[nos-bbs] How to avoid SMTP spam mail in mqueue

[Jose Ng Lee]

Thanks for the recommendations Michael.

I have shorewall firewall block port 25 for two days and Jnos was good and no crash.  Today, I tried open port 25 and monitored TUN0 with tcpdump.  The smtp mail spam just keep flowing and my Jnos is accepting those spam mail for relay and crashing.

As I understood, by default Jnos Deny Relay.  I tried the commands "smtp deny relay" and "stmp relay deny" but not accepted.

Still trying to find out why Jnos is accepting those e-mail instead of denying relay.  Before, I don't have in Rewrite a specific define and all the spam e-mails accumulated in mqueue.  Now, in Rewrite everything that is not defined is put in check.  So, the check.txt file is growing larger (later delete) but at least is not smtp for delivered out.

José / HP2AT
  
  ----- Original Message ----- 
  From: Michael E Fox - N6MEF 
  To: Jose Ng Lee ; 'TAPR xNOS Mailing List' 
  Sent: Monday, March 17, 2014 2:51 PM
  Subject: Re: [nos-bbs] How to avoid SMTP spam mail in mqueue


  For the greatest protection, run all email through your separate mail server.  This includes:
  -- inbound connections from Internet hosts to your public I address,
  -- inbound connections from Internet hosts to your 44.x address via tunnel from the AMPRnet gateway, and
  -- inbound connections from other 44.x machines to your 44.x address via tunnels


  M






  Sent from my Verizon Wireless 4G LTE smartphone


  -------- Original message --------
  From: Jose Ng Lee 
  Date:03/17/2014 8:39 AM (GMT-08:00) 
  To: Michael E Fox - N6MEF ,'TAPR xNOS Mailing List' 
  Subject: Re: [nos-bbs] How to avoid SMTP spam mail in mqueue 


  Thanks Michael for the tips on how to protect my Jnos.

  I could block SMTP (port 25) on the Firewall for inbound mails to TUN0, but does that block also the good mail 44 route coming fron encap?

  I trying to figure out why my Jnos accepted all those incoming spam mail.  It should have issue an SMTP DENY and not accepted those emails.  Maybe, there is a script somewhere on my CentOS machine allowing the entrace.  So will keep looking.

  José / HP2AT

    ----- Original Message ----- 
    From: Michael E Fox - N6MEF 
    To: 'Jose Ng Lee' ; 'TAPR xNOS Mailing List' 
    Sent: Monday, March 17, 2014 8:28 AM
    Subject: RE: [nos-bbs] How to avoid SMTP spam mail in mqueue


    Block direct inbound SMTP connections to JNOS.  

    Set up an MX in Linux using all the modern spam avoidance mechanisms dynamic black lists, UBE detection, signature-based detection, etc.) and send all inbound email to JNOS through that mail server using an MX record in DNS.  



    Michael

    N6MEF





    From: nos-bbs-bounces at tapr.org [mailto:nos-bbs-bounces at tapr.org] On Behalf Of Jose Ng Lee
    Sent: Sunday, March 16, 2014 10:55 PM
    To: TAPR xNOS Mailing List
    Subject: [nos-bbs] How to avoid SMTP spam mail in mqueue



    I noticed today my Raspberry Pi Jnos was respawing in every few minutes.   So, I checked and found out there was some spam e-mails in mqueue not been able to deliver and causing the system to crash and respawn.  Deleted those e-mails and checking the logs and put in blacklist the offender IPs.



    I play with 3 Jnos systems:



    Main systems PC with Linux Ubuntu 12.04 LTS: onx.hp2at.ampr.org

    No spam mail in mqueue.



    Raspberry Pi with Raspbian: hp2ng.ampr.org

    Few spam mail in mqueue.



    PC with Centos 5.9: hp2sa.ampr.org

    THOUSANDS of spam mail in mqueue.  Don't know how this got through or why it was received in JNOS.  The autoexec.nos is the same as my other system.



    This is on the message heading on one mail:



    Received: from pc-200402271018 by hp2sa.ampr.org (ONXSA BBS) with SMTP
            id AA24803 ; Thu, 13 Mar 2014 03:17:52 EST
    From: =?BIG5?B?pWqo5a21vNY=?= <springboard at yahoo.com>
    To: "awze" <awze at awze.com>
    Subject:
     =?BIG5?B?RGlzbmV5qOC1o7nPrtGhQqlfpf2lzaeupHCpaiC1paqpxXao7LTBuc+u0aFCpfq6?=
     =?BIG5?B?0KRqpViyTaFJ?=
    Date: Wed, 28 Apr 2004 22:58:06 +0800
    MIME-Version: 1.0
    Content-Type: text/html;
            charset="Big5"
    Content-Transfer-Encoding: quoted-printable
    X-Priority: 3
    X-MSMail-Priority: Normal
    X-Mailer: Microsoft Outlook Express 6.00.2800.1106
    X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
    Message-Id: <24804 at hp2sa.ampr.org>

    Took this JNOS offline until the problem solve.



    Please can anyone know a way to deny receiving spam mail in jnos.



    Thanks,

    José / HP2AT
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.tapr.org/pipermail/nos-bbs_lists.tapr.org/attachments/20140319/5ffcb4a1/attachment.html>