this is not a good idea: it
# can be trivially forged.
#acl whitelist from friendly@...

domain = sender machine
from = sender

So, what's correct? I'm especially interested to know if

acl whitelist domain example.net

whitelists only sender machine "example.net" or all subdomains as well, 
like "smtp.example.net".

Kai

-- 
Kai Sch\ufffdtzl, Berlin, Germany
Get your web at Conactive Internet Services: http://www.conactive.com

On Wed, 14 Dec 2005, Kai Schaetzl wrote:

> > I'm new to all this so forgive me if this is a silly question. I googled libspf2
> > and I'm not sure which or what I should be downloading.
> Surprise: www.libspf2.org ;-)

I installed milter-greylist last week and has some problems with
libspf2. First problem was quite stupid - install script of libspf2 does
not copied one of the files to my system after installation (I put this
file manually). After I recompiled greylist I saw that SPF does not work
at all.

After all I removed libspf2 and installed spf_alt instead. I compiled and
installed it without any problems and now it works fine for me :-)

Probably it's better to use spf_alt :-)

Best Regards, 					mailto:eugenef@...
	Eugene.

--- In milter-greylist@yahoogroups.com, Eugene Filatov <eugenef@p...>
wrote:
>
> On Wed, 14 Dec 2005, Kai Schaetzl wrote:
> 
> > > I'm new to all this so forgive me if this is a silly question. I
googled libspf2
> > > and I'm not sure which or what I should be downloading.
> > Surprise: www.libspf2.org ;-)
> 
> I installed milter-greylist last week and has some problems with
> libspf2. First problem was quite stupid - install script of libspf2 does
> not copied one of the files to my system after installation (I put this
> file manually).

Same here.  I don't know where is the problem.

> After I recompiled greylist I saw that SPF does not work
> at all.

I wrote something on the MailScanner wiki... 

http://wiki.mailscanner.info/doku.php?id=documentation:anti_spam:greylisting:install:sendmail:milter-greylist

Feel free to comment.

> 
> After all I removed libspf2 and installed spf_alt instead. I
compiled and

> installed it without any problems and now it works fine for me :-)
> 
> Probably it's better to use spf_alt :-)
> 
> Best Regards, 					mailto:eugenef@p...
> 	Eugene.
>

Eugene Filatov wrote on Wed, 14 Dec 2005 13:56:03 +0200 (EET):

> I installed milter-greylist last week and has some problems with 
> libspf2. First problem was quite stupid - install script of libspf2 does 
> not copied one of the files to my system after installation (I put this 
> file manually).

Yes.

 After I recompiled greylist I saw that SPF does not work 
> at all. 

I don't know but I guess if that was a thread-safety problem it would just 
crash instead of not being available. So, could it be that you accidentally 
used the wrong configure parameter? I for one accidentally used --with-spf2 
the first time and as I see others used (other) wrong ones as well. Whatever 
it may be this package seems to attract wrong configure options ;-)

>  
> After all I removed libspf2 and installed spf_alt instead. I compiled and 
> installed it without any problems and now it works fine for me :-) 
>  
> Probably it's better to use spf_alt :-)

I don't know what the difference between the packages is. Should just work 
as good.

Kai

-- 
Kai Sch\ufffdtzl, Berlin, Germany
Get your web at Conactive Internet Services: http://www.conactive.com

manu@... wrote:
> Mike Loiterman <mike@...> wrote:
> 
> 
>>If I wanted to white list ANYONE@... would this be the correct regex:
>>acl whitelist domain /.*domain\.com/
> 
> 
> I'd do 
> acl whitelist domain /.*@domain\.com/
> 

Why start off with the .*?

In a regex it's irrelevant as regexes are always substring matches unless
anchored with ^ or $. /@domain\.com/ matches the same as /.*@domain\.com/ but
uses less memory.

Personally, I'd do acl whitelist domain /domain\.com$/ or /@domain\.com$/. The
difference being the first one will match sub-domains (ie user@...),
but the second will not.