Print Page | Close Window

bug: whitelist versus authorizedToEmail

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6553
Printed Date: 15 March 2025 at 7:53am


Topic: bug: whitelist versus authorizedToEmail
Posted By: kp4711
Subject: bug: whitelist versus authorizedToEmail
Date Posted: 11 September 2008 at 12:21pm
Hi,
 
I think there is a bug:
When the from-address ist in whitelist the sender can send to addresses wich are not written in the authorizedToEmail-List.
The CustomDomainFiler "authorizedTo" is enabled for the receipient-Doamin.
Using SF 4.0.0.772
 
I know that addresses which are on the whitelist passes all filters, but I think that the filter "authorizedTo" should be active. In practise a spammer can use a well-known-address like
mailto:ebay@ebay.de - ebay@ebay.de which are often on the whitelist and then he can send much automaticly generated mails to the reciepient-Domain.
 
Sorry for my bad english, but I hope you understand me.
 
greeting
kp4711


Replies:
Posted By: LogSat
Date Posted: 11 September 2008 at 10:13pm
kp4711,

The behavior is not a bug, it is by design. All whitelists take precedence over any other filter, with the exception of the two filters that work based on a TCP level even before any SMTP sessions take place. The order in which the filters are applied is at:

http://www.logsat.com/SpamFilter/Forums/forum_posts.asp?TID=5171#11418%20 - www.logsat.com/SpamFilter/Forums/forum_posts.asp?TID=5171#11418

We always accept feedback from users however, so if we receive enough requests to alter this behavior, we may be changing it in the future.


-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: kp4711
Date Posted: 12 September 2008 at 6:43am
Hi,
 
ok i understand this but there are many problems with some servers for example mailout01.t-online.de is not able to understand greylisting before HELO or EHELO Command. There are a lot of implementation wich only understand the SMTP-Errors like 421 after they have send there HELO or EHLO Command.
 
So i think that is a good Idea to implement a check of the whitelistedIP-List in the greylist-process. So we are able to allow some Servers who have problems with greylisting before SMTP to bypass the greylistProcess.
 
What say other users to this feature-request?
 
kp4711

Posted By: LogSat
Date Posted: 13 September 2008 at 6:33pm
Having to wait for the remote server to send their HELO string would diminish the effectiveness of these two filters, and render SpamFilter more vulnerable to DoS attacks. If you receive thousands of connections in a few seconds, and for each one the hacker/spammer waits 30 seconds before sending the HELO command, as SpamFilter would have to wait for that string before disconnecting them, within a few seconds your server would pretty much be toast. Allowing the blacklist cache and the greylist filter to disconnect the connection immediately helps a lot in defying such attacks.

This said, please do note that you can add IPs to a whitelist that excludes them from the greylist filter. Please see:
http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6379&PID=11747#11665 - www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6379&PID=11747#11665


-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP


Print Page | Close Window