whitelist issues |
Post Reply 
|
| Author | |
Terry 
Senior Member 
Joined: 06 February 2005 Status: Offline Points: 155 |
 Post Options
 Thanks(0)
 Quote Reply
 Topic: whitelist issuesPosted: 30 March 2011 at 4:13pm |
|
I read where the whitelist is no longer the first filter being checked by spamfilter...this appears to be causing some issues with our users....please tell me if this is true... sender "a" is whitelisted (from same mailserver as "sender b"
sender "b" is not whitelisted (but uses the same mailserver as "sender a")
sender "b" sends an email to my account but the ip address he is sending from is blacklisted by "SpamCop" for example...does this add an entry to the "Cached IP blacklist"? Because if it does this would explain to me why we are finding that sender "a" is now being blocked even though they are whitelisted....
if this is the case....this is causing a real problem for us
|
|
 |
|
|
LogSat
Admin Group 
Joined: 25 January 2005 Location: United States Status: Offline Points: 4104 |
Post Options
Thanks(0)
Quote Reply
Posted: 30 March 2011 at 9:00pm |
|
Terry,
We keep a list of the order in which SpamFilter's filters are processed at: http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6726 Please note that this order has never changed, and that the "Cached IP blacklist" has always taken precedence over all other whitelists since its inception. This is because this filter (along with the greylist filter) work at a TCP level even before any SMTP sessions get established. Without an SMTP session, SpamFilter cannot know the email address of the recipient and thus can't apply the whitelists. I've added a note at the bottom of those postings today to highlight a workaround that allows to have some remote sender's IP addresses bypass those two filters as well.
|
|
|
|
|
Terry
Senior Member
Joined: 06 February 2005 Status: Offline Points: 155 |
Post Options
Thanks(0)
Quote Reply
Posted: 31 March 2011 at 2:38pm |
|
Roberto, what clear the blacklist ip cache then...does a server reboot reset it? How do things get off this list?
|
|
|
|
|
Terry
Senior Member
Joined: 06 February 2005 Status: Offline Points: 155 |
Post Options
Thanks(0)
Quote Reply
Posted: 31 March 2011 at 4:10pm |
|
Another followup..is the cache you reference as first to check the same as the file HoneypotBlockedIPS.txt.....is this what you check first....I am thinking that my file is about 5 years old and maybe I should flush it and start again?
|
|
|
|
|
LogSat
Admin Group
Joined: 25 January 2005 Location: United States Status: Offline Points: 4104 |
Post Options
Thanks(0)
Quote Reply
Posted: 31 March 2011 at 9:08pm |
SpamFilter maintains the blacklist cache in memory only - nothing is cached to files. To reset it, you can simply stop/restart SpamFilter. You can also use SpamFilter to see the list of IPs that are currently being blacklisted by following the screenshot below. As an FYI, SpamFilter uses the following parameters to determine when an IP is added to this blacklist cache, and for how long it remains there (by default only one hour): ;If an IP sends more than this number of spams in a certain period of time then it is temporarily banned (blacklisted) IPCacheLimboCountTrigger=3
;If an IP sends more than a certain number of spams (default 3 from above) during this number of minutes then it is temporarily banned (blacklisted) IPCacheLimboTimeTrigger=10
;If an IP address was banned because it sent too many spams in a certain time interval, it will be un-banned after this number of minutes IPCacheBlacklistDuration=60  |
|
|
|
|
LogSat
Admin Group
Joined: 25 January 2005 Location: United States Status: Offline Points: 4104 |
Post Options
Thanks(0)
Quote Reply
Posted: 31 March 2011 at 9:13pm |
The "HoneypotBlockedIPS.txt" is a file that is used if you enable the honeypot filter (which is likely disabled in your case - this is the default setting). This file is semi-unrelated to the "DoNotAddIPToHoneypot" setting in the SpamFilter.ini file. This latter .ini setting is used to, in addition to avoiding IPs to be blacklisted by the honeypot filter (which you probably have disabled), also used to prevent IPs from being blocked by blacklist cache and the greylist filters.
|
|
|
|
Topic Options
Terry wrote:|
Post Reply
|
|
Tweet
|
| Forum Jump | Forum Permissions You cannot post new topics in this forum You cannot reply to topics in this forum You cannot delete your posts in this forum You cannot edit your posts in this forum You cannot create polls in this forum You cannot vote in polls in this forum |
This page was generated in 0.289 seconds.